What prevents an arbitrarily long or cyclic cell relay in the network?

Question

I'm sure there are mechanisms in place to prevent this, but what stops someone from making a circuit that is extremely long or cyclic, as to cause a DOS in the network? If possible, this would allow an advisory to amplify their bandwidth significantly and cause a DOS.

Answer 1

As covered in Proposal 110: Avoiding infinite length circuits that was implemented in July 2008, Tor hinders the creation of arbitrarily long circuits through the use of relay_early cells. Only relay_early cells may contain requests to extend circuits, and no more than eight relay_early cells may be sent over a given circuit. Intermediate relays pass on the same type of cell (relay or relay_early) that they receive, as long as those cells are legitimate. But they tear down circuits when they receive a normal relay cell that contains an extend request, or when they receive more than eight relay_early cells.

While adversaries can still create arbitrarily long circuits, using relay_early cells increases the cost of doing so. They would need to specify a malicious relay at every eighth hop. Given that, adversaries might as well just use each of those malicious relays to create an eight-hop circuit.

However, as discussed in Ticket 1038, using relay_early cells introduced a problem with accessing hidden services. Hidden services were receiving relay_early cells, and then tearing down circuits. To prevent that, an exception was created, which allowed hidden services (and clients) to receive inbound relay_early cells without tearing down circuits.

As discussed in Tor security advisory: "relay early" traffic confirmation attack..., a malicious-relay attack on hidden services began in January 2014 that exploited the relay_early exception. In response, Tor 0.2.4.23 was released, which removed the relay_early exception for hidden services and clients. Both now follow the relay_early policy: they drop circuits when they receive an inbound relay_early cell, and log the errors.