Even though circuit length is limited to 8, can an attacker create a circuit of length 8, and then get the exit node to create another circuit of length 8 (get the exit node to be a Tor client)? Then could he repeat this to get a really long chain of circuits and flood the network?
Update: I guess this is possible unless exit policies block connections to Tor ports on entry guards, or entry guards reject exit nodes.
It's possible but relays won't do it.
Tor uses "relay early" cell, which is used to prevent people from building very long paths in the Tor network. Very long paths can be used to induce congestion and aid in breaking anonymity.
It has been addressed in this proposal avoid-infinite-circuits
An attacker can add load to the Tor network by extending a circuit an arbitrary number of times. Every cell that goes down the circuit then adds N times that amount of load in overall bandwidth use. This vulnerability arises because servers don't know their position on the path, so they can't tell how many nodes there are before them on the path.
We propose a new set of relay cells that are distinguishable by intermediate hops as permitting extend cells. This approach will allow us to put an upper bound on circuit length relative to the number of colluding adversary nodes.
Only K (say, 10) Relay_early cells can be sent across a circuit, and only relay_early cells are allowed to contain extend requests. Each intermediate server would pass on the same type of cell that it received (either relay or relay_early), and the cell's destination will be able to learn whether it's allowed to contain an Extend request.
If an intermediate server receives more than K relay_early cells, or if it sees a relay cell that contains an extend request, then it tears down the circuit (protocol violation).
Nodes know how long the circuit chain is and TOR will not expand your chain beyond 8 cells. IIRC there is some sort of crypto based way to verify this.
