Tor daemon down due to a compression bomb

Support Onion Services
1

Hello, one of my tor daemon process was down for several hours. I have a hidden service running using that daemon so the hidden service was down too.

When I checked the logs, I could see this:

Mar 24 10:49:03.000 [notice] Bootstrapped 5% (conn): Connecting to a relay
Mar 24 10:49:03.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay
Mar 24 10:49:03.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay
Mar 24 10:49:03.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done
Mar 24 10:49:03.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
Mar 24 10:49:04.000 [warn] Detected possible compression bomb with input size = 54545 and output size = 1567944
Mar 24 10:49:04.000 [warn] Possible compression bomb; abandoning stream.
Mar 24 10:49:04.000 [warn] Unable to decompress HTTP body (tried Zstandard compressed, on Directory connection (client reading) with 80.67.167.86:9001).
Mar 24 10:49:04.000 [warn] Detected possible compression bomb with input size = 29141 and output size = 824464
Mar 24 10:49:04.000 [warn] Possible compression bomb; abandoning stream.

Tor daemon was unable to reach “Bootstrapped 100% (done): Done” which means it was unable to connect to the tor network.

I read a post saying there is nothing to worry about:

But as I mention, my daemon was down for over 4 hours and it was unable to connect to the tor network.

Thanks.

1 Like
2

Hello,

I had a look at previous logs, and I can see the same “compression bomb” message as far as January so this has been happening for several months.

After I fixed the issue, I tried to reproduce it but it did not work. I get the same “compression bomb” message but this time tor daemon is able to reach 100% and establish the connection:

Mar 24 12:07:32.000 [notice] Bootstrapped 5% (conn): Connecting to a relay
Mar 24 12:07:32.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay
Mar 24 12:07:32.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay
Mar 24 12:07:32.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done
Mar 24 12:07:32.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
Mar 24 12:07:32.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
Mar 24 12:07:32.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
Mar 24 12:07:32.000 [warn] Detected possible compression bomb with input size = 29627 and output size = 834752
Mar 24 12:07:32.000 [warn] Possible compression bomb; abandoning stream.
Mar 24 12:07:32.000 [warn] Unable to decompress HTTP body (tried Zstandard compressed, on Directory connection (client reading) with 137.74.119.109:9001).
Mar 24 12:07:32.000 [notice] Bootstrapped 100% (done): Done
Mar 24 12:07:32.000 [warn] Detected possible compression bomb with input size = 54460 and output size = 1567944
Mar 24 12:07:32.000 [warn] Possible compression bomb; abandoning stream.
Mar 24 12:07:32.000 [warn] Detected possible compression bomb with input size = 29628 and output size = 841184
Mar 24 12:07:32.000 [warn] Possible compression bomb; abandoning stream.

Regards.

1 Like
3

Hello,

I just checked all my tor daemons and all of them has these “compression bomb” messages since January.

Regards.

1 Like