same here, my 4 relays (guards) all had this log entry, with one of them the log entries are spread over a quarter of an hour (2 tor instances runnnig on this one): (this one is on Central European time zone, CET)
Nov 2 05:15:22 : Possible compression bomb; abandoning stream. Nov 2 05:15:23 : message repeated 2 times: [ Possible compression bomb; abandoning stream.] Nov 2 05:16:21 : Possible zlib bomb; abandoning stream. Nov 2 05:16:21 : Possible compression bomb; abandoning stream. Nov 2 05:17:21 : Possible zlib bomb; abandoning stream. Nov 2 05:17:21 : Possible compression bomb; abandoning stream. Nov 2 05:19:21 : message repeated 5 times: [ Possible compression bomb; abandoning stream.] Nov 2 05:19:21 : Possible zlib bomb; abandoning stream. Nov 2 05:19:21 : Possible zlib bomb; abandoning stream. Nov 2 05:20:21 : Possible compression bomb; abandoning stream. Nov 2 05:22:21 : message repeated 4 times: [ Possible compression bomb; abandoning stream.] Nov 2 05:22:21 : Possible zlib bomb; abandoning stream. Nov 2 05:22:21 : Possible compression bomb; abandoning stream. Nov 2 05:23:21 : Possible zlib bomb; abandoning stream. Nov 2 05:23:21 : Possible compression bomb; abandoning stream. Nov 2 05:23:21 : Possible compression bomb; abandoning stream. Nov 2 05:24:21 : Possible zlib bomb; abandoning stream. Nov 2 05:24:21 : Possible compression bomb; abandoning stream. Nov 2 05:24:21 : Possible compression bomb; abandoning stream. Nov 2 05:25:21 : Possible compression bomb; abandoning stream. Nov 2 05:26:21 : message repeated 3 times: [ Possible compression bomb; abandoning stream.] Nov 2 05:26:21 : Possible zlib bomb; abandoning stream. Nov 2 05:26:23 : Possible compression bomb; abandoning stream. Nov 2 05:27:21 : Possible compression bomb; abandoning stream. Nov 2 05:29:39 : Possible compression bomb; abandoning stream. Nov 2 05:29:44 : message repeated 3 times: [ Possible compression bomb; abandoning stream.] gr. Paul On Mon, Nov 2, 2020 at 9:28 PM Chris Dagdigian <d...@sonsorol.org> wrote: > Same on my US exit relay: > > Nov 02 04:03:50.000 [warn] Possible zlib bomb; abandoning stream. > Nov 02 04:03:50.000 [warn] Possible zlib bomb; abandoning stream. > > > > > Christoph Graf <christ...@links-nett.ch> > November 2, 2020 at 11:59 AM > > Same here on my bridge: > > Nov 2 06:21:04 raspipfupf Tor[2556]: Possible zlib bomb; abandoning > stream. > Nov 2 06:21:04 raspipfupf Tor[2556]: Possible zlib bomb; abandoning > stream. > > Time is UTC+1, nothing before and after > > Cheers, Christoph > On 02.11.20 11:05, Guinness wrote: > > > _______________________________________________ > tor-relays mailing list > tor-relays@lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > Guinness <guinn...@crans.org> > November 2, 2020 at 5:05 AM > Hi all, > > We are at least 3 users running middle relays from 0.4.4.5 and after having > some logs like those : > ``` > Nov 02 05:30:55.000 [warn] Possible compression bomb; abandoning stream. > Nov 02 05:30:55.000 [warn] Possible zlib bomb; abandoning stream. > Nov 02 05:30:56.000 [warn] Possible compression bomb; abandoning stream. > Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream. > Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream. > Nov 02 05:31:00.000 [warn] Possible compression bomb; abandoning stream. > Nov 02 05:31:55.000 [warn] Possible compression bomb; abandoning stream. > Nov 02 05:31:56.000 [warn] Possible compression bomb; abandoning stream. > ``` > > I'm wondering if this is an attack or a new feature (haven't checked > yet) but I'd like to know how many users are impacted. > > The interesting informations are : > * Number of warnings > * What kind of relay it is (middle, exit, entry) > > After your answers, I'll complete the issue I have opened on the bug > tracker. > > > Cheers, > > > _______________________________________________ > tor-relays mailing list > tor-relays@lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > _______________________________________________ > tor-relays mailing list > tor-relays@lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >
_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays