diff options
| author | Roger Dingledine <arma@torproject.org> | 2012-06-28 14:00:01 -0400 |
|---|---|---|
| committer | Roger Dingledine <arma@torproject.org> | 2012-07-01 05:27:08 -0400 |
| commit | c32ec9c425e9539bcc8ede95612e2d331c2cc2dd (patch) | |
| tree | 8476d8a4209857c3ee1dfab028818f6b4aa5b152 /src | |
| parent | 9c5a118272bfbb7d4c287f4310237bf90a404c63 (diff) | |
| download | tor-c32ec9c425e9539bcc8ede95612e2d331c2cc2dd.tar tor-c32ec9c425e9539bcc8ede95612e2d331c2cc2dd.tar.gz | |
Detect bug 6252 (unexpected sendme cell)
I only check on circuits, not streams, since bloating your stream
window past the initial circuit window can't help you much.
Also, I compare to CIRCWINDOW_START_MAX so we don't have surprising
races if we lower CIRCWINDOW_START for an experiment.
Diffstat (limited to 'src')
| -rw-r--r-- | src/or/relay.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/src/or/relay.c b/src/or/relay.c index 3f894bfe1..4ab440384 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1265,11 +1265,25 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, case RELAY_COMMAND_SENDME: if (!conn) { if (layer_hint) { + if (layer_hint->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from exit relay. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", layer_hint->package_window); circuit_resume_edge_reading(circ, layer_hint); } else { + if (circ->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from client. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } circ->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP, "circ-level sendme at non-origin, packagewindow %d.", |