From c32ec9c425e9539bcc8ede95612e2d331c2cc2dd Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Thu, 28 Jun 2012 14:00:01 -0400 Subject: Detect bug 6252 (unexpected sendme cell) I only check on circuits, not streams, since bloating your stream window past the initial circuit window can't help you much. Also, I compare to CIRCWINDOW_START_MAX so we don't have surprising races if we lower CIRCWINDOW_START for an experiment. --- changes/bug6252 | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 changes/bug6252 (limited to 'changes') diff --git a/changes/bug6252 b/changes/bug6252 new file mode 100644 index 000000000..0d29203fa --- /dev/null +++ b/changes/bug6252 @@ -0,0 +1,8 @@ + o Security fixes: + - Tear down the circuit if we get an unexpected SENDME cell. Clients + could use this trick to make their circuits receive cells faster + than our flow control would have allowed, or to gum up the network, + or possibly to do targeted memory denial-of-service attacks on + entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor -- + from July 2002, before the release of Tor 0.0.0. + -- cgit v1.2.3