From c1bd10411116c549326f74b09658a50bbae812b4 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Thu, 28 Jun 2012 14:00:01 -0400 Subject: [PATCH 1/2] Detect bug 6252 (unexpected sendme cell) I only check on circuits, not streams, since bloating your stream window past the initial circuit window can't help you much. Also, I compare to CIRCWINDOW_START_MAX so we don't have surprising races if we lower CIRCWINDOW_START for an experiment. --- changes/bug6252 | 8 ++++++++ src/or/relay.c | 14 ++++++++++++++ 2 files changed, 22 insertions(+) create mode 100644 changes/bug6252 diff --git a/changes/bug6252 b/changes/bug6252 new file mode 100644 index 0000000000..0d29203fab --- /dev/null +++ b/changes/bug6252 @@ -0,0 +1,8 @@ + o Security fixes: + - Tear down the circuit if we get an unexpected SENDME cell. Clients + could use this trick to make their circuits receive cells faster + than our flow control would have allowed, or to gum up the network, + or possibly to do targeted memory denial-of-service attacks on + entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor -- + from July 2002, before the release of Tor 0.0.0. + diff --git a/src/or/relay.c b/src/or/relay.c index 3e418ea13f..3d261c2650 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1265,11 +1265,25 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, case RELAY_COMMAND_SENDME: if (!rh.stream_id) { if (layer_hint) { + if (layer_hint->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from exit relay. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", layer_hint->package_window); circuit_resume_edge_reading(circ, layer_hint); } else { + if (circ->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from client. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } circ->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP, "circ-level sendme at non-origin, packagewindow %d.", From 393944dfb67fb27991e152ec67f74cebbf3a23ba Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 18 Jul 2012 10:24:17 -0400 Subject: [PATCH 2/2] Have the bug6252 commit message reflect its on-again/off-again status --- changes/{bug6252 => bug6252_again} | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) rename changes/{bug6252 => bug6252_again} (65%) diff --git a/changes/bug6252 b/changes/bug6252_again similarity index 65% rename from changes/bug6252 rename to changes/bug6252_again index 0d29203fab..f7fd00cb38 100644 --- a/changes/bug6252 +++ b/changes/bug6252_again @@ -4,5 +4,8 @@ than our flow control would have allowed, or to gum up the network, or possibly to do targeted memory denial-of-service attacks on entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor -- - from July 2002, before the release of Tor 0.0.0. + from July 2002, before the release of Tor 0.0.0. We had committed + this patch previously, but we had to revert it because of bug 6271. + Now that 6271 is fixed, this appears to work. +