mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-10 05:03:43 +01:00
Reject create/begin/etc cells with {circ,stream}ID 0.
Otherwise, it's possible to create streams or circuits with these bogus IDs, leading to orphaned circuits or streams, or to ones that can cause bandwidth DOS problems. Fixes bug 7889; bugfix on all released Tors.
This commit is contained in:
parent
52bf1556b1
commit
4ccf09b1c2
8
changes/bug7889
Normal file
8
changes/bug7889
Normal file
@ -0,0 +1,8 @@
|
||||
o Major bugfixes:
|
||||
- Reject bogus create and relay cells with 0 circuit ID or 0 stream
|
||||
ID: these could be used to create unexpected streams and circuits
|
||||
which would count as "present" to some parts of Tor but "absent"
|
||||
to others, leading to zombie circuits and streams or to a
|
||||
bandwidth DOS. Fixes bug 7889; bugfix on every released version of
|
||||
Tor. Reported by "oftc_must_be_destroyed".
|
||||
|
@ -382,6 +382,14 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn)
|
||||
return;
|
||||
}
|
||||
|
||||
if (cell->circ_id == 0) {
|
||||
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
|
||||
"Received a create cell (type %d) from %s:%d with zero circID; "
|
||||
" ignoring.", (int)cell->command, conn->_base.address,
|
||||
conn->_base.port);
|
||||
return;
|
||||
}
|
||||
|
||||
/* If the high bit of the circuit ID is not as expected, close the
|
||||
* circ. */
|
||||
id_is_high = cell->circ_id & (1<<15);
|
||||
|
@ -1046,6 +1046,23 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
|
||||
return - END_CIRC_REASON_TORPROTOCOL;
|
||||
}
|
||||
|
||||
if (rh.stream_id == 0) {
|
||||
switch (rh.command) {
|
||||
case RELAY_COMMAND_BEGIN:
|
||||
case RELAY_COMMAND_CONNECTED:
|
||||
case RELAY_COMMAND_DATA:
|
||||
case RELAY_COMMAND_END:
|
||||
case RELAY_COMMAND_RESOLVE:
|
||||
case RELAY_COMMAND_RESOLVED:
|
||||
case RELAY_COMMAND_BEGIN_DIR:
|
||||
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Relay command %d with zero "
|
||||
"stream_id. Dropping.", (int)rh.command);
|
||||
return 0;
|
||||
default:
|
||||
;
|
||||
}
|
||||
}
|
||||
|
||||
/* either conn is NULL, in which case we've got a control cell, or else
|
||||
* conn points to the recognized stream. */
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user