nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-09-21 13:34:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'public/bug12195'

Browse Source
This commit is contained in:
Nick Mathewson 2014-06-04 12:16:03 -04:00
commit e74c360156
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
changes/bug12195 Normal file
View File

@ -0,0 +1,7 @@
o Major bugfixes:
- When a circuit accidentally has the same circuit ID for its
forward and reverse direction, correctly detect the direction of
cells using that circuit. Previously, this would have made
roughly one circuit in a million non-functional. Fixes bug
12195; this is a bugfix on every version of Tor.

4
src/or/command.c
View File

@ -376,7 +376,7 @@ command_process_created_cell(cell_t *cell, channel_t *chan)
return; return;
} }
if (circ->n_circ_id != cell->circ_id) { if (circ->n_circ_id != cell->circ_id || circ->n_chan != chan) {
log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL, log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,
"got created cell from Tor client? Closing."); "got created cell from Tor client? Closing.");
circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL); circuit_mark_for_close(circ, END_CIRC_REASON_TORPROTOCOL);
@ -461,6 +461,7 @@ command_process_relay_cell(cell_t *cell, channel_t *chan)
} }
if (!CIRCUIT_IS_ORIGIN(circ) && if (!CIRCUIT_IS_ORIGIN(circ) &&
chan == TO_OR_CIRCUIT(circ)->p_chan &&
cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id)
direction = CELL_DIRECTION_OUT; direction = CELL_DIRECTION_OUT;
else else
@ -529,6 +530,7 @@ command_process_destroy_cell(cell_t *cell, channel_t *chan)
circ->received_destroy = 1; circ->received_destroy = 1;
if (!CIRCUIT_IS_ORIGIN(circ) && if (!CIRCUIT_IS_ORIGIN(circ) &&
chan == TO_OR_CIRCUIT(circ)->p_chan &&
cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) { cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) {
/* the destroy came from behind */ /* the destroy came from behind */
circuit_set_p_circid_chan(TO_OR_CIRCUIT(circ), 0, NULL); circuit_set_p_circid_chan(TO_OR_CIRCUIT(circ), 0, NULL);