tor/changes/ticket40389
David Goulet adb248b6d6 TROVE-2021-003: Check layer_hint before half-closed end and resolve cells
This issue was reported by Jann Horn part of Google's Project Zero.

Jann's one-sentence summary: entry/middle relays can spoof RELAY_END cells on
half-closed streams, which can lead to stream confusion between OP and
exit.

Fixes #40389
2021-06-10 08:50:05 -04:00

4 lines
190 B
Plaintext

o Major bugfixes (relay, TROVE):
- Don't allow entry or middle relays to spoof RELAY_END or RELAY_RESOLVED
cell on half-closed streams. Fixes bug 40389; bugfix on 0.3.5.1-alpha.