[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #7947 [Tor]: Do handle TRUNCATE command properly if circuit pending still

#7947: Do handle TRUNCATE command properly if circuit pending still
-------------------------+--------------------------------------------------
 Reporter:  cypherpunks  |          Owner:                    
     Type:  defect       |         Status:  new               
 Priority:  normal       |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor          |        Version:                    
 Keywords:  tor-relay    |         Parent:                    
   Points:               |   Actualpoints:                    
-------------------------+--------------------------------------------------

Comment(by cypherpunks):

 circ->n_hop and circ->n_chan can't be set in the same time anyway. You
 could place tor_assert(!circ->n_chan) for sure.

 No, it wasn't tested. It even makes attack-with-zillion-connections-to-
 internet even easy, no need to buld new circuits or wait success of extend
 request -- just truncate and extend to new target. But you can't prevent
 it if no fix placed, anyway. Legitimate client still have purpose not to
 wait for answer to truncate non finished extend request yet and repeat to
 new address, even if no connection complete or no create cell flushed yet
 or something else.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7947#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs