[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #22931 [Core Tor/Tor]: What happens when a VERSIONS cell is sent outside a handshake?
#22931: What happens when a VERSIONS cell is sent outside a handshake?
--------------------------+----------------------------------
Reporter: teor | Owner:
Type: defect | Status: needs_review
Priority: Medium | Milestone: Tor: unspecified
Component: Core Tor/Tor | Version:
Severity: Normal | Resolution:
Keywords: doc tor-spec | Actual Points:
Parent ID: #18856 | Points:
Reviewer: | Sponsor:
--------------------------+----------------------------------
Changes (by teor):
* status: new => needs_review
Comment:
The relay drops extra versions cells. We could document this by saying:
{{{
+ Any VERSIONS cells sent after the first VERSIONS cell MUST be ignored.
}}}
Changing versions on a link shouldn't be allowed.
There are 3 possible cases:
First and second version cells ask for link version 3 and has cird_id_len
2:
`Jul 15 18:41:01.000 [info] channel_tls_process_versions_cell: Received a
VERSIONS cell on a connection with its version already set to 3; dropping`
First version cell asks for link version 4 and has cird_id_len 2, second
version cell asks for link version 4 and has cird_id_len 4:
`Jul 15 18:46:14.000 [info] channel_tls_process_versions_cell: Received a
VERSIONS cell on a connection with its version already set to 4; dropping`
First version cell asks for link version 4 and has cird_id_len 2, second
version cell asks for link version 4 and has cird_id_len 2:
(The cell is mis-parsed: the command is read from the second byte of the
versions cell's payload length. Since no further input arrives to complete
the cell, the relay times out.)
A script that sends cells to trigger all these cases is at:
https://github.com/teor2345/endosome/blob/master/client-or-22931.py
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22931#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs