[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #7129 [Tor]: circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13

#7129: circuit_end_reason_to_control_string(): Bug: Unrecognized reason code 13
----------------------------+-----------------------------------------------
    Reporter:  cypherpunks  |        Type:  defect
      Status:  new          |    Priority:  normal
   Milestone:               |   Component:  Tor   
     Version:               |    Keywords:        
      Parent:               |      Points:        
Actualpoints:               |  
----------------------------+-----------------------------------------------

Comment(by andrea):

 Hmm, it's just possible this is a channel-related issue, since a grep
 through the source seems to strongly suggest the only way for a 13 to get
 there is to be constructed arithmetically (it occurs as a numerical
 constant nowhere near any of the circuit code).  The only likely point for
 that to happen is the bitwise or in circuit_truncated():

 circuit_mark_for_close(TO_CIRCUIT(circ),
 END_CIRC_REASON_FLAG_REMOTE|END_CIRC_REASON_CHANNEL_CLOSED|reason)

 ... which I would have touched to introduce
 END_CIRC_REASON_CHANNEL_CLOSED.  I'll go back and see if I just renamed an
 existing code or actually introduced a new one without realizing there was
 something like that going on and whether it was possible for it to have
 this effect.  If so, the reason in question must have been
 END_CIRC_REASON_RESOURCELIMIT (0x5), since END_CIRC_REASON_CHANNEL_CLOSED
 is 0x8 and the END_CIRC_REASON_FLAG_REMOTE flag will have been masked off
 by circuit_end_reason_to_control_string().

 Additional observation: it seems wrong to issue an LD_BUG warning for a
 code that might have been passed from another node [1]; the problem could
 be in some other node, or it could even be an attack (good thing this
 wasn't a tor_assert()...).  The circuit_end_reason_to_control_string()
 should probably issue different warning messages depending on
 END_CIRC_REASON_FLAG_REMOTE.

 [1] From or.h:

  684 /** Bitwise-OR this with the argument to circuit_mark_for_close() or
  685  * control_event_circuit_status() to indicate that the reason was
  686  * passed through from a destroy or truncate cell. */
  687 #define END_CIRC_REASON_FLAG_REMOTE     512
  688

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7129#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs