[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[or-cvs] r8289: backbackport: defense in depth (in tor/branches/tor-0_1_0-patches: . contrib src/or src/win32)
- To: or-cvs@xxxxxxxxxxxxx
- Subject: [or-cvs] r8289: backbackport: defense in depth (in tor/branches/tor-0_1_0-patches: . contrib src/or src/win32)
- From: arma@xxxxxxxx
- Date: Tue, 29 Aug 2006 05:23:50 -0400 (EDT)
- Delivered-to: archiver@seul.org
- Delivered-to: or-cvs-outgoing@seul.org
- Delivered-to: or-cvs@seul.org
- Delivery-date: Tue, 29 Aug 2006 05:23:58 -0400
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-cvs@xxxxxxxxxxxxx
Author: arma
Date: 2006-08-29 05:23:49 -0400 (Tue, 29 Aug 2006)
New Revision: 8289
Modified:
tor/branches/tor-0_1_0-patches/configure.in
tor/branches/tor-0_1_0-patches/contrib/tor.nsi
tor/branches/tor-0_1_0-patches/src/or/circuitbuild.c
tor/branches/tor-0_1_0-patches/src/or/command.c
tor/branches/tor-0_1_0-patches/src/or/connection_edge.c
tor/branches/tor-0_1_0-patches/src/win32/orconfig.h
Log:
backbackport: defense in depth
Modified: tor/branches/tor-0_1_0-patches/configure.in
===================================================================
--- tor/branches/tor-0_1_0-patches/configure.in 2006-08-29 08:43:29 UTC (rev 8288)
+++ tor/branches/tor-0_1_0-patches/configure.in 2006-08-29 09:23:49 UTC (rev 8289)
@@ -4,7 +4,7 @@
dnl See LICENSE for licensing information
AC_INIT
-AM_INIT_AUTOMAKE(tor, 0.1.0.17)
+AM_INIT_AUTOMAKE(tor, 0.1.0.18)
AM_CONFIG_HEADER(orconfig.h)
AC_CANONICAL_HOST
Modified: tor/branches/tor-0_1_0-patches/contrib/tor.nsi
===================================================================
--- tor/branches/tor-0_1_0-patches/contrib/tor.nsi 2006-08-29 08:43:29 UTC (rev 8288)
+++ tor/branches/tor-0_1_0-patches/contrib/tor.nsi 2006-08-29 09:23:49 UTC (rev 8289)
@@ -31,7 +31,7 @@
!include "MUI.nsh"
-!define VERSION "0.1.0.17"
+!define VERSION "0.1.0.18"
!define INSTALLER "tor-${VERSION}-win32.exe"
!define WEBSITE "http://tor.eff.org/"
Modified: tor/branches/tor-0_1_0-patches/src/or/circuitbuild.c
===================================================================
--- tor/branches/tor-0_1_0-patches/src/or/circuitbuild.c 2006-08-29 08:43:29 UTC (rev 8288)
+++ tor/branches/tor-0_1_0-patches/src/or/circuitbuild.c 2006-08-29 09:23:49 UTC (rev 8289)
@@ -552,6 +552,11 @@
log_fn(LOG_WARN,"n_conn already set. Bug/attack. Closing.");
return -1;
}
+ if (!server_mode(get_options())) {
+ log_fn(LOG_WARN,
+ "Got an extend cell, but running as a client. Closing.");
+ return -1;
+ }
relay_header_unpack(&rh, cell->payload);
Modified: tor/branches/tor-0_1_0-patches/src/or/command.c
===================================================================
--- tor/branches/tor-0_1_0-patches/src/or/command.c 2006-08-29 08:43:29 UTC (rev 8288)
+++ tor/branches/tor-0_1_0-patches/src/or/command.c 2006-08-29 09:23:49 UTC (rev 8289)
@@ -159,6 +159,15 @@
return;
}
+ if (!server_mode(get_options())) {
+ log_fn(LOG_WARN,
+ "Received create cell (type %d) from %s:%d, but we're a client. "
+ "Sending back a destroy.",
+ (int)cell->command, conn->address, conn->port);
+ connection_send_destroy(cell->circ_id, conn);
+ return;
+ }
+
/* If the high bit of the circuit ID is not as expected, then switch
* which half of the space we'll use for our own CREATE cells.
*
Modified: tor/branches/tor-0_1_0-patches/src/or/connection_edge.c
===================================================================
--- tor/branches/tor-0_1_0-patches/src/or/connection_edge.c 2006-08-29 08:43:29 UTC (rev 8288)
+++ tor/branches/tor-0_1_0-patches/src/or/connection_edge.c 2006-08-29 09:23:49 UTC (rev 8289)
@@ -1361,12 +1361,20 @@
uint16_t port;
assert_circuit_ok(circ);
- relay_header_unpack(&rh, cell->payload);
/* XXX currently we don't send an end cell back if we drop the
* begin because it's malformed.
*/
+ if (!server_mode(get_options()) &&
+ circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
+ log_fn(LOG_WARN,
+ "Relay begin cell at non-server. Dropping.");
+ return 0;
+ }
+
+ relay_header_unpack(&rh, cell->payload);
+
if (!memchr(cell->payload+RELAY_HEADER_SIZE, 0, rh.length)) {
log_fn(LOG_WARN,"relay begin cell has no \\0. Dropping.");
return 0;
Modified: tor/branches/tor-0_1_0-patches/src/win32/orconfig.h
===================================================================
--- tor/branches/tor-0_1_0-patches/src/win32/orconfig.h 2006-08-29 08:43:29 UTC (rev 8288)
+++ tor/branches/tor-0_1_0-patches/src/win32/orconfig.h 2006-08-29 09:23:49 UTC (rev 8289)
@@ -215,4 +215,4 @@
#define HAVE_EVENT_H
/* Version number of package */
-#define VERSION "0.1.0.17"
+#define VERSION "0.1.0.18"