[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #12848 [Tor]: Tor wrongly process circuit as connected to n_chan if create cell delivery failed

#12848: Tor wrongly process circuit as connected to n_chan if create cell delivery
failed
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:
  cypherpunks            |     Status:  new
         Type:  defect   |  Milestone:  Tor: 0.2.5.x-final
     Priority:  normal   |    Version:  Tor: 0.2.5.5-alpha
    Component:  Tor      |   Keywords:  tor-relay 024-backport 023-backport
   Resolution:           |  Parent ID:
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------
Changes (by nickm):

 * keywords:   => tor-relay 024-backport 023-backport
 * milestone:   => Tor: 0.2.5.x-final


Comment:

 Thanks!  How did you find this?

 It appears that this bug dates back to 0.2.4 at least, and probably 0.2.3
 and earlier.  It's probably causing the most trouble in 0.2.5 because of
 the destroy cell queue, though.

 I looked for other places where we set circ->n_chan early, and found one
 in circuit_handle_first_hop() right before it calls
 circuit_send_next_onion_skin().  If onion_skin_create() fails there, then
 n_chan will still be set when circuit_send_next_onion_skin() returns.  We
 should probably fix that too.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12848#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs