[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #20307 [Core Tor/Tor]: [warn] Remote server sent bogus reason code 65021
#20307: [warn] Remote server sent bogus reason code 65021
-------------------------------------------------+-------------------------
Reporter: arma | Owner:
Type: defect | Status: new
Priority: Very High | Milestone: Tor:
| 0.3.0.x-final
Component: Core Tor/Tor | Version: Tor:
| 0.2.8.1-alpha
Severity: Normal | Resolution:
Keywords: circuit, 029-backport, nickm- | Actual Points:
deferred-20161017, triage-out-030-201612 |
Parent ID: | Points: 2
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Changes (by dgoulet):
* keywords: circuit, 029-proposed, nickm-deferred-20161017, triage-
out-030-201612 => circuit, 029-backport, nickm-deferred-20161017,
triage-out-030-201612
* priority: Medium => Very High
* version: Tor: 0.2.9.3-alpha => Tor: 0.2.8.1-alpha
* milestone: Tor: 0.3.1.x-final => Tor: 0.3.0.x-final
Comment:
Here is the problem which also fixes in part #21056 as introduction point
are being flagged wrongfully because of this bug.
In `circuit_mark_for_close_()`, we take the `int reason` and then assigned
it to:
{{{
circ->marked_for_close_reason = reason;
circ->marked_for_close_orig_reason = orig_reason;
}}}
Both of the above are `uint16_t` which is bad because the reason value is
a `int`. Furthermore, we have internal reasons that are negative value
such as `#define END_CIRC_REASON_IP_NOW_REDUNDANT -4` used to indicate the
circuit subsystem to NOT report the intro point as a failed connection
attempt ultimately putting the intro point in the failure cache. But with
the `uint16_t` conversion, the reason became `65532` instead of `-4` which
ultimately invalidates 2/3 of the intro points of a descriptor on the
client side. BAD!
This issue has been introduced in `8b4e5b7ee` released in
tor-0.2.8.1-alpha.
I'm also flagging this for an 029 backport even though this is not a
security issue, it has quite bad consequences for HS reachability.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20307#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs