[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #7947 [Tor]: Do handle TRUNCATE command properly if circuit pending still
#7947: Do handle TRUNCATE command properly if circuit pending still
-------------------------+--------------------------------------------------
Reporter: cypherpunks | Owner:
Type: defect | Status: new
Priority: normal | Milestone: Tor: 0.2.4.x-final
Component: Tor | Version:
Keywords: tor-relay | Parent:
Points: | Actualpoints:
-------------------------+--------------------------------------------------
Comment(by cypherpunks):
circ->n_hop and circ->n_chan can't be set in the same time anyway. You
could place tor_assert(!circ->n_chan) for sure.
No, it wasn't tested. It even makes attack-with-zillion-connections-to-
internet even easy, no need to buld new circuits or wait success of extend
request -- just truncate and extend to new target. But you can't prevent
it if no fix placed, anyway. Legitimate client still have purpose not to
wait for answer to truncate non finished extend request yet and repeat to
new address, even if no connection complete or no create cell flushed yet
or something else.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7947#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs