August 2014 - tor-commits - lists.torproject.org

[tor/master] Don't send DESTROY to circID 0 when circuit_deliver_create_cell fails
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit b32a8b024ce3a57f8865ed2937dbc3f3fd5072ee Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 12 12:10:57 2014 -0400 Don't send DESTROY to circID 0 when circuit_deliver_create_cell fails Cypherpunks found this and wrote this patch. Fix for 12848; fix on (I think) d58d4c0d, which went into 0.0.8pre1 --- changes/bug12848 | 4 ++++ src/or/circuitbuild.c | 11 +++++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/changes/bug12848 b/changes/bug12848 new file mode 100644 index 0000000..7aa79c3 --- /dev/null +++ b/changes/bug12848 @@ -0,0 +1,4 @@ + o Major bugfixes (relay): + - Avoid queuing or sending destroy cells for circuit ID zero when + we fail to send a CREATE cell. Fixes bug 12848; bugfix on + 0.0.8pre1. Found and fixed by "cypherpunks". diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 4603de0..11f8250 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -584,18 +584,18 @@ circuit_deliver_create_cell(circuit_t *circ, const create_cell_t *create_cell, id = get_unique_circ_id_by_chan(circ->n_chan); if (!id) { log_warn(LD_CIRC,"failed to get unique circID."); - return -1; + goto error; } - log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id); - circuit_set_n_circid_chan(circ, id, circ->n_chan); memset(&cell, 0, sizeof(cell_t)); r = relayed ? create_cell_format_relayed(&cell, create_cell) : create_cell_format(&cell, create_cell); if (r < 0) { log_warn(LD_CIRC,"Couldn't format create cell"); - return -1; + goto error; } + log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id); + circuit_set_n_circid_chan(circ, id, circ->n_chan); cell.circ_id = circ->n_circ_id; append_cell_to_circuit_queue(circ, circ->n_chan, &cell, @@ -619,6 +619,9 @@ circuit_deliver_create_cell(circuit_t *circ, const create_cell_t *create_cell, } return 0; + error: + circ->n_chan = NULL; + return -1; } /** We've decided to start our reachability testing. If all

1 0

[tor/master] Add an extra check in channel_send_destroy for circID==0
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit 981e037fd3b9e20b6e58e9c1470999a0f3a1ef0e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 12 12:14:05 2014 -0400 Add an extra check in channel_send_destroy for circID==0 Prevents other cases of 12848. --- src/or/channel.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/or/channel.c b/src/or/channel.c index 1270eac..cd55bd0 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -2625,6 +2625,14 @@ channel_send_destroy(circid_t circ_id, channel_t *chan, int reason) cell_t cell; tor_assert(chan); + if (circ_id == 0) { + log_warn(LD_BUG, "Attempted to send a destroy cell for circID 0 " + "on a channel " U64_FORMAT " at %p in state %s (%d)", + U64_PRINTF_ARG(chan->global_identifier), + chan, channel_state_to_string(chan->state), + chan->state); + return 0; + } /* Check to make sure we can send on this channel first */ if (!(chan->state == CHANNEL_STATE_CLOSING ||

1 0

[tor/master] Fix another case of 12848 in circuit_handle_first_hop
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit 0044d74b3c51cf5824435e76eca2a675b51a14bc Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 12 12:15:09 2014 -0400 Fix another case of 12848 in circuit_handle_first_hop I looked for other places where we set circ->n_chan early, and found one in circuit_handle_first_hop() right before it calls circuit_send_next_onion_skin(). If onion_skin_create() fails there, then n_chan will still be set when circuit_send_next_onion_skin() returns. We should probably fix that too. --- src/or/circuitbuild.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 11f8250..5325eff 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -475,6 +475,7 @@ circuit_handle_first_hop(origin_circuit_t *circ) log_debug(LD_CIRC,"Conn open. Delivering first onion skin."); if ((err_reason = circuit_send_next_onion_skin(circ)) < 0) { log_info(LD_CIRC,"circuit_send_next_onion_skin failed."); + circ->base_.n_chan = NULL; return err_reason; } }

1 0

[tor/master] Merge remote-tracking branch 'public/bug12848_024' into maint-0.2.5
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit d443658fade3b4090d0b93903b4aec857cab03ea Merge: 789c8d8 0044d74 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 13 23:14:28 2014 -0400 Merge remote-tracking branch 'public/bug12848_024' into maint-0.2.5 Conflicts: src/or/circuitbuild.c changes/bug12848 | 4 ++++ src/or/channel.c | 8 ++++++++ src/or/circuitbuild.c | 12 ++++++++---- 3 files changed, 20 insertions(+), 4 deletions(-) diff --cc src/or/channel.c index 3072eff,cd55bd0..ffd6849 --- a/src/or/channel.c +++ b/src/or/channel.c @@@ -2681,7 -2622,17 +2681,15 @@@ is_destroy_cell(channel_t *chan int channel_send_destroy(circid_t circ_id, channel_t *chan, int reason) { - cell_t cell; - tor_assert(chan); + if (circ_id == 0) { + log_warn(LD_BUG, "Attempted to send a destroy cell for circID 0 " + "on a channel " U64_FORMAT " at %p in state %s (%d)", + U64_PRINTF_ARG(chan->global_identifier), + chan, channel_state_to_string(chan->state), + chan->state); + return 0; + } /* Check to make sure we can send on this channel first */ if (!(chan->state == CHANNEL_STATE_CLOSING || diff --cc src/or/circuitbuild.c index 283afee,5325eff..897f90f --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@@ -657,13 -584,9 +658,11 @@@ circuit_deliver_create_cell(circuit_t * id = get_unique_circ_id_by_chan(circ->n_chan); if (!id) { - log_warn(LD_CIRC,"failed to get unique circID."); + static ratelim_t circid_warning_limit = RATELIM_INIT(9600); + log_fn_ratelim(&circid_warning_limit, LOG_WARN, LD_CIRC, + "failed to get unique circID."); - return -1; + goto error; } - log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id); - circuit_set_n_circid_chan(circ, id, circ->n_chan); memset(&cell, 0, sizeof(cell_t)); r = relayed ? create_cell_format_relayed(&cell, create_cell)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.5'
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit c69e96680a8db0d3d0c20e68f8f8d6727470ece4 Merge: 283730a d443658 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 13 23:15:44 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.5' changes/bug12848 | 4 ++++ src/or/channel.c | 8 ++++++++ src/or/circuitbuild.c | 12 ++++++++---- 3 files changed, 20 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.2.5] Merge remote-tracking branch 'public/bug12848_024' into maint-0.2.5
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit d443658fade3b4090d0b93903b4aec857cab03ea Merge: 789c8d8 0044d74 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 13 23:14:28 2014 -0400 Merge remote-tracking branch 'public/bug12848_024' into maint-0.2.5 Conflicts: src/or/circuitbuild.c changes/bug12848 | 4 ++++ src/or/channel.c | 8 ++++++++ src/or/circuitbuild.c | 12 ++++++++---- 3 files changed, 20 insertions(+), 4 deletions(-) diff --cc src/or/channel.c index 3072eff,cd55bd0..ffd6849 --- a/src/or/channel.c +++ b/src/or/channel.c @@@ -2681,7 -2622,17 +2681,15 @@@ is_destroy_cell(channel_t *chan int channel_send_destroy(circid_t circ_id, channel_t *chan, int reason) { - cell_t cell; - tor_assert(chan); + if (circ_id == 0) { + log_warn(LD_BUG, "Attempted to send a destroy cell for circID 0 " + "on a channel " U64_FORMAT " at %p in state %s (%d)", + U64_PRINTF_ARG(chan->global_identifier), + chan, channel_state_to_string(chan->state), + chan->state); + return 0; + } /* Check to make sure we can send on this channel first */ if (!(chan->state == CHANNEL_STATE_CLOSING || diff --cc src/or/circuitbuild.c index 283afee,5325eff..897f90f --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@@ -657,13 -584,9 +658,11 @@@ circuit_deliver_create_cell(circuit_t * id = get_unique_circ_id_by_chan(circ->n_chan); if (!id) { - log_warn(LD_CIRC,"failed to get unique circID."); + static ratelim_t circid_warning_limit = RATELIM_INIT(9600); + log_fn_ratelim(&circid_warning_limit, LOG_WARN, LD_CIRC, + "failed to get unique circID."); - return -1; + goto error; } - log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id); - circuit_set_n_circid_chan(circ, id, circ->n_chan); memset(&cell, 0, sizeof(cell_t)); r = relayed ? create_cell_format_relayed(&cell, create_cell)

1 0

[tor/maint-0.2.5] Fix another case of 12848 in circuit_handle_first_hop
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit 0044d74b3c51cf5824435e76eca2a675b51a14bc Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 12 12:15:09 2014 -0400 Fix another case of 12848 in circuit_handle_first_hop I looked for other places where we set circ->n_chan early, and found one in circuit_handle_first_hop() right before it calls circuit_send_next_onion_skin(). If onion_skin_create() fails there, then n_chan will still be set when circuit_send_next_onion_skin() returns. We should probably fix that too. --- src/or/circuitbuild.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 11f8250..5325eff 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -475,6 +475,7 @@ circuit_handle_first_hop(origin_circuit_t *circ) log_debug(LD_CIRC,"Conn open. Delivering first onion skin."); if ((err_reason = circuit_send_next_onion_skin(circ)) < 0) { log_info(LD_CIRC,"circuit_send_next_onion_skin failed."); + circ->base_.n_chan = NULL; return err_reason; } }

1 0

[tor/maint-0.2.5] Don't send DESTROY to circID 0 when circuit_deliver_create_cell fails
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit b32a8b024ce3a57f8865ed2937dbc3f3fd5072ee Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 12 12:10:57 2014 -0400 Don't send DESTROY to circID 0 when circuit_deliver_create_cell fails Cypherpunks found this and wrote this patch. Fix for 12848; fix on (I think) d58d4c0d, which went into 0.0.8pre1 --- changes/bug12848 | 4 ++++ src/or/circuitbuild.c | 11 +++++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/changes/bug12848 b/changes/bug12848 new file mode 100644 index 0000000..7aa79c3 --- /dev/null +++ b/changes/bug12848 @@ -0,0 +1,4 @@ + o Major bugfixes (relay): + - Avoid queuing or sending destroy cells for circuit ID zero when + we fail to send a CREATE cell. Fixes bug 12848; bugfix on + 0.0.8pre1. Found and fixed by "cypherpunks". diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 4603de0..11f8250 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -584,18 +584,18 @@ circuit_deliver_create_cell(circuit_t *circ, const create_cell_t *create_cell, id = get_unique_circ_id_by_chan(circ->n_chan); if (!id) { log_warn(LD_CIRC,"failed to get unique circID."); - return -1; + goto error; } - log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id); - circuit_set_n_circid_chan(circ, id, circ->n_chan); memset(&cell, 0, sizeof(cell_t)); r = relayed ? create_cell_format_relayed(&cell, create_cell) : create_cell_format(&cell, create_cell); if (r < 0) { log_warn(LD_CIRC,"Couldn't format create cell"); - return -1; + goto error; } + log_debug(LD_CIRC,"Chosen circID %u.", (unsigned)id); + circuit_set_n_circid_chan(circ, id, circ->n_chan); cell.circ_id = circ->n_circ_id; append_cell_to_circuit_queue(circ, circ->n_chan, &cell, @@ -619,6 +619,9 @@ circuit_deliver_create_cell(circuit_t *circ, const create_cell_t *create_cell, } return 0; + error: + circ->n_chan = NULL; + return -1; } /** We've decided to start our reachability testing. If all

1 0

[tor/maint-0.2.5] Add an extra check in channel_send_destroy for circID==0
by nickm＠torproject.org 14 Aug '14

14 Aug '14

commit 981e037fd3b9e20b6e58e9c1470999a0f3a1ef0e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 12 12:14:05 2014 -0400 Add an extra check in channel_send_destroy for circID==0 Prevents other cases of 12848. --- src/or/channel.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/or/channel.c b/src/or/channel.c index 1270eac..cd55bd0 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -2625,6 +2625,14 @@ channel_send_destroy(circid_t circ_id, channel_t *chan, int reason) cell_t cell; tor_assert(chan); + if (circ_id == 0) { + log_warn(LD_BUG, "Attempted to send a destroy cell for circID 0 " + "on a channel " U64_FORMAT " at %p in state %s (%d)", + U64_PRINTF_ARG(chan->global_identifier), + chan, channel_state_to_string(chan->state), + chan->state); + return 0; + } /* Check to make sure we can send on this channel first */ if (!(chan->state == CHANNEL_STATE_CLOSING ||

1 0

[translation/gettor_completed] Update translations for gettor_completed
by translation＠torproject.org 13 Aug '14

13 Aug '14

commit 6dc3910fadfe8e491717c32096ee3bb78da9a2fd Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 13 22:15:09 2014 +0000 Update translations for gettor_completed --- de/gettor.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/de/gettor.po b/de/gettor.po index a5d5876..ac4286f 100644 --- a/de/gettor.po +++ b/de/gettor.po @@ -17,7 +17,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2013-01-19 13:40+0100\n" -"PO-Revision-Date: 2014-08-13 21:44+0000\n" +"PO-Revision-Date: 2014-08-13 21:50+0000\n" "Last-Translator: debakel <spam1(a)mrtz.me>\n" "Language-Team: German (http://www.transifex.com/projects/p/torproject/language/de/)\n" "MIME-Version: 1.0\n"

1 0