commit 9df89aacbd9cac69660a5199ab6eca5ee5fc3ba7 Author: Nick Mathewson nickm@torproject.org Date: Fri Apr 27 12:02:55 2012 -0400

Close OR connections that send junk before AUTHORIZE/VERSIONS

Fix for 4369. --- changes/bug4369 | 3 +++ src/or/command.c | 16 +++++++++++++--- 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/changes/bug4369 b/changes/bug4369 new file mode 100644 index 0000000..c444102 --- /dev/null +++ b/changes/bug4369 @@ -0,0 +1,3 @@ + o Minor features: + - Close any connection that sends unrecognized junk before the + handshake. Solves an issue noted in bug 4369. diff --git a/src/or/command.c b/src/or/command.c index fb281a7..7c4556e 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -160,9 +160,11 @@ command_process_cell(cell_t *cell, or_connection_t *conn) if (handshaking && cell->command != CELL_VERSIONS && cell->command != CELL_NETINFO) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Received unexpected cell command %d in state %s; ignoring it.", + "Received unexpected cell command %d in state %s; closing the " + "connection", (int)cell->command, conn_state_to_string(CONN_TYPE_OR,conn->_base.state)); + connection_mark_for_close(TO_CONN(conn)); return; }

@@ -258,8 +260,15 @@ command_process_var_cell(var_cell_t *cell, or_connection_t *conn) switch (conn->_base.state) { case OR_CONN_STATE_OR_HANDSHAKING_V2: - if (cell->command != CELL_VERSIONS) + if (cell->command != CELL_VERSIONS) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Received a cell with command %d in state %s; " + "closing the connection.", + (int)cell->command, + conn_state_to_string(CONN_TYPE_OR,conn->_base.state)); + connection_mark_for_close(TO_CONN(conn)); return; + } break; case OR_CONN_STATE_TLS_HANDSHAKING: /* If we're using bufferevents, it's entirely possible for us to @@ -272,9 +281,10 @@ command_process_var_cell(var_cell_t *cell, or_connection_t *conn) if (! command_allowed_before_handshake(cell->command)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Received a cell with command %d in state %s; " - "ignoring it.", + "closing the connection.", (int)cell->command, conn_state_to_string(CONN_TYPE_OR,conn->_base.state)); + connection_mark_for_close(TO_CONN(conn)); return; } else { if (enter_v3_handshake_with_cell(cell, conn)<0)