[tor-bugs] #6252 [Tor Relay]: We obey sendme cells even when we shouldn't get them

[Tor Bug Tracker & Wiki]

#6252: We obey sendme cells even when we shouldn't get them
-----------------------+----------------------------------------------------
 Reporter:  arma       |          Owner:                    
     Type:  defect     |         Status:  new               
 Priority:  major      |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Relay  |        Version:                    
 Keywords:             |         Parent:                    
   Points:             |   Actualpoints:                    
-----------------------+----------------------------------------------------
 A client can send sendme cells preemptively to the exit relay, allowing:

 - cheating on her flow/congestion control, to get her bytes faster

 - DoS on the network, by adding way more cells into the network than she
 was supposed to.

 - perhaps a memory DoS on the entry relay, if she stops reading from the
 TLS connection but keeps up the blitz of sendme cells.

 I believe the fix is to tear down the circuit when we get a sendme we
 should not have gotten.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6252>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online