[tor-bugs] #10777 [Tor]: Remotely triggerable circuit destruction by path bias code

[Tor Bug Tracker & Wiki]

#10777: Remotely triggerable circuit destruction by path bias code
-----------------------------+-----------------------------------
     Reporter:  cypherpunks  |      Owner:
         Type:  defect       |     Status:  needs_review
     Priority:  major        |  Milestone:  Tor: 0.2.4.x-final
    Component:  Tor          |    Version:
   Resolution:               |   Keywords:  tor-client regression
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+-----------------------------------

Comment (by mikeperry):

 Replying to [comment:17 mikeperry]:
 > bug10777_netunreach_024 seems ok. However, I am not a fan of
 bug10777_nointernal_024..
 > This branch would prevent us from detecting that entire class of route
 manipulation (tagging the initial relay cells after a circuit was
 established).
 >
 > Specifically, in circuit_receive_relay_cell(), we use
 END_STREAM_REASON_INTERNAL to mean that the relay cell was not recognized,
 which is exactly what we'd see for a simple XOR tag that was meant to be
 undone by a cooperating exit node, but hit an honest exit node instead.

 Actually, no I'm wrong. We only return INTERNAL if the decryption itself
 fails, not for unrecognized. Still digging for other cases...

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10777#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online