[tor-bugs] #21576 [Core Tor/Tor]: Bug: Assertion linked_dir_conn_base failed in connection_ap_handshake_send_begin

[Tor Bug Tracker & Wiki]

#21576: Bug: Assertion linked_dir_conn_base failed in
connection_ap_handshake_send_begin
---------------------------------+------------------------------------
 Reporter:  alecmuffett          |          Owner:  teor
     Type:  defect               |         Status:  needs_review
 Priority:  Medium               |      Milestone:  Tor: 0.3.0.x-final
Component:  Core Tor/Tor         |        Version:  Tor: 0.2.9.3-alpha
 Severity:  Normal               |     Resolution:
 Keywords:  crash, 029-backport  |  Actual Points:  0.5
Parent ID:                       |         Points:  0.2
 Reviewer:                       |        Sponsor:
---------------------------------+------------------------------------
Changes (by teor):

 * status:  assigned => needs_review
 * version:  Tor: 0.2.9.9 => Tor: 0.2.9.3-alpha
 * points:   => 0.2
 * actualpoints:   => 0.5


Comment:

 This timing-dependent crash occurs when a directory connection is
 unlinked, and then tries to send a BEGIN cell shortly afterwards. It could
 happen on any tor node that uses BEGINDIR, which includes clients,
 bridges, relays (when using BEGINDIR to an ORPort-only mirror, introduced
 in #20711 in tor-0.3.0.4-rc). Authorities are unaffected: they never use
 BEGINDIR.

 It particularly affects hidden services, hidden service clients, bridges,
 bridge clients, and anything with AllDirActionsPrivate set, because these
 roles/options use BEGINDIR more, over longer connections.

 Since it is network-timing dependent, I can't rule out it being triggered
 remotely.

 Please see my branch [https://github.com/teor2345/tor/tree/bug21576_029_v2
 bug21576_029_v2], which stops opening invalid connections, rather than
 crashing.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21576#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online