[tor-bugs] #26060 [Core Tor/Stem]: Invalid [Length] field when receiving RELAY cells via stem.client.Circuit

[Tor Bug Tracker & Wiki]

#26060: Invalid [Length] field when receiving RELAY cells via stem.client.Circuit
---------------------------+------------------------
 Reporter:  plcp           |          Owner:  atagar
     Type:  defect         |         Status:  new
 Priority:  Medium         |      Milestone:
Component:  Core Tor/Stem  |        Version:
 Severity:  Normal         |     Resolution:
 Keywords:  client         |  Actual Points:
Parent ID:                 |         Points:
 Reviewer:                 |        Sponsor:
---------------------------+------------------------

Comment (by plcp):

 Here is a little demo:

 {{{
 git clone "https://git.torproject.org/stem.git" stem-client
 ln -s stem-client/stem
 virtualenv venv
 source venv/bin/activate
 pip install -r ./stem-client/requirements.txt
 tor PublishServerDescriptor 0 AssumeReachable 1 ExitRelay 0
 ProtocolWarnings 1 SafeLogging 0 LogTimeGranularity 1 PidFile "$(mktemp)"
 SOCKSPort 0 ContactInfo none at example.com
  DataDirectory "$(mktemp -d)" ORPort 9050 DirPort 9051 Log "err stderr" &

 wget https://raw.githubusercontent.com/plcp/tor-
 scripts/master/stem_26060_issue.py
 python stem_26060_issue.py
 }}}

 You should obtain something like that:
 {{{
 Before repacking:
         Cell headers:
          - circ_id:     80000000
          - command:     03
         RELAY headers:
          - command:     6e
          - recognized:  eab1
          - stream_id:   c650
          - digest:      7e0f68b7
          - length:      68e4

 After repacking:
         Cell headers:
          - circ_id:     80000000
          - command:     03
         RELAY headers:
          - command:     6e
          - recognized:  eab1
          - stream_id:   c650
          - digest:      7e0f68b7
          - length:      01f2             !! corrupted !!

 After decryption:
         Cell headers:
          - circ_id:     80000000
          - command:     03
         RELAY headers:
          - command:     04               RELAY_CONNECTED
          - recognized:  0000
          - stream_id:   0001
          - digest:      a0b49e85
          - length:      6916             !! corrupted !!

 Digest (from the RELAY cell):   a0b49e85
 Digest (computed length):       db7932a8
 Digest (expected length):       a0b49e85
 }}}

 I've managed to fix this issue as follows:
 https://github.com/plcp/stem-
 client/commit/0e2ec2627df05ffcbd2d93be52b862e111bb400b

 (note that I'm only using `stem.client.cell` and thus haven't modified
 `stem.client.Circuit` accordingly)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26060#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online