[tor-bugs] #2317 [Tor Client]: Missing sanity checks for cbtnummodes consensus parameter

[Tor Bug Tracker & Wiki]

#2317: Missing sanity checks for cbtnummodes consensus parameter
------------------------+---------------------------------------------------
 Reporter:  Sebastian   |       Owner:                    
     Type:  defect      |      Status:  needs_review      
 Priority:  major       |   Milestone:  Tor: 0.2.2.x-final
Component:  Tor Client  |     Version:                    
 Keywords:              |      Parent:                    
------------------------+---------------------------------------------------

Comment(by Sebastian):

 > If an exit relay sets its circ package window higher than 1000, it will
 cause current Tor clients that use it to close those circuits because it
 will violate their deliver_window >= 0 checks.
 >
 > But if we later change Tor clients to handle that better (e.g. to read
 the circwindow out of the consensus and assume that exit relays are using
 that value), then we wouldn't want to have put a constraint in.
 >
 > Also, if the circ package window is 1, current Tor clients will fail to
 use that circuit well, because they won't send any sendmes back until
 they've gotten 100 cells. So we could argue for a minimum of 100. But at
 the same time, I don't want to dictate to future clients what their
 constraints should be, in case we change the sendme design in the future.
 >
 > So why not [0, MAX_INT32] here?

 Because we can change the min/max in these newer versions of Tor, and at
 least the older versions of Tor don't break. If your argument is that
 people will be confused about seeing warnings, what will they be more
 confused about - a Tor that still works but with a warning, or a Tor that
 breaks without a warning?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2317#comment:25>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online