[tor-bugs] #4369 [Tor Relay]: I can send (almost) any cell I want before the VERSIONS or NETINFO cell

[Tor Bug Tracker & Wiki]

#4369: I can send (almost) any cell I want before the VERSIONS or NETINFO cell
-----------------------+----------------------------------------------------
 Reporter:  arma       |          Owner:                    
     Type:  defect     |         Status:  new               
 Priority:  normal     |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Relay  |        Version:  Tor: 0.2.2.34     
 Keywords:             |         Parent:                    
   Points:             |   Actualpoints:                    
-----------------------+----------------------------------------------------

Comment(by arma):

 In command_process_cell(), it's (v2 and v3 affected)
 {{{
   /* Reject all but VERSIONS and NETINFO when handshaking. */
   /* (VERSIONS should actually be impossible; it's variable-length.) */
   if (handshaking && cell->command != CELL_VERSIONS &&
       cell->command != CELL_NETINFO) {
     log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
            "Received unexpected cell command %d in state %s; ignoring
 it.",
            (int)cell->command,
            conn_state_to_string(CONN_TYPE_OR,conn->_base.state));
     return;
   }
 }}}

 And in command_process_var_cell() it's (v2 affected only)
 {{{
     case OR_CONN_STATE_OR_HANDSHAKING_V2:
       if (cell->command != CELL_VERSIONS)
         return;
       break;
 }}}

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4369#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online