[tor-bugs] #22931 [Core Tor/Tor]: What happens when a VERSIONS cell is sent outside a handshake?

[Tor Bug Tracker & Wiki]

#22931: What happens when a VERSIONS cell is sent outside a handshake?
--------------------------+----------------------------------
 Reporter:  teor          |          Owner:
     Type:  defect        |         Status:  needs_review
 Priority:  Medium        |      Milestone:  Tor: unspecified
Component:  Core Tor/Tor  |        Version:
 Severity:  Normal        |     Resolution:
 Keywords:  doc tor-spec  |  Actual Points:
Parent ID:  #18856        |         Points:
 Reviewer:                |        Sponsor:
--------------------------+----------------------------------
Changes (by teor):

 * status:  new => needs_review


Comment:

 The relay drops extra versions cells. We could document this by saying:
 {{{
 + Any VERSIONS cells sent after the first VERSIONS cell MUST be ignored.
 }}}
 Changing versions on a link shouldn't be allowed.

 There are 3 possible cases:

 First and second version cells ask for link version 3 and has cird_id_len
 2:

 `Jul 15 18:41:01.000 [info] channel_tls_process_versions_cell: Received a
 VERSIONS cell on a connection with its version already set to 3; dropping`

 First version cell asks for link version 4 and has cird_id_len 2, second
 version cell asks for link version 4 and has cird_id_len 4:

 `Jul 15 18:46:14.000 [info] channel_tls_process_versions_cell: Received a
 VERSIONS cell on a connection with its version already set to 4; dropping`

 First version cell asks for link version 4 and has cird_id_len 2, second
 version cell asks for link version 4 and has cird_id_len 2:

 (The cell is mis-parsed: the command is read from the second byte of the
 versions cell's payload length. Since no further input arrives to complete
 the cell, the relay times out.)

 A script that sends cells to trigger all these cases is at:

 https://github.com/teor2345/endosome/blob/master/client-or-22931.py

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22931#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online