[tor-bugs] #31653 [Core Tor/Tor]: padding machine sending padding from relay to client closes circuit
Tor Bug Tracker & Wiki
blackhole at torproject.org
Fri Sep 6 00:18:54 UTC 2019
#31653: padding machine sending padding from relay to client closes circuit
-----------------------------+------------------------------------
Reporter: pulls | Owner: (none)
Type: defect | Status: new
Priority: Medium | Milestone: Tor: 0.4.2.x-final
Component: Core Tor/Tor | Version: Tor: 0.4.1.5
Severity: Normal | Resolution:
Keywords: wtf-pad circpad | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
-----------------------------+------------------------------------
Comment (by mikeperry):
The codepath in circpad_machine_schedule_padding() for 0 delay uses a
direct call instead of a scheduled callback.
This might be causing an out-of-order AES ctr issue where the padding cell
is being sent before the cell that triggered it, but somehow the AES
counters are not updated correctly for this ordering. This should not
happen normally... Are you also using the branch from #29494 by any
chance? That might mess with your cell ordering in this case...
As a workaround: Can you try replacing the direct call to
circpad_send_padding_cell_for_callback() from
circpad_machine_schedule_padding() for the case where in_usec <0
(https://github.com/pylls/tor/blob/40c6f9bd887bdec7ed3bb03c690dd3d560321d48/src/core/or/circuitpadding.c#L1485)
with an assignment of either in_usec = 0 or in_usec = 1?
This will cause us to unwind back to libevent to call timer_set_cb() on
the next event loop.
Hope this helps!
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31653#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
More information about the tor-bugs
mailing list