[or-cvs] r6940: defense in depth (tor/branches/tor-0_1_1-patches/src/or)

[arma at seul.org]

Author: arma
Date: 2006-07-30 00:38:48 -0400 (Sun, 30 Jul 2006)
New Revision: 6940

Modified:
   tor/branches/tor-0_1_1-patches/src/or/circuitbuild.c
   tor/branches/tor-0_1_1-patches/src/or/command.c
   tor/branches/tor-0_1_1-patches/src/or/connection_edge.c
Log:
defense in depth


Modified: tor/branches/tor-0_1_1-patches/src/or/circuitbuild.c
===================================================================
--- tor/branches/tor-0_1_1-patches/src/or/circuitbuild.c	2006-07-30 04:32:58 UTC (rev 6939)
+++ tor/branches/tor-0_1_1-patches/src/or/circuitbuild.c	2006-07-30 04:38:48 UTC (rev 6940)
@@ -683,10 +683,15 @@
   char *id_digest=NULL;
 
   if (circ->n_conn) {
-    log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
            "n_conn already set. Bug/attack. Closing.");
     return -1;
   }
+  if (!server_mode(get_options())) {
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
+           "Got an extend cell, but running as a client. Closing.");
+    return -1;
+  }
 
   relay_header_unpack(&rh, cell->payload);
 

Modified: tor/branches/tor-0_1_1-patches/src/or/command.c
===================================================================
--- tor/branches/tor-0_1_1-patches/src/or/command.c	2006-07-30 04:32:58 UTC (rev 6939)
+++ tor/branches/tor-0_1_1-patches/src/or/command.c	2006-07-30 04:38:48 UTC (rev 6940)
@@ -172,6 +172,15 @@
                                END_CIRC_REASON_HIBERNATING);
     return;
   }
+  if (!server_mode(get_options())) {
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
+           "Received create cell (type %d) from %s:%d, but we're a client. "
+           "Sending back a destroy.",
+           (int)cell->command, conn->address, conn->port);
+    connection_or_send_destroy(cell->circ_id, conn,
+                               END_CIRC_REASON_TORPROTOCOL);
+    return;
+  }
 
   /* If the high bit of the circuit ID is not as expected, then switch
    * which half of the space we'll use for our own CREATE cells.

Modified: tor/branches/tor-0_1_1-patches/src/or/connection_edge.c
===================================================================
--- tor/branches/tor-0_1_1-patches/src/or/connection_edge.c	2006-07-30 04:32:58 UTC (rev 6939)
+++ tor/branches/tor-0_1_1-patches/src/or/connection_edge.c	2006-07-30 04:38:48 UTC (rev 6940)
@@ -1575,12 +1575,20 @@
   uint16_t port;
 
   assert_circuit_ok(circ);
-  relay_header_unpack(&rh, cell->payload);
 
   /* XXX currently we don't send an end cell back if we drop the
    * begin because it's malformed.
    */
 
+  if (!server_mode(get_options()) &&
+      circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
+           "Relay begin cell at non-server. Dropping.");
+    return 0;
+  }
+
+  relay_header_unpack(&rh, cell->payload);
+
   if (!memchr(cell->payload+RELAY_HEADER_SIZE, 0, rh.length)) {
     log_warn(LD_PROTOCOL,"relay begin cell has no \\0. Dropping.");
     return 0;