defense in depth

svn:r6939

diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index d2973203ac265fbf7265740a9dd7e4e286ac3e3d..fa5da30c4956c71c4ea55411b32b1f604896aa60 100644 (file)
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -625,11 +625,17 @@ circuit_extend(cell_t *cell, circuit_t *circ)
   char *id_digest=NULL;
 
   if (circ->n_conn) {
-    log_fn(LOG_PROTOCOL_WARN,LD_PROTOCOL,
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
            "n_conn already set. Bug/attack. Closing.");
     return -1;
   }
 
+  if (!server_mode(get_options())) {
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
+           "Got an extend cell, but running as a client. Closing.");
+    return -1;
+  }
+
   relay_header_unpack(&rh, cell->payload);
 
   if (rh.length < 4+2+ONIONSKIN_CHALLENGE_LEN+DIGEST_LEN) {

diff --git a/src/or/command.c b/src/or/command.c
index 9e3e5297373af1625fa880b8fe6c2161a93d4c33..f508ab254541474037370c8e8b7b50ced5b6ecb9 100644 (file)
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -173,6 +173,16 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn)
     return;
   }
 
+  if (!server_mode(get_options())) {
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
+           "Received create cell (type %d) from %s:%d, but we're a client. "
+           "Sending back a destroy.",
+           (int)cell->command, conn->_base.address, conn->_base.port);
+    connection_or_send_destroy(cell->circ_id, conn,
+                               END_CIRC_REASON_TORPROTOCOL);
+    return;
+  }
+
   /* If the high bit of the circuit ID is not as expected, close the
    * circ. */
   id_is_high = cell->circ_id & (1<<15);

diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c
index 7839a91de2b7d8ffe7ad673f22c299488d651ddc..746d65afc279062f64e9a5a7a38caf0b1151b487 100644 (file)
--- a/src/or/connection_edge.c
+++ b/src/or/connection_edge.c
@@ -1598,12 +1598,20 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ)
   uint16_t port;
 
   assert_circuit_ok(circ);
-  relay_header_unpack(&rh, cell->payload);
 
   /* XXX currently we don't send an end cell back if we drop the
    * begin because it's malformed.
    */
 
+  if (!server_mode(get_options()) &&
+      circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
+    log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
+           "Relay begin cell at non-server. Dropping.");
+    return 0;
+  }
+
+  relay_header_unpack(&rh, cell->payload);
+
   if (!memchr(cell->payload+RELAY_HEADER_SIZE, 0, rh.length)) {
     log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
            "Relay begin cell has no \\0. Dropping.");