diff options
| author | Roger Dingledine <arma@torproject.org> | 2007-07-12 17:09:19 +0000 |
|---|---|---|
| committer | Roger Dingledine <arma@torproject.org> | 2007-07-12 17:09:19 +0000 |
| commit | ef6bc1a451f2aba577e833bced28de448367fbf5 (patch) | |
| tree | 6fdda7bd7131e70ecfd3213d3da30fadee060133 /src/or/relay.c | |
| parent | 656b7761a81155047af6b41fd27c2aa6663b008e (diff) | |
| download | tor-ef6bc1a451f2aba577e833bced28de448367fbf5.tar.gz tor-ef6bc1a451f2aba577e833bced28de448367fbf5.zip | |
Keep streamids from different exits on a circuit separate. This
bug may have allowed other routers on a given circuit to inject
cells into streams. Reported by lodger; fixes bug 446. [Bugfix
on 0.1.2.x]
svn:r10818
Diffstat (limited to 'src/or/relay.c')
| -rw-r--r-- | src/or/relay.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/src/or/relay.c b/src/or/relay.c index 2bcd400453..a2f77eaf4d 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -18,7 +18,8 @@ const char relay_c_id[] = static int relay_crypt(circuit_t *circ, cell_t *cell, int cell_direction, crypt_path_t **layer_hint, char *recognized); static edge_connection_t *relay_lookup_conn(circuit_t *circ, cell_t *cell, - int cell_direction); + int cell_direction, + crypt_path_t *layer_hint); static int connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, @@ -164,7 +165,8 @@ circuit_receive_relay_cell(cell_t *cell, circuit_t *circ, int cell_direction) } if (recognized) { - edge_connection_t *conn = relay_lookup_conn(circ, cell, cell_direction); + edge_connection_t *conn = relay_lookup_conn(circ, cell, cell_direction, + layer_hint); if (cell_direction == CELL_DIRECTION_OUT) { ++stats_n_relay_cells_delivered; log_debug(LD_OR,"Sending away from origin."); @@ -380,7 +382,8 @@ circuit_package_relay_cell(cell_t *cell, circuit_t *circ, * attached to circ, return that conn, else return NULL. */ static edge_connection_t * -relay_lookup_conn(circuit_t *circ, cell_t *cell, int cell_direction) +relay_lookup_conn(circuit_t *circ, cell_t *cell, int cell_direction, + crypt_path_t *layer_hint) { edge_connection_t *tmpconn; relay_header_t rh; @@ -398,7 +401,8 @@ relay_lookup_conn(circuit_t *circ, cell_t *cell, int cell_direction) for (tmpconn = TO_ORIGIN_CIRCUIT(circ)->p_streams; tmpconn; tmpconn=tmpconn->next_stream) { if (rh.stream_id == tmpconn->stream_id && - !tmpconn->_base.marked_for_close) { + !tmpconn->_base.marked_for_close && + tmpconn->cpath_layer == layer_hint) { log_debug(LD_APP,"found conn for stream %d.", rh.stream_id); return tmpconn; } |