Make ACI anti-collision logic work; make sure that cells are filled with 0s.

svn:r176

4 files changed, 15 insertions, 5 deletions

diff --git a/src/or/circuit.c b/src/or/circuit.c
index c73b5188ef..ed22340209 100644
--- a/src/or/circuit.c
+++ b/src/or/circuit.c
@@ -113,10 +113,10 @@ try_again:
 
   crypto_pseudo_rand(2, (unsigned char *)&test_aci);
 
-  if(aci_type == ACI_TYPE_LOWER && test_aci >= (2<<15))
-    test_aci -= (2<<15);
-  if(aci_type == ACI_TYPE_HIGHER && test_aci < (2<<15))
-    test_aci += (2<<15);
+  if(aci_type == ACI_TYPE_LOWER && test_aci >= (1<<15))
+    test_aci -= (1<<15);
+  if(aci_type == ACI_TYPE_HIGHER && test_aci < (1<<15))
+    test_aci += (1<<15);
   /* if aci_type == ACI_BOTH, don't filter any of it */
 
   if(test_aci == 0)
@@ -489,6 +489,7 @@ int circuit_consider_sending_sendme(circuit_t *circ, int edge_type) {
 
   assert(circ);
 
+  memset(&sendme, 0, sizeof(cell_t));
   sendme.command = CELL_SENDME;
   sendme.length = CIRCWINDOW_INCREMENT;
 
diff --git a/src/or/connection.c b/src/or/connection.c
index 8e7fcb7c0a..919da19f59 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -479,6 +479,8 @@ void connection_send_cell(connection_t *conn) {
     connection_write_cell_to_buf(&cell, conn);
   }
 
+  /* ???? If we might not have added a cell above, why are we
+   * ???? increasing outbuf_flushlen? -NM */
   conn->outbuf_flushlen += sizeof(cell_t); /* instruct it to send a cell */
   connection_start_writing(conn);
 
@@ -512,6 +514,7 @@ int connection_send_destroy(aci_t aci, connection_t *conn) {
      return 0;
   }
 
+  memset(&cell, 0, sizeof(cell_t));
   cell.aci = aci;
   cell.command = CELL_DESTROY;
   log(LOG_INFO,"connection_send_destroy(): Sending destroy (aci %d).",aci);
@@ -606,6 +609,9 @@ repeat_connection_package_raw_inbuf:
   if(!amount_to_process)
     return 0;
 
+  /* Initialize the cell with 0's */
+  memset(&cell, 0, sizeof(cell_t));
+
   if(amount_to_process > CELL_PAYLOAD_SIZE - TOPIC_HEADER_SIZE) {
     cell.length = CELL_PAYLOAD_SIZE - TOPIC_HEADER_SIZE;
   } else {
@@ -679,6 +685,7 @@ int connection_consider_sending_sendme(connection_t *conn, int edge_type) {
     return 0;
   }
 
+  memset(&cell, 0, sizeof(cell_t));
   *(uint16_t *)(cell.payload+2) = htons(conn->topic_id);
   *cell.payload = TOPIC_COMMAND_SENDME;
   cell.length += TOPIC_HEADER_SIZE;
diff --git a/src/or/connection_ap.c b/src/or/connection_ap.c
index 43bf960c6a..9d28d5a4a9 100644
--- a/src/or/connection_ap.c
+++ b/src/or/connection_ap.c
@@ -314,6 +314,8 @@ int ap_handshake_send_onion(connection_t *ap_conn, connection_t *n_conn, circuit
     } else { /* last cell */
       cell.length = dataleft;
       memcpy(cell.payload, tmpbuf + tmpbuflen - dataleft, dataleft);
+      /* fill extra space with 0 bytes */
+      memset(cell.payload + dataleft, 0, CELL_PAYLOAD_SIZE - dataleft);
       connection_write_cell_to_buf(&cell, n_conn);
       dataleft = 0;
     }
diff --git a/src/or/main.c b/src/or/main.c
index 7add4dada0..fe2de2ebc1 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -342,7 +342,7 @@ int prepare_for_poll(int *timeout) {
           /* either a full router, or we've got a circuit. send a padding cell. */
 //          log(LOG_DEBUG,"prepare_for_poll(): Sending keepalive to (%s:%d)",
 //              tmpconn->address, tmpconn->port);
-//          memset(&cell,0,sizeof(cell_t));
+          memset(&cell,0,sizeof(cell_t));
           cell.command = CELL_PADDING;
           if(connection_write_cell_to_buf(&cell, tmpconn) < 0)
             tmpconn->marked_for_close = 1;