Fixes bug 25474; bugfix on 0.3.2.5-alpha.

"ours" merge to avoid version bump

"ours" merge to avoid version bump.

"ours" to avoid version bump.

"ours" merge to avoid version bump.

These were meant to demonstrate old behavior, or old rust behavior.

One of them _should_ work in Rust, but won't because of
implementation details.  We'll fix that up later.

The C code and the rust code had different separate integer overflow
bugs here.  That suggests that we're better off just forbidding this
pathological case.

Also, add tests for expected behavior on receiving a bad protocol
list in a consensus.

Fixes another part of 25249.

Fixes part of 24249; bugfix on 0.2.9.4-alpha.

These are as Teor wrote them; I've disabled the ones that don't pass
yet, with XXXX comments.

I've refactored these to be a separate function, to avoid tricky
merge conflicts.

Some of these are disabled with "XXXX" comments; they should get
fixed moving forward.

This one can only be exploited if you can generate a correctly
signed consensus, so it's not as bad as 25074.

Fixes bug 25251; also tracked as TROVE-2018-004.

In some cases we had checked for it, but in others we had not.  One
of these cases could have been used to remotely cause
denial-of-service against directory authorities while they attempted
to vote.

Fixes TROVE-2018-001.

Closes most of #25323.

These patches were already merged, and so don't need a changes file
in these branches.

"ours" merge to avoid conflicts with the cherry-picked fix for 24898.

Roger Dingledine authored 7 years ago and Nick Mathewson committed 7 years ago

since all it does is produce false positives

this commit should get merged into 0.2.9 and 0.3.0 *and* 0.3.1, even
though the code in the previous commit is already present in 0.3.1. sorry
for the mess.

[Cherry-picked]

Roger Dingledine authored 7 years ago and Nick Mathewson committed 7 years ago

since all it does is produce false positives

this commit should get merged into 0.2.9 and 0.3.0 *and* 0.3.1, even
though the code in the previous commit is already present in 0.3.1. sorry
for the mess.

Roger Dingledine authored 7 years ago and Nick Mathewson committed 7 years ago

This commit takes a piece of commit af8cadf3 and a piece of commit
46fe353f25, with the goal of making channel_is_client() be based on what
sort of connection handshake the other side used, rather than seeing
whether the other side ever sent a create_fast cell to us.

Signed-off-by: David Goulet <dgoulet@torproject.org>

Fixes #25236

Signed-off-by: David Goulet <dgoulet@torproject.org>

Never allow the function to set a bucket value above the allowed circuit
burst.

Closes #25202

Signed-off-by: David Goulet <dgoulet@torproject.org>

We had this safeguard around dos_init() but not when the consensus changes
which can modify consensus parameters and possibly enable the DoS mitigation
even if tor wasn't a public relay.

Fixes #25223

Signed-off-by: David Goulet <dgoulet@torproject.org>