onion-grater stream ownership check is very buggy resulting in restrict-stream-events being broken
This is the buggy check:
if self.client_address == event.source_address or \
self.client_pid == pid_of_laddr((event.source_address,
event.source_port)):
self.client_streams.add(event.id)
It has two serious bugs:
-
self.client_addressis an (address, port) tuple butevent.source_addressis just an address, so the left-hand side of the condition is alwaysFalse. I introduced this nonsense in commit 42fd3adf exactly 2 years ago to the day. - The right-hand side is broken for clients running in a netns: in that case
self.client_pid == Noneandpid_of_laddr()can only handle loopback addresses so it will returnNone, so the comparision becomesNone == Nonewhich isTrue.
So, in particular, restrict-stream-events is broken for Tor Browser, it has had access to all stream info for the past ~two years.