torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix bug 571: associate certificates with keys, not dirservers, so that we can have certificates for dirservers we do not recognize.

Browse Source 
svn:r13304
This commit is contained in:
Nick Mathewson
2008-01-26 23:18:30 +00:00
parent c7fe633780
commit 68cf666d04
5 changed files with 142 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/or/routerparse.c
+13 -17
View File
@@ -1433,14 +1433,13 @@ extrainfo_parse_entry_from_string(const char *s, const char *end,
authority_cert_t *
authority_cert_parse_from_string(const char *s, const char **end_of_string)
{
authority_cert_t *cert = NULL;
authority_cert_t *cert = NULL, *old_cert;
smartlist_t *tokens = NULL;
char digest[DIGEST_LEN];
directory_token_t *tok;
char fp_declared[DIGEST_LEN];
char *eos;
size_t len;
trusted_dir_server_t *ds;
int found;
s = eat_whitespace(s);
@@ -1531,22 +1530,19 @@ authority_cert_parse_from_string(const char *s, const char **end_of_string)
}
/* If we already have this cert, don't bother checking the signature. */
ds = trusteddirserver_get_by_v3_auth_digest(
cert->cache_info.identity_digest);
old_cert = authority_cert_get_by_digests(
cert->cache_info.identity_digest,
cert->signing_key_digest);
found = 0;
if (ds && ds->v3_certs) {
SMARTLIST_FOREACH(ds->v3_certs, authority_cert_t *, c,
{
/* XXXX020 can we just compare signed_descriptor_digest ? */
if (c->cache_info.signed_descriptor_len == len &&
c->cache_info.signed_descriptor_body &&
!memcmp(s, c->cache_info.signed_descriptor_body, len)) {
log_debug(LD_DIR, "We already checked the signature on this "
"certificate; no need to do so again.");
found = 1;
break;
}
});
if (old_cert) {
/* XXXX020 can we just compare signed_descriptor_digest ? */
if (old_cert->cache_info.signed_descriptor_len == len &&
old_cert->cache_info.signed_descriptor_body &&
!memcmp(s, old_cert->cache_info.signed_descriptor_body, len)) {
log_debug(LD_DIR, "We already checked the signature on this "
"certificate; no need to do so again.");
found = 1;
}
}
if (!found) {
if (check_signature_token(digest, tok, cert->identity_key, 0,