Nick Mathewson 7b8c5d3436 Clock skew fixes. ...

Allow some slop (currently 3 minutes) when checking certificate validity.

Change certificate lifetime from 1 year to 2 days.  Since we
regenerate regularly (we regenerate regularly, right??), this
shouldn't be a problem.

Have directories reject descriptors published too far in the future
(currently 30 minutes).  If dirservs don't do this:
    0) Today is January 1, 2000.
    1) A very skewed server publishes descriptor X with a declared
       publication time of August 1, 2000.
    2) The directory includes X.
    3) Because of certificate lifetime issues, nobody can use the
       skewed server.
    4) The server fixes its skew, and goes to republish a new descriptor Y
       with publication time of January 1, 2000.
    5) But because the directory already has a "more recent" descriptor X,
       it rejects descriptor "Y" as superseded!

This patch should make step 2 go away.


svn:r658

2003-10-22 16:41:35 +00:00

branches/TODO

This commit was manufactured by cvs2svn to create branch 'TODO'.

2002-06-26 22:45:49 +00:00

tags

This commit was manufactured by cvs2svn to create tag

2003-10-19 05:45:22 +00:00

trunk

Clock skew fixes.

2003-10-22 16:41:35 +00:00

S

Description

No description provided

96 MiB

Languages

C 94.4%

Python 1.5%

C++ 1.1%

Shell 1.1%

M4 0.9%

Other 0.8%