nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-27 22:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Check directory signatures based on name of signer, not on whom we got the directory from.

Browse Source 
svn:r1940
This commit is contained in:
Nick Mathewson 2004-06-02 20:00:57 +00:00
parent 43c404ca68
commit 65e26bae3d
4 changed files with 28 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/or/directory.c
View File

@ -336,7 +336,7 @@ int connection_dir_process_inbuf(connection_t *conn) {
connection_mark_for_close(conn);
return -1;
}
if(router_load_routerlist_from_directory(body, conn->identity_pkey) < 0){
if(router_load_routerlist_from_directory(body, NULL) < 0){
log_fn(LOG_INFO,"...but parsing failed. Ignoring.");
} else {
log_fn(LOG_INFO,"updated routers.");

2
src/or/or.h
View File

@ -578,6 +578,8 @@ typedef struct {
* published?
*/
time_t published_on;
/** Which router is claimed to have signed it? */
char *signing_router;
} routerlist_t;
/** Holds accounting information for a single step in the layered encryption

10
src/or/routerlist.c
View File

@ -212,7 +212,8 @@ routerinfo_t *router_get_by_nickname(char *nickname)
routerinfo_t *router;
tor_assert(nickname);
tor_assert(routerlist);
if (!routerlist)
return NULL;
for(i=0;i<smartlist_len(routerlist->routers);i++) {
router = smartlist_get(routerlist->routers, i);
@ -446,9 +447,10 @@ int router_load_routerlist_from_string(const char *s, int trusted)
}
/** Add to the current routerlist each router stored in the
* signed directory <b>s</b>. If pkey is provided, make sure that <b>s</b> is
* signed with pkey. */
int router_load_routerlist_from_directory(const char *s, crypto_pk_env_t *pkey)
* signed directory <b>s</b>. If pkey is provided, check the signature against
* pkey; else check against the pkey of the signing directory server. */
int router_load_routerlist_from_directory(const char *s,
crypto_pk_env_t *pkey)
{
routerlist_t *new_list = NULL;
check_software_version_against_directory(s, options.IgnoreVersion);

21
src/or/routerparse.c
View File

@ -366,10 +366,27 @@ router_parse_routerlist_from_directory(const char *str,
}
if (smartlist_len(tokens) != 1 ||
((directory_token_t*)smartlist_get(tokens,0))->tp != K_DIRECTORY_SIGNATURE){
(!(tok=smartlist_get(tokens,0))) || /* always succeeds */
(tok->tp != K_DIRECTORY_SIGNATURE)) {
log_fn(LOG_WARN,"Expected a single directory signature"); goto err;
}
tok = smartlist_get(tokens,0);
if (tok->n_args == 1) {
routerinfo_t *r = router_get_by_nickname(tok->args[0]);
log_fn(LOG_DEBUG, "Got directory signed by %s", tok->args[0]);
if (r && r->is_trusted_dir) {
pkey = r->identity_pkey;
} else if (!r && pkey) {
/* pkey provided for debugging purposes. */
} else if (!r) {
log_fn(LOG_WARN, "Directory was signed by unrecognized server %s",
tok->args[0]);
goto err;
} else if (r && !r->is_trusted_dir) {
log_fn(LOG_WARN, "Directory was signed by non-trusted server %s",
tok->args[0]);
goto err;
}
}
if (strcmp(tok->object_type, "SIGNATURE") || tok->object_size != 128) {
log_fn(LOG_WARN, "Bad object type or length on directory signature");
goto err;