Commit 70075933 authored by Roger Dingledine's avatar Roger Dingledine
Browse files

stop checking for clock skew, even for servers. 

this means we are vulnerable to an attack where somebody recovers
and uses a really old certificate. however, if they do that, they
probably can get our identity key just as easily.


svn:r3241
parent fdf8c55f

src/or/connection_or.c

+2 −0
Changes for src/or/connection_or.c: 2 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -391,6 +391,7 @@ connection_tls_finish_handshake(connection_t *conn) { 
    log_fn(LOG_WARN, "Identity key not as expected for router claiming to be '%s' (%s:%d) ", nickname, conn->address, conn->port);

    return -1;

  }

#if 0

  if (router_get_by_digest(digest_rcvd)) {

    /* This is a known router; don't cut it slack with its clock skew. */

    if (tor_tls_check_lifetime(conn->tls, TIGHT_CERT_ALLOW_SKEW)<0) {
@@ -399,6 +400,7 @@ connection_tls_finish_handshake(connection_t *conn) { 
      return -1;

    }

  }

#endif



  if (connection_or_nonopen_was_started_here(conn)) {

    /* I initiated this connection. */