r11773@catbus: nickm | 2007-02-12 15:18:48 -0500 (0c40a080) · Commits · The Tor Project / Core / debian / tor

ChangeLog

+8 −0

Original line number	Diff line number	Diff line
		@@ -33,6 +33,14 @@ Changes in version 0.1.2.8-alpha - 2007-??-??
		advance warning.
		- Remove some never-implemented options. Mark PathlenCoinWeight as
		obsolete.
		- Implement proposal 106: Stop requiring clients to have well-formed
		certificates; stop checking nicknames in certificates. (Clients have
		certificates so that they can look like Tor servers, but in the future
		we might want to allow them to look like regular TLS clients instead.
		Nicknames in certificates serve no purpose other than making our
		protocol easier to recognize on the wire.)
		- Revise messages on handshake failure again to be even more clear about
		which are incoming connections and which are outgoing.


		Changes in version 0.1.2.7-alpha - 2007-02-06

+11 −7

Original line number	Diff line number	Diff line
		@@ -111,12 +111,14 @@ NR. Write path-spec.txt
		- recommend gaim.
		- unrecommend IE because of ftp:// bug.
		N - we should add a preamble to tor-design saying it's out of date.
		N - Document transport and natdport

		- Forward compatibility fixes
		- Caches should start trying to cache consensus docs?
		NR - Design
		N - Implement, if we think it's smart.
		N . Document transport and natdport
		o In man page
		- In a good HOWTO.

		. Forward compatibility fixes
		D Caches should start trying to cache consensus docs?
		D Design
		D Implement, if we think it's smart.
		- Start uploading short and long descriptors; authorities should support
		URLs to retrieve long descriptors, and should discard short descriptors
		for now. Later, once tools use the "long descriptor" URLs, authorities
		@@ -124,9 +126,11 @@ N - Implement, if we think it's smart.
		a descriptor.
		NR - Design
		N - Implement, if we think it's smart.
		- Check for any outstanding checks we do on the form or number of client
		o Check for any outstanding checks we do on the form or number of client
		certificates that would prevent us from executing certain
		blocking-resistance strategies.
		o Design (proposal 106)
		o Implement

		Things we'd like to do in 0.2.0:
		- Proposals:

+1 −1

Original line number	Diff line number	Diff line
		@@ -24,5 +24,5 @@ Proposals by number:
		103 Splitting identity key from regularly used signing key [OPEN]
		104 Long and Short Router Descriptors [OPEN]
		105 Version negotiation for the Tor protocol [OPEN]
		106 Checking fewer things during TLS handshakes [OPEN]
		106 Checking fewer things during TLS handshakes [FINISHED]

+1 −1

+0 −50

Original line number	Diff line number	Diff line
		@@ -672,56 +672,6 @@ tor_tls_peer_has_cert(tor_tls_t *tls)
		return 1;
		}

		/** Write the nickname (if any) that the peer connected on <b>tls</b>
		* claims to have into the first <b>buflen</b> characters of <b>buf</b>.
		* Truncate the nickname if it is longer than buflen-1 characters. Always
		* NUL-terminate. Return 0 on success, -1 on failure.
		*/
		int
		tor_tls_get_peer_cert_nickname(int severity, tor_tls_t *tls,
		char *buf, size_t buflen)
		{
		X509 *cert = NULL;
		X509_NAME *name = NULL;
		int nid;
		int lenout;
		int r = -1;

		if (!(cert = SSL_get_peer_certificate(tls->ssl))) {
		log_fn(severity, LD_PROTOCOL, "Peer has no certificate");
		goto error;
		}
		if (!(name = X509_get_subject_name(cert))) {
		log_fn(severity, LD_PROTOCOL, "Peer certificate has no subject name");
		goto error;
		}
		if ((nid = OBJ_txt2nid("commonName")) == NID_undef)
		goto error;

		lenout = X509_NAME_get_text_by_NID(name, nid, buf, buflen);
		if (lenout == -1)
		goto error;
		if (((int)strspn(buf, LEGAL_NICKNAME_CHARACTERS)) < lenout) {
		log_fn(severity, LD_PROTOCOL,
		"Peer certificate nickname %s has illegal characters.",
		escaped(buf));
		if (strchr(buf, '.'))
		log_fn(severity, LD_PROTOCOL,
		" (Maybe it is not really running Tor at its "
		"advertised OR port.)");
		goto error;
		}

		r = 0;

		error:
		if (cert)
		X509_free(cert);

		tls_log_errors(severity, "getting peer certificate nickname");
		return r;
		}

		/** DOCDOC */
		static void
		log_cert_lifetime(X509 cert, const char problem)