[tor-commits] [tor/master] Fix code for checking expired certificates on load

[nickm@xxxxxxxxxxxxxx]

commit f64ef65b9d3297d2b039f1bec71192e0b73cd83b
Author: Nick Mathewson <nickm@xxxxxxxxxxxxxx>
Date:   Tue Sep 1 09:47:51 2015 -0400

    Fix code for checking expired certificates on load
    
    Fixes CID 1306915, which noticed that the check was dead.
---
 src/or/routerkeys.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/or/routerkeys.c b/src/or/routerkeys.c
index 80b26e6..1bf0951 100644
--- a/src/or/routerkeys.c
+++ b/src/or/routerkeys.c
@@ -482,10 +482,12 @@ ed_key_init_from_file(const char *fname, uint32_t flags,
     tor_log(severity, LD_OR, "Cert was for wrong key");
     bad_cert = 1;
   } else if (signing_key &&
-             tor_cert_checksig(cert, &signing_key->pubkey, now) < 0 &&
-             (signing_key || cert->cert_expired)) {
+             tor_cert_checksig(cert, &signing_key->pubkey, now) < 0) {
     tor_log(severity, LD_OR, "Can't check certificate");
     bad_cert = 1;
+  } else if (cert->cert_expired) {
+    tor_log(severity, LD_OR, "Certificate is expired");
+    bad_cert = 1;
   } else if (signing_key && cert->signing_key_included &&
              ! ed25519_pubkey_eq(&signing_key->pubkey, &cert->signing_key)) {
     tor_log(severity, LD_OR, "Certificate signed by unexpectd key!");



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits