Misc small code cleanups; remove exit_server_mode(); change tor_tls_verify behavior

svn:r2073

5 files changed, 18 insertions, 16 deletions

diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index 1ed6b029a..980c4410c 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -114,7 +114,9 @@ void circuit_rep_hist_note_result(circuit_t *circ) {
     return;
   }
   if (server_mode()) {
-    prev_digest = router_get_my_routerinfo()->identity_digest;
+    routerinfo_t *me = router_get_my_routerinfo();
+    tor_assert(me);
+    prev_digest = me->identity_digest;
   }
   do {
     router = router_get_by_digest(hop->identity_digest);
diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index d60a7f53f..860eaff4b 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -155,10 +155,12 @@ connection_or_init_conn_from_address(connection_t *conn,
 connection_t *connection_or_connect(uint32_t addr, uint16_t port,
                                     const char *id_digest) {
   connection_t *conn;
+  routerinfo_t *me;
 
   tor_assert(id_digest);
 
-  if(server_mode() && 0) { /* XXX008 if I'm an OR and id_digest is my digest */
+  if(server_mode() && (me=router_get_my_routerinfo()) &&
+     !memcmp(me->identity_digest, id_digest,DIGEST_LEN)) {
     log_fn(LOG_WARN,"Request to connect to myself! Failing.");
     return NULL;
   }
@@ -267,6 +269,7 @@ connection_tls_finish_handshake(connection_t *conn) {
   routerinfo_t *router;
   char nickname[MAX_NICKNAME_LEN+1];
   connection_t *c;
+  crypto_pk_env_t *identity_rcvd=NULL;
 
   conn->state = OR_CONN_STATE_OPEN;
   connection_watch_events(conn, POLLIN);
@@ -298,12 +301,18 @@ connection_tls_finish_handshake(connection_t *conn) {
            nickname, conn->address, conn->port);
     return -1;
   }
-  if(tor_tls_verify(conn->tls, router->identity_pkey)<0) {
+  if(tor_tls_verify(conn->tls, &identity_rcvd)<0) {
     log_fn(LOG_WARN,"Other side '%s' (%s:%d) has a cert but it's invalid. Closing.",
            nickname, conn->address, conn->port);
     return -1;
   }
   log_fn(LOG_DEBUG,"The router's cert is valid.");
+  if(crypto_pk_cmp_keys(identity_rcvd, router->identity_pkey) != 0) {
+    crypto_free_pk_env(identity_rcvd);
+    log_fn(LOG_WARN, "Identity key not as expected for %s", nickname);
+    return -1;
+  }
+  crypto_free_pk_env(identity_rcvd);
 
   /* XXXX008 This isn't right; fix this one we launch by identity digest
    * XXXX008 rather than by nickname */
diff --git a/src/or/main.c b/src/or/main.c
index 618d4a59a..9ed1dd14e 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -473,14 +473,6 @@ int advertised_server_mode(void) {
   return (options.ORPort != 0);
 }
 
-/** Return true iff we are trying to be an exit server.
- */
-int exit_server_mode(void) {
-  /* XXX008 NM: non-exit servers still answer resolve requests, right? How
-   * is this to be used? */
-  return (options.ORPort != 0);
-}
-
 /** Return true iff we are trying to be a socks proxy. */
 int proxy_mode(void) {
   return (options.SocksPort != 0);
@@ -747,7 +739,7 @@ static int do_hup(void) {
     /* Restart cpuworker and dnsworker processes, so they get up-to-date
      * configuration options. */
     cpuworkers_rotate();
-    if (exit_server_mode())
+    if (server_mode())
       dnsworkers_rotate();
     /* Rebuild fresh descriptor as needed. */
     router_rebuild_descriptor();
@@ -1011,7 +1003,7 @@ int tor_init(int argc, char *argv[]) {
     log_fn(LOG_WARN,"You are running Tor as root. You don't need to, and you probably shouldn't.");
 #endif
 
-  if(exit_server_mode()) { /* only spawn dns handlers if we're a router */
+  if(server_mode()) { /* only spawn dns handlers if we're a router */
     dns_init(); /* initialize the dns resolve tree, and spawn workers */
   }
   if(proxy_mode()) {
diff --git a/src/or/or.h b/src/or/or.h
index ee231bd6d..95b40e840 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -1198,7 +1198,6 @@ int authdir_mode(void);
 int clique_mode(void);
 int server_mode(void);
 int advertised_server_mode(void);
-int exit_server_mode(void);
 int proxy_mode(void);
 
 int main(int argc, char *argv[]);
diff --git a/src/or/router.c b/src/or/router.c
index f9b413db0..578370893 100644
--- a/src/or/router.c
+++ b/src/or/router.c
@@ -516,8 +516,8 @@ int router_rebuild_descriptor(void) {
     log_fn(LOG_WARN, "Couldn't dump router to string.");
     return -1;
   }
-  ri->is_trusted_dir = ri->dir_port &&
-    router_digest_is_trusted_dir(ri->identity_digest);
+  ri->is_trusted_dir = (ri->dir_port &&
+    router_digest_is_trusted_dir(ri->identity_digest));
   return 0;
 }