Allow more clock skew from unrecognized hosts than from recognized ones.

svn:r2874

1 files changed, 20 insertions, 0 deletions

diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index a5aaeac29..ca3edd536 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -12,6 +12,13 @@
 
 #include "or.h"
 
+/** How much clock skew do we tolerate when checking certificates for
+ * known routers? (sec) */
+#define TIGHT_CERT_ALLOW_SKEW (90*60)
+/** How much clock skew do we tolerate when checking certificates for
+ * unknown routers/clients? (sec) */
+#define LOOSE_CERT_ALLOW_SKEW (24*60*60)
+
 static int connection_tls_finish_handshake(connection_t *conn);
 static int connection_or_process_cells_from_inbuf(connection_t *conn);
 
@@ -362,6 +369,11 @@ connection_tls_finish_handshake(connection_t *conn) {
            nickname, conn->address, conn->port);
     return -1;
   }
+  if(tor_tls_check_lifetime(conn->tls, LOOSE_CERT_ALLOW_SKEW)<0) {
+    log_fn(LOG_WARN,"Other side '%s' (%s:%d) has a very highly skewed clock, or an expired certificate. Closing.",
+           nickname, conn->address, conn->port);
+    return -1;
+  }
   log_fn(LOG_DEBUG,"The router's cert is valid.");
   crypto_pk_get_digest(identity_rcvd, digest_rcvd);
 
@@ -379,6 +391,14 @@ connection_tls_finish_handshake(connection_t *conn) {
     log_fn(LOG_WARN, "Identity key not as expected for %s", nickname);
     return -1;
   }
+  if (router_get_by_digest(digest_rcvd)) {
+    /* This is a known router; don't cut it slack with its clock skew. */
+    if(tor_tls_check_lifetime(conn->tls, TIGHT_CERT_ALLOW_SKEW)<0) {
+      log_fn(LOG_WARN,"Router '%s' (%s:%d) has a skewed clock, or an expired certificate. Closing.",
+             nickname, conn->address, conn->port);
+      return -1;
+    }
+  }
 
   if (connection_or_nonopen_was_started_here(conn)) {
     /* I initiated this connection. */