October 2011 - tor-commits - lists.torproject.org

[tor/master] Properly refcount client_identity_key
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 3a890b3b70d53ac864be682f50f07ba07b8f09ba Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Oct 26 18:22:04 2010 +0200 Properly refcount client_identity_key In a2bb0bf we started using a separate client identity key. When we are in "public server mode" (that means not a bridge) we will use the same key. Reusing the key without doing the proper refcounting leads to a segfault on cleanup during shutdown. Fix that. Also introduce an assert that triggers if our refcount falls below 0. That should never happen. --- src/common/crypto.c | 1 + src/or/router.c | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index c723c33..a444cf1 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -326,6 +326,7 @@ crypto_free_pk_env(crypto_pk_env_t *env) if (--env->refs > 0) return; + tor_assert(env->refs == 0); if (env->key) RSA_free(env->key); diff --git a/src/or/router.c b/src/or/router.c index 96aca88..c471599 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -559,7 +559,7 @@ init_keys(void) * otherwise, set the server identity key as our client identity * key. */ if (public_server_mode(options)) { - set_client_identity_key(prkey); /* set above */ + set_client_identity_key(crypto_pk_dup_key(prkey)); /* set above */ } else { if (!(prkey = crypto_new_pk_env())) return -1;

1 0

[tor/master] Rename get_client_identity_key to get_tlsclient_identity_key
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 2a2301e41117ad8439dbe8039085202fa0d6f6ed Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 21 13:53:31 2010 -0400 Rename get_client_identity_key to get_tlsclient_identity_key --- src/or/connection_or.c | 2 +- src/or/main.c | 2 +- src/or/or.h | 2 +- src/or/router.c | 10 +++++----- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 7817db8..95cc02e 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -962,7 +962,7 @@ connection_or_check_valid_tls_handshake(or_connection_t *conn, started_here ? conn->_base.address : safe_str(conn->_base.address); const char *conn_type = started_here ? "outgoing" : "incoming"; crypto_pk_env_t *our_identity = - started_here ? get_client_identity_key() : + started_here ? get_tlsclient_identity_key() : get_server_identity_key(); int has_cert = 0, has_identity=0; diff --git a/src/or/main.c b/src/or/main.c index 466801c..ba704f5 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -874,7 +874,7 @@ run_scheduled_events(time_t now) if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME_INTERNAL < now) { log_info(LD_GENERAL,"Rotating tls context."); if (tor_tls_context_init(public_server_mode(options), - get_client_identity_key(), + get_tlsclient_identity_key(), is_server ? get_server_identity_key() : NULL, MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_warn(LD_BUG, "Error reinitializing TLS context"); diff --git a/src/or/or.h b/src/or/or.h index a594d6f..4105ff4 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4207,7 +4207,7 @@ crypto_pk_env_t *get_onion_key(void); time_t get_onion_key_set_at(void); void set_client_identity_key(crypto_pk_env_t *k); void set_server_identity_key(crypto_pk_env_t *k); -crypto_pk_env_t *get_client_identity_key(void); +crypto_pk_env_t *get_tlsclient_identity_key(void); crypto_pk_env_t *get_server_identity_key(void); int client_identity_key_is_set(void); int server_identity_key_is_set(void); diff --git a/src/or/router.c b/src/or/router.c index c53bb8b..f7a50ae 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -148,11 +148,11 @@ set_client_identity_key(crypto_pk_env_t *k) client_identitykey = k; } -/** Returns the current client identity key; requires that the key has - * been set. +/** Returns the current client identity key for use on outgoing TLS + * connections; requires that the key has been set. */ crypto_pk_env_t * -get_client_identity_key(void) +get_tlsclient_identity_key(void) { tor_assert(client_identitykey); return client_identitykey; @@ -490,7 +490,7 @@ init_keys(void) set_client_identity_key(prkey); /* Create a TLS context. */ if (tor_tls_context_init(0, - get_client_identity_key(), + get_tlsclient_identity_key(), NULL, MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error creating TLS context for Tor client."); @@ -586,7 +586,7 @@ init_keys(void) /* 3. Initialize link key and TLS context. */ if (tor_tls_context_init(public_server_mode(options), - get_client_identity_key(), + get_tlsclient_identity_key(), get_server_identity_key(), MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error initializing TLS context");

1 0

[tor/master] Reinit keys at the start of options_act().
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 55d9e4b8bad18a99d51b0b6347cef46e730dceda Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 23 16:38:35 2011 -0400 Reinit keys at the start of options_act(). Previously we did this nearer to the end (in the old_options && transition_affects_workers() block). But other stuff cares about keys being consistent with options... particularly anything which tries to access a key, which can die in assert_identity_keys_ok(). Fixes bug 3228; bugfix on 0.2.2.18-alpha. Conflicts: src/or/config.c --- changes/bug3228 | 3 +++ src/or/config.c | 23 +++++++++++++++-------- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/changes/bug3228 b/changes/bug3228 new file mode 100644 index 0000000..4aca810 --- /dev/null +++ b/changes/bug3228 @@ -0,0 +1,3 @@ + o Major bugfixes: + - Resolve a crash that occured when setting BridgeRelay to 1 with + accounting enabled. Fixes bug 3228; bugfix on 0.2.2.18-alpha. diff --git a/src/or/config.c b/src/or/config.c index 7d7f2c3..ea389ff 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1269,12 +1269,26 @@ options_act(or_options_t *old_options) or_options_t *options = get_options(); int running_tor = options->command == CMD_RUN_TOR; char *msg; + const int transition_affects_workers = + old_options && options_transition_affects_workers(old_options, options); if (running_tor && !have_lockfile()) { if (try_locking(options, 1) < 0) return -1; } + /* We want to reinit keys as needed before we do much of anything else: + keys are important, and other things can depend on them. */ + if (running_tor && + (transition_affects_workers || + (options->V3AuthoritativeDir && (!old_options || + !old_options->V3AuthoritativeDir)))) { + if (init_keys() < 0) { + log_warn(LD_BUG,"Error initializing keys; exiting"); + return -1; + } + } + if (consider_adding_dir_authorities(options, old_options) < 0) return -1; @@ -1368,14 +1382,10 @@ options_act(or_options_t *old_options) geoip_remove_old_clients(time(NULL)+(2*60*60)); } - if (options_transition_affects_workers(old_options, options)) { + if (transition_affects_workers) { log_info(LD_GENERAL, "Worker-related options changed. Rotating workers."); - if (init_keys() < 0) { - log_warn(LD_BUG,"Error initializing keys; exiting"); - return -1; - } if (server_mode(options) && !server_mode(old_options)) { ip_address_changed(0); if (has_completed_circuit || !any_predicted_circuits(time(NULL))) @@ -1388,9 +1398,6 @@ options_act(or_options_t *old_options) if (dns_reset()) return -1; } - - if (options->V3AuthoritativeDir && !old_options->V3AuthoritativeDir) - init_keys(); } /* Maybe load geoip file */

1 0

[tor/master] Fix assert for relay/bridge state change
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 908289894419b8fa331197948cb048f08ff5d035 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 25 15:28:58 2011 +0100 Fix assert for relay/bridge state change When we added support for separate client tls certs on bridges in a2bb0bfdd5 we forgot to correctly initialize this when changing from relay to bridge or vice versa while Tor is running. Fix that by always initializing keys when the state changes. Fixes bug 2433. Conflicts: src/or/config.c --- changes/bug2433 | 5 +++++ src/or/config.c | 10 ++++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/changes/bug2433 b/changes/bug2433 new file mode 100644 index 0000000..8e47c4f --- /dev/null +++ b/changes/bug2433 @@ -0,0 +1,5 @@ + o Major bugfixes: + - Don't assert when changing from bridge to relay or vice versa with a controller. + The assert happened because we didn't properly initialize our keys in this case. + Bugfix on 0.2.2.18, fixes bug 2433. Issue first discovered by bastik. + diff --git a/src/or/config.c b/src/or/config.c index fbfa771..7d7f2c3 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1371,11 +1371,12 @@ options_act(or_options_t *old_options) if (options_transition_affects_workers(old_options, options)) { log_info(LD_GENERAL, "Worker-related options changed. Rotating workers."); + + if (init_keys() < 0) { + log_warn(LD_BUG,"Error initializing keys; exiting"); + return -1; + } if (server_mode(options) && !server_mode(old_options)) { - if (init_keys() < 0) { - log_warn(LD_BUG,"Error initializing keys; exiting"); - return -1; - } ip_address_changed(0); if (has_completed_circuit || !any_predicted_circuits(time(NULL))) inform_testing_reachability(); @@ -3763,6 +3764,7 @@ options_transition_affects_workers(or_options_t *old_options, new_options->ServerDNSSearchDomains || old_options->SafeLogging != new_options->SafeLogging || old_options->ClientOnly != new_options->ClientOnly || + public_server_mode(old_options) != public_server_mode(new_options) || !config_lines_eq(old_options->Logs, new_options->Logs)) return 1;

1 0

[tor/master] Don't crash a bridge authority on SIGHUP if it's not in the consensus
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 62c29a93ba78ad6ae91b87755ed8cc0283d27e56 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Wed Feb 16 04:12:37 2011 -0800 Don't crash a bridge authority on SIGHUP if it's not in the consensus Fixes bug 2572. --- changes/bug2572 | 5 +++++ src/or/router.c | 2 +- 2 files changed, 6 insertions(+), 1 deletions(-) diff --git a/changes/bug2572 b/changes/bug2572 new file mode 100644 index 0000000..a5cca28 --- /dev/null +++ b/changes/bug2572 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Don't crash a bridge authority on SIGHUP if it can't force itself + into its routerlist. Fixes bug 2572. + + diff --git a/src/or/router.c b/src/or/router.c index c471599..7354267 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -615,7 +615,7 @@ init_keys(void) /* 4. Build our router descriptor. */ /* Must be called after keys are initialized. */ mydesc = router_get_my_descriptor(); - if (authdir_mode(options)) { + if (authdir_mode_handles_descs(options, ROUTER_PURPOSE_GENERAL)) { const char *m = NULL; routerinfo_t *ri; /* We need to add our own fingerprint so it gets recognized. */

1 0

[tor/master] stop asserting at boot
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit cecc5b7aa1030eddcf1a613d103b81f5cb98e959 Author: Roger Dingledine <arma(a)torproject.org> Date: Mon May 30 23:50:37 2011 -0400 stop asserting at boot The patch for 3228 made us try to run init_keys() before we had loaded our state file, resulting in an assert inside init_keys. We had moved it too early in the function. Now it's later in the function, but still above the accounting calls. --- src/or/config.c | 23 +++++++++++------------ 1 files changed, 11 insertions(+), 12 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index ea389ff..16b5e9c 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1277,18 +1277,6 @@ options_act(or_options_t *old_options) return -1; } - /* We want to reinit keys as needed before we do much of anything else: - keys are important, and other things can depend on them. */ - if (running_tor && - (transition_affects_workers || - (options->V3AuthoritativeDir && (!old_options || - !old_options->V3AuthoritativeDir)))) { - if (init_keys() < 0) { - log_warn(LD_BUG,"Error initializing keys; exiting"); - return -1; - } - } - if (consider_adding_dir_authorities(options, old_options) < 0) return -1; @@ -1333,6 +1321,17 @@ options_act(or_options_t *old_options) finish_daemon(options->DataDirectory); } + /* We want to reinit keys as needed before we do much of anything else: + keys are important, and other things can depend on them. */ + if (transition_affects_workers || + (options->V3AuthoritativeDir && (!old_options || + !old_options->V3AuthoritativeDir))) { + if (init_keys() < 0) { + log_warn(LD_BUG,"Error initializing keys; exiting"); + return -1; + } + } + /* Write our PID to the PID file. If we do not have write permissions we * will log a warning */ if (running_tor && options->PidFile)

1 0

[tor/master] Merge branch 'maint-0.2.1' into maint-0.2.2
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 41d9d3f90437ae9dbde1590faf0ffc412c68df19 Merge: 4a1a89b cecc5b7 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Oct 26 16:34:45 2011 -0400 Merge branch 'maint-0.2.1' into maint-0.2.2

1 0

[tor/master] Merge branch 'maint-0.2.2'
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 9625a2e8f5070198f58b3c343e65a3ac99765ede Merge: c21c8da 41d9d3f Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Oct 26 16:36:59 2011 -0400 Merge branch 'maint-0.2.2'

1 0

[tor/master] Add public_server_mode function.
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 07ab559a8e9932fbed1e00e3210a1bb855cf1508 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Fri Oct 1 00:07:10 2010 -0700 Add public_server_mode function. --- src/or/or.h | 1 + src/or/router.c | 9 +++++++++ 2 files changed, 10 insertions(+), 0 deletions(-) diff --git a/src/or/or.h b/src/or/or.h index 0f5b2bb..f405113 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4239,6 +4239,7 @@ int authdir_mode_tests_reachability(or_options_t *options); int authdir_mode_bridge(or_options_t *options); int server_mode(or_options_t *options); +int public_server_mode(or_options_t *options); int advertised_server_mode(void); int proxy_mode(or_options_t *options); void consider_publishable_server(int force); diff --git a/src/or/router.c b/src/or/router.c index 2afde74..45eeca0 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -954,6 +954,15 @@ server_mode(or_options_t *options) return (options->ORPort != 0 || options->ORListenAddress); } +/** Return true iff we are trying to be a non-bridge server. + */ +int +public_server_mode(or_options_t *options) +{ + if (!server_mode(options)) return 0; + return (!options->BridgeRelay); +} + /** Remember if we've advertised ourselves to the dirservers. */ static int server_is_advertised=0;

1 0

[tor/master] Maintain separate server and client TLS contexts.
by arma＠torproject.org 26 Oct '11

26 Oct '11

commit 9976df9e5619b89339390c322138f7228b8fa715 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 3 18:14:08 2010 -0700 Maintain separate server and client TLS contexts. Fixes bug #988. Conflicts: src/or/main.c src/or/router.c --- src/common/tortls.c | 101 +++++++++++++++++++++++++++++++++++++++++++-------- src/common/tortls.h | 4 ++- src/or/main.c | 10 ++++-- src/or/router.c | 13 +++++-- 4 files changed, 105 insertions(+), 23 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index d3435e7..c78a9ec 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -184,12 +184,16 @@ static X509* tor_tls_create_certificate(crypto_pk_env_t *rsa, const char *cname_sign, unsigned int lifetime); static void tor_tls_unblock_renegotiation(tor_tls_t *tls); +static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, + crypto_pk_env_t *identity, + unsigned int key_lifetime); static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime); -/** Global tls context. We keep it here because nobody else needs to - * touch it. */ -static tor_tls_context_t *global_tls_context = NULL; +/** Global TLS contexts. We keep them here because nobody else needs + * to touch them. */ +static tor_tls_context_t *server_tls_context = NULL; +static tor_tls_context_t *client_tls_context = NULL; /** True iff tor_tls_init() has been called. */ static int tls_library_is_initialized = 0; @@ -402,9 +406,15 @@ tor_tls_init(void) void tor_tls_free_all(void) { - if (global_tls_context) { - tor_tls_context_decref(global_tls_context); - global_tls_context = NULL; + if (server_tls_context) { + tor_tls_context_t *ctx = server_tls_context; + server_tls_context = NULL; + tor_tls_context_decref(ctx); + } + if (client_tls_context) { + tor_tls_context_t *ctx = client_tls_context; + client_tls_context = NULL; + tor_tls_context_decref(ctx); } if (!HT_EMPTY(&tlsmap_root)) { log_warn(LD_MM, "Still have entries in the tlsmap at shutdown."); @@ -591,6 +601,63 @@ tor_tls_context_incref(tor_tls_context_t *ctx) ++ctx->refcnt; } +/** Create new global client and server TLS contexts. + * + * If server_identity is NULL, this will not generate a server + * TLS context. If is_public_server is non-zero, this will use + * the same TLS context for incoming and outgoing connections, and + * ignore client_identity. */ +int +tor_tls_context_init(int is_public_server, + crypto_pk_env_t *client_identity, + crypto_pk_env_t *server_identity, + unsigned int key_lifetime) +{ + int rv1 = 0; + int rv2 = 0; + + if (is_public_server) { + tor_tls_context_t *new_ctx; + tor_tls_context_t *old_ctx; + + tor_assert(server_identity != NULL); + + rv1 = tor_tls_context_init_one(&server_tls_context, + server_identity, + key_lifetime); + + if (rv1 >= 0) { + new_ctx = server_tls_context; + tor_tls_context_incref(new_ctx); + old_ctx = client_tls_context; + client_tls_context = new_ctx; + + if (old_ctx != NULL) { + tor_tls_context_decref(old_ctx); + } + } + } else { + if (server_identity != NULL) { + rv1 = tor_tls_context_init_one(&server_tls_context, + server_identity, + key_lifetime); + } else { + tor_tls_context_t *old_ctx = server_tls_context; + server_tls_context = NULL; + + if (old_ctx != NULL) { + tor_tls_context_decref(old_ctx); + } + } + + rv2 = tor_tls_context_init_one(&client_tls_context, + client_identity, + key_lifetime); + } + + return rv1 < rv2 ? rv1 : rv2; +} + /** Create a new TLS context for use with Tor TLS handshakes. * identity should be set to the identity key used to sign the * certificate. @@ -599,15 +666,17 @@ tor_tls_context_incref(tor_tls_context_t *ctx) * it generates new certificates; all new connections will use * the new SSL context. */ -int -tor_tls_context_init(crypto_pk_env_t *identity, unsigned int key_lifetime) +static int +tor_tls_context_init_one(tor_tls_context_t **ppcontext, + crypto_pk_env_t *identity, + unsigned int key_lifetime) { tor_tls_context_t *new_ctx = tor_tls_context_new(identity, key_lifetime); - tor_tls_context_t *old_ctx = global_tls_context; + tor_tls_context_t *old_ctx = *ppcontext; if (new_ctx != NULL) { - global_tls_context = new_ctx; + *ppcontext = new_ctx; /* Free the old context if one existed. */ if (old_ctx != NULL) { @@ -920,10 +989,12 @@ tor_tls_new(int sock, int isServer) { BIO *bio = NULL; tor_tls_t *result = tor_malloc_zero(sizeof(tor_tls_t)); + tor_tls_context_t *context = isServer ? server_tls_context : + client_tls_context; - tor_assert(global_tls_context); /* make sure somebody made it first */ - if (!(result->ssl = SSL_new(global_tls_context->ctx))) { - tls_log_errors(NULL, LOG_WARN, "generating TLS context"); + tor_assert(context); /* make sure somebody made it first */ + if (!(result->ssl = SSL_new(context->ctx))) { + tls_log_errors(NULL, LOG_WARN, "creating SSL object"); tor_free(result); return NULL; } @@ -962,8 +1033,8 @@ tor_tls_new(int sock, int isServer) } HT_INSERT(tlsmap, &tlsmap_root, result); SSL_set_bio(result->ssl, bio, bio); - tor_tls_context_incref(global_tls_context); - result->context = global_tls_context; + tor_tls_context_incref(context); + result->context = context; result->state = TOR_TLS_ST_HANDSHAKE; result->isServer = isServer; result->wantwrite_n = 0; diff --git a/src/common/tortls.h b/src/common/tortls.h index 3f80d99..55fee81 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -50,7 +50,9 @@ typedef struct tor_tls_t tor_tls_t; const char *tor_tls_err_to_string(int err); void tor_tls_free_all(void); -int tor_tls_context_init(crypto_pk_env_t *identity, +int tor_tls_context_init(int is_public_server, + crypto_pk_env_t *client_identity, + crypto_pk_env_t *server_identity, unsigned int key_lifetime); tor_tls_t *tor_tls_new(int sock, int is_server); void tor_tls_set_logged_address(tor_tls_t *tls, const char *address); diff --git a/src/or/main.c b/src/or/main.c index fe1f42e..00fce80 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -816,6 +816,7 @@ run_scheduled_events(time_t now) static time_t time_to_dump_geoip_stats = 0; static time_t time_to_retry_dns_init = 0; or_options_t *options = get_options(); + int is_server = server_mode(options); int i; int have_dir_info; @@ -837,7 +838,7 @@ run_scheduled_events(time_t now) * shut down and restart all cpuworkers, and update the directory if * necessary. */ - if (server_mode(options) && + if (is_server && get_onion_key_set_at()+MIN_ONION_KEY_LIFETIME < now) { log_info(LD_GENERAL,"Rotating onion key."); rotate_onion_key(); @@ -872,7 +873,10 @@ run_scheduled_events(time_t now) last_rotated_x509_certificate = now; if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME_INTERNAL < now) { log_info(LD_GENERAL,"Rotating tls context."); - if (tor_tls_context_init(get_identity_key(), MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + if (tor_tls_context_init(public_server_mode(options), + get_identity_key(), + is_server ? get_identity_key() : NULL, + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_warn(LD_BUG, "Error reinitializing TLS context"); /* XXX is it a bug here, that we just keep going? -RD */ } @@ -1110,7 +1114,7 @@ run_scheduled_events(time_t now) /** 9. and if we're a server, check whether our DNS is telling stories to * us. */ - if (server_mode(options) && time_to_check_for_correct_dns < now) { + if (is_server && time_to_check_for_correct_dns < now) { if (!time_to_check_for_correct_dns) { time_to_check_for_correct_dns = now + 60 + crypto_rand_int(120); } else { diff --git a/src/or/router.c b/src/or/router.c index 9afa983..dce2ad6 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -457,8 +457,11 @@ init_keys(void) return -1; } set_identity_key(prkey); - /* Create a TLS context; default the client nickname to "client". */ - if (tor_tls_context_init(get_identity_key(), MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + /* Create a TLS context. */ + if (tor_tls_context_init(0, + get_identity_key(), + NULL, + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error creating TLS context for Tor client."); return -1; } @@ -536,8 +539,10 @@ init_keys(void) tor_free(keydir); /* 3. Initialize link key and TLS context. */ - if (tor_tls_context_init(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + if (tor_tls_context_init(public_server_mode(options), + get_identity_key(), + get_identity_key(), + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error initializing TLS context"); return -1; }

1 0