[tor-bugs] #22460 [Core Tor/Tor]: Received a bad CERTS cell: Link certificate does not match TLS certificate

[Tor Bug Tracker & Wiki]

#22460: Received a bad CERTS cell: Link certificate does not match TLS certificate
-------------------------------------------------+-------------------------
 Reporter:  teor                                 |          Owner:
     Type:  defect                               |         Status:  new
 Priority:  High                                 |      Milestone:  Tor:
                                                 |  0.3.1.x-final
Component:  Core Tor/Tor                         |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tor-relay certs handshake ed25519    |  Actual Points:
  needs-analysis                                 |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by dgoulet):

 * keywords:  tor-relay certs handshake ed25519 needs-analysis 030-backport
     => tor-relay certs handshake ed25519 needs-analysis


Comment:

 Another data point. For every `[info] or_handshake_certs_ed25519_ok():
 Received a bad CERTS cell: At least one Ed25519 certificate was badly
 signe`, I get this two lines above:

 `[info] channel_register(): Channel 0x616000030680 (global ID 30923) in
 state opening (1) registered with no identity digest`

 As far as I can tell on my testnet dirauth, this *only* happens with >=
 030. I also see that weirdly only with unstable relays. For instance (IP
 removed because from testnet):

 {{{
 May 29 23:27:08.000 [info] channel_tls_process_versions_cell(): Negotiated
 version 4 with <IP>:80; Sending cells: CERTS
 May 29 23:27:08.000 [warn] Received a bad CERTS cell: At least one Ed25519
 certificate was badly signed
 May 29 23:27:08.000 [info] channel_tls_process_certs_cell(): Received a
 bad CERTS cell from <IP>:80: Invalid certificate chain!
 May 29 23:27:08.000 [info] conn_close_if_marked(): Conn (addr "<IP>", fd
 21, type OR, state 7) marked, but wants to flush 1334 bytes. (Marked at
 src/or/connection_or.c:1319)
 May 29 23:27:08.000 [info] conn_close_if_marked(): We stalled too much
 while trying to write 1334 bytes to address "<IP>".  If this happens a
 lot, either something is wrong with your network connection, or something
 is wrong with theirs. (fd 21, type OR, state 7, marked at
 src/or/connection_or.c:1319).
 May 29 23:27:08.000 [info] connection_or_note_state_when_broken():
 Connection died in state 'handshaking (Tor, v3 handshake) with SSL state
 SSL negotiation finished successfully in OPEN'
 May 29 23:27:08.000 [info] connection_handle_write_impl(): in-progress
 connect failed. Removing. (Connection timed out)
 May 29 23:27:08.000 [info] connection_close_immediate(): fd 24, type
 Directory, state connecting, 1370 bytes on outbuf.
 May 29 23:27:08.000 [info] connection_handle_write_impl(): in-progress
 connect failed. Removing. (Connection timed out)
 May 29 23:27:08.000 [info] connection_close_immediate(): fd 22, type
 Directory, state connecting, 1373 bytes on outbuf.
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22460#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online