[tor-bugs] #22460 [Core Tor/Tor]: Received a bad CERTS cell: Link certificate does not match TLS certificate

Tor Bug Tracker & Wiki blackhole at torproject.org
Wed May 31 22:55:05 UTC 2017


#22460: Received a bad CERTS cell: Link certificate does not match TLS certificate
-------------------------------------------------+-------------------------
 Reporter:  teor                                 |          Owner:
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  High                                 |      Milestone:  Tor:
                                                 |  0.3.1.x-final
Component:  Core Tor/Tor                         |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tor-relay certs handshake ed25519    |  Actual Points:
  needs-analysis 030-backport                    |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by nickm):

 > I bet that the "The link certificate didn't match the TLS public key"
 thing is similar, but I'm not sure.

 It's similar, I think.  I believe this bug happens when we send an x.509
 cert as part of a TLS handshake, then rotate our TLS context, then send
 our certs cell from connection_or_send_certs_cell().  This timing for this
 rotation means that the link certificate in our certs cell won't match the
 one from the TLS handshake.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22460#comment:26>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online


More information about the tor-bugs mailing list