Merge branch 'maint-0.2.2_secfix' into master_secfix

Conflicts:
	src/common/tortls.c
	src/or/connection_or.c
	src/or/dirserv.c
	src/or/or.h

diff --cc src/common/tortls.c
index a8b60850b47d0c8b543c569780568ddcbbb6a5b8,352c3d6176057922ca3db6ac899103e1e950fda5..7aaa4e08941ce4e4cefc98a8ef8be732d69110a1
--- 1/src/common/tortls.c
--- 2/src/common/tortls.c
+++ b/src/common/tortls.c
@@@ -204,13 -189,14 +204,15 @@@ static X509* tor_tls_create_certificate
                                          const char *cname,
                                          const char *cname_sign,
                                          unsigned int lifetime);
 -static void tor_tls_unblock_renegotiation(tor_tls_t *tls);
 +
  static int tor_tls_context_init_one(tor_tls_context_t **ppcontext,
                                      crypto_pk_env_t *identity,
-                                     unsigned int key_lifetime);
+                                     unsigned int key_lifetime,
+                                     int is_client);
  static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity,
-                                               unsigned int key_lifetime);
+                                               unsigned int key_lifetime,
+                                               int is_client);
 +static int check_cert_lifetime_internal(const X509 *cert, int tolerance);
  
  /** Global TLS contexts. We keep them here because nobody else needs
   * to touch them. */
@@@ -1085,12 -727,13 +1091,13 @@@ tor_tls_context_init_one(tor_tls_contex
   * certificate.
   */
  static tor_tls_context_t *
- tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime)
+ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime,
+                     int is_client)
  {
 -  crypto_pk_env_t *rsa = NULL;
 +  crypto_pk_env_t *rsa = NULL, *rsa_auth = NULL;
    EVP_PKEY *pkey = NULL;
    tor_tls_context_t *result = NULL;
 -  X509 *cert = NULL, *idcert = NULL;
 +  X509 *cert = NULL, *idcert = NULL, *authcert = NULL;
    char *nickname = NULL, *nn2 = NULL;
  
    tor_tls_init();
@@@ -1106,35 -745,26 +1113,39 @@@
      goto error;
    if (crypto_pk_generate_key(rsa)<0)
      goto error;
-   /* Generate short-term RSA key for use in the in-protocol ("v3")
-    * authentication handshake. */
-   if (!(rsa_auth = crypto_new_pk_env()))
-     goto error;
-   if (crypto_pk_generate_key(rsa_auth)<0)
-     goto error;
-   /* Create a link certificate signed by identity key. */
-   cert = tor_tls_create_certificate(rsa, identity, nickname, nn2,
-                                     key_lifetime);
-   /* Create self-signed certificate for identity key. */
-   idcert = tor_tls_create_certificate(identity, identity, nn2, nn2,
-                                       IDENTITY_CERT_LIFETIME);
-   /* Create an authentication certificate signed by identity key. */
-   authcert = tor_tls_create_certificate(rsa_auth, identity, nickname, nn2,
-                                         key_lifetime);
-   if (!cert || !idcert || !authcert) {
-     log(LOG_WARN, LD_CRYPTO, "Error creating certificate");
-     goto error;
+   if (!is_client) {
 -    /* Create certificate signed by identity key. */
++    /* Generate short-term RSA key for use in the in-protocol ("v3")
++     * authentication handshake. */
++    if (!(rsa_auth = crypto_new_pk_env()))
++      goto error;
++    if (crypto_pk_generate_key(rsa_auth)<0)
++      goto error;
++    /* Create a link certificate signed by identity key. */
+     cert = tor_tls_create_certificate(rsa, identity, nickname, nn2,
+                                       key_lifetime);
+     /* Create self-signed certificate for identity key. */
+     idcert = tor_tls_create_certificate(identity, identity, nn2, nn2,
+                                         IDENTITY_CERT_LIFETIME);
 -    if (!cert || !idcert) {
++    /* Create an authentication certificate signed by identity key. */
++    authcert = tor_tls_create_certificate(rsa_auth, identity, nickname, nn2,
++                                          key_lifetime);
++    if (!cert || !idcert || !authcert) {
+       log(LOG_WARN, LD_CRYPTO, "Error creating certificate");
+       goto error;
+     }
    }
  
    result = tor_malloc_zero(sizeof(tor_tls_context_t));
    result->refcnt = 1;
-   result->my_link_cert = tor_cert_new(X509_dup(cert));
-   result->my_id_cert = tor_cert_new(X509_dup(idcert));
-   result->my_auth_cert = tor_cert_new(X509_dup(authcert));
-   if (!result->my_link_cert || !result->my_id_cert || !result->my_auth_cert)
-     goto error;
-   result->link_key = crypto_pk_dup_key(rsa);
-   result->auth_key = crypto_pk_dup_key(rsa_auth);
+   if (!is_client) {
 -    result->my_cert = X509_dup(cert);
 -    result->my_id_cert = X509_dup(idcert);
 -    result->key = crypto_pk_dup_key(rsa);
++    result->my_link_cert = tor_cert_new(X509_dup(cert));
++    result->my_id_cert = tor_cert_new(X509_dup(idcert));
++    result->my_auth_cert = tor_cert_new(X509_dup(authcert));
++    if (!result->my_link_cert || !result->my_id_cert || !result->my_auth_cert)
++      goto error;
++    result->link_key = crypto_pk_dup_key(rsa);
++    result->auth_key = crypto_pk_dup_key(rsa_auth);
+   }
  
  #ifdef EVERYONE_HAS_AES
    /* Tell OpenSSL to only use TLS1 */

diff --cc src/or/command.c
index c85b057878262c3502aec55a96e9faef260465f4,1fa8bc6a7e8b015d605afe27a32c66dd56d1383a..d35e2a9c80b7cbd82b4c8f6380a6d97bb1191e49
--- 1/src/or/command.c
--- 2/src/or/command.c
+++ b/src/or/command.c
@@@ -316,6 -232,7 +316,7 @@@ static voi
  command_process_create_cell(cell_t *cell, or_connection_t *conn)
  {
    or_circuit_t *circ;
 -  or_options_t *options = get_options();
++  const or_options_t *options = get_options();
    int id_is_high;
  
    if (we_are_hibernating()) {

diff --cc src/or/config.c
index c5322f512092f2ab4e2e5ebd673ed93aa486c98b,78e433620df13714afea07680fe7c29a717a5029..1b9f9fb475d0c86938bf906c1ac36f6592ad1039
--- 1/src/or/config.c
--- 2/src/or/config.c
+++ b/src/or/config.c
@@@ -282,9 -269,10 +282,11 @@@ static config_var_t _option_vars[] = 
    V(GeoIPFile,                   FILENAME,
      SHARE_DATADIR PATH_SEPARATOR "tor" PATH_SEPARATOR "geoip"),
  #endif
+   V(GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays,
+                                  BOOL,     "0"),
    OBSOLETE("Group"),
    V(HardwareAccel,               BOOL,     "0"),
 +  V(HeartbeatPeriod,             INTERVAL, "6 hours"),
    V(AccelName,                   STRING,   NULL),
    V(AccelDir,                    FILENAME, NULL),
    V(HashedControlPassword,       LINELIST, NULL),

diff --cc src/or/connection_or.c
index 14da69851eaa29cec8e5c598e98bc989f6db23dc,27a34d3d15003481959207a78aa793e2a762b804..4c0960ceca73fb2cdf8970d5658825a0b66966f5
--- 1/src/or/connection_or.c
--- 2/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@@ -1031,20 -813,21 +1036,22 @@@ connection_or_connect(const tor_addr_t 
    conn->_base.state = OR_CONN_STATE_CONNECTING;
    control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0);
  
 -  /* use a proxy server if available */
 -  if (options->HTTPSProxy) {
 -    using_proxy = 1;
 -    tor_addr_copy(&addr, &options->HTTPSProxyAddr);
 -    port = options->HTTPSProxyPort;
 -  } else if (options->Socks4Proxy) {
 -    using_proxy = 1;
 -    tor_addr_copy(&addr, &options->Socks4ProxyAddr);
 -    port = options->Socks4ProxyPort;
 -  } else if (options->Socks5Proxy) {
 -    using_proxy = 1;
 -    tor_addr_copy(&addr, &options->Socks5ProxyAddr);
 -    port = options->Socks5ProxyPort;
+   conn->is_outgoing = 1;
+ 
 +  /* If we are using a proxy server, find it and use it. */
 +  r = get_proxy_addrport(&proxy_addr, &proxy_port, &proxy_type, TO_CONN(conn));
 +  if (r == 0) {
 +    conn->proxy_type = proxy_type;
 +    if (proxy_type != PROXY_NONE) {
 +      tor_addr_copy(&addr, &proxy_addr);
 +      port = proxy_port;
 +      conn->_base.proxy_state = PROXY_INFANT;
 +    }
 +  } else {
 +    log_warn(LD_GENERAL, "Tried to connect through proxy, but proxy address "
 +             "could not be found.");
 +    connection_free(TO_CONN(conn));
 +    return NULL;
    }
  
    switch (connection_connect(TO_CONN(conn), conn->_base.address,

diff --cc src/or/dirserv.c
index 5cb4aba5aa4aebcd0ee2c9c7d43e9b0889726f68,c427fe2ef36097064c86d1c4da45c66d60eb3a0c..288fca99b8d5af336acc46d3d824c60b82338f1e
--- 1/src/or/dirserv.c
--- 2/src/or/dirserv.c
+++ b/src/or/dirserv.c
@@@ -2333,9 -2363,13 +2402,13 @@@ set_routerstatus_from_routerinfo(router
        (router_get_advertised_bandwidth(ri) >= BANDWIDTH_TO_GUARANTEE_GUARD ||
         router_get_advertised_bandwidth(ri) >=
                                MIN(guard_bandwidth_including_exits,
-                                   guard_bandwidth_excluding_exits))) {
-     long tk = rep_hist_get_weighted_time_known(node->identity, now);
-     double wfu = rep_hist_get_weighted_fractional_uptime(node->identity, now);
+                                   guard_bandwidth_excluding_exits)) &&
+       (options->GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays ||
+        is_router_version_good_for_possible_guard(ri->platform))) {
+     long tk = rep_hist_get_weighted_time_known(
 -                                      ri->cache_info.identity_digest, now);
++                                      node->identity, now);
+     double wfu = rep_hist_get_weighted_fractional_uptime(
 -                                      ri->cache_info.identity_digest, now);
++                                      node->identity, now);
      rs->is_possible_guard = (wfu >= guard_wfu && tk >= guard_tk) ? 1 : 0;
    } else {
      rs->is_possible_guard = 0;

diff --cc src/or/or.h
index 7a901e7ae201929b9f677e432eac42a42e4d2ba3,7d50e1f5054409b651c38ea3b610e0cef9c0fc04..e4f9b9b2b6f38ca59508452cd9af9aea50e4795c
--- 1/src/or/or.h
--- 2/src/or/or.h
+++ b/src/or/or.h
@@@ -1220,7 -1068,12 +1220,13 @@@ typedef struct or_connection_t 
     * router itself has a problem.
     */
    unsigned int is_bad_for_new_circs:1;
+   /** True iff we have decided that the other end of this connection
+    * is a client.  Connections with this flag set should never be used
+    * to satisfy an EXTEND request.  */
+   unsigned int is_connection_with_client:1;
+   /** True iff this is an outgoing connection. */
+   unsigned int is_outgoing:1;
 +  unsigned int proxy_type:2; /**< One of PROXY_NONE...PROXY_SOCKS5 */
    uint8_t link_proto; /**< What protocol version are we using? 0 for
                         * "none negotiated yet." */
    circid_t next_circ_id; /**< Which circ_id do we try to use next on

diff --cc src/or/routerparse.c
Simple merge