Verify that router fingerprint lines match identity keys. (We dont use them, but others might.)

svn:r5389

1 files changed, 20 insertions, 1 deletions

diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 89a374e24a..d7c5c02486 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -135,7 +135,7 @@ static struct {
   { "dir-signing-key",     K_DIR_SIGNING_KEY,     ARGS,    OBJ_OK,
                                                                 DIR|NETSTATUS},
   { "family",              K_FAMILY,              ARGS,    NO_OBJ,  RTR },
-  { "fingerprint",         K_FINGERPRINT,         ARGS,    NO_OBJ, ANYSIGNED },
+  { "fingerprint",         K_FINGERPRINT,     CONCAT_ARGS, NO_OBJ, ANYSIGNED },
   { "hibernating",         K_HIBERNATING,         ARGS,    NO_OBJ,  RTR },
   { "read-history",        K_READ_HISTORY,        ARGS,    NO_OBJ,  RTR },
   { "write-history",       K_WRITE_HISTORY,       ARGS,    NO_OBJ,  RTR },
@@ -851,6 +851,25 @@ router_parse_entry_from_string(const char *s, const char *end)
     warn(LD_DIR, "Couldn't calculate key digest"); goto err;
   }
 
+  if ((tok = find_first_by_keyword(tokens, K_FINGERPRINT))) {
+    /* If there's a fingerprint line, it must match the identity digest. */
+    char d[DIGEST_LEN];
+    if (tok->n_args < 1) {
+      warn(LD_DIR, "Too few arguments to fingerprint");
+      goto err;
+    }
+    tor_strstrip(tok->args[0], " ");
+    if (base16_decode(d, DIGEST_LEN, tok->args[0], strlen(tok->args[0]))) {
+      warn(LD_DIR, "Couldn't decode fingerprint '%s'", tok->args[0]);
+      goto err;
+    }
+    if (memcmp(d,router->cache_info.identity_digest, DIGEST_LEN)!=0) {
+      warn(LD_DIR, "Fingerprint '%s' does not match identity digest.",
+           tok->args[0]);
+      goto err;
+    }
+  }
+
   if ((tok = find_first_by_keyword(tokens, K_PLATFORM))) {
     router->platform = tor_strdup(tok->args[0]);
   }