1 files changed, 30 insertions, 12 deletions

diff --git a/src/or/command.c b/src/or/command.c
index e68b6bfc6a..023f2bead5 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -985,15 +985,24 @@ command_process_certs_cell(var_cell_t *cell, or_connection_t *conn)
   }
 
   if (conn->handshake_state->started_here) {
+    int severity;
     if (! (id_cert && link_cert))
       ERR("The certs we wanted were missing");
     /* Okay. We should be able to check the certificates now. */
     if (! tor_tls_cert_matches_key(conn->tls, link_cert)) {
       ERR("The link certificate didn't match the TLS public key");
     }
-    if (! tor_tls_cert_is_valid(link_cert, id_cert, 0))
+    /* Note that this warns more loudly about time and validity if we were
+    * _trying_ to connect to an authority, not necessarily if we _did_ connect
+    * to one. */
+    if (router_digest_is_trusted_dir(conn->identity_digest))
+      severity = LOG_WARN;
+    else
+      severity = LOG_PROTOCOL_WARN;
+
+    if (! tor_tls_cert_is_valid(severity, link_cert, id_cert, 0))
       ERR("The link certificate was not valid");
-    if (! tor_tls_cert_is_valid(id_cert, id_cert, 1))
+    if (! tor_tls_cert_is_valid(severity, id_cert, id_cert, 1))
       ERR("The ID certificate was not valid");
 
     conn->handshake_state->authenticated = 1;
@@ -1026,9 +1035,9 @@ command_process_certs_cell(var_cell_t *cell, or_connection_t *conn)
       ERR("The certs we wanted were missing");
 
     /* Remember these certificates so we can check an AUTHENTICATE cell */
-    if (! tor_tls_cert_is_valid(auth_cert, id_cert, 1))
+    if (! tor_tls_cert_is_valid(LOG_PROTOCOL_WARN, auth_cert, id_cert, 1))
       ERR("The authentication certificate was not valid");
-    if (! tor_tls_cert_is_valid(id_cert, id_cert, 1))
+    if (! tor_tls_cert_is_valid(LOG_PROTOCOL_WARN, id_cert, id_cert, 1))
       ERR("The ID certificate was not valid");
 
     log_info(LD_OR, "Got some good certificates from %s:%d: "
@@ -1100,7 +1109,14 @@ command_process_auth_challenge_cell(var_cell_t *cell, or_connection_t *conn)
 
   conn->handshake_state->received_auth_challenge = 1;
 
-  if (use_type && public_server_mode(get_options())) {
+  if (! public_server_mode(get_options())) {
+    /* If we're not a public server then we don't want to authenticate on a
+       connection we originated, and we already sent a NETINFO cell when we
+       got the CERTS cell. We have nothing more to do. */
+    return;
+  }
+
+  if (use_type >= 0) {
     log_info(LD_OR, "Got an AUTH_CHALLENGE cell from %s:%d: Sending "
              "authentication",
              safe_str(conn->_base.address), conn->_base.port);
@@ -1110,16 +1126,18 @@ command_process_auth_challenge_cell(var_cell_t *cell, or_connection_t *conn)
       connection_mark_for_close(TO_CONN(conn));
       return;
     }
-    if (connection_or_send_netinfo(conn) < 0) {
-      log_warn(LD_OR, "Couldn't send netinfo cell");
-      connection_mark_for_close(TO_CONN(conn));
-      return;
-    }
   } else {
-    log_info(LD_OR, "Got an AUTH_CHALLENGE cell from %s:%d: Not "
-             "authenticating",
+    log_info(LD_OR, "Got an AUTH_CHALLENGE cell from %s:%d, but we don't "
+             "know any of its authentication types. Not authenticating.",
              safe_str(conn->_base.address), conn->_base.port);
   }
+
+  if (connection_or_send_netinfo(conn) < 0) {
+    log_warn(LD_OR, "Couldn't send netinfo cell");
+    connection_mark_for_close(TO_CONN(conn));
+    return;
+  }
+
 #undef ERR
 }