mirrors/arti.git/crates/arti-relay/src, branch arti-v2.5.0

arti-relay: Link IncomingStreamRequestFilter in RequestFilter

2026-06-29T13:52:57Z

Suggested by opara in https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/4145#note_3430815

proto: Pass an IncomingStreamRequestFilter factory to the create handler

2026-06-29T13:52:56Z

This implements what we discussed in `doc/dev/notes/relay-streams.md` (lines 218-234): > Currently, to allow incoming stream requests on a circuit, > you first need to call `RelayCirc::allow_stream_requests()` > to install a `CmdChecker` and `IncomingStreamRequestFilter`. > This is not ideal, because `allow_stream_requests()` will need to be > called unconditionally, on each `RelayCirc`, > right after it's created in the `CreateHandler` impl > (which in turn, would mean making `handle_create()` async too, > because `allow_stream_requests()` is async, which wouldn't be great). > > So, the first step here is to rework the `RelayCirc` API to make relay circuits > be constructable with a list of allowed `RelayCmd`s and `IncomingStreamRequestFilter` > from the get-go ([#2582]), and to get rid of `allow_stream_requests()`, > which will enable the `CREATE*` handler to remain non-`async`. > > In any case, the `CREATE*` handler will still require some changes, > because it needs to be initialized with an `IncomingStreamRequestFilter`, I am not sure using an `IncomingStreamRequestFilter` "factory" is necessarily the right approach here, but the circuit `Reactor`'s constructor needs to take an `IncomingStreamRequestFilter`, and `IncomingStreamRequestFilter` is not `Clone` (and FWIW, I think it's better if we don't make it `Clone`). One obvious limitation is that the `IncomingStreamRequestFilter` of the circuit reactor is fixed for the entire lifetime of the circuit. In practice, I don't think this is going to be a problem, because the arti-relay `IncomingStreamRequestFilter` is only going be used for * preventing single-hop exit streams * per-circuit rate-limiting. Both of these checks will require the filter to have access to a recent `NetDir`, which is straightforward if the filter has an Arc (as mentioned in doc/dev/notes/relay-streams.md, `NetDirProvider` has a handy non-async `timely_netdir()` function we can use). And since these checks are based on consensus params, we don't really need to ever update an already-built circuit with a new `IncomingStreamRequestFilter` (because all `IncomingStreamRequestFilter` will have the ability to obtain a fresh `NetDir` as needed). Nevertheless, I left a TODO about this, because I expect this type to change once we figure out all the other pieces needed for #1448.

arti-relay: Add an unimplemented stream request filter

2026-06-29T13:50:49Z

This is currently just a placeholder that accepts all stream requests. It will be fleshed out later, as part of #1448

maint: Run maint/add_warning to deny string slices

2026-06-09T15:36:01Z

This commit executes maint/add_warning with the just added change to deny string slices except in tests. I recommend auditing this by checking out the previous commit followed by running the script yourself and then verifying that the diff is identical to this commit. This commit makes cargo clippy fail. We will add exceptions in the next commit.

relay: Remove docs type link that are outside scope

2026-05-28T16:11:56Z

Signed-off-by: David Goulet

relay: Recompute valid_until cache in view constructor

2026-05-28T16:11:56Z

The recompute of the valid_until cache is done now in the constructor of FullKeyView so the view is directly usable once built. Else, the caller always need to call the recompute function which is error prone especially when used as a throwaway view. Also, without this change, building the view and then attempting to log the public keys would fail. Signed-off-by: David Goulet

relay: Introduce src/task/crypto/keys.rs

2026-05-28T16:11:56Z

Move all key related action function to keys.rs in order to alleviate crypto.rs. The Reactor will get more functionnalities soon so cleanup. No behavior change, just code movement. Related to #2548

relay: Rename try_rotate_keys_no_lock()

2026-05-28T16:11:56Z

Remove the _no_lock() since no more locks now. Signed-off-by: David Goulet

relay: Make FullKeyView pub(super)

2026-05-28T16:11:56Z

Now, the FullKeyView is officially only seen by the crypto task. Signed-off-by: David Goulet

relay: Remove locking of FullKeyView

2026-05-28T16:11:56Z

No need for the valid_until cache locking that used to ensure coherent view accross tasks. As we move towards having the FullKeyView be solely owned by the crypto task, no need for locking. Future commit will introduce a control command channel which will be used to get keys for other tasks. The valid_until cache is kept though because it helps with key lookups to avoid walking all keys each time. Signed-off-by: David Goulet