mirrors/arti.git/crates/tor-proto/src/relay/channel/handshake.rs, branch arti-v2.0.0

proto: Enforce condition with type system

2026-01-22T16:16:44Z

This commits returns either Some(AUTH_CELL, CERTS) or None. We future proof ourselves against one Some and other None even if an error check is done before. Signed-off-by: David Goulet

proto: Use the channel codec channel type

2026-01-22T16:16:44Z

Remove the channel type from Unverified and Verified channels and instead use the channel type in the underlying channel codec. The codec requires such type in order to restrict messages sets. Instead of duplicating it, this commit simply makes it that there is now only a single channel type attached to a channel structure. The resulting `struct Channel` in the end gets it copied from the channel codec as the framed_tls gets split and given to the `Reactor`. Down the line, we need a channel type attached to the `Channel` in order to know if it is a client or not and authenticated or not. Signed-off-by: David Goulet

proto: Remove Option<> around peer_ip for build_netinfo_cell()

2026-01-22T16:16:44Z

Signed-off-by: David Goulet

proto: Avoid magic hardcoded value for LINK_AUTH

2026-01-22T16:16:44Z

Instead, use the static AUTHTYPE_ED25519_SHA256_RFC5705 value which is for now the only version we support. Signed-off-by: David Goulet

proto: Enforce CERTS and AUTHENTICATE are always expected together

2026-01-22T16:16:44Z

A Responder receiving cells from the Initiator, if it gets a CERTS, an AUTHENTICATE must also be present (and vice-versa). Signed-off-by: David Goulet

proto: Send relay channel NETINFO in check()

2026-01-22T16:16:44Z

Once channel is verified and authenticate if need be, send the NETINFO. We require our advertised IP addresses for this so pass them to launch() as well to the UnverifiedRelayChannel. A cargo fmt change slipped in here, sorry about that. Signed-off-by: David Goulet

proto: Authenticate a relay channel

2026-01-22T16:16:44Z

This commit is a bit loaded but it is coherent. First, we set Eq and PartialEq to the channel message Authenticate so we can compare it with the one we expected. Second, the AuthenticationCell enum is introduced to store either an AUTH_CHALLENGE or an AUTHENTICATE since one side of the handshake can only have one. This allows us to store one or the other in UnverifiedRelayChannel. Depending on what we have, the authentication process is different as it dictates which side we are on (initiator vs responder). Keep in mind that the handshake code enforces receiving a AUTH_CHALLENGE along side CERTS. And same goes for AUTHENTICATE which means that if we have an AUTH_CHALLENGE in the UnverifiedRelayChannel, it is certain that the other side wants to authenticate and we are the initiator. Finally, the sending of CERTS and AUTHENTICATE by the initiator is now in UnverifiedRelayChannel::check() done right after verifying the channel CERTS and holding a "VerifiedChannel" object. This means that the last piece, sending the `NETINFO` by the initiator will be done in the check() but in a future commit. This leaves the VerifiableChannel::finish() to send nothing and only finalize the channel with the NETINFO (canonicity). Signed-off-by: David Goulet

proto: Add CertifiedConn to relay handshake

2026-01-22T16:16:44Z

We need this trait for the underlying TLS stream in order to access data such as the certificates or keying material. Signed-off-by: David Goulet

proto: Implement RelayResponderHandshake

2026-01-22T16:16:44Z

This commit introduces the RelayResponderHandshake object used when accepting an inbound connection to open a channel. There are still TODOs pepperred in the code but the base is implemented. The Unverified and Verified channel need to be adjusted for this new handshake. This will come in the next commits. Signed-off-by: David Goulet

proto: Make CERTS cell optionnable for UnverifiedChannel

2026-01-22T16:16:44Z

This requires to make a series of cert and digest also optionnable in the VerifiedChannel. This change is needed because as a relay responder, you might get the CERTS or not depending on if the other side wants to authenticate. Client and bridges do not authenticate and thus it is expected to not have a CERTS cell. This leads to the UnverifiedChannel::check() function to return early with a VerifiedChannel without any identity attached to it. Signed-off-by: David Goulet