mirrors/arti.git/crates/tor-rpc-connect/src/auth, branch main mirror of https://gitlab.torproject.org/tpo/core/arti http://git.dilluti0n.com/mirrors/arti.git/atom?h=main 2026-06-09T15:36:01Z maint: Run maint/add_warning to deny string slices 2026-06-09T15:36:01Z Clara Engler cve@cve.cx 2026-06-09T15:36:01Z urn:sha1:9f5752a77fb57052c06ead0eeae606831f1e8e97 This commit executes maint/add_warning with the just added change to deny string slices except in tests. I recommend auditing this by checking out the previous commit followed by running the script yourself and then verifying that the diff is identical to this commit. This commit makes cargo clippy fail. We will add exceptions in the next commit. Upgrade rand crates to 0.10. 2026-05-12T20:55:43Z Wesley Aptekar-Cassels me@wesleyac.com 2026-05-07T20:06:21Z urn:sha1:a18167928901d8c88cd1cdd87346de8ad1ee42a2 When the circ-padding feature is enabled, we use maybenot, which does not yet support rand 0.10. In the meantime, enabling this feature pulls in rand 0.9. This is not ideal, but should be okay as a temporary situation. This also replaces the use of ReseedingRng (which was removed in 0.10) with the reseeding_rng crate. This is somewhat less performant, but it should be okay. Fix name of clippy lint to unchecked_time_subtraction (2) 2025-11-06T11:28:22Z Ian Jackson ijackson@chiark.greenend.org.uk 2025-11-06T11:23:25Z urn:sha1:a5fd5c48ea059a80cc1f6c50e248654b5ff3aaff Run maint/add_warning squash! Upgrade rand dependency to 0.9. 2025-03-18T16:09:44Z Nick Mathewson nickm@torproject.org 2025-03-18T13:01:31Z urn:sha1:2f8993c22c2b86010e4fd8b5169ef0ab83f8c754 - `rand::thread_rng()` has been deprecated and renamed to `rand::rng()` rpc-connect: Abort on misformed cookie file, and explain why. 2025-01-27T20:14:39Z Nick Mathewson nickm@torproject.org 2025-01-27T20:14:39Z urn:sha1:2ef3084a5e489516c4c449818dd652b1cf781ff7 rpc-connect: Use file_access() API, and permit symlinks. 2025-01-27T20:09:19Z Nick Mathewson nickm@torproject.org 2025-01-27T20:09:19Z urn:sha1:b8f7a2a654d3c7732ec3e888b8857fed2a9ed187 rpc: Expose Cookie::load unconditionally. 2025-01-15T15:21:05Z Nick Mathewson nickm@torproject.org 2025-01-15T15:21:05Z urn:sha1:86ad28dda17b7e181dcb8e93e8aaf312a43e7a38 rpc: Use symbolic constants for nonce/mac lengths. 2025-01-15T14:18:44Z Nick Mathewson nickm@torproject.org 2025-01-15T14:00:36Z urn:sha1:0d9ec0383df8230dfe8bc9720f84bcb30d63f662 rpc: Tests for cookie nonce/mac encoding/decoding. 2025-01-15T14:18:44Z Nick Mathewson nickm@torproject.org 2025-01-15T13:56:45Z urn:sha1:7a1daa02f4ef9d749d3fd4abb4304ccac196d7b7 Also fix a bug in decoding, where we accepted too-short strings. rpc: Tweak cookie protocol to bind both nonces. 2025-01-15T14:18:44Z Nick Mathewson nickm@torproject.org 2025-01-09T19:55:50Z urn:sha1:f3fcd71f218595402175c2530a09dabb7ed10f9d Previously participants in the cookie protocol only bound the peer nonce in their MACs. With this change, they bind both nonces. This change is _probably_ not necessary for security, but it can't hurt. It follows a general principle that Adam Langley told me a long time ago: you won't regret binding more, but you might regret binding less.