| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| |\ \ \
| | | |
| | | |
| | | |
| | | | |
fix nighly ci
See merge request tpo/core/arti!668
|
| | | |/
| |/| |
|
| |\ \ \
| | | |
| | | |
| | | |
| | | | |
fix fs-misstrust on android
See merge request tpo/core/arti!667
|
| | |/ /
| | |
| | |
| | |
| | |
| | | |
it would fail to link at runtime due to missing getgrnam_r in bionic
and then it would fail again because some directory is group writeable
|
| |\ \ \
| |/ /
|/| |
| | |
| | | |
Update shellexpand, and switch to non-fork
See merge request tpo/core/arti!661
|
| |/ /
| |
| |
| |
| |
| |
| |
| | |
Now we have bus>1 ownership of the crate name `shellexpand`. I have
made a release, and retired `shellexpand-fork`.
The new shellexpand release switches to a (quite similarly) unforked
version of `dirs`.
|
| |\ \
| | |
| | |
| | |
| | | |
Implement establish rendezvous cell
See merge request tpo/core/arti!651
|
| |/ / |
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
Revise our handling of the zeroize trait
Closes #254
See merge request tpo/core/arti!655
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Everything that is a secret encryption key, or an input that is used
to produce a secret encryption key, has to get zeroized. And that's
all!
Closes #254.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This does not yet make sure that `SecretBuf` is used where it
_should_ be, but at least it ensures that most uses of `SecretBytes`
will indeed act as intended, and make sure that whatever they
contain is zeroized.
It requires some corresponding changes to method calls for
correctness and type conformance.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This Writer is a simple wrapper around `Vec<u8>` that makes sure
that its contents are cleared whenever they are dropped _or
reallocated_.
The reallocation is the important part here: without that, we risk
not zeroizing the first allocation of the buffer.
|
| | | | |
|
| | | |
| | |
| | |
| | | |
Part of #254.
|
| | | |
| | |
| | |
| | | |
These are not secret.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Using `zeroize` here tells these crates that they should make
various structures zeroize-on-drop.
(This is not yet implemented in `aes` 0.8.1, but support has been
merged in the repository for `aes`, so it should go out in the next
release.)
No corresponding feature flag is needed to enable zeroize-on-drop
for `rsa` and `*25519-dalek` private keys.
|
| | | | |
|
| |\ \ \
| | | |
| | | |
| | | |
| | | | |
Delete unused Enum and fileinput in maint file
See merge request tpo/core/arti!660
|
| | | | | |
|
| |\ \ \ \
| |/ / /
|/| | |
| | | |
| | | |
| | | |
| | | | |
Add params() method to NetDirProvider
Closes #528
See merge request tpo/core/arti!658
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Now it maintains an up-to-date set of default parameters to be
handed out if there is no directory.
Closes #528.
|
| | |/ /
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This method will let users get the latest `NetParameters`, with
user-configured overrides, even if there is no current directory at
all.
Part of #528
|
| |\ \ \
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Rename `.inc` and other included files to end in `.rs`
Closes #381
See merge request tpo/core/arti!645
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
In order to mitigate syntax highlighting issues and a rust-analyzer bug
(https://github.com/rust-analyzer/rust-analyzer/issues/10178), rename
files that are included with the `include!` macro to have a `.rs`
extension.
Make sure the included files are outside `src/`, in order to not confuse
humans and automated editing tools that might mistake them for valid
Rust modules.
fixes arti#381
|
| |\ \ \ \
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
tor-rtcompat: s/micros/millis inside a flaky test
Closes #515
See merge request tpo/core/arti!644
|
| | |/ / /
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The other tests wait for 100 milliseconds; this one waits for 100
*microseconds* for some reason, which meant it was understandably flaky
if run on anything less than perfect conditions (arti#515).
This is probably a typo, so just change it.
fixes arti#515
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
This had to become a new internal function, since at the point that
the handshake needs this code, it does not yet have a Channel to use.
This change made the error messages in the handshake code more
informative: and now they require a regex to check. Later, we might
want to defer formatting these strings, but I don't think we need
to do it now.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Doing this will make sure that we fix a correctness issue in netdir that
will be caused if we add more IDs.
(Also add RelayIdType::COUNT in tor-linkspec.)
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
This will let us use `&RelayId` in all the places that take
`Into<RelayIdRef>`.
|
| | | | | |
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
The hidden ones are only used to implement higher-level accessors;
the others are not used at all.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
There are some downstream changes required for this to work, but
they are all just unit tests that could no longer infer the type of
an Ed25519 key.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
With this change, each individual identity type becomes optional.
The functions that expose them unconditionally are now in a "legacy"
trait that only some downstream types are expected to implement.
There are new convenience APIs in HasRelayIds:
* to return Option<&keytype>,
* to see if one identity-set contains another.
This commit will break several downstream crates! For the
reviewer's convenience, I will put the fixes for those crates into a
series of squash! commits on this one.
tor-netdir
----------
Revise tor-netdir to accept optional identities. This required some
caveats and workarounds about the cases where we have to deal with a
key type that the tor-netdir code does not currently recognize at
all. If we start to add more identity types in the future, we may
well want more internal indices in this code.
tor-proto
---------
In order to make tor-proto support optional identities, there were
fewer changes than I thought. Some "check" functions needed to start
looking at "all the ids we want" rather than at "the two known IDs";
they also needed to accommodate that case where we don't have an ID
that we demand.
This change will also help with bridges, since we want to be able to
connect to a bridge without knowing all of its IDs up front.
The protocol currently _requires_ the two current ID types in some
places. To deal with that, I added a new `MissingId` error.
I also removed a couple of unconditional identity accessors for
chanmgr; code should use `target().identity(...)` instead.
tor-chanmgr
-----------
This is an incomplete conversion: it does not at all handle channel
targets without Ed25519 identities yet. It still uses those
identities to index its internal map from identity to channel; but
it gives a new `MissingId` error type if it's given a channel target
that doesn't have one.
We'll want to revise the map type again down the road when we
implement bridges, but I'd rather not step on the channel-padding
work in progress right now.
tor-guardmgr
------------
This change is mostly a matter of constructing owned identity types
more sensibly, rather than unwrapping them directly.
There are some places marked with TODOs where we still depend on
particular identity types, because of how the directory protocol
works. This will need revisiting when we add bridge support here.
tor-circmgr
-----------
These changes are just relatively simple API changes in the tests.
|
| | | | |
| | | |
| | | |
| | | | |
These will all be used shortly.
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
This makes lookups a little more efficient. I do with that HashSet
just supported this use-case, but for now this seems our best option.
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
This implementation is (sadly) too copy-heavy or now, because
HashSet<RelayId> can't be indexed with RelayIdRef.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The formats used here are backward-compatible with those used by C
tor and those used elsewhere in our code. We need a way to encode
_both_ current kinds of identities as a string that tells you what
kind of ID they are. Traditionally we have used hexadecimal,
sometimes with a $, for RSA ids, and we have used base64 for Ed25519
IDs.
We also introduce a new forward-compatible format for new identity
keys in the future. (The new format is the key identity type, a
colon, and the id encoded as base64.) We will use this new format
_only_ when we need to encode identities in a way where it would be
otherwise unclear what kind of key we are dealing with.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
(It's safe to require these specific keys, since we constructed the
objects for testing, and we know for certain that they contain given
keys.)
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
I wonder if these types are correct. I think it makes sense to have
a Ref type like this, rather than just using `&RelayId`, but it
doesn't seems that I can make `RelayId` and `RelayIdRef` implement
Borrow and ToOwned for one another, so maybe I've messed up.
|
| | | | | |
|
| | | | | |
|
| | | | | |
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
This method tells if two HasRelayIds contain exactly the same set of
Relay identities, and is generally useful for debugging.
|
| | | | |
| | | |
| | | |
| | | | |
These are the other inspiration for #428.
|
| | | | |
| | | |
| | | |
| | | | |
I believe that this was the original motivation behind #428.
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
This will allow RelayIds to replace IdPair in tor-guardmgr. (The
fields are named accordingly with `serde(rename)`.)
|
