summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
| * | tor-dirmgr: make note_request_* functions standaloneeta2022-05-102-72/+80
| | | | | | | | | | | | | | | - DirMgr::note_request_outcome and friends are now just standalone functions, taking a CircMgr.
| * | tor-dirmgr/bootstrap.rs: refactor query_into_requests, make it usedeta2022-05-102-60/+56
| | | | | | | | | | | | | | | | | | | | | - query_into_requests is now called make_requests_for_documents, and does the &[DocId] -> DocQuery conversion internally instead. - DirMgr::make_consensus_request and DirMgr::query_into_requests are now gone. The tests use the new functions, as does fetch_multiple.
| * | tor-dirmgr: move query_into_requests into bootstrap.rseta2022-05-102-44/+71
| | | | | | | | | | | | | | | | | | | | | - There's no good reason these functions needed to be part of the dirmgr, apart from needing a runtime and a store. - However, we can just add those as arguments and copy them over. This commit does that.
| * | tor-dirmgr/bootstrap.rs: refactor load_all -> load_documents_from_storeeta2022-05-103-15/+29
| | | | | | | | | | | | | | | | | | | | | | | | - Function renamed & docs tidied up a bit - Function signature now takes what it needs (immutable &dyn Store instead of mutex, slice instead of Vec) and nothing more - DocQuery::load_documents_into was also renamed DocQuery::load_from_store_into and given similar treatment
| * | tor-dirmgr/storage.rs: impl Store for Box<dyn Store>eta2022-05-101-0/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Annoyingly, Rust doesn't automatically generate this sort of `impl` for you, and I'd like to reduce the usage of Mutex<DynStore> everywhere else in favour of either &dyn Store or &mut dyn Store. (This is for two reasons: firstly, we might have a Store implementation that doesn't use a mutex as above, or similar refactors; secondly, passing the raw trait object reference lets us encode mutability into the function signature, which I believe is quite valuable.)
| * | tor-dirmgr/lib.rs: move DirMgr::load_documents_into to DocQueryeta2022-05-103-56/+59
| | | | | | | | | | | | | | | Move the function out of DirMgr, giving it a new &Mutex<DynStore> argument instead.
* | | Merge branch 'fix-coverage-ci' into 'main'eta2022-05-101-0/+3
|\ \ \ | | | | | | | | | | | | | | | | Disable fs-mistrust in coverage CI. See merge request tpo/core/arti!493
| * | | Disable fs-mistrust in coverage CI.Nick Mathewson2022-05-101-0/+3
| |/ / | | | | | | | | | | | | The CI runners like to run as root with umask 000, which our code rightly freaks out about.
* | | Merge branch 'excise-husky' into 'main'Nick Mathewson2022-05-106-27/+7
|\ \ \ | |/ / |/| | | | | | | | Remove cargo-husky, and replace with manual instructions See merge request tpo/core/arti!494
| * | Remove cargo-husky, and replace with manual instructionseta2022-05-106-27/+7
|/ / | | | | | | | | | | | | | | A build script reaching into your .git/hooks/ and modifying them nonconsensually was a bit of a horrifying concept, and also made it hard to build arti with the feature disabled. Remove this crate, and replace it with manual instructions on how to install the hooks in CONTRIBUTING.md.
* | Merge branch 'tinystr_nicknames' into 'main'eta2022-05-108-11/+122
|\ \ | | | | | | | | | | | | netdoc: add a new type for Nicknames See merge request tpo/core/arti!405
| * | netdoc: add a new type for NicknamesNick Mathewson2022-05-098-11/+122
|/ / | | | | | | | | | | | | | | | | | | Relay nicknames are always between 1 and 19 characters long, and they're always ASCII: That means that storing them in a [u8;19] will always be possible, and always use less resources than storing them in a String. Fortunately, the tinystr crate already helps us with this kind of thing.
* | Merge branch 'use-fs-mistrust'Nick Mathewson2022-05-0923-154/+515
|\ \
| * | Loosen checking for readable files within target directories.Nick Mathewson2022-05-092-14/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the target directory itself is unreadable by untrusted users, then its contents can't be read[*] by them regardless of their permissions. If the target directory _is_ readable, then _it_ will be rejected if we are forbidding readable objects. (And if we aren't we don't care if the contents are readable.) A similar argument would apply to writable objects within an unreadable target directory. We're not making that argument, since such contents are likelier to be a mistake. [*] Unless they're hard-linked; see comments in "Limitations" section.
| * | Add a CLI option to disable FS permission checks.Nick Mathewson2022-05-091-1/+10
| | |
| * | Remove "Mistrust" from the public API of arti-client.Nick Mathewson2022-05-094-16/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I'm doing this per discussion, so that we can have it be part of the TorConfig later on, and not break stuff as we change the Mistrust API to have a builder. This change, unfortunately, results in a little more internal complexity and duplicated code in arti and arti-client. I've marked those points with TODOs.
| * | arti: use fs-mistrust to validate configuration file locations.Nick Mathewson2022-05-096-13/+31
| | |
| * | arti-client: Configure and use fs-mistrust.Nick Mathewson2022-05-096-8/+72
| | | | | | | | | | | | | | | | | | This is derived from the environment, not the configuration file: We might not want to trust the configuration file until we've decided whether we like its permissions.
| * | Update tor-dirmgr to use fs-mistrust.Nick Mathewson2022-05-097-86/+116
| | |
| * | tor-persist: Use fs-mistrust to verify state file permissions.Nick Mathewson2022-05-094-35/+55
| | |
| * | Add new FsPermissions ErrorKind.Nick Mathewson2022-05-091-0/+9
| | |
| * | fs-mistrust: add various methods.Nick Mathewson2022-05-092-7/+174
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This includes: * a CachedDir::join method. * functions to read and write from provided filenames in a CachedDir. * a method to tell whether a fs-mistrust error is about bad file permissions, or failure to inspect file permissions or some other kind of IO problem.
| * | Derive Clone and Debug for CheckedDir.Nick Mathewson2022-05-051-0/+1
| | |
| * | gitlab-ci: Disable fs mistrust in integration testNick Mathewson2022-05-051-0/+3
| | | | | | | | | | | | | | | | | | The environment where the test runner does its thing seems to want to run as root with umask 000, which naturally makes the fs permissions checks freak out.
* | | Merge branch 'netparams' into 'main'Nick Mathewson2022-05-092-3/+3
|\ \ \ | | | | | | | | | | | | | | | | NetParams: Document its role as a validated config parameter See merge request tpo/core/arti!492
| * | | NetParams: Document its role as a validated config parameterIan Jackson2022-05-092-3/+3
|/ / /
* | | Merge branch 'coverage-weekly' into 'main'Ian Jackson2022-05-065-34/+80
|\ \ \ | | | | | | | | | | | | | | | | export coverage to pages See merge request tpo/core/arti!489
| * | | only deploy pages on maintrinity-1686a2022-05-051-1/+1
| | | |
| * | | use true instead of /bin/truetrinity-1686a2022-05-051-2/+2
| | | | | | | | | | | | | | | | see https://gitlab.torproject.org/tpo/core/arti/-/issues/400#note_2800763
| * | | add schedulable job to generate aggregated coveragetrinity-1686a2022-05-051-6/+45
| | | |
| * | | generate aggregated coverage reportstrinity-1686a2022-05-052-13/+20
| | | |
| * | | chutney test stop network when arti died or did not starttrinity-1686a2022-05-052-15/+15
| | | |
* | | | A few small changelog style edits.arti-v0.3.0Nick Mathewson2022-05-061-6/+6
| | | |
* | | | Merge remote-tracking branch 'origin/mr/491'Nick Mathewson2022-05-061-2/+2
|\ \ \ \
| * | | | CHANGELOG.md: resolve minor typoseta2022-05-061-2/+2
| | | | |
* | | | | Clear semver_status now that 0.3.0 is coming out.Nick Mathewson2022-05-061-72/+1
| | | | |
* | | | | Bump the version of every* crate to 0.3.0Nick Mathewson2022-05-0634-218/+218
| | | | | | | | | | | | | | | | | | | | * Except for safelog and fs-mistrust, which are new.
* | | | | Change safelog version to 0.1.0.Nick Mathewson2022-05-064-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | (This is okay because we haven't published it yet, or any crate that uses it.)
* | | | | Update README.md files (automated).Nick Mathewson2022-05-0610-16/+307
|/ / / /
* | | | CHANGELOG.md: light reformatting.Nick Mathewson2022-05-061-14/+0
| | | |
* | | | Finish the CHANGELOG.md for 0.3.0Nick Mathewson2022-05-061-24/+53
| | | |
* | | | Merge branch 'derive-builder-fork' into 'main'Nick Mathewson2022-05-069-32/+35
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switch to derive_builder_arti_fork Closes #446 See merge request tpo/core/arti!490
| * | | | Switch to derive_builder_arti_forkIan Jackson2022-05-069-32/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For reference, the git source for this crate (and the others in its workspace) currently lives in my personal github account (ijackson). If this fork turns out to be long-lived and gains features and/or users, it would be good to move it to a gitlab somewhere. I have granted Nick crate ownership on the crates.io system.
* | | | | Merge branch 'safelogging' into 'main'Nick Mathewson2022-05-0614-7/+799
|\ \ \ \ \ | |/ / / / |/| | | | | | | | | | | | | | | | | | | | | | | | Implement a safe-logging facility. Closes #189 See merge request tpo/core/arti!485
| * | | | Punctuation fix.eta2022-05-061-1/+1
| | | | |
| * | | | Disable safe-logging when logging to console.Nick Mathewson2022-05-061-1/+30
| | | | |
| * | | | arti: add support for safe-logging configurationNick Mathewson2022-05-062-3/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Here we add a config option to disable safe logging, and ensure that safe logging is disabled when we are formatting an error message on exit (since we assume it's safe to write sensitive info to stderr.)
| * | | | Apply `sensitive` in some info-level log messages.Nick Mathewson2022-05-066-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | This specifically applies the `sensitive` wrapper in the places where we're logging target addresses at level "info" or higher.
| * | | | Implement a safe-logging facility.Nick Mathewson2022-05-067-0/+723
|/ / / / | | | | | | | | | | | | | | | | | | | | This is a rough first-cut of an API that I think might help us with keeping limited categories of sensitive information out of our logs. I'll refine it based on experiences with using it.
* | | | Merge branch 'typos-20220504' into 'main'eta2022-05-054-6/+6
|\ \ \ \ | |_|/ / |/| | | | | | | | | | | Fix typos (using the typos-cli tool). See merge request tpo/core/arti!486
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 17:14:49 +0000