summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | | | | proto: Make TRUNCATE trigger a proto violationGabriela Moldovan2026-05-202-5/+25
| | | | | | |
| * | | | | | proto: Add some tests for DESTROY handlingGabriela Moldovan2026-05-201-1/+60
| | | | | | |
| * | | | | | proto: Make do_create2_handshake() check EXTENDED2 was sentGabriela Moldovan2026-05-201-1/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds an extra assertion that ensures the relay reactor does in fact send an EXTENDED2 on its towards-the-client channel after receiving the CREATED2 response from the fake hop. This check is nice to have in general, but the main reason I'm doing this now is because for the DESTROY tests I'm about to add, I need the inbound MPSC queue (towards the client) drained of these handshake messages in order to check that the "next" cell we've sent is a destroy. I could've added some custom code to drain it just for the purposes of that test, but I think it's better to have `do_create2_handshake()` take care of it.
| * | | | | | proto: Extend helper to check that DESTROY was sent in both directionsGabriela Moldovan2026-05-201-7/+21
| | | | | | |
| * | | | | | proto: Rename a test helper and adjust its docsGabriela Moldovan2026-05-201-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new name is (hopefully) a bit more descriptive. I'm planning on extending this function soon to support checking if a DESTROY has been sent on the outbound channel too, so I'm tweaking the docs a bit in preparation for that.
| * | | | | | proto: Return the CircId from test handshake helperGabriela Moldovan2026-05-201-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | I'll soon need this for a DESTROY test.
| * | | | | | proto: Add test helper for sending AnyChanMsgsGabriela Moldovan2026-05-201-0/+5
| | | | | | |
| * | | | | | proto: Add a comment clarifying why we don't need to propagate DESTROYGabriela Moldovan2026-05-201-0/+7
| | | | | | |
| * | | | | | proto: Adjust DESTROY-related logs in the backward reactorGabriela Moldovan2026-05-201-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changes a debug log to have the same format as the corresponding DESTROY-related log from the forward reactor. Part of #2490
| * | | | | | proto: Pass the cell by reference to resolve a warningGabriela Moldovan2026-05-201-3/+2
| | | | | | |
| * | | | | | proto: Log a message when a forward DESTROY comes alongGabriela Moldovan2026-05-201-3/+15
| | |/ / / / | |/| | | | | | | | | | | | | | | | Part of #2490
* | | | | | Merge branch 'relay-crypto-reactor' into 'main'David Goulet2026-05-265-315/+659
|\ \ \ \ \ \ | |_|_|/ / / |/| | | | | | | | | | | | | | | | | relay: Transform the crypto task into a reactor See merge request tpo/core/arti!3919
| * | | | | relay: Use futures::select instead of tokioDavid Goulet2026-05-262-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Avoid using super::super:: and instead importDavid Goulet2026-05-261-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Use a struct for key valid_until cacheDavid Goulet2026-05-262-88/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of a HashMap, use a struct that contains explicit valid_until value per key type as those won't change anytime soon. This is to have a smaller memory footprint and simpler design. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Rename crypto task reconcile() to recompute_valid_until()David Goulet2026-05-262-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: .expect() on mutex lock failureDavid Goulet2026-05-262-26/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change made it that we don't need Result<> to be returned for two functions therefore affecting the callsites. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Small move of imports (fmt)David Goulet2026-05-261-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Crypto task now listens for new consensusDavid Goulet2026-05-263-42/+108
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Add unit test for key view reconcile()David Goulet2026-05-262-1/+152
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Fix unit tests after crypto task rewriteDavid Goulet2026-05-261-56/+21
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Crypto task removal of get_ntor_keys()David Goulet2026-05-262-48/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the last piece that needed to be removed since we can use the view to get those keys. This also allows us to remove the temporary FullKeyView::keymgr() function and instead keep the keymgr access strictly to the view guard. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Set the FullKeyView in InerTorRelayDavid Goulet2026-05-264-105/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is so we early set the FullKeyView and we use it accross the code from initialization. The try_generate_keys() now takes a view and locks it to make its changes. And we also make build_proto_relay_auth_material() use a view to simplify its code and also stop relying on the KeyMgr for key accessors. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Crypto task uses the key view reconcile()David Goulet2026-05-261-38/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This effectively removes KeyChange and use the returned set of key types that were rotated. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Add key view reconcile() for the valid_until cacheDavid Goulet2026-05-261-4/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rebuild the valid_until cache from the key manager and return which key has changed. Function is not used in this commit. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Unify crypto task try_rotate_keys()David Goulet2026-05-261-32/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rename the try_rotate_keys() to be explicit about no locking and use it in the Reactor. We need this try_rotate_keys() independent function so our first generate all keys can call it which is done before the reactor starts. Because we need crypto material in order to initialize the ChanMgr, we have to generate keys before spawning the task. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Spawn new crypto reactorDavid Goulet2026-05-262-59/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This also remove unused code from this change. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Crypto task try_generate_all is simplifiedDavid Goulet2026-05-261-28/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Like previous commit, we only care now if a generate has been done. It is enough of a signal to rebuild our channel auth material and set ntor keys. Part of the refactoring into phases. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Simplify the remove expired keys processDavid Goulet2026-05-261-37/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The crypto task remove_expired_keys() only returns the next minimum expiry time of all keys it looked at if any remains. This is part of a broad refactoring of the task so we get to have three phases at each run that is: 1. Expire, 2. Rotate, 3. Reconcille With that design, we only need to know if a rotation happened and if so, we can signal other task that we did and rebuild the channel auth key material and ntor keys. The reconcille phase will be in charge of rebuilding the valid_until task of the view. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Fix race between key view and keymgr updateDavid Goulet2026-05-261-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The race will appear once we start using the FullKeyView accross the code in the next commit(s). This is also neat because it will enforce that the keymgr is only accessed with the write lock held. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Copy try_rotate_keys() into crypto reactorDavid Goulet2026-05-261-1/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a full copy without change (except the keymgr access) so that function becomes a Reactor function. Future commit will cleanup the original copy when the crypto reactor replaces the current task. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Implement new crypto reactor run_once()David Goulet2026-05-262-13/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This basically copies the code from rotate_keys_task() and puts it in the run_once(). Cleanup will follow in the next commits to lock step changes. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Crypto new reactor scaffoldingDavid Goulet2026-05-262-1/+35
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Add FullKeyView in the crypto task moduleDavid Goulet2026-05-262-0/+191
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This object wraps the `KeyMgr` and provide getters for all specific relay key types. That view is meant to access all keys a relay has. Upcoming restricted views will wrap that object to offer a limited view that is more domain specific. A valid_until cache is kept for all expirable keys so all get() of those keys always return the same one. Signed-off-by: David Goulet <[email protected]>
* | | | | Merge branch 'relay-metrics' into 'main'wesleyac2026-05-267-32/+83
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | Add metrics exporter to arti-relay See merge request tpo/core/arti!3980
| * | | | | relay: Don't error when metrics is configured but disabled.Wesley Aptekar-Cassels2026-05-261-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is not likely to cause any major problem, so just warning should be fine.
| * | | | | arti-relay: Add metrics exporter.Wesley Aptekar-Cassels2026-05-264-1/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This currently does not actually export any metrics, but puts the infrastructure in place to do so. This adds the `experimental`, `__is_experimental`, etc features to arti-relay. I presume we want to do that in the long term, but I'm not 100% sure on that.
| * | | | | Move metrics config types to tor-config.Wesley Aptekar-Cassels2026-05-263-30/+36
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will allow these types to be shared by arti and arti-relay. This does change these types from being behind the experimental-api flag. I think this is okay, as tor-config is not a stable crate anyways, but it's worth keeping in mind. There is also an argument to be made for having two separate types, one in arti and one in arti-relay, as we do for LoggingConfig. I think that using a single type has benefits, and we should strive to eventually merge the LoggingConfigs, for instance, and perhaps other types, but it doesn't seem critical in either direction at the moment.
* | | | | Merge branch 'stabilize-flowctl-cc' into 'main'Nick Mathewson2026-05-264-8/+10
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Stabilize 'flowctl-cc' and add to 'full' Closes #2419 See merge request tpo/core/arti!4014
| * | | | | arti: move 'flowctl-cc' from 'experimental' to 'full'Steven Engler2026-05-221-2/+2
| | | | | |
| * | | | | arti-client: move 'flowctl-cc' from 'experimental' to 'full'Steven Engler2026-05-221-2/+3
| | | | | |
| * | | | | tor-circmgr: move 'flowctl-cc' from 'experimental' to 'full'Steven Engler2026-05-221-2/+3
| | | | | |
| * | | | | tor-proto: move 'flowctl-cc' from 'experimental' to 'full'Steven Engler2026-05-221-2/+2
| | | | | |
* | | | | | Merge branch '3777_rebased' into 'main'Nick Mathewson2026-05-265-5/+30
|\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | ptmgr: pass outbound_proxy to managed PT processes See merge request tpo/core/arti!4017
| * | | | | | ptmgr: Defer proxy protocol string conversionNihal2026-05-264-8/+12
| | | | | | |
| * | | | | | ptmgr: pass outbound_proxy to managed PT processesNihal2026-05-264-4/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously the [channel] outbound_proxy setting was applied to Arti's own direct connections but was not forwarded to managed PT processes. https://spec.torproject.org/pt-spec/configuration-environment.html
* | | | | | | Merge branch 'fix-channel-build-task-disappeared' into 'main'Nick Mathewson2026-05-264-119/+188
|\ \ \ \ \ \ \ | |/ / / / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tor-chanmgr: notify waiters when a launch is cancelled Closes #1716 See merge request tpo/core/arti!3946
| * | | | | | tor-chanmgr: Notify waiters when a launch is cancelledBoris Nagaev2026-05-044-119/+188
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a future that owns a pending channel launch is dropped after publishing the pending entry, other waiters can see the oneshot sender disappear and report "channel build task disappeared" as an internal bug. Fix this by tying pending-entry cleanup and waiter notification together. Once we take responsibility for a pending launch, every exit path now removes or upgrades the pending entry and notifies waiters with the observed result. Cancellation reports RequestCancelled, while post-build failures keep their original error instead of turning into the internal bug or retrying the launch owner. Add regression tests that cover both successive dropped launch-owner futures and a failure while installing a newly built channel, so waiters see the expected error in each case.
* | | | | | | Merge branch 'srv-fixes' into 'main'gabi-2502026-05-262-34/+147
|\ \ \ \ \ \ \ | |_|/ / / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | netdir: Fix SRV lifetime calculation for non-standard voting periods Closes #2522 See merge request tpo/core/arti!3965
| * | | | | | hsservice: Set the current random value for the custom netdirGabriela Moldovan2026-05-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This test was supposed to set both the current and the previous SRV in the test netdir, but was actually only setting the previous one. With the new SRV fixes from ee07c441909b41d5fbbfbffae310e954a69db478, all the hsservice tests using this netdir were panicking on an `.unwrap()`, because the SRV for the "previous" TP could not be found, which is actually what you'd expect to happen, given that the netdir was built with only one SRV. The reason the tests weren't failing before is, funnily enough, because of the bug in SRV calculation that is fixed in ee07c441909b41d5fbbfbffae310e954a69db478: In `tor-netdir`, the `extract_srvs()` function (correctly) only returned a single SRV from the consensus (the "previous one", set with `bld.shared_rand_prev()` in the test), but the `find_params_for_time()` was wrongly matching up that same SRV with multiple time periods. This happened because the old implementation was computing the "previous SRV" validity interval as: * ts_begin = `[start_of_day_containing(consensus_ts) - ONE_DAY` * ts_end = `ts_begin + srv_interval` And because the test SRV interval is 288h(!), and the test TP length is only 24h, the validity period of the previous SRV (incorrectly) covered two TPs (both the previous and the current). So as a result, the test was "successfully" getting back the same SRV for both the previous and the current TP. The bug was introduced in the commit that originally added the hsservice tests: 279842526591918e25ca97e6392f211a50192396
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 19:59:34 +0000