| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| |
|
|
| |
(Documentation movement still needed.)
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
I got this by reading over all the relevant Rust stdlib safety
documentation (now linked to in the macro definitions),
and making sure that the C no-UB text is sufficient to guarantee
that those requirements are met.
|
| |
|
|
|
|
|
|
|
| |
Previously, some of our conversion macros tried to exit early with
`?`. This is undesirable, since the OutPtr conversion has the side
effect of writing NULL to a pointer (if it is present).
Now, every conversion runs, and _then_ we exit with an error if
any of them fails.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
These macros do the only part of our FFI functions that needs to be
`unsafe`: converting input pointers into types that can be used in
safe rust. I've added documentation about what requirements each of
these conversions puts onto out inputs: both informally, and via a
reference to the relevant parts of the Rust library documentation.
While doing this I found a safety bug in `OutPtr::from_opt_ptr`:
it should have been using `MaybeUninit`.
These macros should allow us to build a "proof sketch" for the
safety of our FFI code. We need to show, for each input parameter:
- That the documented requirements for its conversion method
are also documented requirements for that kind of input, in our
header file.
- That the documented requirements for how it can be used
after conversion are in fact followed in the code.
|
| |
|
|
| |
(and to what extent)
|
| | |
|
| | |
|
| |
|
|
| |
In brief: Everything now starts with ARTI_RPC, arti_rpc, or ArtiRpc.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
These documents are no longer called "safety". They are now mostly
collected as a big list of "correctness requirements" at the start
of the cbindgen header. Because of these requirements, most
functions no longer need their own "safety" sections.
I am explicitly using `#[allow(clippy::missing_safety_doc)]` on each
function, rather than adding a blanket exception:
- There are other unsafe functions in this code, to which we
wouldn't want an exception to apply.
- Documenting the safety^W correctness requirements of a function
is important enough to make sure that we aren't skipping out on
it unintentionally.
|
| | |
|
| |
|
|
|
|
|
|
| |
Per discussion, we'd rather have an optional output parameter for error
objects rather than mess with thread-local variables.
This is possibly less convenient for direct usage from C,
but likely more convenient for wrapper functions in other languages.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
In this API, borrowed strings are `const char *`, and owned strings
are `ArtiRpcStr *`. You can get the former from the latter with
`arti_rpc_str_get()`, which returns a `const char *` in hopes that
you will neither modify nor free() that `const char *`
(Note that there are no places where string ownership needs to be
passed into this library; and at present, there is only one case
where it is passed out. I do not anticipate that we will need to do
intake of owned strings. We will probably need to return these in a
few more cases as we add more API surface.)
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
| |
This only covers the absolute minimal API in order to launch a
connection and run simple requests, and it doesn't document anything
nearly well enough. Nonetheless I think it's good enough for an
initial review, to make sure that we've got the basics right (as
well as a general consensus on the error handling API, naming, and
so forth).
|
| |
|
|
| |
(Internally, it is a boxed CStr that is always UTF-8.)
|
| |\
| |
| |
| |
| | |
rpclib: Use i64 rather than u64 for request IDs.
See merge request tpo/core/arti!2279
|
| | |
| |
| |
| | |
This makes it conform to the spec and match arti-rpcserver.
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Per discussion, this field isn't really specified in a way that lets
us fill it sensibly at the moment. So for now, we're going to just
omit it.
Additionally, we said that we'd Report on our errors; this branch
changes the implementation of RpcError to do that.
Question: Will the blanket implementation for Into<RpcError> make
it harder to re-add a Data field later on if we want to do so?
|
| | |
| |
| |
| |
| | |
We've wanted separate error codes for "no such method exists" and
"this method exists, but this object doesn't have it."
|
| | | |
|
| | |
| |
| |
| |
| |
| | |
The "complex" test here is fairly involved, since it tries to detect
deadlocks and race conditions by using multiple threads and
answering requests out of order.
|
| | | |
|
| | |
| |
| |
| | |
This turns out not to be necessary.
|
| | | |
|
| |/
|
|
|
|
| |
I hadn't been sure that we wanted to do this, since arti is
forgiving about its inputs, but IIRC Diziet was in favor of this,
and it _does_ make it easier to write tests.
|
| | |
|
| | |
|
| |
|
|
| |
Also add a link to #1491 where we discuss it more.
|
| | |
|
| | |
|
| |
|
|
| |
I think we'll need this again later, but for now it's redundant.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
If we return RpcError by default, we don't give a good way to
actually access the original error string.
(Nonetheless, we still enforce that errors can be decoded as
RpcError.)
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
