summaryrefslogtreecommitdiff
path: root/crates/tor-cell/src/chancell
Commit message (Collapse)AuthorAgeFilesLines
* tor-cell: remove `derive_more::Into` for `RelayEarly`Steven Engler2026-06-241-1/+1
| | | | | We don't use this anymore, and it can lead to subtle bugs since we lose the original channel message command.
* tor-cell: document that destroy reason should be NONESteven Engler2026-06-121-0/+7
| | | | | | | The spec was recently updated in [1], so we should make this clearer in our code comments. [1]: https://gitlab.torproject.org/tpo/core/torspec/-/merge_requests/490
* maint: Run maint/add_warning to deny string slicesClara Engler2026-06-091-0/+1
| | | | | | | | | | | | This commit executes maint/add_warning with the just added change to deny string slices except in tests. I recommend auditing this by checking out the previous commit followed by running the script yourself and then verifying that the diff is identical to this commit. This commit makes cargo clippy fail. We will add exceptions in the next commit.
* cell: Add Authenticate::BODY_LEN as a public constDavid Goulet2026-03-301-0/+2
| | | | | | | We use this constant value when building the AUTHENTICATE cell to optimize the memory allocation as this won't ever change. Signed-off-by: David Goulet <[email protected]>
* Merge branch 'build_certs_refactor' into 'main'Nick Mathewson2026-03-231-0/+10
|\ | | | | | | | | cell, proto, cert: Simplify CERTS cell building. See merge request tpo/core/arti!3795
| * cell: Feature-gate API using the possibly absent EncodedCert type.Nick Mathewson2026-03-231-0/+1
| |
| * cell, proto, cert: Simplify CERTS cell building.Nick Mathewson2026-03-191-0/+9
| | | | | | | | | | | | | | | | Formerly we required the caller for push_cert_body to specify the type of the cert that they were pushing. But in nearly every case, the certificate object that the caller is holding knows what its own type is! This makes the tor_proto build_certs_cell function a bit less error-prone, since we don't have to worry about mismatch.
* | proto: Check the AUTHENTICATE auth type that we support itDavid Goulet2026-03-191-0/+5
| | | | | | | | | | | | | | | | As a responder, we should check the AUTHENTICATE auth type and make sure we support it. We were not doing that, we were simply putting in our max version. Signed-off-by: David Goulet <[email protected]>
* | cell: Use Error::MissingData if Authenticate fields length is wrongDavid Goulet2026-03-191-26/+16
| | | | | | | | | | | | Proper error to use and better code to use checked_sub(). Signed-off-by: David Goulet <[email protected]>
* | cell: Simplify the Authenticate APIDavid Goulet2026-03-191-16/+26
| | | | | | | | | | | | | | | | | | | | Remove the is_equal_no_sig() and instead add a getter that returns a reference to the body without the random part so it can be used to verify the signature. The caller now checks the equality with what it is expected. Signed-off-by: David Goulet <[email protected]>
* | proto: Fix AUTHENTICATE equality check and signature checkDavid Goulet2026-03-191-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes two things. 1. The "is_equal_no_sig()", if true, was going into the error path. 2. The signature verification is done against the body of the AUTHENTICATE cell that is all fields except the signature. Next commit will change the is_equal_no_sig() to make more sense with the "body" semantic. Signed-off-by: David Goulet <[email protected]>
* | proto: Responder channel properly validates the AUTHENTICATE cellDavid Goulet2026-03-191-1/+34
|/ | | | | | | | It is now validated against the received KP_link_ed of the initiator peer and we compare only the section of the AUTHENTICATE cell that we can compare (minus random bytes and sig). Signed-off-by: David Goulet <[email protected]>
* proto: Implement a Canonicity structDavid Goulet2026-02-121-0/+12
| | | | | | | | | | | | | | | | | This struct will be put in a Channel and derived from the received NETINFO cell. This follows the C-tor implementation for which we have two indicator of canonicity: 1. Peer is canonical: the address they advertise in the NETINFO cell matches the one we see on the TCP connection. 2. Canonical to peer: the peer sees us as canonical. Those flag will get used to select "the best" channel. Signed-off-by: David Goulet <[email protected]>
* proto: Authenticate a relay channelDavid Goulet2026-01-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit is a bit loaded but it is coherent. First, we set Eq and PartialEq to the channel message Authenticate so we can compare it with the one we expected. Second, the AuthenticationCell enum is introduced to store either an AUTH_CHALLENGE or an AUTHENTICATE since one side of the handshake can only have one. This allows us to store one or the other in UnverifiedRelayChannel. Depending on what we have, the authentication process is different as it dictates which side we are on (initiator vs responder). Keep in mind that the handshake code enforces receiving a AUTH_CHALLENGE along side CERTS. And same goes for AUTHENTICATE which means that if we have an AUTH_CHALLENGE in the UnverifiedRelayChannel, it is certain that the other side wants to authenticate and we are the initiator. Finally, the sending of CERTS and AUTHENTICATE by the initiator is now in UnverifiedRelayChannel::check() done right after verifying the channel CERTS and holding a "VerifiedChannel" object. This means that the last piece, sending the `NETINFO` by the initiator will be done in the check() but in a future commit. This leaves the VerifiableChannel::finish() to send nothing and only finalize the channel with the NETINFO (canonicity). Signed-off-by: David Goulet <[email protected]>
* Fix name of clippy lint to unchecked_time_subtraction (2)Ian Jackson2025-11-061-1/+1
| | | | Run maint/add_warning
* proto: Add the channel authentication dataDavid Goulet2025-10-231-0/+5
| | | | | | | | | | | This commit only adds a struct holding all the authentication data that needs to be built during the verification process after all handshake cells needed for authentication have been sent. It lives in the VerifiedChannel struct so it can be used to build the AUTHENTICATE cell and be sent before the NETINFO. Signed-off-by: David Goulet <[email protected]>
* proto: Remove the AUTHORIZE as a parsable cellDavid Goulet2025-08-211-35/+0
| | | | | | | | | | | | | The AUTHORIZE cell command is simply reserved but not defined. The tor specification, at this point in time, is allowing such cell before the handshake starts but it is very unclear on what ordering is allowed nor how many can are allowed. C-tor silents drop them like VPADDING and so clearly unused. Instead of dealing with it, simply remove its support but keeping its reserved number. Signed-off-by: David Goulet <[email protected]>
* cell: Add helper functionsDavid Goulet2025-08-201-0/+5
| | | | | | | | | | | | Add is_known_cmd() to the restricted_msg!() macro which can be used to learn if a specific ChanCmd is part of the restricted set or not. Then add a simple function to get the link protocol version from a channel codec. Part of #1597 Signed-off-by: David Goulet <[email protected]>
* tor-cell: fix comment in `ChannelCodec::encode`Steven Engler2025-08-121-1/+3
| | | | | | This comment isn't correct if the encode() was given a non-empty buffer (for example if two cells were written to the same buffer, the second encode() would be given a non-empty buffer, so `pos != 5`).
* Switch Cargo.toml files to edition 2024.Nick Mathewson2025-08-072-8/+4
| | | | | | | | | | | | | | First, run ``` git grep -l "^edition =" | xargs perl -i -pe 's/^edition *=.*/edition = "2024"/;' ``` Second, manually verify that all Cargo.toml files have changed, and nothing else has changed. Third, run cargo fmt again.
* Some HasMemoryCost impls in tor-cellIan Jackson2024-10-021-18/+44
|
* Change tor_bytes::Readable name to `b` in many placesIan Jackson2024-09-111-15/+15
| | | | | | | | | | | | | | | The codebase uses `r` sometimes and `b` at other times. Making this consistent makes widespread changes easier, and is clearer for humans. I think `b` is better than `r` because `r` might be "return". It is indeed used that way in a couple of places in reader.rs, even. I haven't changed *everywhere*, just Readable impls (where `r` is particularly likely to be "return value") and occurrences in tor-bytes. No functional change.
* Use uXX::MAX in place of std::uXX::MAXNick Mathewson2024-04-222-3/+3
| | | | | | The old code produced a warning from clippy nightly; we may as well update to use the new associated consts. (They've been there since Rust 1.4x.)
* Run maint/add_warning.Nick Mathewson2024-03-131-0/+1
|
* Fix typosDimitris Apostolou2024-01-081-1/+1
|
* tor-cell: Fix ambitious certtypeEmil Engler2023-12-281-1/+2
| | | | | | | When using the `arti-client` crate in other contexes, the Rust compiler sometimes has difficulties with determining the current type in this particular case, due to a collision with the popular serde json crate, which also provides an implementation for converting u8.
* Add a caret_int HandshakeType for HTYPE constantsJim Newsome2023-10-261-5/+21
|
* Change `CircId` to never be zeroJim Newsome2023-10-252-4/+5
| | | | | | | | | | This changes the internal representation to be `NonZeroU32` instead of just `u32`. Various places where a circuit ID is optional now use `Option<CircId>`. Fixes a bug in `CircIdRange::sample` that would previously return a circuit ID of 0, when the rng returned 0x8000_0000 for a low range.
* Run maint/add_warning to add lint block everywhereIan Jackson2023-08-231-0/+1
|
* Run maint/add_warning to actually apply new lint allowsIan Jackson2023-07-101-0/+1
|
* tor-cell: remove use of arrayrefNick Mathewson2023-06-011-3/+7
| | | | Closes #872
* tor-cell: add a TODO comment about simplifying Body away.Nick Mathewson2023-02-151-0/+4
|
* tor-cell: Implement {Relay,Chan}Msg for every body typeNick Mathewson2023-02-151-0/+48
| | | | | This will make it ergonomic to decode a single body type without having to declare a variant that accepts only a single message.
* tor-cell: Refactor relay cells to copy much lessNick Mathewson2023-02-151-10/+9
| | | | | | | | | | | | | We now manipulate raw relay cell bodies as (an alias for) `Box<[u8;509]>` rather than as (an alias for) `[u8;509]`. This enables us to do much less copying. It will become more important soon, as we defer parsing relay cell bodies even longer. Related to #7. We also use SliceWriter to avoid allocating a Vec<> for every relay message we want to encode, and instead encode directly into the cell.
* Change tor_bytes::Error::BadMessage to a Cow.Nick Mathewson2023-02-091-3/+5
| | | | | | | | | | Actually, to avoid making a breaking change, I'm deprecating BadMessage and creating a new InvalidMessage variant that takes a Cow. This way I don't need to track every crate that re-exposes tor_bytes::Error and call this a breaking change in those. Making this change will allow tor_bytes errors to be much more helpful.
* tor-cell: Remove chancell::msg::Body::into_message.Nick Mathewson2023-02-091-52/+1
| | | | | It's now redundant, since `restricted_msg!` defines From and Into for us.
* tor-cell: Make RelayEarly a separate type.Nick Mathewson2023-02-091-4/+30
| | | | This allows us to remove a shenanigan from `restricted_msg!{}`.
* tor-cell: Have restrict_msg add conversion functions.Nick Mathewson2023-02-091-6/+2
| | | | | | | | | | | | | | | | Every FooMsg type now implements Into<AnyFooMsg>, and TryFrom<FooMsg>. Additionally, it now implements From<X> for every distinct type that it supports. This last part lets us discard a bunch of code. Unfortunately, I needed some downright hackish trickery in order to get these macros to avoid generating `From<AnyFooMsg> for AnyFooMsg` and conflicting with the blanket implementation. The trickery to deal with RelayEarly and Relay being the same type was not necessarily worth it; I will be separating them and removing said trickery in the next commit.
* cell: Parameterize ChannelCodec::decode and encode.Nick Mathewson2023-02-091-7/+14
| | | | | | | This change lets us use ChannelCodec to encode and decode any restricted channel message type we want. (Later on, we'll turn the related Codec class in tor-proto into a more type-restricted version of this.)
* tor-cell: Rename ChanMsg and ChanCell-related types.Nick Mathewson2023-02-072-44/+44
|
* tor-cell: Remove ChanMsg methods that are duplicated in ChanMsgClass.Nick Mathewson2023-02-072-23/+4
|
* tor-cell: Use macro to generate ChanMsg too.Nick Mathewson2023-02-071-105/+34
|
* tor-cell: Make Body and MsgClass traits more uniform.Nick Mathewson2023-02-071-49/+53
| | | | | | | | Doing this will make it much easier to implement a macro that generates restricted instances of the Msg types (for #525). The Body change is a breaking change. I don't think anybody else implements Body, but in theory they could.
* tor-cell: Generic "Restricted{Relay,Chan}Cell" types.Nick Mathewson2023-02-071-9/+23
| | | | | | | These are generalizations of RelayCell and ChanCell respectively, that allow using an arbitrary message type in place of the fully general RelayMsg and ChanMsg types. Doing this is a prerequisite for usefully implementing arti#525.
* Allow clippy::unchecked_duration_subtraction in testsNick Mathewson2023-01-271-0/+1
| | | | | This panics on error, and we're fine with a panic on misbehavior in tests.
* Merge branch 'test-lints' into 'main'eta2023-01-061-0/+9
|\ | | | | | | | | Add test lint blocks to all "mod test" See merge request tpo/core/arti!937
| * test lint blocks: Add many many automaticallyIan Jackson2022-12-121-0/+9
| | | | | | | | | | This is precisely the result of running the rune in maint/adhoc-add-lint-blocks.
* | msg::{CreateFast/CreatedFast}: Rename accessor to (into_)body()Neel Chauhan2022-12-181-2/+2
|/
* Fix typosDimitris Apostolou2022-11-061-1/+1
|
* Merge branch 'rename_for_to_from' into 'main'Nick Mathewson2022-10-251-2/+2
|\ | | | | | | | | tor-cell: Rename for_client and for_relay See merge request tpo/core/arti!793
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 21:47:51 +0000