summaryrefslogtreecommitdiff
path: root/crates/tor-circmgr/src/lib.rs
Commit message (Collapse)AuthorAgeFilesLines
* Run cargo fmt one more time for good measure.Nick Mathewson2022-03-301-2/+2
|
* Refactor FirstHopId into type-differentiated formNick Mathewson2022-03-301-10/+22
| | | | | | | | | | | The FirstHopId type now records an enum that stores whether the hop is a guard or a fallback. This change addresses concerns about remembering to check the type or source of an Id before passing it down to the FallbackState or GuardSet. Making this change required an API change, so that dirmgr can report success/failure status without actually knowing whether it's using a fallback or a guard.
* Rename Guard=>FirstHop, GuardId=>FirstHopIdNick Mathewson2022-03-301-3/+3
| | | | | This is preparation for having separate GuardId and FirstHopId types that distinguish which back-end they index.
* Rename ExternalFailure => ExternalActivity.Nick Mathewson2022-03-301-3/+3
|
* Replace the fallback directories when they change in the config.Nick Mathewson2022-03-301-0/+5
| | | | | | The code here uses a new iterator type, since I couldn't find one of these on crates.io. I tried writing the code without it, but it was harder to follow and test.
* Add status tracking to FallbackDir.Nick Mathewson2022-03-301-0/+9
| | | | | | | | | | | We do this by creating a new FallbackSet type that includes status information, and updating the GuardMgr APIs to record success and failure about it when appropriate. We can use this to mark FallbackDirs retriable (or not). With this change, FallbackDir is now stored internally as a Guard in the GuardMgr crate. That's fine: the FallbackDir type really only matters for configuration.
* circmgr: Use guard-manager's view of the fallbacks when possible.Nick Mathewson2022-03-301-1/+4
| | | | | | | | | | | | | | | | | | If we're building a path with the guard manager involved, we now ask the guard manager to pick our first hop no matter what. We only pick from the fallback list ourselves if we're using the API with no guard manager. This causes some follow-on changes where we have to remember an OwnedChanTarget object in a TorPath we've built, and where we gain the ability to say we're building a path "from nothing extra at all." Those are all internal to the crate, though. Closes #220, by making sure that we use our guards to get a fresh netdir (if we can) before falling back to any fallbacks, even if our consensus is old. Compilation should be fixed in the next commit.
* Turn FallbackList into a real type, and store one in GuardMgr.Nick Mathewson2022-03-301-7/+12
| | | | | | | | | | | | | | The guard manager is responsible for handing out the first hops of tor circuits, keeping track of their successes and failures, and remembering their states. Given that, it makes sense to store this information here. It is not yet used; I'll be fixing that in upcoming commits. Arguably, this information no longer belongs in the directory manager: I've added a todo about moving it. This commit will break compilation on its own in a couple of places; subsequent commits will fix it up.
* Move fallback.rs into guardmgr.Nick Mathewson2022-03-301-1/+2
| | | | | | | This is the logical place for it, I think: the GuardMgr's job is to pick the first hop for a circuit depending on remembered status for possible first hops. Making this change will let us streamline the code that interacts with these objects.
* Make daemon tasks self-contained; introduce NetDirProvidereta2022-03-301-3/+251
| | | | | | | | | | | | | | | The various background daemon tasks that `arti-client` used to spawn are now handled inside their respective crates instead, with functions provided to spawn them that return `TaskHandle`s. This required introducing a new trait, `NetDirProvider`, which steals some functionality from the `DirProvider` trait to enable `tor-circmgr` to depend on it (`tor-circmgr` is a dependency of `tor-dirmgr`, so it can't depend on `DirProvider` directly). While we're at it, we also make some of the tasks wait for events from the `NetDirProvider` instead of sleeping, slightly increasing efficiency.
* move StreamIsolation to isolation moduletrinity-1686a2022-03-241-1/+2
|
* move isolation in separate moduletrinity-1686a2022-03-241-5/+3
|
* dirmgr: Note errors and inform the circmgr about them.Nick Mathewson2022-03-211-0/+11
| | | | | | Some error types indicate that the guard has failed as a dircache. We should treat these errors as signs to close the circuit, and to mark the guard as having failed.
* circmgr: Change API for using FallbackDirsNick Mathewson2022-03-211-3/+3
| | | | | | It'll soon more convenient to pass in FallbackDirs as a slice of references, rather than just a slice of FallbackDirs: I'm going to be changing how we handle these in tor-dirmgr.
* Merge branch 'test-isolation' into 'main'Nick Mathewson2022-03-171-0/+4
|\ | | | | | | | | new api for isolation See merge request tpo/core/arti!377
| * replace TODOs with documentationtrinity-1686a2022-03-161-1/+1
| |
| * testing new api for isolationTrinity Pointard2022-03-161-0/+4
| |
* | Make CircMgrConfig transparent (and make it a trait)Ian Jackson2022-03-161-20/+15
|/ | | | See commentary for the rationale.
* Disable clippy::clone_on_ref_ptrIan Jackson2022-02-241-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This lint is IMO inherently ill-conceived. I have looked for the reasons why this might be thought to be a good idea and there were basically two (and they are sort of contradictory): I. "Calling ‘.clone()` on an Rc, Arc, or Weak can obscure the fact that only the pointer is being cloned, not the underlying data." This is the wording from https://rust-lang.github.io/rust-clippy/v0.0.212/#clone_on_ref_ptr It is a bit terse; we are left to infer why it is a bad idea to obscure this fact. It seems to me that if it is bad to obscure some fact, that must be because the fact is a hazard. But why would it be a hazard to not copy the underlying data ? In other languages, faliing to copy the underlying data is a serious correctness hazard. There is a whose class of bugs where things were not copied, and then mutated and/or reused in multiple places in ways that were not what the programmer intended. In my experience, this is a very common bug when writing Python and Javascript. I'm told it's common in golang too. But in Rust this bug is much much harder to write. The data inside an Arc is immutable. To have this bug you'd have use interior mutability - ie mess around with Mutex or RefCell. That provides a good barrier to these kind of accidents. II. "The reason for writing Rc::clone and Arc::clone [is] to make it clear that only the pointer is being cloned, as opposed to the underlying data. The former is always fast, while the latter can be very expensive depending on what is being cloned." This is the reasoning found here https://github.com/rust-lang/rust-clippy/issues/2048 This is saying that *not* using Arc::clone is hazardous. Specifically, that a deep clone is a performance hazard. But for this argument, the lint is precisely backwards. It's linting the "good" case and asking for it to be written in a more explicit way; while the supposedly bad case can be written conveniently. Also, many objects (in our codebase, and in all the libraries we use) that are Clone are in fact simply handles. They contain Arc(s) (or similar) and are cheap to clone. Indeed, that is the usual case. It does not make sense to distinguish in the syntax we use to clone such a handle, whether the handle is a transparent Arc, or an opaque struct containing one or more other handles. Forcing Arc::clone to be written as such makes for code churn when a type is changed from Arc<Something> to Something: Clone, or vice versa.
* Merge remote-tracking branch 'origin/mr/340'Nick Mathewson2022-02-231-7/+6
|\
| * Make NoLock into BadApiUsage.Nick Mathewson2022-02-221-7/+6
| | | | | | | | | | | | To implement this, we had to refactor the tor_circmgr api for flushing state changes to disk, so that it checks if it has the lock, and only then tries to store.
* | Remove clippy::needless_borrow exception in CI.Nick Mathewson2022-02-201-1/+0
|/ | | | | This exception is no longer necessary now that the underlying CI bug is fixed.
* Move persistent state flush from client to circmgrYuan Lyu2022-02-151-1/+13
|
* Change deny(clippy::all) to warn(clippy::all).Nick Mathewson2022-02-141-1/+1
| | | | Closes #338.
* tor-circmgr: Introduce TargetPorts with a pretty Display implIan Jackson2022-02-041-1/+1
|
* Temporarily disable some clippy lints on nightlyIan Jackson2022-02-021-0/+1
|
* Rename FooRuntime to FooNativeTlsRuntime for consistency.Nick Mathewson2022-01-261-1/+1
|
* Merge branch 'ticket255' into 'main'eta2022-01-241-1/+1
|\ | | | | | | | | | | | | Refactor our Runtime implementations to allow replacement parts Closes #255 See merge request tpo/core/arti!251
| * Refactor Runtimes to use separate TLS implementations internally.Nick Mathewson2022-01-191-1/+1
| | | | | | | | | | This will make it easier to implement them using some other TLS provider as well, without having to duplicate all of our code.
* | Rename PathConfig::more_permissive_than()Nick Mathewson2022-01-201-1/+3
|/ | | | | | Since it implements a "<=" type relationship, it should be called "at_least_as_permissive_as()." Since it's a crate-private function, the long name isn't too bad.
* Merge branch 'ticket_178' into 'main'eta2022-01-101-0/+12
|\ | | | | | | | | | | | | Fix ticket 178: Don't use a NetDir until we have microdescriptors for all of our primary guards. Closes #178 See merge request tpo/core/arti!220
| * Add API to check if primary MDs are missing.Nick Mathewson2022-01-061-0/+12
| | | | | | | | | | | | | | We need this information to know if it's okay to migrate to a new NetDir, or if we need to download more information first. Part of #178.
* | tor-circmgr: Remove Arc around ClientCircIan Jackson2022-01-071-2/+2
|/ | | | | | See the new commentary text on `ClientCirc` for the rationale. Signed-off-by: Ian Jackson <[email protected]>
* extend lints to include 'clippy::all'Daniel Eades2021-12-281-0/+1
|
* Expand some comments about circuit expiration.Nick Mathewson2021-12-151-2/+5
| | | | | Emphasize that circuit expiration functions _decide whether to expire the circuit_, and don't expire it automatically.
* Add spawn_expiration_task function in circuit managerYuan Lyu2021-12-151-31/+2
|
* Make preemptive circuits reconfigurable.Nick Mathewson2021-12-071-19/+16
| | | | | | This required re-centralizing the configuration object for preemptive circuits, since previously the settings from it were a bit spread out over the crate.
* Make circuit_timing reconfigurable.Nick Mathewson2021-12-071-4/+2
|
* Add new configuration objects to reconfigure.Nick Mathewson2021-12-071-5/+9
| | | | | (These weren't in the codebase when I started the first version of this branch.)
* Allow on-the-fly changing of path_rulesNick Mathewson2021-12-071-5/+30
| | | | | | | | | | | | And now the complexity begins: when the user changes the path_rules, they not only want new circuits to obey those rules: they want _all new requests_ to be put onto circuits that obey those rules. That means that when the path rules become more restrictive, we need to retire all the circuits, and make sure that currently pending circuits aren't used for any requests. If it's any comfort, doing this was even more complicated in C tor. ;)
* Sketch API for reconfiguration.Nick Mathewson2021-12-071-0/+19
| | | | | | | This patch doesn't actually make anything reconfigurable, but it does create an API that will tell you "you can't change the value of that!" If the API looks reasonable, I can start making it possible to change the values of individual items.
* Clarify names and docs for predictive circuits.Nick Mathewson2021-12-071-3/+3
| | | | | Also, use humantime_serde, rather than a number of seconds, to indicate configuration time.
* Rename circuits_preemptive to preemptive_circuitsNick Mathewson2021-12-071-6/+6
| | | | | | This obeys a few conventions: * adjective before noun * config objects end with "config"
* Allow configurability on preemptive circuitsNeel Chauhan2021-12-071-11/+17
|
* Merge remote-tracking branch 'origin/mr/154'Nick Mathewson2021-11-301-3/+61
|\
| * Add tests & address review commentaryeta2021-11-301-9/+10
| |
| * Actually build preemptive circuits (and minor fixes)eta2021-11-291-0/+34
| | | | | | | | | | | | The new CircMgr::build_circuits_preemptively function actually causes preemptive circuits to be built; it gets called from arti-client, like the other daemon tasks the CircMgr has.
| * Introduce PreemptiveCircuitPredictor and TargetCircUsage::Preemptiveeta2021-11-231-2/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation for making Arti build circuits preemptively, this commit introduces `TargetCircUsage::Preemptive`, a circuit usage that works somewhat differently from other ones: it requires at least 2 circuits to exist that can exit the port it contains in order for an existing circuit to match against it (path-spec.txt § 2.1.1); if that's not the case, that usage will require building new circuits (in order that we build enough to have 2 available). This required refactoring how circuit reuse worked; now, `CircList::find_open` uses the new `AbstractSpec::find_supported` trait method, which we customize to implement the above check in the case of `Preemptive` circuit usages. To make that work, `OpenEntry` now takes two type parameters (the spec and circuit types), instead of taking a builder type parameter and using its associated types. (We also got rid of type constraints on that struct, yay!) A WIP implementation of a preemptive circuit predictor that implements path-spec.txt § 2.1.1 is also included, but this will require additional effort to wire it up with the `CircMgr` properly.
* | add semicolons if nothing returnedDaniel Eades2021-11-251-0/+1
|/
* Flatten enforce_distance into path_rules.Nick Mathewson2021-11-181-2/+2
| | | | Also use the path_rules name consistently throughout the code.
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 05:36:25 +0000