summaryrefslogtreecommitdiff
path: root/crates/tor-dirmgr/src/lib.rs
Commit message (Collapse)AuthorAgeFilesLines
* Remove BootstrapAction::ImpossibleNick Mathewson2022-05-191-1/+1
| | | | It does nothing that Fatal does not. Suggested by @eta in review.
* DirMgr: Unify error return pathsNick Mathewson2022-05-171-13/+23
| | | | | | | | | | | | | | | | | We no longer have separate return paths for recoverable and fatal errors; instead, they are merged, and distinguished based on recovery actions. Since it is now possible for download() to give an error that should _not_ destroy the previous state, it takes `&mut Box<dyn DirState>`. This change unfortunately means that we can no longer call `state = state.advance()`, but instead have to do some mem::swap junk with poisoned values. Any better solution would be a good thing. Additionally, the reset() and advance() methods can no longer fail. There is still a separate return path for reset-triggering errors; I'm about to fix that.
* DirMgr: Improve display for DocSourceNick Mathewson2022-05-161-3/+11
| | | | (Also, implement Display for tor_dirclient::SourceInfo).
* DirMgr: make DocSource useful by having it include dirserver info.Nick Mathewson2022-05-161-4/+5
| | | | | | | | | Previously DocSource would tell you whether the document was from a local store or a cache server, but it wouldn't tell you _which_ server it came from. This change required adding DocSource as an argument to DirState::add_from_download.
* Resolve DOCDOC comments in tor-dirmgr.Nick Mathewson2022-05-121-4/+2
|
* Adjust if-modified-since field on the basis of tolerated skewNick Mathewson2022-05-111-26/+68
| | | | | | | | | | If we're happy with a directory from 3 days ago, we should say "if-modified-since 3 days ago". This patch is larger than I'd like, since I had to add &DirMgrConfig as an argument to the functions that make a consensus request. Closes #467.
* Add DirSkewTolerance section to DirMgr configuration.Nick Mathewson2022-05-111-2/+2
| | | | | | | | | | | | | | | | | | | | This new section describes how much variance we accept when it comes to expired and not-yet-valid directory documents. (Currently, the only ones where this matters for are consensus documents and authority certificates.) A document that is invalid by no more than these tolerances is not _live_, but it can still be used. These tolerances serve two purposes: * First, they allow clients to run with a little more clock skew than they would tolerate otherwise. * Second, they allow clients to survive the situation where the authorities are unable to reach a consensus for a day or two. Compare with Tor's REASONABLY_LIVE_TIME and NETWORKSTATUS_ALLOW_SKEW constants; also compare with proposal 212. Closes #412.
* tor-dirmgr: move apply_netdir_changes() to be a DirMgr methodeta2022-05-101-3/+75
|
* tor-dirmgr/state.rs: take an object to get a netdir, not a netdireta2022-05-101-3/+5
| | | | | | | | | - Taking a previous netdir directly and keeping it around before we need it is a bit of a waste of memory, and also doesn't mesh well with how SharedMutArc works. - To remedy this, introduce a new trait `PreviousNetDir` and have the state machines take that instead. (I was a bit tempted to just pass in the SharedMutArc directly. Maybe I should've done that.)
* tor-dirmgr/state.rs: remove GetConsensusState::bodge_neweta2022-05-101-6/+24
| | | | - (Also fixes up some dirfilter stuff, whoops.)
* tor-dirmgr/state.rs: use the NetDirChange API instead of WriteNetDireta2022-05-101-0/+1
| | | | | | | | | | | - GetMicrodescsState now uses the NetDirChange API to propagate netdir changes, instead of modifying the netdir directly. - PendingNetDir was refactored in order to support this use case. - As a result, the netdir-related methods in WriteNetDir can be removed, leaving only the DirFilter for now. - add_from_cache() no longer takes a store, because nothing uses it. - (bodge: apply_netdir_changes() was put in a few places missed previously)
* tor-dirmgr/state.rs: refactor GetConsensusState::neweta2022-05-101-2/+3
| | | | | | | | | | | | | - GetConsensusState::new now takes a set of parameters matching what it actually needs, instead of just taking a writedir. (It still *does* take a writedir, and indeed still uses it for basically everything, but that will eventually go away.) - Its call sites were updated. - Some tests now need to take a runtime, and got indented a lot as a result. - Resetting was made non-functional, because we need to thread through the parameters passed to GetConsensusState to all of the other states, too. This will happen in a later commit.
* tor-dirmgr: move DirState to state.rseta2022-05-101-75/+1
| | | | | | - Given that this is effectively an implementation detail, it doesn't really make sense to have it be in the crate root... - (also, we're going to change it a bunch now)
* tor-dirmgr: make note_request_* functions standaloneeta2022-05-101-64/+0
| | | | | - DirMgr::note_request_outcome and friends are now just standalone functions, taking a CircMgr.
* tor-dirmgr/bootstrap.rs: refactor query_into_requests, make it usedeta2022-05-101-49/+43
| | | | | | | - query_into_requests is now called make_requests_for_documents, and does the &[DocId] -> DocQuery conversion internally instead. - DirMgr::make_consensus_request and DirMgr::query_into_requests are now gone. The tests use the new functions, as does fetch_multiple.
* tor-dirmgr: move query_into_requests into bootstrap.rseta2022-05-101-43/+8
| | | | | | | - There's no good reason these functions needed to be part of the dirmgr, apart from needing a runtime and a store. - However, we can just add those as arguments and copy them over. This commit does that.
* tor-dirmgr/bootstrap.rs: refactor load_all -> load_documents_from_storeeta2022-05-101-2/+5
| | | | | | | | - Function renamed & docs tidied up a bit - Function signature now takes what it needs (immutable &dyn Store instead of mutex, slice instead of Vec) and nothing more - DocQuery::load_documents_into was also renamed DocQuery::load_from_store_into and given similar treatment
* tor-dirmgr/lib.rs: move DirMgr::load_documents_into to DocQueryeta2022-05-101-55/+3
| | | | | Move the function out of DirMgr, giving it a new &Mutex<DynStore> argument instead.
* tor-dirmgr: make DownloadScheduleBuilder publicIan Jackson2022-05-041-1/+1
| | | | | | This type was returned by the public DownloadSchedule::builder function. But the only thing that seems to have noticed that the type name itself wasn't exported, was rustdoc. Hmmm.
* Change builder list APIIan Jackson2022-05-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The new API is (roughly) as discussed in https://gitlab.torproject.org/tpo/core/arti/-/issues/451 This is quite a large commit and it is not convenient to split it up. It contains the following changes: * Redo the list builder and accessor macros implemnetation, including docs and tests. * Change uses of define_list_config_builder. In each case: - Move the docs about the default value to the containing field. - Remove the other docs (which were just recapitulations, and are now not needed since the ListBuilder is no longer public). - Rewmove or replace `pub` in the define_list_builder_helper call, so that the builder is no longer public. - Change the main macro call site to use define_list_builder_helper. - Add a call to define_list_builder_accessors. * Make the module `list_builder` pub so that we have somewhere to put the overview documentation. * Consequential changes: - Change `outer.inner().replace(X)` to `outer.set_inner(X)` - Consequential changes to imports (`use` statements).
* DirMgrConfig: Remove unnecessary accessorsIan Jackson2022-04-261-4/+4
| | | | | | | These fields are pub. Retain two convenience accessor functions that access sub-fields of network.
* DownloadSchedule: Abolish accessors in DownloadScheduleConfigIan Jackson2022-04-261-1/+1
| | | | We can just make the fields pub(crate).
* Introduce AuthorityListBuilder in NetworkConfigBuilderIan Jackson2022-04-251-1/+1
| | | | | | | | | NetworkConfigBuilder needs to not contain any validated structs, so that its serde does not expose the validated details. AuthorityListBuilder is what ought to go here - and it contains Vec<AuthorityBuilder>, not Vec<Authority>. As a consequence, many places now deal with AuthorityBuilder, rather than Authority.
* Refactor FirstHopId into type-differentiated formNick Mathewson2022-03-301-6/+4
| | | | | | | | | | | The FirstHopId type now records an enum that stores whether the hop is a guard or a fallback. This change addresses concerns about remembering to check the type or source of an Id before passing it down to the FallbackState or GuardSet. Making this change required an API change, so that dirmgr can report success/failure status without actually knowing whether it's using a fallback or a guard.
* Rename Guard=>FirstHop, GuardId=>FirstHopIdNick Mathewson2022-03-301-4/+4
| | | | | This is preparation for having separate GuardId and FirstHopId types that distinguish which back-end they index.
* Rename ExternalFailure => ExternalActivity.Nick Mathewson2022-03-301-4/+4
|
* Add status tracking to FallbackDir.Nick Mathewson2022-03-301-0/+11
| | | | | | | | | | | We do this by creating a new FallbackSet type that includes status information, and updating the GuardMgr APIs to record success and failure about it when appropriate. We can use this to mark FallbackDirs retriable (or not). With this change, FallbackDir is now stored internally as a Guard in the GuardMgr crate. That's fine: the FallbackDir type really only matters for configuration.
* Move fallback.rs into guardmgr.Nick Mathewson2022-03-301-1/+1
| | | | | | | This is the logical place for it, I think: the GuardMgr's job is to pick the first hop for a circuit depending on remembered status for possible first hops. Making this change will let us streamline the code that interacts with these objects.
* Make daemon tasks self-contained; introduce NetDirProvidereta2022-03-301-16/+9
| | | | | | | | | | | | | | | The various background daemon tasks that `arti-client` used to spawn are now handled inside their respective crates instead, with functions provided to spawn them that return `TaskHandle`s. This required introducing a new trait, `NetDirProvider`, which steals some functionality from the `DirProvider` trait to enable `tor-circmgr` to depend on it (`tor-circmgr` is a dependency of `tor-dirmgr`, so it can't depend on `DirProvider` directly). While we're at it, we also make some of the tasks wait for events from the `NetDirProvider` instead of sleeping, slightly increasing efficiency.
* Merge branch 'no-system-time' into 'main'eta2022-03-301-8/+10
|\ | | | | | | | | | | | | Don't use SystemTime::now() Closes #306 See merge request tpo/core/arti!365
| * use wallclock where possible in teststrinity-1686a2022-02-261-8/+10
| |
* | Abolish filter::DynFilter in favour of transparent DirFilterIan Jackson2022-03-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | There are two reasons why the DynFilter newtype might be needed: 1. To impl Default. But we don't need it to impl Default since we can have an accessor which does the defaulting. 2. To hide the API. But this is usrely an unstable API. Just writing Arc<dyn> gets rid of a lot of unnecessary boilerplate and conversion code.
* | dirmgr: Initial DirFilter code.Nick Mathewson2022-03-241-0/+11
| | | | | | | | | | | | This code sits behind a feature flag, and can be used to modify directories before storing them. This is part of the implementation for #397.
* | Expand some comments based on review from @diziet.Nick Mathewson2022-03-211-0/+4
| |
* | Fix build with Rust 1.53.Nick Mathewson2022-03-211-6/+9
| | | | | | | | Pattern bindings after `@` weren't stabilized then :/
* | dirmgr: Note errors and inform the circmgr about them.Nick Mathewson2022-03-211-0/+48
| | | | | | | | | | | | Some error types indicate that the guard has failed as a dircache. We should treat these errors as signs to close the circuit, and to mark the guard as having failed.
* | Merge branch 'config-partials-transparent' into 'main'Ian Jackson2022-03-171-6/+6
|\ \ | | | | | | | | | | | | Absolish builders for CircMgrConfig and DirMgrConfig See merge request tpo/core/arti!417
| * | DirMgrConfig: abolish builder; make it transparent and exhaustiveIan Jackson2022-03-161-6/+6
| | | | | | | | | | | | See rationale in the comment.
* | | dirmgr: Always send if-modified-since on consensus documents.Nick Mathewson2022-03-161-10/+49
|/ / | | | | | | | | | | | | | | | | | | We never want a consensus document that's super-old, since we would reject it immediately for being too old. Also, never send an if-modified-since that's so old that we'd reject the response. Closes #403
* | Follow-up from arti!318Nick Mathewson2022-03-111-1/+1
| | | | | | | | Make update_config only conditionally exported; add semver-status update.
* | Expose APIs for external DirProviderChristian Grigis2022-03-111-1/+4
| |
* | Merge branch 'dir-provider-redux' into 'main'Ian Jackson2022-03-021-1/+63
|\ \ | | | | | | | | | | | | Alternative DirProvider setup See merge request tpo/core/arti!347
| * | DirProvider: Fix infinite recursion bugNick Mathewson2022-02-251-4/+4
| | |
| * | Un-parameterize DirProvider.Nick Mathewson2022-02-231-15/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch removes the EventStream associated type and the Runtime parameter. The Runtime parameter wasn't actually used for anything, and the EventStream was easy enough to replace with a BoxStream in this case. Also replaced DirBootstrapEvents with a BoxStream to avoid tying anything to our backend.
| * | Add basic DirProvider trait, use it in clientChristian Grigis2022-02-231-0/+68
| | |
* | | Disable clippy::clone_on_ref_ptrIan Jackson2022-02-241-1/+0
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This lint is IMO inherently ill-conceived. I have looked for the reasons why this might be thought to be a good idea and there were basically two (and they are sort of contradictory): I. "Calling ‘.clone()` on an Rc, Arc, or Weak can obscure the fact that only the pointer is being cloned, not the underlying data." This is the wording from https://rust-lang.github.io/rust-clippy/v0.0.212/#clone_on_ref_ptr It is a bit terse; we are left to infer why it is a bad idea to obscure this fact. It seems to me that if it is bad to obscure some fact, that must be because the fact is a hazard. But why would it be a hazard to not copy the underlying data ? In other languages, faliing to copy the underlying data is a serious correctness hazard. There is a whose class of bugs where things were not copied, and then mutated and/or reused in multiple places in ways that were not what the programmer intended. In my experience, this is a very common bug when writing Python and Javascript. I'm told it's common in golang too. But in Rust this bug is much much harder to write. The data inside an Arc is immutable. To have this bug you'd have use interior mutability - ie mess around with Mutex or RefCell. That provides a good barrier to these kind of accidents. II. "The reason for writing Rc::clone and Arc::clone [is] to make it clear that only the pointer is being cloned, as opposed to the underlying data. The former is always fast, while the latter can be very expensive depending on what is being cloned." This is the reasoning found here https://github.com/rust-lang/rust-clippy/issues/2048 This is saying that *not* using Arc::clone is hazardous. Specifically, that a deep clone is a performance hazard. But for this argument, the lint is precisely backwards. It's linting the "good" case and asking for it to be written in a more explicit way; while the supposedly bad case can be written conveniently. Also, many objects (in our codebase, and in all the libraries we use) that are Clone are in fact simply handles. They contain Arc(s) (or similar) and are cheap to clone. Indeed, that is the usual case. It does not make sense to distinguish in the syntax we use to clone such a handle, whether the handle is a transparent Arc, or an opaque struct containing one or more other handles. Forcing Arc::clone to be written as such makes for code churn when a type is changed from Arc<Something> to Something: Clone, or vice versa.
* | dirmgr: add Store traittharvik2022-02-231-8/+9
|/
* Merge branch 'remaining-errors'Nick Mathewson2022-02-171-0/+18
|\
| * dirmgr: Remember where netdocs came from.Nick Mathewson2022-02-161-0/+18
| | | | | | | | | | This isn't complete (see TODO), but it's enough to let us report the right ErrorKind if something fails to parse.
* | arti-client: add ability to automatically bootstrapeta2022-02-161-2/+2
|/ | | | | | | | | | | | | The new `BootstrapBehavior` enum controls whether an unbootstrapped `TorClient` will bootstrap itself automatically (`Ondemand`) when an attempt is made to use it, or whether the user must perform bootstrapping themselves (`Manual`). The `lazy-init` example shows how you could write a simple `get_tor_client()` function that used a global `OnceCell` to share a Tor client across an entire application with this API. closes arti#278
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 07:56:51 +0000