summaryrefslogtreecommitdiff
path: root/crates/tor-dirmgr/src/state.rs
Commit message (Collapse)AuthorAgeFilesLines
* tor-rtcompat: CompoundRuntime: Add a CoarseTimeProvider, and implIan Jackson2024-03-251-1/+1
| | | | | | In all the uses in-crate, this is just a RealCoarseTimeProvider. Now all the compound runtimes impl CoarseTimeProvider.
* Run maint/add_warning.Nick Mathewson2024-03-131-0/+1
|
* tor-dirmgr: Rename DirMgrConfig.cache_path to cache_dirIan Jackson2023-12-041-1/+1
| | | | | | This variable contains precisely the value of cache_dir from arti_client::config::StorageConfig and it should therefore have the same name.
* arti-client: add exit selection with GeoIP country codeseta2023-09-181-0/+8
| | | | | | | | | | | | | | | | | | | | This threads the country codes work through the rest of the codebase: - `tor-dirmgr` will now enable GeoIP with the embedded database when the `geoip` future is enabled - This can be extended later using the `DirMgrConfig` to allow specifying a custom database; this is not done here, though - `tor-circmgr`'s `SupportedCircUsage` and `TargetCircUsage` fields gain new `country_code` members to allow filtering circuits by country - These are `()` in builds where the `geoip` feature is not enabled -- doing it this way means we don't have to copy and paste huge swathes of code, since we can't use `#[cfg]` in patterns - `ExitPathBuilder` gains (hacked-in) support for choosing a relay with the correct country code - Due to the lack of conjuction, we just copy and paste a small bit, pending further refactoring - `StreamPrefs` now lets you specify a country code, letting embedders make use of the feature
* Run maint/add_warning to add lint block everywhereIan Jackson2023-08-231-0/+1
|
* Merge branch 'clippy-allow' into 'main'Ian Jackson2023-07-111-0/+1
|\ | | | | | | | | clippy: Allow some of our existing code patterns See merge request tpo/core/arti!1396
| * Run maint/add_warning to actually apply new lint allowsIan Jackson2023-07-101-0/+1
| |
* | rng ranges: Use gen_range_infallible() for Duration::ZERO..=TIan Jackson2023-07-101-3/+2
|/
* Merge branch 'event_report_everywhere' into 'main'Nick Mathewson2023-07-071-6/+2
|\ | | | | | | | | | | | | Throughout: Use event_report!() macros for reporting Errors. Closes #949 See merge request tpo/core/arti!1383
| * Throughout: Use *_report!() macros for reporting Errors.Nick Mathewson2023-07-071-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I identified the cases to replace by searching for the string `.report()`. There are a few that I didn't change: * A couple of cases that used anyhow::Error, * One case that reported two Errors. * Two cases in `tor_hsclient::err` that just did `error!("Bug: {}")`. I have also not audited the cases in `tor-hsclient` where we're using `tor_error::Report` manually. Nonetheless, closes #949.
* | rng ranges: Use inclusive Duration ranges in several placesIan Jackson2023-07-071-1/+1
|/ | | | | | | | | | | | | | Many of these call sites would panic if, somehow, the upper bound was zero. In most cases it is very complicated to see if whether this could happen. However, there is a better answer: Durations are (conceptually) dense, so picking the closed set (which includes its boundary) rather than the open one (which doesn't) will make little practical difference. So change four call sites to use `..=` instead of just `..`.
* dirmgr: use voting_period.Nick Mathewson2023-06-291-4/+1
|
* Downgrade and clarify message about dir replacment time.Nick Mathewson2023-05-081-8/+12
| | | | Closes #839
* Merge branch 'fix_802_core' into 'main'Ian Jackson2023-04-181-1/+6
|\ | | | | | | | | | | | | DirMgr: Detect that directory state is ready if it begins with all MDs Closes #802 See merge request tpo/core/arti!1126
| * DirMgr: Detect that directory state is ready if it begins with all MDsNick Mathewson2023-04-101-1/+6
| | | | | | | | | | | | | | | | | | | | | | Previously, we'd only call PendingNetDir::upgrade_if_necesessary when adding a microdescriptor. But if it began already having all of its descriptors (because we found them in the cache), we wouldn't actually upgrade it to a PendingNetDir::Yielding, which would make it unusable, and would make us schedule its reset time too far in the future. Fixes #802.
* | Use bool::then_some() as appropriateNick Mathewson2023-04-111-1/+1
|/ | | | | | Now that we require a version of Rust that allows `b.then_some(v)`, clippy complains about our use of `b.then(|| v)`.
* tor-netdoc: Change fill_from_previous_netdirIan Jackson2023-02-091-1/+1
| | | | | | | | | | | | | | | | * Remove the return value, which was not used anywhere. Also remove the code to calculate the return value. * Take an Arc<NetDir> rather than a reference. We are going to want this for HS support. This has no overall effect on the lifetime of the4 Arc, which was owned at the one call site and then imediately dropped. * Change the documentation to explain what the function's role is in the netdir API, rather than the fiddly details of what it actually does internally. Relegate the latter to a code comment. (When we have HS, this will do more, or, at least, make further arrangements.)
* Use ErrorReport - run rustfmtIan Jackson2023-01-301-1/+5
| | | | Split off for ease of review and possible rebase.
* Use ErrorReport for errors in warn! in tor-dirmgrIan Jackson2023-01-301-2/+2
|
* Allow clippy::unchecked_duration_subtraction in testsNick Mathewson2023-01-271-0/+1
| | | | | This panics on error, and we're fine with a panic on misbehavior in tests.
* Complete our migration to base64ct.Nick Mathewson2023-01-201-1/+2
| | | | | | | | | This is in lieu of upgrading to the latest base64 crate, which has a different API from the old one. Since we have to migrate either way, we might as well use base64ct everywhere. I don't think that most of these cases _require_ constant-time base64, but it won't hurt.
* test lint blocks: Do some semi-manuallyIan Jackson2022-12-121-0/+8
| | | | | | | This is the hunks from running the rune in maint/adhoc-add-lint-blocks but which require some subsequent manual fixup: usually, deleting now-superfluous outer allows, but in some cases manually putting back lints that the adhoc script deleted.
* Rename DirSkewTolerance to DirToleranceNick Mathewson2022-07-221-1/+1
| | | | | | This name is more accurate because we aren't only dealing with clock skew here: we're also trying to tolerate the case where the authorities fail to reach consensus for a while.
* Refactor most DirStatus users to use DirProgress.Nick Mathewson2022-06-131-16/+17
| | | | This is all crate-internal APIs, fortunately.
* Rename DirStatusInner to DirProgress.Nick Mathewson2022-06-131-4/+4
| | | | | | This is about to become only a _part_ of what defines a DirStatus: a DirStatus will also include a reset count, and some kind of info about how long we've gone without progress.
* DirMgr:: Remove Error::NoChange as redundant.Nick Mathewson2022-05-251-38/+16
| | | | | | | | Now that the relevant functions now report changed/not-changed status via a boolean out-parameter (see !527), there's no reason to have a separate NoChanged error case. Closes #484.
* Merge branch 'bug482' into 'main'eta2022-05-241-20/+105
|\ | | | | | | | | | | | | DirMgr: Stop load-from-cache process when there is no change. Closes #482 See merge request tpo/core/arti!527
| * DirMgr: Stop load-from-cache process when there is no change.Nick Mathewson2022-05-241-20/+105
| | | | | | | | | | | | | | | | | | | | | | | | Previously in !511 I had introduced a bug where, if there was an error more serious than "no change", that error would keep us from noticing that we had no change, and we'd loop until the safety counter ran out. Then we'd panic. This commit fixes the bug by reintroducing the `changed` boolean -- this time as an outparam for the add_from_* methods. Fixes #482.
* | fs-mistrust: make Mistrust have a corresponding Builder type.Nick Mathewson2022-05-241-1/+1
|/ | | | | This is an approximately minimal revision to get Builder in place; subsequent commits will clean up the API.
* Fix compilation with Rust 1.56.Nick Mathewson2022-05-171-3/+2
|
* DirMgr: Remove blocking_error return path.Nick Mathewson2022-05-171-26/+22
|
* DirMgr: Unify error return pathsNick Mathewson2022-05-171-84/+133
| | | | | | | | | | | | | | | | | We no longer have separate return paths for recoverable and fatal errors; instead, they are merged, and distinguished based on recovery actions. Since it is now possible for download() to give an error that should _not_ destroy the previous state, it takes `&mut Box<dyn DirState>`. This change unfortunately means that we can no longer call `state = state.advance()`, but instead have to do some mem::swap junk with poisoned values. Any better solution would be a good thing. Additionally, the reset() and advance() methods can no longer fail. There is still a separate return path for reset-triggering errors; I'm about to fix that.
* DirMgr: Remove special handling of "changed" booleanNick Mathewson2022-05-171-53/+43
|
* DirMgr: Start refactoring error handling.Nick Mathewson2022-05-171-1/+4
| | | | | | This commit adds a couple of new error types that we will soon want to distinguish, and a new way of classifying errors. These are not yet all used.
* Give an error if the cache violates If-Modified-Since.Nick Mathewson2022-05-161-7/+24
| | | | | This should be sufficient to detect several kinds of nefariousness that we'd previously overlooked.
* Add missing extend_tolerance to add_consensus_text.Nick Mathewson2022-05-161-0/+1
| | | | This should have gone in when we fixed #412
* Move consensus signature verification to add-document code.Nick Mathewson2022-05-161-22/+95
| | | | | | | | | | | Previously, we did this in `advance()`, but that wasn't so great: it meant that we could fail in the advance() code, whereas the calls to `advance()` treated errors as fatal. This treats failed verification as a blocking error that requires a reset. Fixes one aspect of #439.
* DirMgr: Add a way for a state to report a blocking error.Nick Mathewson2022-05-161-0/+5
| | | | | (A blocking error is one that means that the current bootstrap attempt has failed, and must be restarted.)
* Implement nonfatal errors in add_from_*Nick Mathewson2022-05-161-52/+91
|
* DirMgr: Let add_from_* distinguish non-fatal errorsNick Mathewson2022-05-161-30/+47
| | | | | | | Previously all errors were treated as non-fatal. The add_from_* implementations don't yet behave properly; I'll fix them in subsequent commits.
* DirMgr: make DocSource useful by having it include dirserver info.Nick Mathewson2022-05-161-17/+35
| | | | | | | | | Previously DocSource would tell you whether the document was from a local store or a cache server, but it wouldn't tell you _which_ server it came from. This change required adding DocSource as an argument to DirState::add_from_download.
* tor-dirmgr: update status reporting to consider skew toleranceNick Mathewson2022-05-111-0/+6
| | | | | | In our status reporting code, we consider an expired-but-still-usable directory still bootstrapped, but not 100% bootstrapped.
* Make reset_time() for incomplete directories more generous.Nick Mathewson2022-05-111-10/+35
| | | | | | | | | | | Since we want to be willing to use older consensuses, we don't necessarily want to reset a download just because the consensus is expired. This new behavior isn't ideal either; I've added a TODO that relates to #433. Related of #412
* Add DirSkewTolerance section to DirMgr configuration.Nick Mathewson2022-05-111-0/+2
| | | | | | | | | | | | | | | | | | | | This new section describes how much variance we accept when it comes to expired and not-yet-valid directory documents. (Currently, the only ones where this matters for are consensus documents and authority certificates.) A document that is invalid by no more than these tolerances is not _live_, but it can still be used. These tolerances serve two purposes: * First, they allow clients to run with a little more clock skew than they would tolerate otherwise. * Second, they allow clients to survive the situation where the authorities are unable to reach a consensus for a day or two. Compare with Tor's REASONABLY_LIVE_TIME and NETWORKSTATUS_ALLOW_SKEW constants; also compare with proposal 212. Closes #412.
* tor-dirmgr: small fixups for the bootstrapping refactoreta2022-05-101-11/+6
| | | | | | | - Some FIXMEs got removed or amended. - AddMicrodescs now yields a mutable reference, so we can use .drain() and reuse the allocation. - Some panics were downgraded to debug_asserts.
* tor-dirmgr/state.rs: take an object to get a netdir, not a netdireta2022-05-101-9/+24
| | | | | | | | | - Taking a previous netdir directly and keeping it around before we need it is a bit of a waste of memory, and also doesn't mesh well with how SharedMutArc works. - To remedy this, introduce a new trait `PreviousNetDir` and have the state machines take that instead. (I was a bit tempted to just pass in the SharedMutArc directly. Maybe I should've done that.)
* tor-dirmgr/state.rs: remove GetConsensusState::bodge_neweta2022-05-101-37/+12
| | | | - (Also fixes up some dirfilter stuff, whoops.)
* tor-dirmgr/state.rs: remove WriteNetDir, use filters directlyeta2022-05-101-97/+79
| | | | | - The only purpose of WriteNetDir was to provide a filter, which isn't necessary any more. Refactor to provide the filter directly.
* tor-dirmgr/state.rs: use the NetDirChange API instead of WriteNetDireta2022-05-101-243/+164
| | | | | | | | | | | - GetMicrodescsState now uses the NetDirChange API to propagate netdir changes, instead of modifying the netdir directly. - PendingNetDir was refactored in order to support this use case. - As a result, the netdir-related methods in WriteNetDir can be removed, leaving only the DirFilter for now. - add_from_cache() no longer takes a store, because nothing uses it. - (bodge: apply_netdir_changes() was put in a few places missed previously)
* tor-dirmgr/state.rs: add new NetDirChange API, consume iteta2022-05-101-0/+25
| | | | | | | | | | | | | - The new DirState::get_netdir_change() API lets the state machine export a NetDirChange: a request to either replace the current netdir, or add microdescs to it. - bootstrap.rs now consumes this new API, even though nothing implements it yet. - This will let us implement GetMicrodescsState without having to directly mutate the netdir. The calling code also handles checking the netdir against the circmgr for sufficiency, and updating the consensus metadata in the store, meaning the revised GetMicrodescsState will not have to perform these tasks.
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 23:28:29 +0000