summaryrefslogtreecommitdiff
path: root/crates/tor-guardmgr/src/lib.rs
Commit message (Collapse)AuthorAgeFilesLines
* Remove clippy::needless_borrow exception in CI.Nick Mathewson2022-02-201-1/+0
| | | | | This exception is no longer necessary now that the underlying CI bug is fixed.
* Change deny(clippy::all) to warn(clippy::all).Nick Mathewson2022-02-141-1/+1
| | | | Closes #338.
* Add TODOs on uncertain points about time_since_last_trafficNick Mathewson2022-02-091-0/+1
| | | | | | This edge-case was there even before the migration of 595fe1ab881b94106649, but now it's more explicit and ought to be revisited.
* Remove the use of Mutex in channel unused_since timestampYuan Lyu2022-02-081-5/+10
|
* Make SpawnError wrappers contain a 'spawning' stringNick Mathewson2022-02-041-11/+25
| | | | | (By our convention, these errors should say what we were trying to spawn when the error occurred.)
* errors: impl HasKind for GuardMgrErrorIan Jackson2022-02-041-0/+12
|
* spawn errors: tor-guardmgr: Use formulaic patternIan Jackson2022-02-041-2/+2
| | | | This makes this like all the others, and is marginally shorter
* tor_persist::Error: impl HasKind and adjust commentsIan Jackson2022-02-041-1/+2
| | | | | And change the comments to slightly reinterpret these errors, to relate to the circumstances rather than error generation site.
* Temporarily disable some clippy lints on nightlyIan Jackson2022-02-021-0/+1
|
* guardmgr: Use a better persistent data formatNick Mathewson2022-01-111-50/+136
| | | | | | | | | | | | | | | | | Previously we stored only one guard sample, in a state file called "default_guards". That's not future-proof, since we want to have multiple samples in the future. (`guard-spec.txt` specifies separate samples for highly restrictive filters, and for bridge usage.) This patch changes our behavior so that we can store multiple samples in a new "guards" file. I had thought about automatically migrating from the previous file format and location, but I don't think that's necessary given our current (lack of) stability guarantees. Closes #176.
* Add API to check if primary MDs are missing.Nick Mathewson2022-01-061-1/+11
| | | | | | | We need this information to know if it's okay to migrate to a new NetDir, or if we need to download more information first. Part of #178.
* extend lints to include 'clippy::all'Daniel Eades2021-12-281-0/+1
|
* Remove unused started_at PendingRequestNeel Chauhan2021-12-141-7/+2
|
* Merge branch 'bug183a_redux' into 'main'eta2021-12-071-6/+14
|\ | | | | | | | | | | | | Squash, refactor, and test !139 (Don't use same family as exit when picking a guard) Closes #183 See merge request tpo/core/arti!173
| * Use hashset _inside_ GuardRestriction.Nick Mathewson2021-12-061-1/+3
| | | | | | | | This approach saves us from a linear search when picking guards.
| * Change GuardUsage to have Vec of restrictions.Nick Mathewson2021-12-061-7/+13
| | | | | | | | | | | | | | | | There's not much reason to use a HashSet here, since we're just going over the whole list. This reverts commit 16e8489abbea1581b8e2 and does a little more refactoring.
| * Implement guard family restriction codeNeel Chauhan2021-12-061-3/+3
| |
* | Resolve roughly half of the XXXXs.Nick Mathewson2021-12-061-1/+3
|/ | | | | | | | We want to only use TODO in the codebase for non-blockers, and open tickets for anything that is a bigger blocker than a TODO. These XXXXs seem like definite non-blockers to me. Part of arti#231.
* add semicolons if nothing returnedDaniel Eades2021-11-251-3/+4
|
* More typo fixes that I forgot to save :(Nick Mathewson2021-11-241-3/+3
|
* Avoid a warning about retain_mut() in nightly.Nick Mathewson2021-11-231-2/+2
| | | | | | | Rust nightly claims that Vec might get its own retain_mut method, which would potentially conflict with the extension method we've grabbed from the retain_mut crate. To solve this, we're calling the method explicitly.
* Use guard-extreme-restriction-percentNeel Chauhan2021-11-231-3/+8
|
* In guard filtering code, warn if the filter is too small according to guard ↵Neel Chauhan2021-11-221-1/+8
| | | | params
* Move top-level configuration downwards from `arti` to `arti-config`.Nick Mathewson2021-11-181-0/+1
| | | | | | | | To do this at all neatly, I had to split out `tor-config` from `arti-config` again, and putting the lower level stuff (paths, builder errors) into tor-config. I also changed our use of derive_builder to always use a common error type, to avoid error type proliferation.
* Fix typosDimitris Apostolou2021-11-121-1/+1
|
* Merge branch 'bug219'Nick Mathewson2021-11-021-8/+4
|\
| * Refactor tor-guardmgr's inter-task communication.Nick Mathewson2021-11-021-8/+4
| | | | | | | | | | | | | | | | | | This is based on @eta's patches for !118 and !119: Since we already have an unbounded channel, we don't need to use an elaborate mess of one-shot senders. We can just use the unbounded_send() method, which also lets us enqueue a message without having to await. Closes #219.
* | tor-circmgr: test DirPathBuilder with GuardMgr.Nick Mathewson2021-11-021-1/+2
| |
* | Add a comment to explain the computation of net_has_been_down.Nick Mathewson2021-11-021-0/+5
| |
* | Mark primary guards as retriable when we come back online.Nick Mathewson2021-11-021-47/+40
|/ | | | | | | | | | | | We define "coming back online" as happening when a guard attempt succeeds, if that attempt that was launched when we seemed to be offline. We define "seeming to be offline" as having all of our primary guards marked unreachable, and having received no incoming network traffic in a while. Closes #216.
* Update our disclaimers and limitations sections.Nick Mathewson2021-10-271-0/+1
|
* Implement a "lightweight" form of pathbias detection.Nick Mathewson2021-10-261-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | We now track, for every guard: the total number of successful circuits we've built through it, along with the total number of "indeterminate" circuits. Recall that a circuit's status is "indeterminate" if it has failed for a reason that _might_ be the guard's fault, or might not be the guard's fault. For example, if extending to the second hop of the circuit fails, we have no way to know whether the guard deliberately refused to connect there, or whether the second hop is just offline. But we don't want to forgive all indeterminate circuit failures: if we did, then a malicious guard could simply reject any second hops that it didn't like, thereby filtering the client into a chosen set of circuits. As a stopgap solution, this patch now makes guards become permanently disabled if the fraction of their circuit failures becomes too high. See also general-purpose path bias selection (arti#65), and Mike's idea for changing the guard reachability definition (torspec#67). This patch doesn't do either of those. Closes #185.
* Merge branch 'share_state'Nick Mathewson2021-10-211-11/+39
|\
| * Implement the guard side of shared state directories.Nick Mathewson2021-10-211-2/+18
| |
| * Finish the timeout-inference side of shared state.Nick Mathewson2021-10-201-2/+19
| |
| * Replace the return type of StorageMgr::try_lock with a tristateNick Mathewson2021-10-201-1/+1
| | | | | | | | | | It's useful to know now only if we now have the lock, but also if we just got it for the first time.
| * Initial work on periodically reloading state.Nick Mathewson2021-10-191-11/+6
| | | | | | | | | | We can use this in the case where we don't get the lock on the state file, because another process is running.
* | Fix most warnings from nightly.Nick Mathewson2021-10-191-0/+1
|/ | | | (One represents code that I forgot to write.)
* Use better reporting for guard status.Nick Mathewson2021-10-131-2/+2
| | | | | | | | | | | | | The previous code would report all failures to build a circuit as failures of the guard. But of course that's not right: If we fail to extend to the second or third hop, that might or might not be the guard's fault. Now we use the "pending status" feature of the GuardMonitor type so that an early failure is attributed to the guard, but a later failure is attributed as "Indeterminate". Only a complete circuit is called a success. We use a new "GuardStatusHandle" type here so that we can report the status early if there is a timeout.
* Rename GuardStatusMsg, make it public, add an `Indeterminate` case.Nick Mathewson2021-10-131-5/+5
|
* Actually select guards for directory circuits.Nick Mathewson2021-10-131-1/+2
|
* Make the guard selection function return a more useful type.Nick Mathewson2021-10-111-4/+43
|
* Change the GuardMgr APIs to no longer be async.Nick Mathewson2021-10-101-32/+18
|
* Use an mpsc::unbounded() channel in GuardMgr.Nick Mathewson2021-10-101-24/+18
| | | | | | | | | | | | The advantage here is that we no longer have to use a futures-aware Mutex, or a blocking send operation, and therefore can simplify a bunch of the GuardMgr APIs to no longer be async. That'll avoid having to propagate the asyncness up the stack. The disadvantage is that unbounded channels are just that: nothing in the channel prevents us from overfilling it. Fortunately, the process that consumes from the channel shouldn't block much, and the channel only gets filled when we're planning a circuit path.
* enable checked_conversions lint.Nick Mathewson2021-10-091-0/+1
|
* Normalize tor-guardmgr warningsNick Mathewson2021-10-091-6/+6
|
* Note a possible heisenbug in a unit test.Nick Mathewson2021-10-081-0/+6
|
* Add a few tracing calls to tor-guardmgr.Nick Mathewson2021-10-081-5/+28
|
* Resolve small issues and XXXX/TODO comments in GuardMgr.Nick Mathewson2021-10-071-29/+39
| | | | | By the time I merge this, most of the comments should have tickets to go with them.
* Tests for top-level GuardMgr.Nick Mathewson2021-10-071-4/+144
| | | | | | | Also, refactor our message handling to be more like the tor_proto reactors. The previous code had a bug where, once the stream of events was exhausted, we wouldn't actually get any more notifications.
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 07:36:49 +0000