summaryrefslogtreecommitdiff
path: root/crates/tor-guardmgr/src/lib.rs
Commit message (Collapse)AuthorAgeFilesLines
* Add the necessary APIs for bridge-based circuit construction.Nick Mathewson2022-09-261-0/+10
|
* GuardMgr/DirMgr: Add APIs for bridge descriptor listsNick Mathewson2022-09-261-0/+12
|
* GuardMgr: Add TODOs for bridge support.Nick Mathewson2022-09-261-0/+25
| | | | | | This covers only the most basic notions of working with bridges: that we need a separate set of guards, and that they have to come from the list of known bridges.
* A basic configuration type for a bridge.Nick Mathewson2022-09-261-0/+2
| | | | | | | This type goes in tor-guardmgr, since that's where decisions about circuits' first hops are made. There are a lot of "todo"s here for us to resolve.
* enable doc_auto_cfg feature on every crate when documenting for docs.rstrinity-1686a2022-08-241-0/+1
|
* Make sure all HasRelayIds constaints allow ?Sized.Nick Mathewson2022-08-101-14/+17
|
* Final (?) API revisions for tor-linkspecNick Mathewson2022-08-101-28/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this change, each individual identity type becomes optional. The functions that expose them unconditionally are now in a "legacy" trait that only some downstream types are expected to implement. There are new convenience APIs in HasRelayIds: * to return Option<&keytype>, * to see if one identity-set contains another. This commit will break several downstream crates! For the reviewer's convenience, I will put the fixes for those crates into a series of squash! commits on this one. tor-netdir ---------- Revise tor-netdir to accept optional identities. This required some caveats and workarounds about the cases where we have to deal with a key type that the tor-netdir code does not currently recognize at all. If we start to add more identity types in the future, we may well want more internal indices in this code. tor-proto --------- In order to make tor-proto support optional identities, there were fewer changes than I thought. Some "check" functions needed to start looking at "all the ids we want" rather than at "the two known IDs"; they also needed to accommodate that case where we don't have an ID that we demand. This change will also help with bridges, since we want to be able to connect to a bridge without knowing all of its IDs up front. The protocol currently _requires_ the two current ID types in some places. To deal with that, I added a new `MissingId` error. I also removed a couple of unconditional identity accessors for chanmgr; code should use `target().identity(...)` instead. tor-chanmgr ----------- This is an incomplete conversion: it does not at all handle channel targets without Ed25519 identities yet. It still uses those identities to index its internal map from identity to channel; but it gives a new `MissingId` error type if it's given a channel target that doesn't have one. We'll want to revise the map type again down the road when we implement bridges, but I'd rather not step on the channel-padding work in progress right now. tor-guardmgr ------------ This change is mostly a matter of constructing owned identity types more sensibly, rather than unwrapping them directly. There are some places marked with TODOs where we still depend on particular identity types, because of how the directory protocol works. This will need revisiting when we add bridge support here. tor-circmgr ----------- These changes are just relatively simple API changes in the tests.
* Introduce a RelayIdSet and use it in place of HashSet<RelayId>.Nick Mathewson2022-08-101-5/+3
| | | | | This makes lookups a little more efficient. I do with that HashSet just supported this use-case, but for now this seems our best option.
* Teach guard restrictions about RelayId.Nick Mathewson2022-08-101-3/+6
| | | | | This implementation is (sadly) too copy-heavy or now, because HashSet<RelayId> can't be indexed with RelayIdRef.
* guardmgr: Change APIs that used to take IDs.Nick Mathewson2022-08-021-14/+9
| | | | These are the other inspiration for #428.
* guardmgr: Replace IdPair with RelayIdsNick Mathewson2022-08-021-2/+2
| | | | I believe that this was the original motivation behind #428.
* tor-linkspec: Refactor out traits to represent a relay's ID set.Nick Mathewson2022-08-021-5/+6
| | | | | | | | | | | | | | We want the set of identities supported by a relay to be extensible in the future with minimal fuss; we'd also like to make working with these ID sets more convenient. To handle that, this commit adds a new trait for "Something that has the same IDs as a relay" and a new object for "an owned representation of a relay's IDs." This commit introduces a similar trait for "Something with a list of SocketAddr, like a relay has." There's no owned equivelent for that, since Vec<SocketAddr> is already a thing. Closes #428.
* GuardMgr: Update to use new NetDirProvider API.Nick Mathewson2022-07-261-3/+3
|
* Run maint/add_warning crates/*/src/{lib,main}.rsIan Jackson2022-06-231-0/+3
| | | | Update all lint blocks
* Rename guardset-selection function.Nick Mathewson2022-06-171-2/+7
| | | | Also, improve its documentation.
* Rename pick_guard, pick_guard_ext.Nick Mathewson2022-06-171-1/+1
| | | | | | Now the primary exposed function is `pick_guard` again. This commit is just function renaming.
* Refactor and document issues with modify_hop.Nick Mathewson2022-06-171-12/+2
| | | | | | | | | | | | At the site of modify_hop, we now have a comment explaining the internal-error issue. To make the internal error less likely, we lower the modify_hop call in lib.rs into GuardSet, where it can make sure it's looking at the same filter as was used to select the guard. The function name "pick_guard_ext" is not permanent; I'm going to rename it in the next commit.
* API-fix for extend_sample_as_needed.Nick Mathewson2022-06-171-10/+3
| | | | | | | | | Previously, the API said "you need to call this in a loop till it returns false". We did that in one place, but not another. With the introduction of filters, forgetting to loop here becomes a bug: so instead, change the behavior of extend_sample_as_needed so it handles looping itself.
* Remove some outdated comments.Nick Mathewson2022-06-171-6/+0
| | | | | These all say, in one form or another, "there is no guard filtering; there is only one selection". That's now false.
* Tweak parameters in guardmgr tests to improve testnet behavior.Nick Mathewson2022-06-171-9/+18
| | | | | | | | | | | | | | The fake network we construct for these tests is small in ways that can sometimes cause weird behavior with guard filters. We fix this by adjusting the parameters of the guard selection algorithm accordingly in the tests. With these new parameters, #491 no longer occurs. This commit also adds comments to explain why the parameters are set as they are. Closes #491.
* GuardMgr: Support for multiple guard setsNick Mathewson2022-06-171-31/+96
| | | | | | | guard-spec.txt specifies that we have multiple separate samples of guards that we can use depending on whether the filter is restrictive or not. Here we implement the rules for switching between samples.
* Move set_filter into GuardMgrInner.Nick Mathewson2022-06-171-40/+33
| | | | | Convert its argument type to Option<&NetDir> to better match the rest of the API.
* GuardMgr: Also apply filters to fallback directories.Nick Mathewson2022-06-171-2/+5
|
* GuardMgr: remove disallowed addresses from returned FirstHops.Nick Mathewson2022-06-171-1/+2
| | | | | | | | Since a guard can have a bunch of addresses, and the guard is permitted if any one of those addresses is permitted, then we might decide to use a guard with some non-permitted addresses. Thus, we need to filter those addresses before returning the view of the guard as a FirstHop.
* GuardMgr: Remove old testing filter variant.Nick Mathewson2022-06-171-3/+9
| | | | | We don't need to restrict based on bits in the key id any longer, since we have a real filter.
* Guardmgr: Change the GuardFilter API.Nick Mathewson2022-06-171-1/+6
| | | | | The guard filter is now a set of restrictions that can be placed on allowable guards.
* Fix clippy::significant_drop_in_scrutinee warningsNick Mathewson2022-06-151-2/+2
| | | | | | | | | This is apparently a new warning from clippy nightly, documented in https://rust-lang.github.io/rust-clippy/master/index.html#significant_drop_in_scrutinee . I'm not in love with the temporary variables that this warning wants me to introduce, but it does seem like a decent way to avoid some kinds of deadlock.
* GuardMgr: Use installed netdir provider when we want a netdirNick Mathewson2022-06-071-20/+73
| | | | | | | | | | | Some of our existing code optionally takes a netdir from the caller. When it doesn't give us one, use the netdir from the installed NetDirProvider. (Possibly someday we should remove the NetDir arguments entirely. I'm deferring that because there are only two APIs affected, and because making this change would force us to rewrite a pretty large mess of unit tests.)
* Move responsibility for GuardMgr NetDir updates to GuardMgr.Nick Mathewson2022-06-071-0/+28
| | | | | | | | | | | Previously it was the job of a task in CircMgr to do this; but we're going to want to give GuardMgr full access to the latest NetDir for this, and for other code-simplification reasons. With this change I'm deprecating a couple of functions in tor-circmgr. It's no longer necessary for us to have an artificial external way for you to feed new NetDirs to a circmgr. (I could just remove them, but I want practice deprecating.)
* lints: Add let_unit_value allow to all cratesIan Jackson2022-05-311-0/+1
| | | | | From running add_warning, with manual picking of the right hunks/lines.
* lints: Add lint block delimiters to every crateIan Jackson2022-05-311-0/+2
| | | | | | This was the result of: maint/add_warning crates/*/src/{lib,main}.rs and then manually curating the results.
* Allow use of RetainMut, since we do not require Rust 1.61 yet.Nick Mathewson2022-05-241-0/+2
|
* impl_standard_builder: Test the Deserialize implIan Jackson2022-05-121-1/+1
| | | | | | | | | | Test the Deserialize impl of every config struct. This detects bugs like the one fixed in !502. The macro now becomes more complex because it needs to take options. Right now this tt-munching option parser is overkill, but this leave space for further options in the future.
* Rename impl_standard_builder from impl_default_via_builderIan Jackson2022-05-121-2/+2
| | | | | | | | | | | | I have Plans for this macro. In particular: * I have a wip branch which tests that the Builder can be deserialised from an empty config (ie, that config reading of a config with a blank section for this item works). * I think we should autogenerate $Config::builder(), and promote that, rather than $ConfigBuilder::default(). This macro could do that.
* No longer derive Default on three structs which derive BuilderIan Jackson2022-05-111-1/+4
|
* config derive attrs: Make builders serde, and validated structs notIan Jackson2022-05-051-1/+1
| | | | | | | | | | | | | | | * Builders additionally derive: Debug, Serialize, Deserialize. * Validated structs no longer derive: Serialize, Deserialize and all related attributes deleted. * As a consequence, all the `#[serde(deny_unknown_fields)]` are gone. That means that right now unknown fields are totally ignored. This is good for compatibility but poor for useability. Doing something better here is arti#417, in progress. * As a consequence, delete tor_dirmgr::retry::default_parallelism. (The default value was already duplicated into a builder attr.)
* GuardUsage: restrictions: Use list builderIan Jackson2022-05-041-11/+24
| | | | | | | | | | | | | | Although these do not appear in the config, it does have a builder. It seems sensible to get rid of this ad-hoc list manipulation site, and replace it with our standard list builder API. define_list_builder_helper requires that the builder element type be Deserialize. Currently GuardUsageRestriction is a transparent, public enum, so we aren't really exposing anything. We could introduce GuardUsageRestrictionBuilder now, but since it's not in the config and thereofore only in the public API of the lower crates, we can definitely put that off.
* squash! Bump every crate's edition to 2021.Nick Mathewson2022-04-251-1/+0
| | | | | Remove all `use` statements for `TryFrom` and `TryInto`. These are now redundant in Rust 2021.
* fix typo in doctrinity-1686a2022-04-251-1/+1
|
* GuardMgr: publish skew estimates.Nick Mathewson2022-04-121-9/+43
| | | | | | Instead of just having a function that recalculates the latest clock skew, instead recalculate the clock skew when it may have changed, and notify other processes via a postage::watch.
* Initial functions to determine and expose a clock skew estimate.Nick Mathewson2022-04-071-0/+17
| | | | | (This is just a placeholder; I'm going to make the functions smarter in the next commit.)
* GuardMgr: record clock skew information.Nick Mathewson2022-04-071-0/+20
| | | | (It is not yet actually used.)
* GuardMgr: Tests for note_external_{success,failure}.Nick Mathewson2022-04-051-0/+57
|
* Rewrite and fix Guard::copy_status_from.Nick Mathewson2022-04-051-4/+4
| | | | | | | | | | | | | | The old version of this function was error-prone, and in fact had errors: it was too easy to forget to add non-persistent fields, and that's exactly what we forgot in a few cases (`microdescriptor_missing`, `circ_history`, and `suspicious_behavior_warned`). The new version of this function consumes both of the incoming Guards, and constructs every field explicitly so that we can't forget to list any. Closes #429.
* GuardMgr: Track directory status and circuit status separately.Nick Mathewson2022-04-051-17/+41
| | | | | | | | | | | | | Previously, we treated successfully building a circuit to a guard as a "success", and any failure, including a directory cache failure, as a failure. With this change, guards now have separate success/failure and retry status for circuit usage and directory usage. This change is needed for guard-as-directory retry to have reasonable behavior. Otherwise, when a guard succeeds at building a circuit, that clears the directory-is-failing status and makes us retry the guards to quickly.
* Rename fallback::status::Status to DirStatus.Nick Mathewson2022-04-041-0/+1
| | | | It's about to be shared between fallbacks and guards.
* Fix some Rustdoc links.Nick Mathewson2022-03-301-2/+2
|
* Refactor FirstHopId into type-differentiated formNick Mathewson2022-03-301-80/+111
| | | | | | | | | | | The FirstHopId type now records an enum that stores whether the hop is a guard or a fallback. This change addresses concerns about remembering to check the type or source of an Id before passing it down to the FallbackState or GuardSet. Making this change required an API change, so that dirmgr can report success/failure status without actually knowing whether it's using a fallback or a guard.
* Rename Guard=>FirstHop, GuardId=>FirstHopIdNick Mathewson2022-03-301-18/+22
| | | | | This is preparation for having separate GuardId and FirstHopId types that distinguish which back-end they index.
* Rename FallbackSet => FallbackState.Nick Mathewson2022-03-301-2/+2
|
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 07:03:29 +0000