aboutsummaryrefslogtreecommitdiff
path: root/crates/tor-guardmgr/src/lib.rs
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove some outdated comments.Nick Mathewson2022-06-171-6/+0
| | | | | These all say, in one form or another, "there is no guard filtering; there is only one selection". That's now false.
* Tweak parameters in guardmgr tests to improve testnet behavior.Nick Mathewson2022-06-171-9/+18
| | | | | | | | | | | | | | The fake network we construct for these tests is small in ways that can sometimes cause weird behavior with guard filters. We fix this by adjusting the parameters of the guard selection algorithm accordingly in the tests. With these new parameters, #491 no longer occurs. This commit also adds comments to explain why the parameters are set as they are. Closes #491.
* GuardMgr: Support for multiple guard setsNick Mathewson2022-06-171-31/+96
| | | | | | | guard-spec.txt specifies that we have multiple separate samples of guards that we can use depending on whether the filter is restrictive or not. Here we implement the rules for switching between samples.
* Move set_filter into GuardMgrInner.Nick Mathewson2022-06-171-40/+33
| | | | | Convert its argument type to Option<&NetDir> to better match the rest of the API.
* GuardMgr: Also apply filters to fallback directories.Nick Mathewson2022-06-171-2/+5
|
* GuardMgr: remove disallowed addresses from returned FirstHops.Nick Mathewson2022-06-171-1/+2
| | | | | | | | Since a guard can have a bunch of addresses, and the guard is permitted if any one of those addresses is permitted, then we might decide to use a guard with some non-permitted addresses. Thus, we need to filter those addresses before returning the view of the guard as a FirstHop.
* GuardMgr: Remove old testing filter variant.Nick Mathewson2022-06-171-3/+9
| | | | | We don't need to restrict based on bits in the key id any longer, since we have a real filter.
* Guardmgr: Change the GuardFilter API.Nick Mathewson2022-06-171-1/+6
| | | | | The guard filter is now a set of restrictions that can be placed on allowable guards.
* Fix clippy::significant_drop_in_scrutinee warningsNick Mathewson2022-06-151-2/+2
| | | | | | | | | This is apparently a new warning from clippy nightly, documented in https://rust-lang.github.io/rust-clippy/master/index.html#significant_drop_in_scrutinee . I'm not in love with the temporary variables that this warning wants me to introduce, but it does seem like a decent way to avoid some kinds of deadlock.
* GuardMgr: Use installed netdir provider when we want a netdirNick Mathewson2022-06-071-20/+73
| | | | | | | | | | | Some of our existing code optionally takes a netdir from the caller. When it doesn't give us one, use the netdir from the installed NetDirProvider. (Possibly someday we should remove the NetDir arguments entirely. I'm deferring that because there are only two APIs affected, and because making this change would force us to rewrite a pretty large mess of unit tests.)
* Move responsibility for GuardMgr NetDir updates to GuardMgr.Nick Mathewson2022-06-071-0/+28
| | | | | | | | | | | Previously it was the job of a task in CircMgr to do this; but we're going to want to give GuardMgr full access to the latest NetDir for this, and for other code-simplification reasons. With this change I'm deprecating a couple of functions in tor-circmgr. It's no longer necessary for us to have an artificial external way for you to feed new NetDirs to a circmgr. (I could just remove them, but I want practice deprecating.)
* lints: Add let_unit_value allow to all cratesIan Jackson2022-05-311-0/+1
| | | | | From running add_warning, with manual picking of the right hunks/lines.
* lints: Add lint block delimiters to every crateIan Jackson2022-05-311-0/+2
| | | | | | This was the result of: maint/add_warning crates/*/src/{lib,main}.rs and then manually curating the results.
* Allow use of RetainMut, since we do not require Rust 1.61 yet.Nick Mathewson2022-05-241-0/+2
|
* impl_standard_builder: Test the Deserialize implIan Jackson2022-05-121-1/+1
| | | | | | | | | | Test the Deserialize impl of every config struct. This detects bugs like the one fixed in !502. The macro now becomes more complex because it needs to take options. Right now this tt-munching option parser is overkill, but this leave space for further options in the future.
* Rename impl_standard_builder from impl_default_via_builderIan Jackson2022-05-121-2/+2
| | | | | | | | | | | | I have Plans for this macro. In particular: * I have a wip branch which tests that the Builder can be deserialised from an empty config (ie, that config reading of a config with a blank section for this item works). * I think we should autogenerate $Config::builder(), and promote that, rather than $ConfigBuilder::default(). This macro could do that.
* No longer derive Default on three structs which derive BuilderIan Jackson2022-05-111-1/+4
|
* config derive attrs: Make builders serde, and validated structs notIan Jackson2022-05-051-1/+1
| | | | | | | | | | | | | | | * Builders additionally derive: Debug, Serialize, Deserialize. * Validated structs no longer derive: Serialize, Deserialize and all related attributes deleted. * As a consequence, all the `#[serde(deny_unknown_fields)]` are gone. That means that right now unknown fields are totally ignored. This is good for compatibility but poor for useability. Doing something better here is arti#417, in progress. * As a consequence, delete tor_dirmgr::retry::default_parallelism. (The default value was already duplicated into a builder attr.)
* GuardUsage: restrictions: Use list builderIan Jackson2022-05-041-11/+24
| | | | | | | | | | | | | | Although these do not appear in the config, it does have a builder. It seems sensible to get rid of this ad-hoc list manipulation site, and replace it with our standard list builder API. define_list_builder_helper requires that the builder element type be Deserialize. Currently GuardUsageRestriction is a transparent, public enum, so we aren't really exposing anything. We could introduce GuardUsageRestrictionBuilder now, but since it's not in the config and thereofore only in the public API of the lower crates, we can definitely put that off.
* squash! Bump every crate's edition to 2021.Nick Mathewson2022-04-251-1/+0
| | | | | Remove all `use` statements for `TryFrom` and `TryInto`. These are now redundant in Rust 2021.
* fix typo in doctrinity-1686a2022-04-251-1/+1
|
* GuardMgr: publish skew estimates.Nick Mathewson2022-04-121-9/+43
| | | | | | Instead of just having a function that recalculates the latest clock skew, instead recalculate the clock skew when it may have changed, and notify other processes via a postage::watch.
* Initial functions to determine and expose a clock skew estimate.Nick Mathewson2022-04-071-0/+17
| | | | | (This is just a placeholder; I'm going to make the functions smarter in the next commit.)
* GuardMgr: record clock skew information.Nick Mathewson2022-04-071-0/+20
| | | | (It is not yet actually used.)
* GuardMgr: Tests for note_external_{success,failure}.Nick Mathewson2022-04-051-0/+57
|
* Rewrite and fix Guard::copy_status_from.Nick Mathewson2022-04-051-4/+4
| | | | | | | | | | | | | | The old version of this function was error-prone, and in fact had errors: it was too easy to forget to add non-persistent fields, and that's exactly what we forgot in a few cases (`microdescriptor_missing`, `circ_history`, and `suspicious_behavior_warned`). The new version of this function consumes both of the incoming Guards, and constructs every field explicitly so that we can't forget to list any. Closes #429.
* GuardMgr: Track directory status and circuit status separately.Nick Mathewson2022-04-051-17/+41
| | | | | | | | | | | | | Previously, we treated successfully building a circuit to a guard as a "success", and any failure, including a directory cache failure, as a failure. With this change, guards now have separate success/failure and retry status for circuit usage and directory usage. This change is needed for guard-as-directory retry to have reasonable behavior. Otherwise, when a guard succeeds at building a circuit, that clears the directory-is-failing status and makes us retry the guards to quickly.
* Rename fallback::status::Status to DirStatus.Nick Mathewson2022-04-041-0/+1
| | | | It's about to be shared between fallbacks and guards.
* Fix some Rustdoc links.Nick Mathewson2022-03-301-2/+2
|
* Refactor FirstHopId into type-differentiated formNick Mathewson2022-03-301-80/+111
| | | | | | | | | | | The FirstHopId type now records an enum that stores whether the hop is a guard or a fallback. This change addresses concerns about remembering to check the type or source of an Id before passing it down to the FallbackState or GuardSet. Making this change required an API change, so that dirmgr can report success/failure status without actually knowing whether it's using a fallback or a guard.
* Rename Guard=>FirstHop, GuardId=>FirstHopIdNick Mathewson2022-03-301-18/+22
| | | | | This is preparation for having separate GuardId and FirstHopId types that distinguish which back-end they index.
* Rename FallbackSet => FallbackState.Nick Mathewson2022-03-301-2/+2
|
* Refactor select_guard_with_expand to use match and log errors.Nick Mathewson2022-03-301-10/+13
|
* Rename ExternalFailure => ExternalActivity.Nick Mathewson2022-03-301-9/+8
|
* Replace the fallback directories when they change in the config.Nick Mathewson2022-03-301-0/+8
| | | | | | The code here uses a new iterator type, since I couldn't find one of these on crates.io. I tried writing the code without it, but it was harder to follow and test.
* Add status tracking to FallbackDir.Nick Mathewson2022-03-301-20/+43
| | | | | | | | | | | We do this by creating a new FallbackSet type that includes status information, and updating the GuardMgr APIs to record success and failure about it when appropriate. We can use this to mark FallbackDirs retriable (or not). With this change, FallbackDir is now stored internally as a Guard in the GuardMgr crate. That's fine: the FallbackDir type really only matters for configuration.
* GuardMgr: Return fallback directories when appropriate.Nick Mathewson2022-03-301-26/+67
| | | | | | | | | | | We only do this when we fail to get a regular guard (e.g., because they're all down), and when we have been asked for a guard for a one-hop directory. Most of the change in this commit is plumbing to make all of the types match up. As before, compilation may still be broken.
* Fix typos in guardmgr/lib.rsNick Mathewson2022-03-301-2/+2
|
* Turn FallbackList into a real type, and store one in GuardMgr.Nick Mathewson2022-03-301-3/+13
| | | | | | | | | | | | | | The guard manager is responsible for handing out the first hops of tor circuits, keeping track of their successes and failures, and remembering their states. Given that, it makes sense to store this information here. It is not yet used; I'll be fixing that in upcoming commits. Arguably, this information no longer belongs in the directory manager: I've added a todo about moving it. This commit will break compilation on its own in a couple of places; subsequent commits will fix it up.
* guardmgr: move error types into new err.rs module.Nick Mathewson2022-03-301-43/+3
| | | | This is more in keeping with the rest of our code.
* Move fallback.rs into guardmgr.Nick Mathewson2022-03-301-0/+1
| | | | | | | This is the logical place for it, I think: the GuardMgr's job is to pick the first hop for a circuit depending on remembered status for possible first hops. Making this change will let us streamline the code that interacts with these objects.
* GuardMgr:: generalize GuardId::from_relay.Nick Mathewson2022-03-211-3/+3
|
* GuardMgr: new API to record guard problems from outside the crate.Nick Mathewson2022-03-211-1/+21
| | | | | We'll need this so that we can say "This guard behaved bogusly as a directory cache; try somebody else."
* GuardMgr: revise handling of "all guards are down".Nick Mathewson2022-03-211-8/+12
| | | | | | | | | | | | | | | | | | | When all guards are down, we would previously mark them all as up, and retry aggressively. But that's far too aggressive: if there's something wrong with our ability to connect to guards, it makes us hammer the network over and over, ignoring all the guard retry timeouts in practice. Instead, * We now allow the `pick_guard()` function to fail without automatically retrying. * We give different errors in the cases when all our guards are down, and when all of the guards selected by our active usage are down. * Our "guards are down" error includes the time at which a guard will next be retriable. This is part of #407.
* Replace manual Default impls with educe in tor-guardmgrIan Jackson2022-03-021-7/+4
|
* Disable clippy::clone_on_ref_ptrIan Jackson2022-02-241-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This lint is IMO inherently ill-conceived. I have looked for the reasons why this might be thought to be a good idea and there were basically two (and they are sort of contradictory): I. "Calling ‘.clone()` on an Rc, Arc, or Weak can obscure the fact that only the pointer is being cloned, not the underlying data." This is the wording from https://rust-lang.github.io/rust-clippy/v0.0.212/#clone_on_ref_ptr It is a bit terse; we are left to infer why it is a bad idea to obscure this fact. It seems to me that if it is bad to obscure some fact, that must be because the fact is a hazard. But why would it be a hazard to not copy the underlying data ? In other languages, faliing to copy the underlying data is a serious correctness hazard. There is a whose class of bugs where things were not copied, and then mutated and/or reused in multiple places in ways that were not what the programmer intended. In my experience, this is a very common bug when writing Python and Javascript. I'm told it's common in golang too. But in Rust this bug is much much harder to write. The data inside an Arc is immutable. To have this bug you'd have use interior mutability - ie mess around with Mutex or RefCell. That provides a good barrier to these kind of accidents. II. "The reason for writing Rc::clone and Arc::clone [is] to make it clear that only the pointer is being cloned, as opposed to the underlying data. The former is always fast, while the latter can be very expensive depending on what is being cloned." This is the reasoning found here https://github.com/rust-lang/rust-clippy/issues/2048 This is saying that *not* using Arc::clone is hazardous. Specifically, that a deep clone is a performance hazard. But for this argument, the lint is precisely backwards. It's linting the "good" case and asking for it to be written in a more explicit way; while the supposedly bad case can be written conveniently. Also, many objects (in our codebase, and in all the libraries we use) that are Clone are in fact simply handles. They contain Arc(s) (or similar) and are cheap to clone. Indeed, that is the usual case. It does not make sense to distinguish in the syntax we use to clone such a handle, whether the handle is a transparent Arc, or an opaque struct containing one or more other handles. Forcing Arc::clone to be written as such makes for code churn when a type is changed from Arc<Something> to Something: Clone, or vice versa.
* Remove clippy::needless_borrow exception in CI.Nick Mathewson2022-02-201-1/+0
| | | | | This exception is no longer necessary now that the underlying CI bug is fixed.
* Change deny(clippy::all) to warn(clippy::all).Nick Mathewson2022-02-141-1/+1
| | | | Closes #338.
* Add TODOs on uncertain points about time_since_last_trafficNick Mathewson2022-02-091-0/+1
| | | | | | This edge-case was there even before the migration of 595fe1ab881b94106649, but now it's more explicit and ought to be revisited.
* Remove the use of Mutex in channel unused_since timestampYuan Lyu2022-02-081-5/+10
|
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 06:37:10 +0000