| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
This caps the PoW effort during sorting, rather than at intake.
This allows us to record efforts that are capped in our metrics
histogram while only recording metrics after the PoW solve has actually
been verified.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
Three is a concern that a DegradedReachable status could overwrite a
previous Broken status. A nicer solution could be to add a function to
StatusSender that only will change the status to a "more or equally
severe" status.
However, I am a little dubious about using the DegradedReachable status
for PoW in general, since it has a better documented meaning for IPTs
than it does for PoW.
|
| | |
|
| |
|
|
| |
Now that this is public, this is prudent.
|
| |
|
|
|
|
| |
I'm not 100% on this being here, it seems like it might want to be a
option for all onion services, rather than per-service. However, this is
good enough for now.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
I have thought about this and come to the conclusion (which is what I
suspected when I wrote it) that the current behaviour is correct.
The attack described is completely impractical (the space of nonces is
very large), and checking whether a nonce is a replay is cheaper than
verifying a PoW solve, so we want to do that first.
Splitting this into something like the following:
* Check replay log without updating
* Check that solve is valid
* Update replay log
Would require adding a somewhat dangerous API to the ReplayLog, and
requires doing more work per request for something that isn't even a
practical attack, AFAICT.
|
| | |
|
| | |
|
| |
|
|
|
| |
We restored the seeds, but doing so is counterproductive if we don't
also recreate the verifiers needed to check solves for those seeds.
|
| | |
|
| | |
|
| |
|
|
|
|
| |
This does not currently allow this option to be changed at runtime,
although the code is structured so that allowing it to be changed at
runtime won't be too hard. This is tracked by #2082.
|
| | |
|
| |
|
|
|
|
|
|
| |
This disentangles the ReplyLog from the IptManager.
This will allow us to make the InternalPowError type more public (in
order to use it in the OnionServiceStatus code) without also having to
make the CreateIptError type more public.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
First, run
```
git grep -l "^edition =" |
xargs perl -i -pe 's/^edition *=.*/edition = "2024"/;'
```
Second, manually verify that all Cargo.toml files have changed,
and nothing else has changed.
Third, run cargo fmt again.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
These now `warn!` and cleanly exit their respective threads on error,
instead of panicking.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
This just pushes around where the panic is for now, but enables better
handling of this error, and it makes it clearer that this panic will
only stop this thread.
|
| | |
|
| |
|
|
|
|
|
|
| |
The "a few KB" measurement was done by using the get_size crate to
measure the size of the RendRequest object, but due to limitations in
that crate (and in my willingness to go implement ways of checking the
size of external types), it might be somewhat off. The ~32MB value is
based on the idea that each RendRequest is 4KB.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
This adds the three new parameters specified in Prop 362 [0].
Two of these replace hardcoded defaults in the code.
The third, HiddenServiceProofOfWorkV1ServiceIntroTimeoutSeconds, is not
implemented yet, but will be in a future commit.
[0]: https://spec.torproject.org/proposals/362-update-pow-control-loop.html
|
| | |
|
| |
|
|
|
| |
This ensures that even in situations where multiple requests are
received at the exact same time, we will not drop any requests.
|
| | |
|
| | |
|
| |
|
|
|
| |
This basically converts everything to use the num_traits conversion
function, and explicitly panics on errors.
|
| |
|
|
|
|
| |
This pulls in num_traits (which is already a dependency for PoW) to
allow f64 casts that for reasons I do not understand are not implemented
via TryFrom in the standard library.
|
| |
|
|
|
| |
This should never happen, as the queue size is limited to well below
u32. However, it's still nicer not to use `as`.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
We need to divide a Duration by this, and Duration only supports
division by u32.
This is, in a sense, just pushing around where the overflow would
happen, (from the conversion in the suggested update to the increment
when a item is dequeued). However, this overflow is so unlikely to
happen (it would require more that 14 million requests per second) that
it does not seem worth slowing down the increment operation to try to
handle it.
|
| | |
|
| |
|
|
|
|
|
|
| |
This has fewer weird edge cases than RwLock does.
It might also be reasonable to make this a AtomicU32 (or AtomicEffort
which wraps AtomicU32), but that's slightly more complex, so I've opted
for a mutex for now.
|
| |
|
|
|
|
| |
This modifies the code to be more testable (making it generic over
RendRequest, getting the time from the runtime rather than
Instant::now(), etc) and adds some tests for the PoW control loop.
|
