| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
| |
As per
https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/4223#note_3438348
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This function returns a `TimeRangeBound`. That implies a
responsibility on the caller to check the time. It doesn't make sense
for this function to do the check as well.
But, it turns out that in tor-hsclient, the `TimeRangeBound<HsDesc>`
is sometimes processed with `.dangerously` on the assumption that it
was checked earlier. I considered changing this, and storing plain
`HsDesc` and a separate `TimeRange` - but that's not right, because
there are places where the `TimeRangeBound<HsDesc>` is used well after
it was verified.
Instead, in this commit, I (effectively) move the `.check_valid_at`
call from `parse_decrypt_validate` to its principal call site.
This involves a change to the error representation. Previously,
validity time errors ended up as `DescriptorErrorDetail::Descriptor`
containing an `HsDescError::OuterValidation` HsDescError::
InnerValidation`, which in turn contains a
`tor_netdoc::Error`. (`tor_netdoc::Error` is a rather awkward type.)
Now we have our own error variant. The overall behaviour is
unchanged.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Replace open-coding of various is_valid_at and various dangerously and
intersect. In more detail:
* Do most of the processing inside `TimeRangeBound::build_intersect`
* Replace uses of dangerously_peek etc. with `TimeBound::unwrap_with`
* The timebound machinery now takes care of doing the intersection
* Remove the individual `.is_valid_at` calls and replace them with
one at the end, on the intersection. This preserves the current
behaviour except that sometimes time validity errors will now be
reported as having occurred the wrong level. We'll deal with this
in a moment (by deleting these checks from here entirely).
* There is no need to handle a `None` from `intersect` any more.
TimeBound handles conflicting time ranges differently: it
allows ranges which are empty due to being ill-formed.
|
| |
|
|
|
| |
This variable had a different name inside the block, to outside. This
was confusing, and, fixing it makes the next commit clearer.
|
| |
|
|
|
| |
I find this names confusing. To my mind "is" implies a function
returning `bool`.
|
| |
|
|
|
|
|
| |
I find these names confusing. To my mind "check" implies a function
returning `Result<(), _>`.
Some other APIs use `unwrap` here but I think `if` is good.
|
| | |
|
| | |
|
| |
|
|
|
| |
This saves us from having to check whether it is 0, and better
represents what the type is allowed to be.
|
| |
|
|
|
|
|
|
| |
The "flow-control" item is documented in proposal 324 section 9.1;
there's a ticket (torspec#418) to document it.
The "proto" item is documented at
https://spec.torproject.org/rend-spec/hsdesc-encrypt.html#item:proto
|
| |
|
|
|
|
|
|
|
|
|
|
| |
This commit executes maint/add_warning with the just added change to
deny string slices except in tests.
I recommend auditing this by checking out the previous commit followed
by running the script yourself and then verifying that the diff is
identical to this commit.
This commit makes cargo clippy fail. We will add exceptions in the next
commit.
|
| |
|
|
| |
The `revision` field is no longer dead code.
|
| | |
|
| |
|
|
| |
Part of #2492 phase 2.
|
| |
|
|
|
|
|
|
|
| |
Fixes part of #2193.
(Edits from nickm: I selected the cases here that I could verify
were correct from immediate context.)
Edited-by: Nick Mathewson <[email protected]>
|
| |
|
|
| |
Run maint/add_warning
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
First, run
```
git grep -l "^edition =" |
xargs perl -i -pe 's/^edition *=.*/edition = "2024"/;'
```
Second, manually verify that all Cargo.toml files have changed,
and nothing else has changed.
Third, run cargo fmt again.
|
| | |
|
| |
|
|
|
| |
In particular, these are errors that provide an opportunity to
inflate the size of an hsdesc download.
|
| |
|
|
|
| |
These errors are suspicious as hsdir inflation attacks, in the
context of prop360.
|
| |
|
|
| |
Fixes: #1691
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In this design, the thin multiplexing layer between PoW types is always
available when onion services are in use, but the specific pow schemes
(and their dependency libraries) are gated by crate features everywhere.
There are now no new cfg() gates.
When the pow-v1 scheme is disabled, we can parse `pow-params v1` lines
into an empty type (so clients know a PoW scheme exists that might be
supported if they were configured differently). We currently don't save
the contents of unknown hsdesc items.
On the relaycell side, the hs ext module already sets a strong precedent
for keeping unrecognized data as a byte vec, and it doesn't provide a
good way to signal soft parse errors like unrecognized optional
extensions. There, the `v1` type is completely optional, and services
lacking a pow scheme suggested by a client would see one of these
'unrecognized' blobs. This isn't necessarily helpful but it fits the
rest of the design.
Co-authored-by: Micah Elizabeth Scott <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
My previous strategy here was to try and centralize hspow in one crate,
writing it like a self-contained feature. That introduced friction in
the data types, prompting the use of simplistic types at the netdoc/cell
layers and full-featured types in the optional modules.
This changes tactics, dissolving the low-level parts of tor-hspow into
tor-hscrypto and the high-level parts into hsclient/hsservice. Full
featured types are used everywhere now, but the tradeoff is that
compile-time configurability is a lot more pervasive. Anything that
knows about PoW types at all needs to be fully configured out. I took
this opportunity to try a more complete set of crate features, allowing
users to configure individual PoW schemes.
Co-authored-by: Micah Elizabeth Scott <[email protected]>
|
| |
|
|
|
|
|
|
| |
This adds a module to tor-hspow for version-independent client logic.
The entire module and its invocations are disabled unless the new
"hs-pow" compile time feature is set.
Co-authored-by: Micah Elizabeth Scott <[email protected]>
|
| |
|
|
|
|
|
|
| |
This implements support for extensible proof-of-work parameters. Right
now only a single type is defined, but in theory we can see up to one
line per type on an onion service.
Co-authored-by: Micah Elizabeth Scott <[email protected]>
|
| |
|
|
| |
Part of #1476
|
| |
|
|
|
|
| |
The `derive_more` crate broke backward compatibility with this version,
so this change involved quite a few manual fixups.
With luck, they'll keep compatibility for some while in the future.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This is the combination of a number of separate commits, many of which
were generated by seddery, and then rebased and squashed.
Cargo.toml
perl -i~ -pe 's{^derive-adhoc}{derive-deftly = "0.10"}' crates/*/Cargo.toml
(not regenerated during rebase)
update Cargo.lock
`cargo fetch` without --locked
(regenerated during rebase)
seddery
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{^use derive_adhoc}{use derive_deftly}'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bdefine_derive_adhoc\b}{define_derive_deftly}g'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bAdhoc\b}{Deftly}g if m{derive}'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\#\[derive_adhoc\b}{#[derive_deftly}g'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{use derive_adhoc}{use derive_deftly}'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bderive_adhoc\b}{derive_deftly_adhoc} if m{use.*deftly}'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bderive_adhoc!}{derive_deftly_adhoc!}'
(not regenerated during rebase)
Manually add `#[derive_deftly_adhoc]` where needed.
seddery
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\#\[adhoc\b}{#[deftly}g'
git-ls-files | grep '\.rs$' | xargs perl -i~ -pe 's{\bderive_adhoc_template}{derive_deftly_template}'
(not regenerated during rebase)
Manually fix up an import
Manually update some builder attrs
Manually fix up tor_rtmock::time_core
This was missed in my seddery, due to me rebasing the branch and not
redoing the seddery.
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
StaticSecret (fmt).
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
StaticSecret.
Previously, when retrieving `KS_hsc_desc_enc` keys (or any other x25519
keys) from the keystore, the keymgr would discard the public part of the
key (SSH private keys contain the public part of the key too). Instead
of discarding the public key and returning just the `StaticSecret`, the
keymgr now returns a `StaticKeypair`. This makes the x25519
`EncodableKey`/`ToEncodableKey` implementation consistent with the
ed25519 one (which retrieves key pairs rather than "unescorted"
secrets).
|
| |
|
|
|
|
| |
This is actually just the start of an existing test case.
tor-hsservice tests will want this in a moment.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
Previously there was no way to construct one of these during
descriptor generation, other than parsing.
A fairly simple builder seems right.
I felt the builder's setter functions for setting keys should be
named precisely after official key names. But the fields weren't,
so for now I have done some builder-level renaming.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
None of the existing NetdocErrorKinds seemed right.
|
| |
|
|
| |
Although this Errorkind is not perfect, it is good enough.
|
| | |
|
| |
|
|
|
|
| |
Actually, never mind about adding an accessor here: this value was
set incorrectly and didn't match its documentation. As such it's
basically useless, and we might as well throw it out.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
This commit removes some actual dead code and additionally adds some
minimal accessors to HsDesc to expose some of its properties. (I'm
trying to keep these minimal since it's not yet clear whether we
want to expose more detail here.)
Here we also make StoredHsDescMeta a conditional type that's only
present when the new "hs-dir" feature is enabled. Neither relays
nor clients need this: Only HsDirs will need it, when we finally
implement relays.
|
