summaryrefslogtreecommitdiff
path: root/crates/tor-netdoc/src/doc
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'test-support-more' into 'main'Clara Engler2026-08-031-1/+1
|\ | | | | | | | | tor-netdoc: testing: Expose some more test utilities See merge request tpo/core/arti!4250
| * tor-netdoc: testing: Expose regsubIan Jackson2026-07-301-1/+1
| | | | | | | | Involves code motion. Review with --color-moved.
* | tor-netdoc: Mark RouterDescUnverified::verify() incompleteClara Engler2026-07-301-0/+3
| | | | | | | | Better do it before the release so we can think about it a bit more.
* | tor-netdoc: Properly obtain min/max for start and end timeClara Engler2026-07-301-2/+2
| | | | | | | | | | | | | | | | | | | | | | We need to obtain the maximum of the lower bound and the minimum of the upper bound instead of vice versa. Another example on why we should replace this with a better implementation. Likewise, `expiry` in the legacy verification code is also obtained like that.
* | tor-netdoc: Rename min/max to start and end timeClara Engler2026-07-301-5/+7
| | | | | | | | | | This makes it more clear, besides it will sound more "correct" with the next commit applied.
* | tor-netdoc: Add various TODO follow-upsClara Engler2026-07-301-3/+5
| |
* | tor-netdoc: Make RouterDescUnverified::verify() publicClara Engler2026-07-301-2/+1
| |
* | tor-netdoc: Run cargo-fmtClara Engler2026-07-301-3/+13
| |
* | tor-netdoc: Allow dead_code for RouterDesc::verifyClara Engler2026-07-301-0/+1
| | | | | | | | Otherwise clippy complains.
* | tor-netdoc: Add large RouterDesc verification testClara Engler2026-07-301-1/+169
| | | | | | | | | | This commit adds a comprehensive test for router descriptor verification that tests various valid and invalid edge cases.
* | tor-netdoc: Add test only rd_encode_sign() methodClara Engler2026-07-301-0/+46
| | | | | | | | | | | | | | This is a bad encode_sign() method for RouterDesc that is testing only and will be used soon to implement testing for invalid router descriptors, for which we may need to create invalid ones in the first place.
* | tor-netdoc: Call .verify() in test_parse2_simpleClara Engler2026-07-301-1/+8
| |
* | tor-netdoc: Add RouterDescUnverified::verify()Clara Engler2026-07-301-5/+118
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit implements verification for router descriptors. 🎉 For this, the following checks are performed: * RouterDesc::identity_ed25519 is validly signed. * RouterDesc::master_key_ed25519 is as implied by identity_ed25519. * RouterDesc::fingerprint is as implied by RouterDesc::signing_key. * RouterDesc::ntor_onion_key_crosscert is validly signed. * RouterDesc::signing_key has correct length and exponent. * All RouterDesc::family_cert elements are valid. * The inner and outer RouterDescSignatures are valid. Unfortunately, we now have two implementations for that, as the legacy parse_internal() also implements its own verification logic for this. It seems merging these two together however would probably cause more harm than good, as the legacy verification is closely intertwined with legacy parsing, making a commonly shared verification logic hard to achieve. In other words: parse2 parses the descriptor in its entirety first, followed by verification afterwards, whereas the legacy code parses and verifies every field before advancing towards the next. Instead, I suggest to read through RouterDesc::parse_internal() and ensure that every verification related check present there is also present here. The notable exception to this is everything TAP related, which is absent on purpose here. Right now, this code is untested. I will add unit tests shortly afterwards.
* tor-netdoc: routerdesc: Abolish onion-key & -crosscert handling in old parserIan Jackson2026-07-291-38/+0
| | | | | | | `onion_key_crosscert` was already absent from `RouterDesc`, even though its item `onion-key-crosscert` was processed by the old parser. Delete it all.
* tor-netdoc: routerdesc: Abolish onion-key (obsolete TAP) fieldIan Jackson2026-07-291-11/+1
| | | | | | | | | | | | | | | | | See prop350 https://spec.torproject.org/proposals/350-remove-tap.html This is part of "Phase 3, Item 2: Remove vestigial TAP code in Arti". Technically we are not at phase 3 yet, because we haven't yet sunsetted C Tor 0.4.8 and made the dirauth changes in Phase 2. However, this field is not used in Arti right now. RouterDescs are used by client code for handling bridges (but we never use TAP keys), and the RouterDesc type will be used for generation and mirroring by by Arti Relay/Dirauth. In prop350 we have decided that we won't be deploying Arti Relay until this as been done.
* Merge branch 'clippy' into 'main'opara2026-07-272-6/+2
|\ | | | | | | | | Fix some recently-appearing clippy lints See merge request tpo/core/arti!4240
| * tor-netdoc: Replace two open-coded slice::fillIan Jackson2026-07-272-6/+2
| | | | | | | | Placates recent clippy.
* | tor-netdoc: Make RouterStatus.port_policy use Intern, not ArcIan Jackson2026-07-272-2/+1
| | | | | | | | We intern these in Microdesc, and should be consistent.
* | tor-netdoc: Make the str in a SoftwareVersion be Intern (fmt)Ian Jackson2026-07-271-3/+1
| |
* | tor-netdoc: Make the str in a SoftwareVersion be InternIan Jackson2026-07-271-3/+3
|/ | | | Rather than converting it to an Arc. This is the new idiom for Intern.
* tor-netdoc: derive Hash for netstatus::ConsensusMethodsIan Jackson2026-07-231-1/+1
|
* tor-netdoc: Use encode_netdoc_unsigned in several placesIan Jackson2026-07-232-9/+4
|
* tor-netdoc: HsDesc parse_decrypt_validate: Fix docs re time boundsIan Jackson2026-07-231-1/+2
| | | | | As per https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/4223#note_3438348
* HsDesc::parse_decrypt_validate: Don't check validity time (style followup)Ian Jackson2026-07-231-5/+3
|
* HsDesc::parse_decrypt_validate: Don't check validity timeIan Jackson2026-07-231-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | This function returns a `TimeRangeBound`. That implies a responsibility on the caller to check the time. It doesn't make sense for this function to do the check as well. But, it turns out that in tor-hsclient, the `TimeRangeBound<HsDesc>` is sometimes processed with `.dangerously` on the assumption that it was checked earlier. I considered changing this, and storing plain `HsDesc` and a separate `TimeRange` - but that's not right, because there are places where the `TimeRangeBound<HsDesc>` is used well after it was verified. Instead, in this commit, I (effectively) move the `.check_valid_at` call from `parse_decrypt_validate` to its principal call site. This involves a change to the error representation. Previously, validity time errors ended up as `DescriptorErrorDetail::Descriptor` containing an `HsDescError::OuterValidation` HsDescError:: InnerValidation`, which in turn contains a `tor_netdoc::Error`. (`tor_netdoc::Error` is a rather awkward type.) Now we have our own error variant. The overall behaviour is unchanged.
* tor-netdoc: hsdesc: Use new TimeRangeBound::build_intersect (fmt)Ian Jackson2026-07-231-5/+4
|
* tor-netdoc: hsdesc: Use new TimeRangeBound::build_intersectIan Jackson2026-07-231-27/+12
| | | | | | | | | | | | | | | | | | | Replace open-coding of various is_valid_at and various dangerously and intersect. In more detail: * Do most of the processing inside `TimeRangeBound::build_intersect` * Replace uses of dangerously_peek etc. with `TimeBound::unwrap_with` * The timebound machinery now takes care of doing the intersection * Remove the individual `.is_valid_at` calls and replace them with one at the end, on the intersection. This preserves the current behaviour except that sometimes time validity errors will now be reported as having occurred the wrong level. We'll deal with this in a moment (by deleting these checks from here entirely). * There is no need to handle a `None` from `intersect` any more. TimeBound handles conflicting time ranges differently: it allows ranges which are empty due to being ill-formed.
* tor-netdoc: hsdesc: Rename a variableIan Jackson2026-07-231-2/+2
| | | | | This variable had a different name inside the block, to outside. This was confusing, and, fixing it makes the next commit clearer.
* tor-checkable: Rename `TimeBound::is_valid_at` to `check_valid_at` (fmt)Ian Jackson2026-07-231-1/+5
|
* tor-checkable: Rename `TimeBound::is_valid_at` to `check_valid_at`Ian Jackson2026-07-232-2/+2
| | | | | I find this names confusing. To my mind "is" implies a function returning `bool`.
* tor-checkable: Rename `TimeBound::check_valid_*` to `if_valid_*`Ian Jackson2026-07-236-24/+24
| | | | | | | I find these names confusing. To my mind "check" implies a function returning `Result<(), _>`. Some other APIs use `unwrap` here but I think `if` is good.
* tor-checkable: TimeBound: Make dangerously_into_parts return TimeRangeIan Jackson2026-07-231-1/+2
| | | | | It is better to return a more cooked type. `TimeRange` aka `TimeRangeBound<()>` is perfect for this.
* tor-checkable: TimeRangeBound: Rename extend_tolerance to extend_end_boundIan Jackson2026-07-231-2/+2
| | | | | | | | | It was confusing that one of these functions had "which bound" mentioned in its name, but the other didn't. So add `end` and switch from `tolerance` to `bound` (see previous commit message). *This* commit should deal only in `extend_tolerance` and `end` and shouldn't touch `extend_start_bound` or `extend_pre_tolerance`.
* tor-checkable: TimeRangeBound: Rename extend_pre_tolerance to extend_start_boundIan Jackson2026-07-231-2/+2
| | | | | | | | | | | | | | Although it is often used to apply a tolerance, it doesn't make sense to say that this is extending the "tolerance" of a `TimeRangeBound`. A `TimeRangeBound` doesn't have a tolerance, only bounds. Also we should be consistent in our terminology, and use `start` rather than `pre`. We'll rename the other method too. Doing them one at a time will makes it easier to spot any "pre/start" vs "<nothing>/end" slips: *this* commit should deal only in `pre` and `start` and shouldn't touch `extend_tolerance`.
* tor-checkable: TimeRangeBound: Rename bounds to bounds_start_endIan Jackson2026-07-231-1/+1
| | | | | | | | | | This just returns a tuple. We're going to introduce a new method that returns a `TimeRagne` and will want to be called `bounds`. That method will want to be in the `TimeBound` trait, but for now we add it here. Various call sites will be added in forthcoming commits.
* tor-netdoc: Fix grammar in a commentIan Jackson2026-07-221-1/+1
|
* tor-netdoc tests; work around version number ordering issueIan Jackson2026-07-211-0/+16
| | | | | | | | | Ideally we would have Arti sort things sensibly but currently we have no types in Arti that are (1) faithful (2) sort correctly. Most of the existing types eventually have a `TorVersion` inside, which is lossy, so we can't use them for (eg) dirauth network status processing.
* Use new TimeRangeBound name throughout the treeIan Jackson2026-07-1610-40/+40
|
* Use new TimeBound name throughout the treeIan Jackson2026-07-168-17/+17
|
* tor-netdoc: Expose ConsensusMethod's fieldIan Jackson2026-07-151-1/+2
|
* tor-netdoc: Stabilise votes and encoding of authcerts (formatting)Ian Jackson2026-07-153-13/+8
|
* tor-netdoc: Stabilise votes and encoding of authcertsIan Jackson2026-07-158-37/+13
|
* tor-netdoc: Remove a now-unnecessary allowIan Jackson2026-07-151-1/+0
|
* tor-netdoc: drop a done TODOIan Jackson2026-07-151-3/+0
| | | | torspec!499 is merged.
* tor-netdoc tests: Test consensus verification error casesIan Jackson2026-07-153-5/+104
|
* tor-netdoc tests: Break out prep_netstatus_verify (fmt)Ian Jackson2026-07-151-6/+1
|
* tor-netdoc tests: Break out prep_netstatus_verifyIan Jackson2026-07-151-18/+32
|
* tor-netdoc tests: Test roundtrip of subset of live dataIan Jackson2026-07-151-2/+50
| | | | With facility to test roundtrip of whole consensus.
* tor-netdoc: Add some missing "retain-unknown" cfg gates to testsIan Jackson2026-07-151-4/+4
| | | | Nothing in CI tests incomplete without retain-unknown, apparently.
* tor-netdoc: Now that poc is gone, make some things no longer pub(crate)Ian Jackson2026-07-151-9/+4
|
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 01:00:26 +0000