aboutsummaryrefslogtreecommitdiff
path: root/crates/tor-proto/src/client/channel/handshake.rs
Commit message (Collapse)AuthorAgeFilesLines
* proto: Remove re-export of MsgBuf in unit testsDavid Goulet2026-04-141-1/+1
| | | | Signed-off-by: David Goulet <[email protected]>
* proto: Add channel relay handshake unit testsDavid Goulet2026-04-141-178/+0
| | | | | | | | | | | | | Instead of copying the client unit tests into the channel module, just make both current unit tests run on a client and relay handshake. This required a bit of trickery with type HandshakeConnectFn but works out in the end. It also adds the RelayMsgBuf that wraps a MsgBuf in order to implement CertifiedConn which is very relay only. Signed-off-by: David Goulet <[email protected]>
* proto: Move channel client handshake tests into client moduleDavid Goulet2026-04-141-0/+225
| | | | | | | | | No behavior change. Make the const cells public as they will be useful for more upcoming unit tests especially on the relay side. Signed-off-by: David Goulet <[email protected]>
* tor-{proto,chanmgr}: change how channels accept a CREATE* handlerSteven Engler2026-04-081-2/+4
| | | | | | | | | | | Instead of giving the `CreateRequestHandler` to the channel after it's constructed, we integrate it into the handshake so that we can give it to the channel constructor. The `ChannelType` is no longer part of the `Channel`. Some of the tests could be cleaned up slightly now that the channel doesn't need the `ChannelType`, but I don't want to conflict with !3853.
* tor-proto: change channel to use `Runtime`Steven Engler2026-04-081-2/+5
| | | | | When used for relay channels, the channel reactor will soon need to spawn relay circuit reactors.
* proto: Rename many variables with more fine grained namingDavid Goulet2026-03-301-6/+6
| | | | | | | | | | Mostly, identity a `ChanTarget` as a "target" since we juggle with PeerInfo and OwnedChanTarget nowadays. All certificate and keys have very specific names which attempts to match the spec as much as possible. Signed-off-by: David Goulet <[email protected]>
* proto: Add names to ignored variablesDavid Goulet2026-03-301-1/+1
| | | | | | https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3791#note_3374465 Signed-off-by: David Goulet <[email protected]>
* proto: Add AuthLogAction enum helperDavid Goulet2026-03-301-5/+4
| | | | | | | | | We can remove the "/* take_slog */ true" pattern and instead have an explicit type at the callsite for semantic. https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3791#note_3374457 Signed-off-by: David Goulet <[email protected]>
* chanmgr: Always use MaybeSensitive<PeerAddr> when building a channelDavid Goulet2026-03-301-3/+3
| | | | Signed-off-by: David Goulet <[email protected]>
* tor-proto: Port to web-time-compatNick Mathewson2026-03-261-1/+1
|
* tor-proto: fix the relay initiator's SLOG digestSteven Engler2026-03-191-4/+5
|
* proto: Set the link protocol outside the recv VERSIONS helperDavid Goulet2026-03-191-0/+3
| | | | | | | | | | | | | | | | | | | It used to work for an initiator to set the link protocol once a VERSIONS is received because initiator send their VERSIONS before. This failed with responders because a responder channel sends their VERSIONS after receiving one from the initiator. This reverse logic means that the channel cell handler was transitionned to the Handshake state before a responder was able to send a VERSIONS cell leading to a failure because VERSIONS cell aren't allowed at the Handshake state. To fix this, the send/recv or recv/send is now explicit per channel type and once this is done and successful, the link protocol is set. A `set_link_protocol()` is added to the ChannelBaseHandshake trait so it can be used to set the cell handler. Signed-off-by: David Goulet <[email protected]>
* proto: New UnverifiedInitiatorChannelDavid Goulet2026-03-191-52/+18
| | | | | | | | Both client and relay specialized channel now use it as their inner base channel so they can use the same common verify() function since it is the same validation for both. Signed-off-by: David Goulet <[email protected]>
* proto: Move cert validation per specialized channelDavid Goulet2026-03-191-2/+41
| | | | | | | | | | | | | | | | | | | | | | | | Remove the last part from check_internal() that is specific to an initiator channel. At this commit, all three specialized channel do the verify process within their own verify() function. The client and relay initiator both look at the TLS cert (code duplication unfortunately). And the relay responder looks at the LINK_AUTH cert extracting the peer KP_link_ed key for validation. The CERTS cell is removed from UnverifiedChannel as it is now only useful within the verification process which is now specialized. A series of TODO(relay) is added to point out the current problem and how to fix them. The next step is to create an UnverifiedInitiatorChannel that will hold the verity_tls_cert() function and peer cert information which is only relevant to an initiator. This will remove code duplication. Signed-off-by: David Goulet <[email protected]>
* proto: Use RelayIds in a VerifiedChannelDavid Goulet2026-03-191-1/+1
| | | | | | | | | | | | | | | | In order to pull this off, make UnverifiedChannel::check_relay_identities() to return a RelayIds that it builds after checking if they match the peer we were expecting. This part is moved in this commit so once check_relay_identities() returns, we are certain of the relay identity validity on both "it identified properly" and "it is the right expected relay". This makes it that the check_relay_identities() returns the RelayIds, the signing key and the RSA id digest (which is needed for authentication later). Signed-off-by: David Goulet <[email protected]>
* tor-proto: remove `is_expecting_auth_challenge()`Steven Engler2026-03-031-4/+0
| | | | The responder always sends an AUTH_CHALLENGE cell.
* safelog: Rename MaybeSensitive::hidden/visible()David Goulet2026-03-031-1/+1
| | | | | | Rename them to respectively sensitive() and not_sensitive(). Signed-off-by: David Goulet <[email protected]>
* proto: Channel handshake minor cleanupDavid Goulet2026-03-031-3/+1
| | | | | | | | | | To make the code a bit better here. Also, at this commit, the UnverifiedChannel::finish() and VerifiedChannel::finish() are basically the exact same. A refactoring to use a finish() helper would work nicely. Signed-off-by: David Goulet <[email protected]>
* proto: Setup the channel PeerInfo in the specialized finish()David Goulet2026-03-031-5/+9
| | | | | | | | | | | Every specific types know if the peer is sensitive or not so now the finish() of each of these channel types builds the right PeerInfo with MaybeSensitive. This is passed on the Channel so from that point on, the Channel will never leak peer data in the logs. Signed-off-by: David Goulet <[email protected]>
* proto: Make channel PeerAddr sensitiveDavid Goulet2026-03-031-2/+10
| | | | | | | Only the R2R channel that the PeerAddr becomes unsensitive. The rest, we keep it sensitive as it can be a client or a client's guard/bridge. Signed-off-by: David Goulet <[email protected]>
* proto: Pass PeerAddr at the channel handshake finish for initiatorsDavid Goulet2026-02-191-9/+3
| | | | | | | | | | Responder relay handshake requires the peer address at the very start as it sends its NETINFO right away. For initiators, we only need it during the finalization process which is when the NETINFO is sent and the Channel is created. Signed-off-by: David Goulet <[email protected]>
* proto: Use the PeerAddr accross channel handshakeDavid Goulet2026-02-191-23/+10
| | | | | | | This is a large change but it is basically using PeerAddr in the channel builder through the channel handshake code and into the Channel itself. Signed-off-by: David Goulet <[email protected]>
* proto: Client channel need to consider PT for the targetDavid Goulet2026-02-121-6/+21
| | | | Signed-off-by: David Goulet <[email protected]>
* proto: Enforce that channel method as unique SocketAddrDavid Goulet2026-02-121-6/+4
| | | | | | | | | | | | | During the channel handshake, we require the peer IP address for the canonicity check which requires the exact peer IP we are connected to. This commit adds a function that enforces this requirement on a ChannelMethod so anything else results in an error. It is to basically have stronger guarantee on the channel method we use in the handshake. Signed-off-by: David Goulet <[email protected]>
* proto: Channel finish() now handles canonicityDavid Goulet2026-02-121-4/+13
| | | | | | | | | | | | | | All handshake pass the NETINFO cell, the advertised addresses (if any) and the peer address in order to build the Canonicity and build the channel with it. In order to pull this off, the "my_addrs" were added to several object along the NETINFO cell. We also pass the channel method when connecting (initiator) to a relay as we need this for this canonicity build. Signed-off-by: David Goulet <[email protected]>
* proto: Add missing clock_skew() to unverified channelsDavid Goulet2026-02-041-6/+3
| | | | Signed-off-by: David Goulet <[email protected]>
* proto: Make channel client to use a specific typeDavid Goulet2026-02-041-38/+43
| | | | | | Remove the use of traits, the caller will handle the specific type. Signed-off-by: David Goulet <[email protected]>
* proto: Use the channel codec channel typeDavid Goulet2026-01-221-1/+0
| | | | | | | | | | | | | | | | | Remove the channel type from Unverified and Verified channels and instead use the channel type in the underlying channel codec. The codec requires such type in order to restrict messages sets. Instead of duplicating it, this commit simply makes it that there is now only a single channel type attached to a channel structure. The resulting `struct Channel` in the end gets it copied from the channel codec as the framed_tls gets split and given to the `Reactor`. Down the line, we need a channel type attached to the `Channel` in order to know if it is a client or not and authenticated or not. Signed-off-by: David Goulet <[email protected]>
* proto: Remove async for VerifiableChannel::check()David Goulet2026-01-221-2/+1
| | | | Signed-off-by: David Goulet <[email protected]>
* proto: Make VerifiableChannel::check() asyncDavid Goulet2026-01-221-1/+2
| | | | | | | | | Relay initiator needs to send CERTS and AUTHENTICATE in that function after verifiying the channel. And thus require to be async. Signed-off-by: David Goulet <[email protected]>
* proto: Make CERTS cell optionnable for UnverifiedChannelDavid Goulet2026-01-221-1/+1
| | | | | | | | | | | | | | | This requires to make a series of cert and digest also optionnable in the VerifiedChannel. This change is needed because as a relay responder, you might get the CERTS or not depending on if the other side wants to authenticate. Client and bridges do not authenticate and thus it is expected to not have a CERTS cell. This leads to the UnverifiedChannel::check() function to return early with a VerifiedChannel without any identity attached to it. Signed-off-by: David Goulet <[email protected]>
* proto: Seal the VerifiableChannel and FinalizableChannel traitsDavid Goulet2026-01-131-0/+14
| | | | | | They are public but avoid anyone outside implementing them. Signed-off-by: David Goulet <[email protected]>
* proto: Add link_protocol() to VerifiableChannel traitDavid Goulet2026-01-131-12/+6
| | | | Signed-off-by: David Goulet <[email protected]>
* proto: Add traits for public channel viewsDavid Goulet2026-01-131-47/+32
| | | | | | | | | | | | | | Add traits that will be returned outside tor-proto allowing us to not expose client and relay specific channels. The goal is for the tor-chanmgr to get those objects implementing those traits and can build and run the reactor without knowing the specific underlying type. This allows us to have less code duplication and less client/relay distinction in the chanmgr. Signed-off-by: David Goulet <[email protected]>
* proto: Make cargo doc happyDavid Goulet2025-11-191-1/+1
| | | | Signed-off-by: David Goulet <[email protected]>
* proto: Split VerifiedChannel::finish()David Goulet2025-11-191-2/+17
| | | | | | | | | | Move the client specific code into VerifiedClientChannel as in sending the NETINFO cell. The rest is pretty much boiler plate to build a channel reactor. The relay finish() code is coming in a followup commit. Signed-off-by: David Goulet <[email protected]>
* proto: Use the new client specific channelsDavid Goulet2025-11-191-11/+19
| | | | | | | | | By changing the connect() returned object we therefore officially make VerifiedChannel and UnverifiedChannel crate only objects. Thus, this commit changes visibility on most things. Signed-off-by: David Goulet <[email protected]>
* proto: Add client specific handshake channel structsDavid Goulet2025-11-191-5/+89
| | | | | | | | | | | | | | This adds the UnverifiedClientChannel and VerifiedClientChannel mirroring the relay API for channels. It plainly uses the generic object underneath as for now those objects are client only. Followup commits will make things more client specific. No behavior change. Signed-off-by: David Goulet <[email protected]>
* proto: Move client handshake into client channel moduleDavid Goulet2025-11-191-0/+140
This only moves code from src/channel to src/client/channel. It introduces a ClientChanBuilder that is used to launch client specific channel by the public ChanBuilder. The followup commits will add a VerifiedClientChannel and UnverifiedClientChannel in order to again decouple client and relay code from the generic objects. Signed-off-by: David Goulet <[email protected]>
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 20:16:45 +0000