| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
This time, our estimator discards outliers, takes the mean of what's
left, and uses the standard deviation to try to figure out how
seriously to take our report of skew/not-skew.
These estimates are still not actually used.
|
| |
|
|
|
| |
(This is just a placeholder; I'm going to make the functions
smarter in the next commit.)
|
| |
|
|
|
|
|
|
| |
Fortunately, we don't need a separate type here: authenticated
clock skew can only come attached to a `tor_proto::Error`.
We also remove skew from `tor_proto::Error::HandshakeCertsExpired`,
since it would now be redundant.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We now check the handshake certificates unconditionally, and only
report them as _expired_ as a last resort.
(Rationale: if somebody is presenting the wrong identity from a year
ago, it is more interesting that they are presenting the wrong ID
than it is that they are doing so with an expired cert.
We also now report a different error if the certificate is expired,
but its expiration is within the range of reported clock skew.
(Rationale: it's helpful to distinguish this case, so that we can
blame the failure on possible clock skew rather than definitely
attributing it to a misbehaving relay.)
Part of #405.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
NETINFO cells, which are sent in every handshake, may contain
timestamps. This patch adds an accessor for the timestamp in the
Netinfo messages, and teaches the tor-proto code how to compute the
minimum clock skew in the code.
The computation isn't terribly precise, but it doesn't need to be:
Tor should work fine if your clock is accurate to within a few
hours.
This patch also notes a Y2038 problem in the protocol: see
torspec#80.
Part of #405.
|
| |\
| |
| |
| |
| |
| |
| | |
tor-proto: Split up a couple of handshake-based errors
Closes #359 and #358
See merge request tpo/core/arti!344
|
| | |
| |
| |
| |
| |
| |
| |
| | |
This helps the user distinguish between protocol violations that
happen when connecting to the tor network from those that happen
while connected.
Closes #358.
|
| | |
| |
| |
| | |
(We'll have a BadChanHandshake soon.)
|
| | |
| |
| |
| |
| |
| |
| | |
We want to distinguish handshake failures from errors later on in
the channel's lifetime.
Closes #359.
|
| |/
|
|
| |
Closes #360.
|
| |
|
|
|
|
|
|
| |
There was only one use of this, and it was in as-yet-unused relay-only
code.
Removing this type required refactoring the relay onion handshake code
to use its own error type, which is probably clever anyway.
|
| | |
|
| |
|
|
|
| |
This is a bit ugly but we need it to work around the problem where
exits aren't always clear about _why_ a hostname lookup failed.
|
| |
|
|
| |
Also document that it's a lower-level error kind.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
This took some refactoring, and gave an opportunity to notice
a few error variants that weren't being used, or didn't mean
what they said on the tin.
|
| | |
|
| |
|
|
|
|
|
| |
This fixes a tiny race condition in the previous code, where we
checked whether an OptTimestamp is None a bit before we set it.
Since std::atomic gives us compare_exchange, we might as well use
it.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously, the reactor would use an `UnboundedSender` to send things to
the `RawCellStream`, in order that the reactor wouldn't block if you
failed to read from the latter. This is bad, though, since it means
people can just run us out of memory by sending lots of things.
To fix this, we make the new `StreamReader` type (which does the reading
parts from `RawCellStream`) keep track of the stream's receive window
and issue SENDMEs once *it* has consumed enough data to require it, thus
meaning that we shouldn't get sent enough data to fill the channel
between reactor and `StreamReader` (and, if we do, that's someone trying
to flood us, and we abort the circuit).
As hinted to above, the `RawCellStream` was removed and its reading
functionalities replaced by `StreamReader`; its writing functionalities
are handled by `StreamTarget` anyway, so we just give out one of those
for the write end. This now means we don't need any mutexes!
note: this commit introduces a known issue, arti#230
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We need this for the circuit timeout estimator (#57). It needs to
know "how recently have we got some incoming traffic", so that it
can tell whether a circuit has truly timed out, or whether the
entire network is down.
I'm implementing this with coarsetime, since we need to update these
in response to every single incoming cell, and we need the timestamp
operation to be _fast_.
(This reinstates an earlier commit, f30b2280, which I reverted
because we didn't need it at the time.)
Closes #179.
|
| |
|
|
| |
Closes #163
|
| | |
|
|
|
This will cause some pain for now, but now is really the best time
to do this kind of thing.
|
