summaryrefslogtreecommitdiff
path: root/crates
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | | | proto: Avoid magic hardcoded value for LINK_AUTHDavid Goulet2026-01-222-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead, use the static AUTHTYPE_ED25519_SHA256_RFC5705 value which is for now the only version we support. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Enforce CERTS and AUTHENTICATE are always expected togetherDavid Goulet2026-01-221-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A Responder receiving cells from the Initiator, if it gets a CERTS, an AUTHENTICATE must also be present (and vice-versa). Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Remove async for VerifiableChannel::check()David Goulet2026-01-224-22/+18
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Move cell sending out of check() and into finish()David Goulet2026-01-222-37/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is so check() only authenticate a channel. The finish() function now only sends back the missing cells and build the final Channel. To pull this off, the AUTHENTICATE cell and our IP addresses need to be copied into the VerifiedRelayChannel. This allows us to remove complexity into the check() function as well and future commit will remove the async. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Remove uneeded code in the unverified inner check()David Goulet2026-01-221-25/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can't get into the UnverifiedChannel::check() without wanting to verify our identities and authenticate. This validation has moved before calling check() for the relay channel type. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Implement FinalizableChannel for an unverified relay channelDavid Goulet2026-01-222-33/+128
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reason for this is so we can use the type system to enforce that a client/bridge<-> relay channel can never become verified and thus in the code path of authentication. In other words, when check() is called, without an authentication cell, we can't authenticate or even verify the identities so we immediately return "self" which in this case is the UnverifiedRelayChannel. That channel can be finish()-ed to yield a Channel that can never be considered authenticated. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Send relay channel NETINFO in check()David Goulet2026-01-223-34/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Once channel is verified and authenticate if need be, send the NETINFO. We require our advertised IP addresses for this so pass them to launch() as well to the UnverifiedRelayChannel. A cargo fmt change slipped in here, sorry about that. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Authenticate a relay channelDavid Goulet2026-01-224-33/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit is a bit loaded but it is coherent. First, we set Eq and PartialEq to the channel message Authenticate so we can compare it with the one we expected. Second, the AuthenticationCell enum is introduced to store either an AUTH_CHALLENGE or an AUTHENTICATE since one side of the handshake can only have one. This allows us to store one or the other in UnverifiedRelayChannel. Depending on what we have, the authentication process is different as it dictates which side we are on (initiator vs responder). Keep in mind that the handshake code enforces receiving a AUTH_CHALLENGE along side CERTS. And same goes for AUTHENTICATE which means that if we have an AUTH_CHALLENGE in the UnverifiedRelayChannel, it is certain that the other side wants to authenticate and we are the initiator. Finally, the sending of CERTS and AUTHENTICATE by the initiator is now in UnverifiedRelayChannel::check() done right after verifying the channel CERTS and holding a "VerifiedChannel" object. This means that the last piece, sending the `NETINFO` by the initiator will be done in the check() but in a future commit. This leaves the VerifiableChannel::finish() to send nothing and only finalize the channel with the NETINFO (canonicity). Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Make VerifiableChannel::check() asyncDavid Goulet2026-01-224-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Relay initiator needs to send CERTS and AUTHENTICATE in that function after verifiying the channel. And thus require to be async. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Add CertifiedConn to relay handshakeDavid Goulet2026-01-222-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need this trait for the underlying TLS stream in order to access data such as the certificates or keying material. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Add relay link signing kp to RelayIdentitiesDavid Goulet2026-01-221-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Add UnverifiedRelayChannel::build_auth_data()David Goulet2026-01-221-37/+101
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reason for this is because both initiator and responder build the authentication data in order to send it (initiator) and validate it (responder). The build_auth_data() function takes a VerifiedChannel as an argument in order to access the CLOG/SLOG data and authentication data MUST always be handled after a channel is verified as in its CERTS has been checked. Take the opportunity also to add the NETINFO and relay identities data into the verified channel which will be needed to finalize the channel. The check() function is now missing the actual validation of the AUTHENTICATE for a responder which will come in the next commit(s). Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Implement RelayResponderHandshakeDavid Goulet2026-01-222-2/+264
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit introduces the RelayResponderHandshake object used when accepting an inbound connection to open a channel. There are still TODOs pepperred in the code but the base is implemented. The Unverified and Verified channel need to be adjusted for this new handshake. This will come in the next commits. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Add helper to build NETINFO cellDavid Goulet2026-01-221-13/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Again, as the CERTS helper, this is used by both initiator and responder handshake. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Add a helper function to build CERTS cellDavid Goulet2026-01-221-1/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both initiator and responder send CERTS cell hence this helper. Signed-off-by: David Goulet <[email protected]>
| * | | | | relay: Pass advertised addresses to the channel handlerDavid Goulet2026-01-2210-19/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need the advertised addresses for the NETINFO cell when opening a relay channel. Keep them in the TorRelay object so we can pass them to the ChanMgr channel handler. This will also help with config reload where only the local values in TorRelay will need to be updated. Signed-off-by: David Goulet <[email protected]>
| * | | | | cert: Add cert_type() to RsaCrossertDavid Goulet2026-01-221-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is always the same type for this specific certificate. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Make CERTS cell optionnable for UnverifiedChannelDavid Goulet2026-01-225-21/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This requires to make a series of cert and digest also optionnable in the VerifiedChannel. This change is needed because as a relay responder, you might get the CERTS or not depending on if the other side wants to authenticate. Client and bridges do not authenticate and thus it is expected to not have a CERTS cell. This leads to the UnverifiedChannel::check() function to return early with a VerifiedChannel without any identity attached to it. Signed-off-by: David Goulet <[email protected]>
| * | | | | proto: Move relay channel related structs outside of handshake.rsDavid Goulet2026-01-222-269/+272
| | |_|/ / | |/| | | | | | | | | | | | | | | | | | | | | | | Code movement only. Signed-off-by: David Goulet <[email protected]>
* | | | | Merge branch 'rate-limit' into 'main'David Goulet2026-01-221-9/+19
|\ \ \ \ \ | |_|_|/ / |/| | | | | | | | | | | | | | arti-relay: Change debug message to rate-limited warning See merge request tpo/core/arti!3602
| * | | | arti-relay: change debug message to rate-limited warningSteven Engler2026-01-201-9/+19
| | |/ / | |/| |
* | | | Merge branch 'database-refactoring' into 'main'Clara Engler2026-01-224-197/+245
|\ \ \ \ | |_|/ / |/| | | | | | | | | | | tor-dirserver: Refactorings in the database.rs module See merge request tpo/core/arti!3599
| * | | tor-dirserver: Remove FromStr for DocumentIdClara Engler2026-01-223-39/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit removes FromStr for DocumentId because it was only used in testing anyways. Instead, it replaces it with a simple From<[u8; 32]> only enabled in test builds, which is sufficient for what we are trying to do. An alternative would be to make the inner field pub, but this seems to aggressive for a testing only thing.
| * | | tor-dirserver: Add `sha2` to `router_descriptor`Clara Engler2026-01-191-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This comit adds a `sha2` column to `router_descriptor` alongside a `CHECK` to see whether it equals `docid`. The reason for this is simple: Microdescriptors are the only kind of documents that are queriable with a SHA2 hash. Previously, we would have simply used the `docid` column for this, but in order to abstract it better, a distinct column with this hash is better.
| * | | tor-dirserver: Rename `doc_id` to `docid`Clara Engler2026-01-194-76/+75
| | | | | | | | | | | | | | | | | | | | Because we went with `docid` in the database (due to `rowid`), it is only natural to call the code variables `docid` too.
| * | | tor-dirserver: Rename sha256 to docid in schemaClara Engler2026-01-194-51/+51
| | | | | | | | | | | | | | | | | | | | | | | | This commit renames the sha256 column to docid for the reason that we agreed upon making the schema visible to all modules, so if we were to encapsulate docid properly, this change is only natural.
| * | | tor-dirserver: Rename database meta tableClara Engler2026-01-191-16/+13
| | | | | | | | | | | | | | | | | | | | This commit renames arti_dirmirror_schema_version to arti_dirserver_schema_version.
| * | | database: Introduce DocumentIdClara Engler2026-01-195-136/+210
| | | | | | | | | | | | | | | | | | | | | | | | This commit introduces a new type in the database module named `DocumentId` for abstracting the underlying content-addressable hash algorithm we are using.
* | | | tor-dircommon: De-duplicate example from AuthorityContactClara Engler2026-01-221-35/+0
| | | |
* | | | arti: Fix commented out comment in exampleClara Engler2026-01-221-1/+1
| | | |
* | | | tor-dircommon: Fix clippy warningClara Engler2026-01-221-1/+1
| | | |
* | | | tor-dircommon: Remove legacy authority syntaxClara Engler2026-01-222-149/+16
| | | | | | | | | | | | | | | | | | | | | | | | Because arti 2.0 is pending, it is good to get rid of technical debt, such as the legacy syntax for specifying directory authorities, which had been replaced by prop330 a few months ago.
* | | | tor-dircommon: Document prop330 syntax betterClara Engler2026-01-222-1/+68
| | | | | | | | | | | | | | | | | | | | This commit adds more documentation/examples for the prop330 syntax for specifying directory authorities.
* | | | tor-dirserver: Make downloader statelessClara Engler2026-01-202-53/+55
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit makes the downloader found in `mirror::operation::download` stateless by removing the `preferred_authority` field and changing all methods from `&mut self` to `&self`. The preferred authority is now accepted as a parameter to `DownloadManager::download` which also returns a tuple now with the actually used authority alongside the response, putting the management of this to the responsibility of the caller. Meanwhile, it also renames the structure from `ConsensusBoundDownloader` to `DownloadManager` because it no longer keeps a state that invalidates after a consensus "ends". The purpose of this is to simplify overall state in order to make the implementation of a finite-state-machine for the dirmirror operation more easy (and deterministic).
* | | Fix flaky `request_fail_ultimately` testClara Engler2026-01-191-1/+10
|/ / | | | | | | | | | | | | | | | | | | | | | | | | This commit fixes the flaky `request_fail_ultimately` in tor-dirserver, which is flaky due to the operating system's handling of TCP RSTs, which are generally detected stochastically and sometimes are not received even after the entire response has been parsed. This leads to tor-dirclient either returning a connection reset or a truncated header error, depending on whether it successfully or unsuccessfully reads zero bytes from the server. Fixes #2318
* | Merge branch 'opaque_arti_2.0' into 'main'Nick Mathewson2026-01-159-107/+146
|\ \ | | | | | | | | | | | | | | | | | | Make all non-main APIs in arti experimental. Closes #2284, #2299, and #419 See merge request tpo/core/arti!3586
| * | arti: Edit README.md text about experimental-api.Nick Mathewson2026-01-141-1/+6
| | |
| * | bench,testing: Use experimental-api.Nick Mathewson2026-01-132-2/+2
| | | | | | | | | | | | These crates are "inherently experimental" and allowed to require it.
| * | arti: remove deprecated feature flags.Nick Mathewson2026-01-133-17/+6
| | | | | | | | | | | | Closes #2299.
| * | Reformatting in arti/Cargo.tomlNick Mathewson2026-01-131-33/+5
| | | | | | | | | | | | No semantic changes.
| * | arti: Resolve unreachable-pub warnings.Nick Mathewson2026-01-132-24/+63
| | |
| * | arti: tweak notes on experimental-apiNick Mathewson2026-01-131-4/+6
| | |
| * | arti: rename experimental-api "run" to "run_proxy".Nick Mathewson2026-01-131-1/+1
| | | | | | | | | | | | | | | Or rather, un-rename it. It's no longer a stable thing, so it doesn't need to have this particular name.
| * | Make arti crate opaque by defaultNick Mathewson2026-01-133-27/+59
| | | | | | | | | | | | | | | | | | Only fn main() is now pub when experimental-api is disabled. Closes #2284.
* | | tor-netdoc: Remove remaining use of EP::OtherClara Engler2026-01-151-8/+16
| | | | | | | | | | | | | | | | | | This commit replaces the last remaining uses of `EP::Other` in `tor-netdoc`, which got removed in arti!3561 but was still made use of in arti!3592 without causing a merge conflict.
* | | Merge branch 'encoded-authcert' into 'main'Ian Jackson2026-01-1515-136/+605
|\ \ \ | | | | | | | | | | | | | | | | Implement EncodedAuthCert and use it in poc for votes See merge request tpo/core/arti!3592
| * | | tor-netdoc: EncodedAuthCert: docs grammarIan Jackson2026-01-151-1/+1
| | | |
| * | | tor-netdoc: EncodedAuthCert: remove another bit of leftover debugIan Jackson2026-01-151-1/+0
| | | |
| * | | tor-netdoc: EncodedAuthCert: remove a hard tab in a commentIan Jackson2026-01-151-1/+1
| | | |
| * | | tor-netdoc: EncodedAuthCert: bodge the features for nowIan Jackson2026-01-151-2/+3
| | | | | | | | | | | | | | | | | | | | The feature arrangements in tor-netdoc are getting to be in need of a serious overhaul.
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 16:08:01 +0000