1
//! Code to handle incoming cells on a channel.
2
//!
3
//! The role of this code is to run in a separate asynchronous task,
4
//! and routes cells to the right circuits.
5
//!
6
//! TODO: I have zero confidence in the close-and-cleanup behavior here,
7
//! or in the error handling behavior.
8

            
9
use super::circmap::{CircEnt, CircMap};
10
use super::OpenChanCellS2C;
11
use crate::channel::OpenChanMsgS2C;
12
use crate::tunnel::circuit::halfcirc::HalfCirc;
13
use crate::util::err::ReactorError;
14
use crate::util::oneshot_broadcast;
15
use crate::{Error, Result};
16
use tor_async_utils::SinkPrepareExt as _;
17
use tor_cell::chancell::msg::{Destroy, DestroyReason, PaddingNegotiate};
18
use tor_cell::chancell::ChanMsg;
19
use tor_cell::chancell::{msg::AnyChanMsg, AnyChanCell, CircId};
20
use tor_memquota::mq_queue;
21
use tor_rtcompat::SleepProvider;
22

            
23
#[cfg_attr(not(target_os = "linux"), allow(unused))]
24
use tor_error::error_report;
25
#[cfg_attr(not(target_os = "linux"), allow(unused))]
26
use tor_rtcompat::StreamOps;
27

            
28
use futures::channel::mpsc;
29
use oneshot_fused_workaround as oneshot;
30

            
31
use futures::sink::SinkExt;
32
use futures::stream::Stream;
33
use futures::Sink;
34
use futures::StreamExt as _;
35
use futures::{select, select_biased};
36
use tor_error::internal;
37

            
38
use std::fmt;
39
use std::pin::Pin;
40
use std::sync::Arc;
41

            
42
use crate::channel::{
43
    codec::CodecError, kist::KistParams, padding, params::*, unique_id, ChannelDetails, CloseInfo,
44
};
45
use crate::tunnel::circuit::{celltypes::CreateResponse, CircuitRxSender};
46
use tracing::{debug, trace};
47

            
48
/// A boxed trait object that can provide `ChanCell`s.
49
pub(super) type BoxedChannelStream = Box<
50
    dyn Stream<Item = std::result::Result<OpenChanCellS2C, CodecError>> + Send + Unpin + 'static,
51
>;
52
/// A boxed trait object that can sink `ChanCell`s.
53
pub(super) type BoxedChannelSink =
54
    Box<dyn Sink<AnyChanCell, Error = CodecError> + Send + Unpin + 'static>;
55
/// A boxed trait object that can provide additional `StreamOps` on a `BoxedChannelStream`.
56
pub(super) type BoxedChannelStreamOps = Box<dyn StreamOps + Send + Unpin + 'static>;
57
/// The type of a oneshot channel used to inform reactor users of the result of an operation.
58
pub(super) type ReactorResultChannel<T> = oneshot::Sender<Result<T>>;
59

            
60
/// Convert `err` to an Error, under the assumption that it's happening on an
61
/// open channel.
62
64
fn codec_err_to_chan(err: CodecError) -> Error {
63
64
    match err {
64
        CodecError::Io(e) => crate::Error::ChanIoErr(Arc::new(e)),
65
        CodecError::EncCell(err) => Error::from_cell_enc(err, "channel cell"),
66
64
        CodecError::DecCell(err) => Error::from_cell_dec(err, "channel cell"),
67
    }
68
64
}
69

            
70
/// A message telling the channel reactor to do something.
71
#[cfg_attr(docsrs, doc(cfg(feature = "testing")))]
72
#[derive(Debug)]
73
#[allow(unreachable_pub)] // Only `pub` with feature `testing`; otherwise, visible in crate
74
#[allow(clippy::exhaustive_enums)]
75
pub enum CtrlMsg {
76
    /// Shut down the reactor.
77
    Shutdown,
78
    /// Tell the reactor that a given circuit has gone away.
79
    CloseCircuit(CircId),
80
    /// Allocate a new circuit in this channel's circuit map, generating an ID for it
81
    /// and registering senders for messages received for the circuit.
82
    AllocateCircuit {
83
        /// Channel to send the circuit's `CreateResponse` down.
84
        created_sender: oneshot::Sender<CreateResponse>,
85
        /// Channel to send other messages from this circuit down.
86
        sender: CircuitRxSender,
87
        /// Oneshot channel to send the new circuit's identifiers down.
88
        tx: ReactorResultChannel<(CircId, crate::tunnel::circuit::UniqId)>,
89
    },
90
    /// Enable/disable/reconfigure channel padding
91
    ///
92
    /// The sender of these messages is responsible for the optimisation of
93
    /// ensuring that "no-change" messages are elided.
94
    /// (This is implemented in `ChannelsParamsUpdatesBuilder`.)
95
    ///
96
    /// These updates are done via a control message to avoid adding additional branches to the
97
    /// main reactor `select!`.
98
    ConfigUpdate(Arc<ChannelPaddingInstructionsUpdates>),
99
    /// Enable/disable/reconfigure KIST.
100
    ///
101
    /// Like in the case of `ConfigUpdate`,
102
    /// the sender of these messages is responsible for the optimisation of
103
    /// ensuring that "no-change" messages are elided.
104
    KistConfigUpdate(KistParams),
105
}
106

            
107
/// Object to handle incoming cells and background tasks on a channel.
108
///
109
/// This type is returned when you finish a channel; you need to spawn a
110
/// new task that calls `run()` on it.
111
#[must_use = "If you don't call run() on a reactor, the channel won't work."]
112
pub struct Reactor<S: SleepProvider> {
113
    /// A receiver for control messages from `Channel` objects.
114
    pub(super) control: mpsc::UnboundedReceiver<CtrlMsg>,
115
    /// A oneshot sender that is used to alert other tasks when this reactor is
116
    /// finally dropped.
117
    pub(super) reactor_closed_tx: oneshot_broadcast::Sender<Result<CloseInfo>>,
118
    /// A receiver for cells to be sent on this reactor's sink.
119
    ///
120
    /// `Channel` objects have a sender that can send cells here.
121
    pub(super) cells: mq_queue::Receiver<AnyChanCell, mq_queue::MpscSpec>,
122
    /// A Stream from which we can read `ChanCell`s.
123
    ///
124
    /// This should be backed by a TLS connection if you want it to be secure.
125
    pub(super) input: futures::stream::Fuse<BoxedChannelStream>,
126
    /// A Sink to which we can write `ChanCell`s.
127
    ///
128
    /// This should also be backed by a TLS connection if you want it to be secure.
129
    pub(super) output: BoxedChannelSink,
130
    /// A handler for setting stream options on the underlying stream.
131
    #[cfg_attr(not(target_os = "linux"), allow(unused))]
132
    pub(super) streamops: BoxedChannelStreamOps,
133
    /// Timer tracking when to generate channel padding
134
    pub(super) padding_timer: Pin<Box<padding::Timer<S>>>,
135
    /// Outgoing cells introduced at the channel reactor
136
    pub(super) special_outgoing: SpecialOutgoing,
137
    /// A map from circuit ID to Sinks on which we can deliver cells.
138
    pub(super) circs: CircMap,
139
    /// A unique identifier for this channel.
140
    pub(super) unique_id: super::UniqId,
141
    /// Information shared with the frontend
142
    pub(super) details: Arc<ChannelDetails>,
143
    /// Context for allocating unique circuit log identifiers.
144
    pub(super) circ_unique_id_ctx: unique_id::CircUniqIdContext,
145
    /// What link protocol is the channel using?
146
    #[allow(dead_code)] // We don't support protocols where this would matter
147
    pub(super) link_protocol: u16,
148
}
149

            
150
/// Outgoing cells introduced at the channel reactor
151
#[derive(Default, Debug, Clone)]
152
pub(super) struct SpecialOutgoing {
153
    /// If we must send a `PaddingNegotiate`
154
    pub(super) padding_negotiate: Option<PaddingNegotiate>,
155
}
156

            
157
impl SpecialOutgoing {
158
    /// Do we have a special cell to send?
159
    ///
160
    /// Called by the reactor before looking for cells from the reactor's clients.
161
    /// The returned message *must* be sent by the caller, not dropped!
162
    #[must_use = "SpecialOutgoing::next()'s return value must be actually sent"]
163
3066
    pub(super) fn next(&mut self) -> Option<AnyChanCell> {
164
        // If this gets more cases, consider making SpecialOutgoing into a #[repr(C)]
165
        // enum, so that we can fast-path the usual case of "no special message to send".
166
3066
        if let Some(p) = self.padding_negotiate.take() {
167
            return Some(p.into());
168
3066
        }
169
3066
        None
170
3066
    }
171
}
172

            
173
/// Allows us to just say debug!("{}: Reactor did a thing", &self, ...)
174
///
175
/// There is no risk of confusion because no-one would try to print a
176
/// Reactor for some other reason.
177
impl<S: SleepProvider> fmt::Display for Reactor<S> {
178
512
    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
179
512
        fmt::Debug::fmt(&self.unique_id, f)
180
512
    }
181
}
182

            
183
impl<S: SleepProvider> Reactor<S> {
184
    /// Launch the reactor, and run until the channel closes or we
185
    /// encounter an error.
186
    ///
187
    /// Once this function returns, the channel is dead, and can't be
188
    /// used again.
189
178
    pub async fn run(mut self) -> Result<()> {
190
178
        trace!("{}: Running reactor", &self);
191
178
        let result: Result<()> = loop {
192
2932
            match self.run_once().await {
193
2754
                Ok(()) => (),
194
106
                Err(ReactorError::Shutdown) => break Ok(()),
195
72
                Err(ReactorError::Err(e)) => break Err(e),
196
            }
197
        };
198
178
        debug!("{}: Reactor stopped: {:?}", &self, result);
199
        // Inform any waiters that the channel has closed.
200
178
        let close_msg = result.as_ref().map_err(Clone::clone).map(|()| CloseInfo);
201
178
        self.reactor_closed_tx.send(close_msg);
202
178
        result
203
178
    }
204

            
205
    /// Helper for run(): handles only one action.
206
3236
    async fn run_once(&mut self) -> std::result::Result<(), ReactorError> {
207
3236
        select! {
208

            
209
            // See if the output sink can have cells written to it yet.
210
            // If so, see if we have to-be-transmitted cells.
211
3236
            ret = self.output.prepare_send_from(async {
212
                // This runs if we will be able to write, so try to obtain a cell:
213

            
214
3066
                if let Some(l) = self.special_outgoing.next() {
215
                    // See reasoning below.
216
                    // eprintln!("PADDING - SENDING NEOGIATION: {:?}", &l);
217
                    self.padding_timer.as_mut().note_cell_sent();
218
                    return Some(l)
219
3066
                }
220
3066

            
221
3066
                select_biased! {
222
3066
                    n = self.cells.next() => {
223
                        // Note transmission on *input* to the reactor, not ultimate
224
                        // transmission.  Ideally we would tap into the TCP stream at the far
225
                        // end of our TLS or perhaps during encoding on entry to the TLS, but
226
                        // both of those would involve quite some plumbing.  Doing it here in
227
                        // the reactor avoids additional inter-task communication, mutexes,
228
                        // etc.  (And there is no real difference between doing it here on
229
                        // input, to just below, on enquieing into the `sendable`.)
230
                        //
231
                        // Padding is sent when the output channel is idle, and the effect of
232
                        // buffering is just that we might sent it a little early because we
233
                        // measure idleness when we last put something into the output layers.
234
                        //
235
                        // We can revisit this if measurement shows it to be bad in practice.
236
                        //
237
                        // (We in any case need padding that we generate when idle to make it
238
                        // through to the output promptly, or it will be late and ineffective.)
239
2770
                        self.padding_timer.as_mut().note_cell_sent();
240
2770
                        n
241
                    },
242
3066
                    p = self.padding_timer.as_mut().next() => {
243
                        // eprintln!("PADDING - SENDING PADDING: {:?}", &p);
244
                        Some(p.into())
245
                    },
246
                }
247
3236
            }) => {
248
2804
                let (msg, sendable) = ret.map_err(codec_err_to_chan)?;
249
2770
                let msg = msg.ok_or(ReactorError::Shutdown)?;
250
2752
                sendable.send(msg).map_err(codec_err_to_chan)?;
251
            }
252

            
253
3236
            ret = self.control.next() => {
254
72
                let ctrl = match ret {
255
28
                    None | Some(CtrlMsg::Shutdown) => return Err(ReactorError::Shutdown),
256
48
                    Some(x) => x,
257
48
                };
258
48
                self.handle_control(ctrl).await?;
259
            }
260

            
261
3236
            ret = self.input.next() => {
262
356
                let item = ret
263
356
                    .ok_or(ReactorError::Shutdown)?
264
288
                    .map_err(codec_err_to_chan)?;
265
288
                crate::note_incoming_traffic();
266
288
                self.handle_cell(item).await?;
267
            }
268

            
269
        }
270
3002
        Ok(()) // Run again.
271
3236
    }
272

            
273
    /// Handle a CtrlMsg other than Shutdown.
274
48
    async fn handle_control(&mut self, msg: CtrlMsg) -> Result<()> {
275
48
        trace!("{}: reactor received {:?}", &self, msg);
276
48
        match msg {
277
            CtrlMsg::Shutdown => panic!(), // was handled in reactor loop.
278
40
            CtrlMsg::CloseCircuit(id) => self.outbound_destroy_circ(id).await?,
279
            CtrlMsg::AllocateCircuit {
280
8
                created_sender,
281
8
                sender,
282
8
                tx,
283
8
            } => {
284
8
                let mut rng = rand::rng();
285
8
                let my_unique_id = self.unique_id;
286
8
                let circ_unique_id = self.circ_unique_id_ctx.next(my_unique_id);
287
8
                let ret: Result<_> = self
288
8
                    .circs
289
8
                    .add_ent(&mut rng, created_sender, sender)
290
8
                    .map(|id| (id, circ_unique_id));
291
8
                let _ = tx.send(ret); // don't care about other side going away
292
8
                self.update_disused_since();
293
8
            }
294
            CtrlMsg::ConfigUpdate(updates) => {
295
                if self.link_protocol == 4 {
296
                    // Link protocol 4 does not permit sending, or negotiating, link padding.
297
                    // We test for == 4 so that future updates to handshake.rs LINK_PROTOCOLS
298
                    // keep doing padding things.
299
                    return Ok(());
300
                }
301

            
302
                let ChannelPaddingInstructionsUpdates {
303
                    // List all the fields explicitly; that way the compiler will warn us
304
                    // if one is added and we fail to handle it here.
305
                    padding_enable,
306
                    padding_parameters,
307
                    padding_negotiate,
308
                } = &*updates;
309
                if let Some(parameters) = padding_parameters {
310
                    self.padding_timer.as_mut().reconfigure(parameters)?;
311
                }
312
                if let Some(enable) = padding_enable {
313
                    if *enable {
314
                        self.padding_timer.as_mut().enable();
315
                    } else {
316
                        self.padding_timer.as_mut().disable();
317
                    }
318
                }
319
                if let Some(padding_negotiate) = padding_negotiate {
320
                    // This replaces any previous PADDING_NEGOTIATE cell that we were
321
                    // told to send, but which we didn't manage to send yet.
322
                    // It doesn't make sense to queue them up.
323
                    self.special_outgoing.padding_negotiate = Some(padding_negotiate.clone());
324
                }
325
            }
326
            CtrlMsg::KistConfigUpdate(kist) => self.apply_kist_params(&kist),
327
        }
328
24
        Ok(())
329
48
    }
330

            
331
    /// Helper: process a cell on a channel.  Most cell types get ignored
332
    /// or rejected; a few get delivered to circuits.
333
288
    async fn handle_cell(&mut self, cell: OpenChanCellS2C) -> Result<()> {
334
288
        let (circid, msg) = cell.into_circid_and_msg();
335
        use OpenChanMsgS2C::*;
336

            
337
288
        match msg {
338
240
            Relay(_) | Padding(_) | Vpadding(_) => {} // too frequent to log.
339
48
            _ => trace!(
340
                "{}: received {} for {}",
341
                &self,
342
                msg.cmd(),
343
                CircId::get_or_zero(circid)
344
            ),
345
        }
346

            
347
288
        match msg {
348
            // These are allowed, and need to be handled.
349
240
            Relay(_) => self.deliver_relay(circid, msg.into()).await,
350

            
351
32
            Destroy(_) => self.deliver_destroy(circid, msg.into()).await,
352

            
353
16
            CreatedFast(_) | Created2(_) => self.deliver_created(circid, msg.into()).await,
354

            
355
            // These are always ignored.
356
            Padding(_) | Vpadding(_) => Ok(()),
357
        }
358
288
    }
359

            
360
    /// Give the RELAY cell `msg` to the appropriate circuit.
361
240
    async fn deliver_relay(&mut self, circid: Option<CircId>, msg: AnyChanMsg) -> Result<()> {
362
240
        let Some(circid) = circid else {
363
            return Err(Error::ChanProto("Relay cell without circuit ID".into()));
364
        };
365

            
366
240
        let mut ent = self
367
240
            .circs
368
240
            .get_mut(circid)
369
240
            .ok_or_else(|| Error::ChanProto("Relay cell on nonexistent circuit".into()))?;
370

            
371
224
        match &mut *ent {
372
8
            CircEnt::Open(s) => {
373
8
                // There's an open circuit; we can give it the RELAY cell.
374
8
                if s.send(msg.try_into()?).await.is_err() {
375
                    drop(ent);
376
                    // The circuit's receiver went away, so we should destroy the circuit.
377
                    self.outbound_destroy_circ(circid).await?;
378
8
                }
379
8
                Ok(())
380
            }
381
8
            CircEnt::Opening(_, _) => Err(Error::ChanProto(
382
8
                "Relay cell on pending circuit before CREATED* received".into(),
383
8
            )),
384
208
            CircEnt::DestroySent(hs) => hs.receive_cell(),
385
        }
386
240
    }
387

            
388
    /// Handle a CREATED{,_FAST,2} cell by passing it on to the appropriate
389
    /// circuit, if that circuit is waiting for one.
390
16
    async fn deliver_created(&mut self, circid: Option<CircId>, msg: AnyChanMsg) -> Result<()> {
391
16
        let Some(circid) = circid else {
392
            return Err(Error::ChanProto("'Created' cell without circuit ID".into()));
393
        };
394

            
395
16
        let target = self.circs.advance_from_opening(circid)?;
396
        let created = msg.try_into()?;
397
        // TODO(nickm) I think that this one actually means the other side
398
        // is closed. See arti#269.
399
        target.send(created).map_err(|_| {
400
            Error::from(internal!(
401
                "Circuit queue rejected created message. Is it closing?"
402
            ))
403
        })
404
16
    }
405

            
406
    /// Handle a DESTROY cell by removing the corresponding circuit
407
    /// from the map, and passing the destroy cell onward to the circuit.
408
32
    async fn deliver_destroy(&mut self, circid: Option<CircId>, msg: AnyChanMsg) -> Result<()> {
409
32
        let Some(circid) = circid else {
410
            return Err(Error::ChanProto("'Destroy' cell without circuit ID".into()));
411
        };
412

            
413
        // Remove the circuit from the map: nothing more can be done with it.
414
32
        let entry = self.circs.remove(circid);
415
32
        self.update_disused_since();
416
24
        match entry {
417
            // If the circuit is waiting for CREATED, tell it that it
418
            // won't get one.
419
8
            Some(CircEnt::Opening(oneshot, _)) => {
420
8
                trace!("{}: Passing destroy to pending circuit {}", &self, circid);
421
8
                oneshot
422
8
                    .send(msg.try_into()?)
423
                    // TODO(nickm) I think that this one actually means the other side
424
                    // is closed. See arti#269.
425
8
                    .map_err(|_| {
426
                        internal!("pending circuit wasn't interested in destroy cell?").into()
427
8
                    })
428
            }
429
            // It's an open circuit: tell it that it got a DESTROY cell.
430
8
            Some(CircEnt::Open(mut sink)) => {
431
8
                trace!("{}: Passing destroy to open circuit {}", &self, circid);
432
8
                sink.send(msg.try_into()?)
433
8
                    .await
434
                    // TODO(nickm) I think that this one actually means the other side
435
                    // is closed. See arti#269.
436
8
                    .map_err(|_| {
437
                        internal!("open circuit wasn't interested in destroy cell?").into()
438
8
                    })
439
            }
440
            // We've sent a destroy; we can leave this circuit removed.
441
8
            Some(CircEnt::DestroySent(_)) => Ok(()),
442
            // Got a DESTROY cell for a circuit we don't have.
443
            None => {
444
8
                trace!("{}: Destroy for nonexistent circuit {}", &self, circid);
445
8
                Err(Error::ChanProto("Destroy for nonexistent circuit".into()))
446
            }
447
        }
448
32
    }
449

            
450
    /// Helper: send a cell on the outbound sink.
451
40
    async fn send_cell(&mut self, cell: AnyChanCell) -> Result<()> {
452
40
        self.output.send(cell).await.map_err(codec_err_to_chan)?;
453
16
        Ok(())
454
40
    }
455

            
456
    /// Called when a circuit goes away: sends a DESTROY cell and removes
457
    /// the circuit.
458
40
    async fn outbound_destroy_circ(&mut self, id: CircId) -> Result<()> {
459
40
        trace!("{}: Circuit {} is gone; sending DESTROY", &self, id);
460
        // Remove the circuit's entry from the map: nothing more
461
        // can be done with it.
462
        // TODO: It would be great to have a tighter upper bound for
463
        // the number of relay cells we'll receive.
464
40
        self.circs.destroy_sent(id, HalfCirc::new(3000));
465
40
        self.update_disused_since();
466
40
        let destroy = Destroy::new(DestroyReason::NONE).into();
467
40
        let cell = AnyChanCell::new(Some(id), destroy);
468
40
        self.send_cell(cell).await?;
469

            
470
16
        Ok(())
471
40
    }
472

            
473
    /// Update disused timestamp with current time if this channel is no longer used
474
80
    fn update_disused_since(&self) {
475
80
        if self.circs.open_ent_count() == 0 {
476
72
            // Update disused_since if it still indicates that the channel is in use
477
72
            self.details.unused_since.update_if_none();
478
72
        } else {
479
8
            // Mark this channel as in use
480
8
            self.details.unused_since.clear();
481
8
        }
482
80
    }
483

            
484
    /// Use the new KIST parameters.
485
    #[cfg(target_os = "linux")]
486
    fn apply_kist_params(&self, params: &KistParams) {
487
        use super::kist::KistMode;
488

            
489
        let set_tcp_notsent_lowat = |v: u32| {
490
            if let Err(e) = self.streamops.set_tcp_notsent_lowat(v) {
491
                // This is bad, but not fatal: not setting the KIST options
492
                // comes with a performance penalty, but we don't have to crash.
493
                error_report!(e, "Failed to set KIST socket options");
494
            }
495
        };
496

            
497
        match params.kist_enabled() {
498
            KistMode::TcpNotSentLowat => set_tcp_notsent_lowat(params.tcp_notsent_lowat()),
499
            KistMode::Disabled => set_tcp_notsent_lowat(u32::MAX),
500
        }
501
    }
502

            
503
    #[cfg(not(target_os = "linux"))]
504
    fn apply_kist_params(&self, params: &KistParams) {
505
        use super::kist::KistMode;
506

            
507
        if params.kist_enabled() != KistMode::Disabled {
508
            tracing::warn!("KIST not currently supported on non-linux platforms");
509
        }
510
    }
511
}
512

            
513
#[cfg(test)]
514
pub(crate) mod test {
515
    #![allow(clippy::unwrap_used)]
516
    use super::*;
517
    use crate::channel::{ClosedUnexpectedly, UniqId};
518
    use crate::fake_mpsc;
519
    use crate::tunnel::circuit::CircParameters;
520
    use crate::util::fake_mq;
521
    use futures::sink::SinkExt;
522
    use futures::stream::StreamExt;
523
    use futures::task::SpawnExt;
524
    use tor_cell::chancell::msg;
525
    use tor_linkspec::OwnedChanTarget;
526
    use tor_rtcompat::{NoOpStreamOpsHandle, Runtime};
527

            
528
    type CodecResult = std::result::Result<OpenChanCellS2C, CodecError>;
529

            
530
    pub(crate) fn new_reactor<R: Runtime>(
531
        runtime: R,
532
    ) -> (
533
        Arc<crate::channel::Channel>,
534
        Reactor<R>,
535
        mpsc::Receiver<AnyChanCell>,
536
        mpsc::Sender<CodecResult>,
537
    ) {
538
        let link_protocol = 4;
539
        let (send1, recv1) = mpsc::channel(32);
540
        let (send2, recv2) = mpsc::channel(32);
541
        let unique_id = UniqId::new();
542
        let dummy_target = OwnedChanTarget::builder()
543
            .ed_identity([6; 32].into())
544
            .rsa_identity([10; 20].into())
545
            .build()
546
            .unwrap();
547
        let send1 = send1.sink_map_err(|e| {
548
            trace!("got sink error: {:?}", e);
549
            CodecError::DecCell(tor_cell::Error::ChanProto("dummy message".into()))
550
        });
551
        let stream_ops = NoOpStreamOpsHandle::default();
552
        let (chan, reactor) = crate::channel::Channel::new(
553
            link_protocol,
554
            Box::new(send1),
555
            Box::new(recv2),
556
            Box::new(stream_ops),
557
            unique_id,
558
            dummy_target,
559
            crate::ClockSkew::None,
560
            runtime,
561
            fake_mq(),
562
        )
563
        .expect("channel create failed");
564
        (chan, reactor, recv1, send2)
565
    }
566

            
567
    // Try shutdown from inside run_once..
568
    #[test]
569
    fn shutdown() {
570
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
571
            let (chan, mut reactor, _output, _input) = new_reactor(rt);
572

            
573
            chan.terminate();
574
            let r = reactor.run_once().await;
575
            assert!(matches!(r, Err(ReactorError::Shutdown)));
576
        });
577
    }
578

            
579
    // Try shutdown while reactor is running.
580
    #[test]
581
    fn shutdown2() {
582
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
583
            // TODO: Ask a rust person if this is how to do this.
584

            
585
            use futures::future::FutureExt;
586
            use futures::join;
587

            
588
            let (chan, reactor, _output, _input) = new_reactor(rt);
589
            // Let's get the reactor running...
590
            let run_reactor = reactor.run().map(|x| x.is_ok()).shared();
591

            
592
            let rr = run_reactor.clone();
593

            
594
            let exit_then_check = async {
595
                assert!(rr.peek().is_none());
596
                // ... and terminate the channel while that's happening.
597
                chan.terminate();
598
            };
599

            
600
            let (rr_s, _) = join!(run_reactor, exit_then_check);
601

            
602
            // Now let's see. The reactor should not _still_ be running.
603
            assert!(rr_s);
604
        });
605
    }
606

            
607
    #[test]
608
    fn new_circ_closed() {
609
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
610
            let (chan, mut reactor, mut output, _input) = new_reactor(rt.clone());
611
            assert!(chan.duration_unused().is_some()); // unused yet
612

            
613
            let (ret, reac) = futures::join!(chan.new_circ(), reactor.run_once());
614
            let (pending, circr) = ret.unwrap();
615
            rt.spawn(async {
616
                let _ignore = circr.run().await;
617
            })
618
            .unwrap();
619
            assert!(reac.is_ok());
620

            
621
            let id = pending.peek_circid();
622

            
623
            let ent = reactor.circs.get_mut(id);
624
            assert!(matches!(*ent.unwrap(), CircEnt::Opening(_, _)));
625
            assert!(chan.duration_unused().is_none()); // in use
626

            
627
            // Now drop the circuit; this should tell the reactor to remove
628
            // the circuit from the map.
629
            drop(pending);
630

            
631
            reactor.run_once().await.unwrap();
632
            let ent = reactor.circs.get_mut(id);
633
            assert!(matches!(*ent.unwrap(), CircEnt::DestroySent(_)));
634
            let cell = output.next().await.unwrap();
635
            assert_eq!(cell.circid(), Some(id));
636
            assert!(matches!(cell.msg(), AnyChanMsg::Destroy(_)));
637
            assert!(chan.duration_unused().is_some()); // unused again
638
        });
639
    }
640

            
641
    // Test proper delivery of a created cell that doesn't make a channel
642
    #[test]
643
    #[ignore] // See bug #244: re-enable this test once it passes reliably.
644
    fn new_circ_create_failure() {
645
        use std::time::Duration;
646
        use tor_rtcompat::SleepProvider;
647

            
648
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
649
            let (chan, mut reactor, mut output, mut input) = new_reactor(rt.clone());
650

            
651
            let (ret, reac) = futures::join!(chan.new_circ(), reactor.run_once());
652
            let (pending, circr) = ret.unwrap();
653
            rt.spawn(async {
654
                let _ignore = circr.run().await;
655
            })
656
            .unwrap();
657
            assert!(reac.is_ok());
658

            
659
            let circparams = CircParameters::default();
660

            
661
            let id = pending.peek_circid();
662

            
663
            let ent = reactor.circs.get_mut(id);
664
            assert!(matches!(*ent.unwrap(), CircEnt::Opening(_, _)));
665

            
666
            #[allow(clippy::clone_on_copy)]
667
            let rtc = rt.clone();
668
            let send_response = async {
669
                rtc.sleep(Duration::from_millis(100)).await;
670
                trace!("sending createdfast");
671
                // We'll get a bad handshake result from this createdfast cell.
672
                let created_cell =
673
                    OpenChanCellS2C::new(Some(id), msg::CreatedFast::new(*b"x").into());
674
                input.send(Ok(created_cell)).await.unwrap();
675
                reactor.run_once().await.unwrap();
676
            };
677

            
678
            let (circ, _) = futures::join!(pending.create_firsthop_fast(circparams), send_response);
679
            // Make sure statuses are as expected.
680
            assert!(matches!(circ.err().unwrap(), Error::BadCircHandshakeAuth));
681

            
682
            reactor.run_once().await.unwrap();
683

            
684
            // Make sure that the createfast cell got sent
685
            let cell_sent = output.next().await.unwrap();
686
            assert!(matches!(cell_sent.msg(), msg::AnyChanMsg::CreateFast(_)));
687

            
688
            // But the next run if the reactor will make the circuit get closed.
689
            let ent = reactor.circs.get_mut(id);
690
            assert!(matches!(*ent.unwrap(), CircEnt::DestroySent(_)));
691
        });
692
    }
693

            
694
    // Try incoming cells that shouldn't arrive on channels.
695
    #[test]
696
    fn bad_cells() {
697
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
698
            let (_chan, mut reactor, _output, mut input) = new_reactor(rt);
699

            
700
            // shouldn't get created2 cells for nonexistent circuits
701
            let created2_cell = msg::Created2::new(*b"hihi").into();
702
            input
703
                .send(Ok(OpenChanCellS2C::new(CircId::new(7), created2_cell)))
704
                .await
705
                .unwrap();
706

            
707
            let e = reactor.run_once().await.unwrap_err().unwrap_err();
708
            assert_eq!(
709
                format!("{}", e),
710
                "Channel protocol violation: Unexpected CREATED* cell not on opening circuit"
711
            );
712

            
713
            // Can't get a relay cell on a circuit we've never heard of.
714
            let relay_cell = msg::Relay::new(b"abc").into();
715
            input
716
                .send(Ok(OpenChanCellS2C::new(CircId::new(4), relay_cell)))
717
                .await
718
                .unwrap();
719
            let e = reactor.run_once().await.unwrap_err().unwrap_err();
720
            assert_eq!(
721
                format!("{}", e),
722
                "Channel protocol violation: Relay cell on nonexistent circuit"
723
            );
724

            
725
            // There used to be tests here for other types, but now that we only
726
            // accept OpenClientChanCell, we know that the codec can't even try
727
            // to give us e.g. VERSIONS or CREATE.
728
        });
729
    }
730

            
731
    #[test]
732
    fn deliver_relay() {
733
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
734
            use crate::tunnel::circuit::celltypes::ClientCircChanMsg;
735
            use oneshot_fused_workaround as oneshot;
736

            
737
            let (_chan, mut reactor, _output, mut input) = new_reactor(rt);
738

            
739
            let (_circ_stream_7, mut circ_stream_13) = {
740
                let (snd1, _rcv1) = oneshot::channel();
741
                let (snd2, rcv2) = fake_mpsc(64);
742
                reactor
743
                    .circs
744
                    .put_unchecked(CircId::new(7).unwrap(), CircEnt::Opening(snd1, snd2));
745

            
746
                let (snd3, rcv3) = fake_mpsc(64);
747
                reactor
748
                    .circs
749
                    .put_unchecked(CircId::new(13).unwrap(), CircEnt::Open(snd3));
750

            
751
                reactor.circs.put_unchecked(
752
                    CircId::new(23).unwrap(),
753
                    CircEnt::DestroySent(HalfCirc::new(25)),
754
                );
755
                (rcv2, rcv3)
756
            };
757

            
758
            // If a relay cell is sent on an open channel, the correct circuit
759
            // should get it.
760
            let relaycell: OpenChanMsgS2C = msg::Relay::new(b"do you suppose").into();
761
            input
762
                .send(Ok(OpenChanCellS2C::new(CircId::new(13), relaycell.clone())))
763
                .await
764
                .unwrap();
765
            reactor.run_once().await.unwrap();
766
            let got = circ_stream_13.next().await.unwrap();
767
            assert!(matches!(got, ClientCircChanMsg::Relay(_)));
768

            
769
            // If a relay cell is sent on an opening channel, that's an error.
770
            input
771
                .send(Ok(OpenChanCellS2C::new(CircId::new(7), relaycell.clone())))
772
                .await
773
                .unwrap();
774
            let e = reactor.run_once().await.unwrap_err().unwrap_err();
775
            assert_eq!(
776
                format!("{}", e),
777
                "Channel protocol violation: Relay cell on pending circuit before CREATED* received"
778
            );
779

            
780
            // If a relay cell is sent on a non-existent channel, that's an error.
781
            input
782
                .send(Ok(OpenChanCellS2C::new(
783
                    CircId::new(101),
784
                    relaycell.clone(),
785
                )))
786
                .await
787
                .unwrap();
788
            let e = reactor.run_once().await.unwrap_err().unwrap_err();
789
            assert_eq!(
790
                format!("{}", e),
791
                "Channel protocol violation: Relay cell on nonexistent circuit"
792
            );
793

            
794
            // It's fine to get a relay cell on a DestroySent channel: that happens
795
            // when the other side hasn't noticed the Destroy yet.
796

            
797
            // We can do this 25 more times according to our setup:
798
            for _ in 0..25 {
799
                input
800
                    .send(Ok(OpenChanCellS2C::new(CircId::new(23), relaycell.clone())))
801
                    .await
802
                    .unwrap();
803
                reactor.run_once().await.unwrap(); // should be fine.
804
            }
805

            
806
            // This one will fail.
807
            input
808
                .send(Ok(OpenChanCellS2C::new(CircId::new(23), relaycell.clone())))
809
                .await
810
                .unwrap();
811
            let e = reactor.run_once().await.unwrap_err().unwrap_err();
812
            assert_eq!(
813
                format!("{}", e),
814
                "Channel protocol violation: Too many cells received on destroyed circuit"
815
            );
816
        });
817
    }
818

            
819
    #[test]
820
    fn deliver_destroy() {
821
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
822
            use crate::tunnel::circuit::celltypes::*;
823
            use oneshot_fused_workaround as oneshot;
824

            
825
            let (_chan, mut reactor, _output, mut input) = new_reactor(rt);
826

            
827
            let (circ_oneshot_7, mut circ_stream_13) = {
828
                let (snd1, rcv1) = oneshot::channel();
829
                let (snd2, _rcv2) = fake_mpsc(64);
830
                reactor
831
                    .circs
832
                    .put_unchecked(CircId::new(7).unwrap(), CircEnt::Opening(snd1, snd2));
833

            
834
                let (snd3, rcv3) = fake_mpsc(64);
835
                reactor
836
                    .circs
837
                    .put_unchecked(CircId::new(13).unwrap(), CircEnt::Open(snd3));
838

            
839
                reactor.circs.put_unchecked(
840
                    CircId::new(23).unwrap(),
841
                    CircEnt::DestroySent(HalfCirc::new(25)),
842
                );
843
                (rcv1, rcv3)
844
            };
845

            
846
            // Destroying an opening circuit is fine.
847
            let destroycell: OpenChanMsgS2C = msg::Destroy::new(0.into()).into();
848
            input
849
                .send(Ok(OpenChanCellS2C::new(
850
                    CircId::new(7),
851
                    destroycell.clone(),
852
                )))
853
                .await
854
                .unwrap();
855
            reactor.run_once().await.unwrap();
856
            let msg = circ_oneshot_7.await;
857
            assert!(matches!(msg, Ok(CreateResponse::Destroy(_))));
858

            
859
            // Destroying an open circuit is fine.
860
            input
861
                .send(Ok(OpenChanCellS2C::new(
862
                    CircId::new(13),
863
                    destroycell.clone(),
864
                )))
865
                .await
866
                .unwrap();
867
            reactor.run_once().await.unwrap();
868
            let msg = circ_stream_13.next().await.unwrap();
869
            assert!(matches!(msg, ClientCircChanMsg::Destroy(_)));
870

            
871
            // Destroying a DestroySent circuit is fine.
872
            input
873
                .send(Ok(OpenChanCellS2C::new(
874
                    CircId::new(23),
875
                    destroycell.clone(),
876
                )))
877
                .await
878
                .unwrap();
879
            reactor.run_once().await.unwrap();
880

            
881
            // Destroying a nonexistent circuit is an error.
882
            input
883
                .send(Ok(OpenChanCellS2C::new(
884
                    CircId::new(101),
885
                    destroycell.clone(),
886
                )))
887
                .await
888
                .unwrap();
889
            let e = reactor.run_once().await.unwrap_err().unwrap_err();
890
            assert_eq!(
891
                format!("{}", e),
892
                "Channel protocol violation: Destroy for nonexistent circuit"
893
            );
894
        });
895
    }
896

            
897
    #[test]
898
    fn closing_if_reactor_dropped() {
899
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
900
            let (chan, reactor, _output, _input) = new_reactor(rt);
901

            
902
            assert!(!chan.is_closing());
903
            drop(reactor);
904
            assert!(chan.is_closing());
905

            
906
            assert!(matches!(
907
                chan.wait_for_close().await,
908
                Err(ClosedUnexpectedly::ReactorDropped),
909
            ));
910
        });
911
    }
912

            
913
    #[test]
914
    fn closing_if_reactor_shutdown() {
915
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
916
            let (chan, reactor, _output, _input) = new_reactor(rt);
917

            
918
            assert!(!chan.is_closing());
919
            chan.terminate();
920
            assert!(!chan.is_closing());
921

            
922
            let r = reactor.run().await;
923
            assert!(r.is_ok());
924
            assert!(chan.is_closing());
925

            
926
            assert!(chan.wait_for_close().await.is_ok());
927
        });
928
    }
929

            
930
    #[test]
931
    fn reactor_error_wait_for_close() {
932
        tor_rtcompat::test_with_all_runtimes!(|rt| async move {
933
            let (chan, reactor, _output, mut input) = new_reactor(rt);
934

            
935
            // force an error by sending created2 cell for nonexistent circuit
936
            let created2_cell = msg::Created2::new(*b"hihi").into();
937
            input
938
                .send(Ok(OpenChanCellS2C::new(CircId::new(7), created2_cell)))
939
                .await
940
                .unwrap();
941

            
942
            // `reactor.run()` should return an error
943
            let run_error = reactor.run().await.unwrap_err();
944

            
945
            // `chan.wait_for_close()` should return the same error
946
            let Err(ClosedUnexpectedly::ReactorError(wait_error)) = chan.wait_for_close().await
947
            else {
948
                panic!("Expected a 'ReactorError'");
949
            };
950

            
951
            // `Error` doesn't implement `PartialEq`, so best we can do is to compare the strings
952
            assert_eq!(run_error.to_string(), wait_error.to_string());
953
        });
954
    }
955
}