1
#![cfg_attr(docsrs, feature(doc_auto_cfg, doc_cfg))]
2
#![doc = include_str!("../README.md")]
3
// @@ begin lint list maintained by maint/add_warning @@
4
#![allow(renamed_and_removed_lints)] // @@REMOVE_WHEN(ci_arti_stable)
5
#![allow(unknown_lints)] // @@REMOVE_WHEN(ci_arti_nightly)
6
#![warn(missing_docs)]
7
#![warn(noop_method_call)]
8
#![warn(unreachable_pub)]
9
#![warn(clippy::all)]
10
#![deny(clippy::await_holding_lock)]
11
#![deny(clippy::cargo_common_metadata)]
12
#![deny(clippy::cast_lossless)]
13
#![deny(clippy::checked_conversions)]
14
#![warn(clippy::cognitive_complexity)]
15
#![deny(clippy::debug_assert_with_mut_call)]
16
#![deny(clippy::exhaustive_enums)]
17
#![deny(clippy::exhaustive_structs)]
18
#![deny(clippy::expl_impl_clone_on_copy)]
19
#![deny(clippy::fallible_impl_from)]
20
#![deny(clippy::implicit_clone)]
21
#![deny(clippy::large_stack_arrays)]
22
#![warn(clippy::manual_ok_or)]
23
#![deny(clippy::missing_docs_in_private_items)]
24
#![warn(clippy::needless_borrow)]
25
#![warn(clippy::needless_pass_by_value)]
26
#![warn(clippy::option_option)]
27
#![deny(clippy::print_stderr)]
28
#![deny(clippy::print_stdout)]
29
#![warn(clippy::rc_buffer)]
30
#![deny(clippy::ref_option_ref)]
31
#![warn(clippy::semicolon_if_nothing_returned)]
32
#![warn(clippy::trait_duplication_in_bounds)]
33
#![deny(clippy::unchecked_duration_subtraction)]
34
#![deny(clippy::unnecessary_wraps)]
35
#![warn(clippy::unseparated_literal_suffix)]
36
#![deny(clippy::unwrap_used)]
37
#![deny(clippy::mod_module_files)]
38
#![allow(clippy::let_unit_value)] // This can reasonably be done for explicitness
39
#![allow(clippy::uninlined_format_args)]
40
#![allow(clippy::significant_drop_in_scrutinee)] // arti/-/merge_requests/588/#note_2812945
41
#![allow(clippy::result_large_err)] // temporary workaround for arti#587
42
#![allow(clippy::needless_raw_string_hashes)] // complained-about code is fine, often best
43
#![allow(clippy::needless_lifetimes)] // See arti#1765
44
//! <!-- @@ end lint list maintained by maint/add_warning @@ -->
45

            
46
use derive_more::Display;
47

            
48
mod internal;
49
pub use internal::*;
50

            
51
mod report;
52
pub use report::*;
53

            
54
mod retriable;
55
pub use retriable::*;
56

            
57
mod misc;
58
pub use misc::*;
59

            
60
#[cfg(feature = "tracing")]
61
pub mod tracing;
62

            
63
/// Classification of an error arising from Arti's Tor operations
64
///
65
/// This `ErrorKind` should suffice for programmatic handling by most applications embedding Arti:
66
/// get the kind via [`HasKind::kind`] and compare it to the expected value(s) with equality
67
/// or by matching.
68
///
69
/// When forwarding or reporting errors, use the whole error (e.g., `TorError`), not just the kind:
70
/// the error itself will contain more detail and context which is useful to humans.
71
//
72
// Splitting vs lumping guidelines:
73
//
74
// # Split on the place which caused the error
75
//
76
// Every ErrorKind should generally have an associated "location" in
77
// which it occurred.  If a problem can happen in two different
78
// "locations", it should have two different ErrorKinds.  (This goal
79
// may be frustrated sometimes by difficulty in determining where exactly
80
// a given error occurred.)
81
//
82
// The location of an ErrorKind should always be clear from its name.  If is not
83
// clear, add a location-related word to the name of the ErrorKind.
84
//
85
// For the purposes of this discussion, the following locations exist:
86
//   - Process:  Our code, or the application code using it.  These errors don't
87
//     usually need a special prefix.
88
//   - Host: A problem with our local computing  environment.  These errors
89
//     usually reflect trying to run under impossible circumstances (no file
90
//     system, no permissions, etc).
91
//   - Local: Another process on the same machine, or on the network between us
92
//     and the Tor network.  Errors in this location often indicate an outage,
93
//     misconfiguration, or a censorship event.
94
//   - Tor: Anywhere within the Tor network, or connections between Tor relays.
95
//     The words "Exit" and "Relay" also indicate this location.
96
//   - Remote: Anywhere _beyond_ the Tor exit. Can be a problem in the Tor
97
//     exit's connection to the real internet,  or with the remote host that the
98
//     exit is talking to.  (This kind of error can also indicate that the exit
99
//     is lying.)
100
//
101
// ## Lump any locations more fine-grained than that.
102
//
103
// We do not split locations more finely unless there's a good reason to do so.
104
// For example, we don't typically split errors within the "Tor" location based
105
// on whether they happened at a guard, a directory, or an exit.  (Errors with
106
// "Exit" or "Guard" in their names are okay, so long as that kind of error can
107
// _only_ occur at an Exit or Guard.)
108
//
109
// # Split based on reasonable response and semantics
110
//
111
// We also should split ErrorKinds based on what it's reasonable for the
112
// receiver to do with them.  Users may find more applications for our errors
113
// than we do, so we shouldn't assume that we can predict every reasonable use
114
// in advance.
115
//
116
// ErrorKinds should be more specific than just the locations in which they
117
// happen: for example, there shouldn't be a `TorNetworkError` or
118
// a `RemoteFailure`.
119
//
120
// # Avoid exposing implementation details
121
//
122
// ErrorKinds should not relate to particular code paths in the Arti codebase.
123

            
124
#[derive(Debug, Clone, Copy, PartialEq, Eq, Display)]
125
#[non_exhaustive]
126
pub enum ErrorKind {
127
    /// Error connecting to the Tor network
128
    ///
129
    /// Perhaps the local network is not working,
130
    /// or perhaps the chosen relay or bridge is not working properly.
131
    /// Not used for errors that occur within the Tor network, or accessing the public
132
    /// internet on the far side of Tor.
133
    #[display("error connecting to Tor")]
134
    TorAccessFailed,
135

            
136
    /// An attempt was made to use a Tor client for something without bootstrapping it first.
137
    #[display("attempted to use unbootstrapped client")]
138
    BootstrapRequired,
139

            
140
    /// Our network directory has expired before we were able to replace it.
141
    ///
142
    /// This kind of error can indicate one of several possible problems:
143
    /// * It can occur if the client used to be on the network, but has been
144
    ///   unable to make directory connections for a while.
145
    /// * It can occur if the client has been suspended or sleeping for a long
146
    ///   time, and has suddenly woken up without having a chance to replace its
147
    ///   network directory.
148
    /// * It can happen if the client has a sudden clock jump.
149
    ///
150
    /// Often, retrying after a minute or so will resolve this issue.
151
    ///
152
    // TODO this is pretty shonky.  "try again after a minute or so", seriously?
153
    //
154
    /// Future versions of Arti may resolve this situation automatically without caller
155
    /// intervention, possibly depending on preferences and API usage, in which case this kind of
156
    /// error will never occur.
157
    //
158
    // TODO: We should distinguish among the actual issues here, and report a
159
    // real bootstrapping problem when it exists.
160
    #[display("network directory is expired.")]
161
    DirectoryExpired,
162

            
163
    /// IO error accessing local persistent state
164
    ///
165
    /// For example, the disk might be full, or there may be a permissions problem.
166
    /// Usually the source will be [`std::io::Error`].
167
    ///
168
    /// Note that this kind of error only applies to problems in your `state_dir`:
169
    /// problems with your cache are another kind.
170
    #[display("could not read/write persistent state")]
171
    PersistentStateAccessFailed,
172

            
173
    /// We could not start up because a local resource is already being used by someone else
174
    ///
175
    /// Local resources include things like listening ports and state lockfiles.
176
    /// (We don't use this error for "out of disk space" and the like.)
177
    ///
178
    /// This can occur when another process
179
    /// (or another caller of Arti APIs)
180
    /// is already running a facility that overlaps with the one being requested.
181
    ///
182
    /// For example,
183
    /// running multiple processes each containing instances of the same hidden service,
184
    /// using the same state directories etc., is not supported.
185
    ///
186
    /// Another example:
187
    /// if Arti is configured to listen on a particular port,
188
    /// but another process on the system is already listening there,
189
    /// the resulting error has kind `LocalResourceAlreadyInUse`.
190
    // Actually, we only currently listen on ports in `arti` so we don't return
191
    // any Rust errors for this situation at all, at the time of writing.
192
    #[display("local resource (port, lockfile, etc.) already in use")]
193
    LocalResourceAlreadyInUse,
194

            
195
    /// We encountered a problem with filesystem permissions.
196
    ///
197
    /// This is likeliest to be caused by permissions on a file or directory
198
    /// being too permissive; the next likeliest cause is that we were unable to
199
    /// check the permissions on the file or directory, or on one of its
200
    /// ancestors.
201
    #[display("problem with filesystem permissions")]
202
    FsPermissions,
203

            
204
    /// Tor client's persistent state has been corrupted
205
    ///
206
    /// This could be because of a bug in the Tor code, or because something
207
    /// else has been messing with the data.
208
    ///
209
    /// This might also occur if the Tor code was upgraded and the new Tor is
210
    /// not compatible.
211
    ///
212
    /// Note that this kind of error only applies to problems in your
213
    /// `state_dir`: problems with your cache are another kind.
214
    #[display("corrupted data in persistent state")]
215
    PersistentStateCorrupted,
216

            
217
    /// Tor client's cache has been corrupted.
218
    ///
219
    /// This could be because of a bug in the Tor code, or because something else has been messing
220
    /// with the data.
221
    ///
222
    /// This might also occur if the Tor code was upgraded and the new Tor is not compatible.
223
    ///
224
    /// Note that this kind of error only applies to problems in your `cache_dir`:
225
    /// problems with your persistent state are another kind.
226
    #[display("corrupted data in cache")]
227
    CacheCorrupted,
228

            
229
    /// We had a problem reading or writing to our data cache.
230
    ///
231
    /// This may be a disk error, a file permission error, or similar.
232
    ///
233
    /// Note that this kind of error only applies to problems in your `cache_dir`:
234
    /// problems with your persistent state are another kind.
235
    #[display("cache access problem")]
236
    CacheAccessFailed,
237

            
238
    /// The keystore has been corrupted
239
    ///
240
    /// This could be because of a bug in the Tor code, or because something else has been messing
241
    /// with the data.
242
    ///
243
    /// Note that this kind of error only applies to problems in your `keystore_dir`:
244
    /// problems with your cache or persistent state are another kind.
245
    #[display("corrupted data in keystore")]
246
    KeystoreCorrupted,
247

            
248
    /// IO error accessing keystore
249
    ///
250
    /// For example, the disk might be full, or there may be a permissions problem.
251
    /// The source is typically an [`std::io::Error`].
252
    ///
253
    /// Note that this kind of error only applies to problems in your `keystore_dir`:
254
    /// problems with your cache or persistent state are another kind.
255
    #[display("could not access keystore")]
256
    KeystoreAccessFailed,
257

            
258
    /// Tor client's Rust async reactor is shutting down.
259
    ///
260
    /// This likely indicates that the reactor has encountered a fatal error, or
261
    /// has been told to do a clean shutdown, and it isn't possible to spawn new
262
    /// tasks.
263
    #[display("reactor is shutting down")]
264
    ReactorShuttingDown,
265

            
266
    /// Tor client is shutting down.
267
    ///
268
    /// This likely indicates that the last handle to the `TorClient` has been
269
    /// dropped, and is preventing other operations from completing.
270
    #[display("Tor client is shutting down.")]
271
    ArtiShuttingDown,
272

            
273
    /// This Tor client software is missing some feature that is recommended
274
    /// (or required) for operation on the network.
275
    ///
276
    /// This occurs when the directory authorities tell us that we ought to have
277
    /// a particular protocol feature that we do not support.
278
    /// The correct solution is likely to upgrade to a more recent version of Arti.
279
    #[display("Software version is deprecated")]
280
    SoftwareDeprecated,
281

            
282
    /// An operation failed because we waited too long for an exit to do
283
    /// something.
284
    ///
285
    /// This error can happen if the host you're trying to connect to isn't
286
    /// responding to traffic.
287
    /// It can also happen if an exit, or hidden service, is overloaded, and
288
    /// unable to answer your replies in a timely manner.
289
    ///
290
    /// And it might simply mean that the Tor network itself
291
    /// (including possibly relays, or hidden service introduction or rendezvous points)
292
    /// is not working properly
293
    ///
294
    /// In either case, trying later, or on a different circuit, might help.
295
    //
296
    // TODO: Say that this is distinct from the case where the exit _tells you_
297
    // that there is a timeout.
298
    #[display("operation timed out at exit")]
299
    RemoteNetworkTimeout,
300

            
301
    /// One or more configuration values were invalid or incompatible.
302
    ///
303
    /// This kind of error can happen if the user provides an invalid or badly
304
    /// formatted configuration file, if some of the options in that file are
305
    /// out of their ranges or unparsable, or if the options are not all
306
    /// compatible with one another. It can also happen if configuration options
307
    /// provided via APIs are out of range.
308
    ///
309
    /// If this occurs because of user configuration, it's probably best to tell
310
    /// the user about the error. If it occurs because of API usage, it's
311
    /// probably best to fix the code that causes the error.
312
    #[display("invalid configuration")]
313
    InvalidConfig,
314

            
315
    /// Tried to change the configuration of a running Arti service in a way
316
    /// that isn't supported.
317
    ///
318
    /// This kind of error can happen when you call a `reconfigure()` method on
319
    /// a service (or part of a service) and the new configuration is not
320
    /// compatible with the previous configuration.
321
    ///
322
    /// The only available remedy is to tear down the service and make a fresh
323
    /// one (for example, by making a new `TorClient`).
324
    #[display("invalid configuration transition")]
325
    InvalidConfigTransition,
326

            
327
    /// Tried to look up a directory depending on the user's home directory, but
328
    /// the user's home directory isn't set or can't be found.
329
    ///
330
    /// This kind of error can also occur if we're running in an environment
331
    /// where users don't have home directories.
332
    ///
333
    /// To resolve this kind of error, either move to an OS with home
334
    /// directories, or make sure that all paths in the configuration are set
335
    /// explicitly, and do not depend on any path variables.
336
    #[display("could not find a home directory")]
337
    NoHomeDirectory,
338

            
339
    /// A requested operation was not implemented by Arti.
340
    ///
341
    /// This kind of error can happen when requesting a piece of protocol
342
    /// functionality that has not (yet) been implemented in the Arti project.
343
    ///
344
    /// If it happens as a result of a user activity, it's fine to ignore, log,
345
    /// or report the error. If it happens as a result of direct API usage, it
346
    /// may indicate that you're using something that isn't implemented yet.
347
    ///
348
    /// This kind can relate both to operations which we plan to implement, and
349
    /// to operations which we do not.  It does not relate to facilities which
350
    /// are disabled (e.g. at build time) or harmful.
351
    ///
352
    /// It can refer to facilities which were once implemented in Tor or Arti
353
    /// but for which support has been removed.
354
    #[display("operation not implemented")]
355
    NotImplemented,
356

            
357
    /// A feature was requested which has been disabled in this build of Arti.
358
    ///
359
    /// This kind of error happens when the running Arti was built without the
360
    /// appropriate feature (usually, cargo feature) enabled.
361
    ///
362
    /// This might indicate that the overall running system has been
363
    /// mis-configured at build-time.  Alternatively, it can occur if the
364
    /// running system is deliberately stripped down, in which case it might be
365
    /// reasonable to simply report this error to a user.
366
    #[display("operation not supported because Arti feature disabled")]
367
    FeatureDisabled,
368

            
369
    /// Someone or something local violated a network protocol.
370
    ///
371
    /// This kind of error can happen when a local program accessing us over some
372
    /// other protocol violates the protocol's requirements.
373
    ///
374
    /// This usually indicates a programming error: either in that program's
375
    /// implementation of the protocol, or in ours.  In any case, the problem
376
    /// is with software on the local system (or otherwise sharing a Tor client).
377
    ///
378
    /// It might also occur if the local system has an incompatible combination
379
    /// of tools that we can't talk with.
380
    ///
381
    /// This error kind does *not* include situations that are better explained
382
    /// by a local program simply crashing or terminating unexpectedly.
383
    #[display("local protocol violation (local bug or incompatibility)")]
384
    LocalProtocolViolation,
385

            
386
    /// Someone or something on the Tor network violated the Tor protocols.
387
    ///
388
    /// This kind of error can happen when a remote Tor instance behaves in a
389
    /// way we don't expect.
390
    ///
391
    /// It usually indicates a programming error: either in their implementation
392
    /// of the protocol, or in ours.  It can also indicate an attempted attack,
393
    /// though that can be hard to diagnose.
394
    #[display("Tor network protocol violation (bug, incompatibility, or attack)")]
395
    TorProtocolViolation,
396

            
397
    /// Something went wrong with a network connection or the local network.
398
    ///
399
    /// This kind of error is usually safe to retry, and shouldn't typically be
400
    /// seen.  By the time it reaches the caller, a more specific error type
401
    /// should typically be available.
402
    #[display("problem with network or connection")]
403
    LocalNetworkError,
404

            
405
    /// More of a local resource was needed, than is available (or than we are allowed)
406
    ///
407
    /// For example, we tried to use more memory than permitted by our memory quota.
408
    #[display("local resource exhausted")]
409
    LocalResourceExhausted,
410

            
411
    /// A problem occurred when launching or communicating with an external
412
    /// process running on this computer.
413
    #[display("an externally launched plug-in tool failed")]
414
    ExternalToolFailed,
415

            
416
    /// A relay had an identity other than the one we expected.
417
    ///
418
    /// This could indicate a MITM attack, but more likely indicates that the
419
    /// relay has changed its identity but the new identity hasn't propagated
420
    /// through the directory system yet.
421
    #[display("identity mismatch")]
422
    RelayIdMismatch,
423

            
424
    /// An attempt to do something remotely through the Tor network failed
425
    /// because the circuit it was using shut down before the operation could
426
    /// finish.
427
    #[display("circuit collapsed")]
428
    CircuitCollapse,
429

            
430
    /// An operation timed out on the tor network.
431
    ///
432
    /// This may indicate a network problem, either with the local network
433
    /// environment's ability to contact the Tor network, or with the Tor
434
    /// network itself.
435
    #[display("tor operation timed out")]
436
    TorNetworkTimeout,
437

            
438
    /// We tried but failed to download a piece of directory information.
439
    ///
440
    /// This is a lower-level kind of error; in general it should be retried
441
    /// before the user can see it.   In the future it is likely to be split
442
    /// into several other kinds.
443
    // TODO ^
444
    #[display("directory fetch attempt failed")]
445
    TorDirectoryError,
446

            
447
    /// An operation finished because a remote stream was closed successfully.
448
    ///
449
    /// This can indicate that the target server closed the TCP connection,
450
    /// or that the exit told us that it closed the TCP connection.
451
    /// Callers should generally treat this like a closed TCP connection.
452
    #[display("remote stream closed")]
453
    RemoteStreamClosed,
454

            
455
    /// An operation finished because the remote stream was closed abruptly.
456
    ///
457
    /// This kind of error is analogous to an ECONNRESET error; it indicates
458
    /// that the exit reported that the stream was terminated without a clean
459
    /// TCP shutdown.
460
    ///
461
    /// For most purposes, it's fine to treat this kind of error the same as
462
    /// regular unexpected close.
463
    #[display("remote stream reset")]
464
    RemoteStreamReset,
465

            
466
    /// An operation finished because a remote stream was closed unsuccessfully.
467
    ///
468
    /// This indicates that the exit reported some error message for the stream.
469
    ///
470
    /// We only provide this error kind when no more specific kind is available.
471
    #[display("remote stream error")]
472
    RemoteStreamError,
473

            
474
    /// A stream failed, and the exit reports that the remote host refused
475
    /// the connection.
476
    ///
477
    /// This is analogous to an ECONNREFUSED error.
478
    #[display("remote host refused connection")]
479
    RemoteConnectionRefused,
480

            
481
    /// A stream was rejected by the exit relay because of that relay's exit
482
    /// policy.
483
    ///
484
    /// (In Tor, exits have a set of policies declaring which addresses and
485
    /// ports they're willing to connect to.  Clients download only _summaries_
486
    /// of these policies, so it's possible to be surprised by an exit's refusal
487
    /// to connect somewhere.)
488
    #[display("rejected by exit policy")]
489
    ExitPolicyRejected,
490

            
491
    /// An operation failed, and the exit reported that it waited too long for
492
    /// the operation to finish.
493
    ///
494
    /// This kind of error is distinct from `RemoteNetworkTimeout`, which means
495
    /// that _our own_ timeout threshold was violated.
496
    #[display("timeout at exit relay")]
497
    ExitTimeout,
498

            
499
    /// An operation failed, and the exit reported a network failure of some
500
    /// kind.
501
    ///
502
    /// This kind of error can occur for a number of reasons.  If it happens
503
    /// when trying to open a stream, it usually indicates a problem connecting,
504
    /// such as an ENOROUTE error.
505
    #[display("network failure at exit")]
506
    RemoteNetworkFailed,
507

            
508
    /// An operation finished because an exit failed to look up a hostname.
509
    ///
510
    /// Unfortunately, the Tor protocol does not distinguish failure of DNS
511
    /// services ("we couldn't find out if this host exists and what its name is")
512
    /// from confirmed denials ("this is not a hostname").  So this kind
513
    /// conflates both those sorts of error.
514
    ///
515
    /// Trying at another exit might succeed, or the address might truly be
516
    /// unresolvable.
517
    #[display("remote hostname not found")]
518
    RemoteHostNotFound,
519

            
520
    /// The target hidden service (`.onion` service) was not found in the directory
521
    ///
522
    /// We successfully connected to at least one directory server,
523
    /// but it didn't have a record of the hidden service.
524
    ///
525
    /// This probably means that the hidden service is not running, or does not exist.
526
    /// (It might mean that the directory servers are faulty,
527
    /// and that the hidden service was unable to publish its descriptor.)
528
    #[display("Onion Service not found")]
529
    OnionServiceNotFound,
530

            
531
    /// The target hidden service (`.onion` service) seems to be down
532
    ///
533
    /// We successfully obtained a hidden service descriptor for the service,
534
    /// so we know it is supposed to exist,
535
    /// but we weren't able to communicate with it via any of its
536
    /// introduction points.
537
    ///
538
    /// This probably means that the hidden service is not running.
539
    /// (It might mean that the introduction point relays are faulty.)
540
    #[display("Onion Service not running")]
541
    OnionServiceNotRunning,
542

            
543
    /// Protocol trouble involving the target hidden service (`.onion` service)
544
    ///
545
    /// Something unexpected happened when trying to connect to the selected hidden service.
546
    /// It seems to have been due to the hidden service violating the Tor protocols somehow.
547
    #[display("Onion Service protocol failed (apparently due to service behaviour)")]
548
    OnionServiceProtocolViolation,
549

            
550
    /// The target hidden service (`.onion` service) is running but we couldn't connect to it,
551
    /// and we aren't sure whose fault that is
552
    ///
553
    /// This might be due to malfunction on the part of the service,
554
    /// or a relay being used as an introduction point or relay,
555
    /// or failure of the underlying Tor network.
556
    #[display("Onion Service not reachable (due to service, or Tor network, behaviour)")]
557
    OnionServiceConnectionFailed,
558

            
559
    /// We tried to connect to an onion service without authentication,
560
    /// but it apparently requires authentication.
561
    #[display("Onion service required authentication, but none was provided.")]
562
    OnionServiceMissingClientAuth,
563

            
564
    /// We tried to connect to an onion service that requires authentication, and
565
    /// ours is wrong.
566
    ///
567
    /// This likely means that we need to use a different key for talking to
568
    /// this onion service, or that it has revoked our permissions to reach it.
569
    #[display("Onion service required authentication, but provided authentication was incorrect.")]
570
    OnionServiceWrongClientAuth,
571

            
572
    /// We tried to parse a `.onion` address, and found that it was not valid.
573
    ///
574
    /// This likely means that it was corrupted somewhere along its way from its
575
    /// origin to our API surface.  It may be the wrong length, have invalid
576
    /// characters, have an invalid version number, or have an invalid checksum.
577
    #[display(".onion address was invalid.")]
578
    OnionServiceAddressInvalid,
579

            
580
    /// An resolve operation finished with an error.
581
    ///
582
    /// Contrary to [`RemoteHostNotFound`](ErrorKind::RemoteHostNotFound),
583
    /// this can't mean "this is not a hostname".
584
    /// This error should be retried.
585
    #[display("remote hostname lookup failure")]
586
    RemoteHostResolutionFailed,
587

            
588
    /// Trouble involving a protocol we're using with a peer on the far side of the Tor network
589
    ///
590
    /// We were using a higher-layer protocol over a Tor connection,
591
    /// and something went wrong.
592
    /// This might be an error reported by the remote host within that higher protocol,
593
    /// or a problem detected locally but relating to that higher protocol.
594
    ///
595
    /// The nature of the problem can vary:
596
    /// examples could include:
597
    /// failure to agree suitable parameters (incompatibility);
598
    /// authentication problems (eg, TLS certificate trouble);
599
    /// protocol violation by the peer;
600
    /// peer refusing to provide service;
601
    /// etc.
602
    #[display("remote protocol violation")]
603
    RemoteProtocolViolation,
604

            
605
    /// An operation failed, and the relay in question reported that it's too
606
    /// busy to answer our request.
607
    #[display("relay too busy")]
608
    RelayTooBusy,
609

            
610
    /// We were asked to make an anonymous connection to a malformed address.
611
    ///
612
    /// This is probably because of a bad input from a user.
613
    #[display("target address was invalid")]
614
    InvalidStreamTarget,
615

            
616
    /// We were asked to make an anonymous connection to a _locally_ disabled
617
    /// address.
618
    ///
619
    /// For example, this kind of error can happen when try to connect to (e.g.)
620
    /// `127.0.0.1` using a client that isn't configured with allow_local_addrs.
621
    ///
622
    /// Usually this means that you intended to reject the request as
623
    /// nonsensical; but if you didn't, it probably means you should change your
624
    /// configuration to allow what you want.
625
    #[display("target address disabled locally")]
626
    ForbiddenStreamTarget,
627

            
628
    /// An operation failed in a transient way.
629
    ///
630
    /// This kind of error indicates that some kind of operation failed in a way
631
    /// where retrying it again could likely have made it work.
632
    ///
633
    /// You should not generally see this kind of error returned directly to you
634
    /// for high-level functions.  It should only be returned from lower-level
635
    /// crates that do not automatically retry these failures.
636
    // Errors with this kind should generally not return a `HasRetryTime::retry_time()` of `Never`.
637
    #[display("un-retried transient failure")]
638
    TransientFailure,
639

            
640
    /// Bug, for example calling a function with an invalid argument.
641
    ///
642
    /// This kind of error is usually a programming mistake on the caller's part.
643
    /// This is usually a bug in code calling Arti, but it might be a bug in Arti itself.
644
    //
645
    // Usually, use `bad_api_usage!` and `into_bad_api_usage!` and thereby `InternalError`,
646
    // rather than inventing a new type with this kind.
647
    //
648
    // Errors with this kind should generally include a stack trace.  They are
649
    // very like InternalError, in that they represent a bug in the program.
650
    // The difference is that an InternalError, with kind `Internal`, represents
651
    // a bug in arti, whereas errors with kind BadArgument represent bugs which
652
    // could be (often, are likely to be) outside arti.
653
    #[display("bad API usage (bug)")]
654
    BadApiUsage,
655

            
656
    /// We asked a relay to create or extend a circuit, and it declined.
657
    ///
658
    /// Either it gave an error message indicating that it refused to perform
659
    /// the request, or the protocol gives it no room to explain what happened.
660
    ///
661
    /// This error is returned by higher-level functions only if it is the most informative
662
    /// error after appropriate retries etc.
663
    #[display("remote host refused our request")]
664
    CircuitRefused,
665

            
666
    /// We were unable to construct a path through the Tor network.
667
    ///
668
    /// Usually this indicates that there are too many user-supplied
669
    /// restrictions for us to comply with.
670
    ///
671
    /// On test networks, it likely indicates that there aren't enough relays,
672
    /// or that there aren't enough relays in distinct families.
673
    //
674
    // TODO: in the future, errors of this type should distinguish between
675
    // cases where this happens because of a user restriction and cases where it
676
    // happens because of a severely broken directory.
677
    //
678
    // The latter should be classified as TorDirectoryBroken.
679
    #[display("could not construct a path")]
680
    NoPath,
681

            
682
    /// We were unable to find an exit relay with a certain set of desired
683
    /// properties.
684
    ///
685
    /// Usually this indicates that there were too many user-supplied
686
    /// restrictions on the exit for us to comply with, or that there was no
687
    /// exit on the network supporting all of the ports that the user asked for.
688
    //
689
    // TODO: same as for NoPath.
690
    #[display("no exit available for path")]
691
    NoExit,
692

            
693
    /// The Tor consensus directory is broken or unsuitable
694
    ///
695
    /// This could occur when running very old software
696
    /// against the current Tor network,
697
    /// so that the newer network is incompatible.
698
    ///
699
    /// It might also mean a catastrophic failure of the Tor network,
700
    /// or that a deficient test network is in use.
701
    ///
702
    /// Currently some instances of this kind of problem
703
    /// are reported as `NoPath` or `NoExit`.
704
    #[display("Tor network consensus directory is not usable")]
705
    TorDirectoryUnusable,
706

            
707
    /// An operation failed because of _possible_ clock skew.
708
    ///
709
    /// The broken clock may be ours, or it may belong to another party on the
710
    /// network. It's also possible that somebody else is lying about the time,
711
    /// caching documents for far too long, or something like that.
712
    #[display("possible clock skew detected")]
713
    ClockSkew,
714

            
715
    /// Internal error (bug) in Arti.
716
    ///
717
    /// A supposedly impossible problem has arisen.  This indicates a bug in
718
    /// Arti; if the Arti version is relatively recent, please report the bug on
719
    /// our [bug tracker](https://gitlab.torproject.org/tpo/core/arti/-/issues).
720
    #[display("internal error (bug)")]
721
    Internal,
722

            
723
    /// Unclassified error
724
    ///
725
    /// Some other error occurred, which does not fit into any of the other kinds.
726
    ///
727
    /// This kind is provided for use by external code
728
    /// hooking into or replacing parts of Arti.
729
    /// It is never returned by the code in Arti (`arti-*` and `tor-*` crates).
730
    #[display("unclassified error")]
731
    Other,
732
}
733

            
734
/// Errors that can be categorized as belonging to an [`ErrorKind`]
735
///
736
/// The most important implementation of this trait is
737
/// `arti_client::TorError`; however, other internal errors throughout Arti
738
/// also implement it.
739
pub trait HasKind {
740
    /// Return the kind of this error.
741
    fn kind(&self) -> ErrorKind;
742
}
743

            
744
#[cfg(feature = "futures")]
745
impl HasKind for futures::task::SpawnError {
746
70
    fn kind(&self) -> ErrorKind {
747
        use ErrorKind as EK;
748
70
        if self.is_shutdown() {
749
70
            EK::ReactorShuttingDown
750
        } else {
751
            EK::Internal
752
        }
753
70
    }
754
}
755

            
756
impl HasKind for void::Void {
757
    fn kind(&self) -> ErrorKind {
758
        void::unreachable(*self)
759
    }
760
}
761

            
762
impl HasKind for std::convert::Infallible {
763
    fn kind(&self) -> ErrorKind {
764
        unreachable!()
765
    }
766
}
767

            
768
/// Sealed
769
mod sealed {
770
    /// Sealed
771
    pub trait Sealed {}
772
}