tor_checkable/
lib.rs

1#![cfg_attr(docsrs, feature(doc_auto_cfg, doc_cfg))]
2#![doc = include_str!("../README.md")]
3// @@ begin lint list maintained by maint/add_warning @@
4#![allow(renamed_and_removed_lints)] // @@REMOVE_WHEN(ci_arti_stable)
5#![allow(unknown_lints)] // @@REMOVE_WHEN(ci_arti_nightly)
6#![warn(missing_docs)]
7#![warn(noop_method_call)]
8#![warn(unreachable_pub)]
9#![warn(clippy::all)]
10#![deny(clippy::await_holding_lock)]
11#![deny(clippy::cargo_common_metadata)]
12#![deny(clippy::cast_lossless)]
13#![deny(clippy::checked_conversions)]
14#![warn(clippy::cognitive_complexity)]
15#![deny(clippy::debug_assert_with_mut_call)]
16#![deny(clippy::exhaustive_enums)]
17#![deny(clippy::exhaustive_structs)]
18#![deny(clippy::expl_impl_clone_on_copy)]
19#![deny(clippy::fallible_impl_from)]
20#![deny(clippy::implicit_clone)]
21#![deny(clippy::large_stack_arrays)]
22#![warn(clippy::manual_ok_or)]
23#![deny(clippy::missing_docs_in_private_items)]
24#![warn(clippy::needless_borrow)]
25#![warn(clippy::needless_pass_by_value)]
26#![warn(clippy::option_option)]
27#![deny(clippy::print_stderr)]
28#![deny(clippy::print_stdout)]
29#![warn(clippy::rc_buffer)]
30#![deny(clippy::ref_option_ref)]
31#![warn(clippy::semicolon_if_nothing_returned)]
32#![warn(clippy::trait_duplication_in_bounds)]
33#![deny(clippy::unchecked_duration_subtraction)]
34#![deny(clippy::unnecessary_wraps)]
35#![warn(clippy::unseparated_literal_suffix)]
36#![deny(clippy::unwrap_used)]
37#![deny(clippy::mod_module_files)]
38#![allow(clippy::let_unit_value)] // This can reasonably be done for explicitness
39#![allow(clippy::uninlined_format_args)]
40#![allow(clippy::significant_drop_in_scrutinee)] // arti/-/merge_requests/588/#note_2812945
41#![allow(clippy::result_large_err)] // temporary workaround for arti#587
42#![allow(clippy::needless_raw_string_hashes)] // complained-about code is fine, often best
43#![allow(clippy::needless_lifetimes)] // See arti#1765
44//! <!-- @@ end lint list maintained by maint/add_warning @@ -->
45
46use std::time;
47use thiserror::Error;
48
49pub mod signed;
50pub mod timed;
51
52/// An error that can occur when checking whether a Timebound object is
53/// currently valid.
54#[derive(Debug, Clone, Error, PartialEq, Eq)]
55#[non_exhaustive]
56pub enum TimeValidityError {
57    /// The object is not yet valid
58    #[error("Object will not be valid for {}", humantime::format_duration(*.0))]
59    NotYetValid(time::Duration),
60    /// The object is expired
61    #[error("Object has been expired for {}", humantime::format_duration(*.0))]
62    Expired(time::Duration),
63    /// The object isn't timely, and we don't know why, or won't say.
64    #[error("Object is not currently valid")]
65    Unspecified,
66}
67
68/// A Timebound object is one that is only valid for a given range of time.
69///
70/// It's better to wrap things in a TimeBound than to give them an is_valid()
71/// valid method, so that you can make sure that nobody uses the object before
72/// checking it.
73pub trait Timebound<T>: Sized {
74    /// An error type that's returned when the object is _not_ timely.
75    type Error;
76
77    /// Check whether this object is valid at a given time.
78    ///
79    /// Return Ok if the object is valid, and an error if the object is not.
80    fn is_valid_at(&self, t: &time::SystemTime) -> Result<(), Self::Error>;
81
82    /// Return the underlying object without checking whether it's valid.
83    fn dangerously_assume_timely(self) -> T;
84
85    /// Unwrap this Timebound object if it is valid at a given time.
86    fn check_valid_at(self, t: &time::SystemTime) -> Result<T, Self::Error> {
87        self.is_valid_at(t)?;
88        Ok(self.dangerously_assume_timely())
89    }
90
91    /// Unwrap this Timebound object if it is valid now.
92    fn check_valid_now(self) -> Result<T, Self::Error> {
93        self.check_valid_at(&time::SystemTime::now())
94    }
95
96    /// Unwrap this object if it is valid at the provided time t.
97    /// If no time is provided, check the object at the current time.
98    fn check_valid_at_opt(self, t: Option<time::SystemTime>) -> Result<T, Self::Error> {
99        match t {
100            Some(when) => self.check_valid_at(&when),
101            None => self.check_valid_now(),
102        }
103    }
104}
105
106/// A cryptographically signed object that can be validated without
107/// additional public keys.
108///
109/// It's better to wrap things in a SelfSigned than to give them an is_valid()
110/// method, so that you can make sure that nobody uses the object before
111/// checking it.  It's better to wrap things in a SelfSigned than to check
112/// them immediately, since you might want to defer the signature checking
113/// operation to another thread.
114pub trait SelfSigned<T>: Sized {
115    /// An error type that's returned when the object is _not_ well-signed.
116    type Error;
117    /// Check the signature on this object
118    fn is_well_signed(&self) -> Result<(), Self::Error>;
119    /// Return the underlying object without checking its signature.
120    fn dangerously_assume_wellsigned(self) -> T;
121
122    /// Unwrap this object if the signature is valid
123    fn check_signature(self) -> Result<T, Self::Error> {
124        self.is_well_signed()?;
125        Ok(self.dangerously_assume_wellsigned())
126    }
127}
128
129/// A cryptographically signed object that needs an external public
130/// key to validate it.
131pub trait ExternallySigned<T>: Sized {
132    /// The type of the public key object.
133    ///
134    /// You can use a tuple or a vector here if the object is signed
135    /// with multiple keys.
136    type Key: ?Sized;
137
138    /// A type that describes what keys are missing for this object.
139    type KeyHint;
140
141    /// An error type that's returned when the object is _not_ well-signed.
142    type Error;
143
144    /// Check whether k is the right key for this object.  If not, return
145    /// an error describing what key would be right.
146    ///
147    /// This function is allowed to return 'true' for a bad key, but never
148    /// 'false' for a good key.
149    fn key_is_correct(&self, k: &Self::Key) -> Result<(), Self::KeyHint>;
150
151    /// Check the signature on this object
152    fn is_well_signed(&self, k: &Self::Key) -> Result<(), Self::Error>;
153
154    /// Unwrap this object without checking any signatures on it.
155    fn dangerously_assume_wellsigned(self) -> T;
156
157    /// Unwrap this object if it's correctly signed by a provided key.
158    fn check_signature(self, k: &Self::Key) -> Result<T, Self::Error> {
159        self.is_well_signed(k)?;
160        Ok(self.dangerously_assume_wellsigned())
161    }
162}
tor_checkable/lib.rs

tor_checkable/
lib.rs
