Addressing review comments: added some unit tests for the new scheduler
type, and made FireIn use an Instant instead (making it FireAt).

This is a revised version of !397; it implements a scheduling system for
periodic tasks that can be externally controlled, and then uses the
external control aspect to implement a basic dormant mode (#90).

More technically, the scheduling system consists of a `Stream` that
periodic tasks are expected to embed in a `while` loop or similar, a
way for tasks themselves to choose how long to wait until the stream
next yields a result, and a handle to control this outside of the task.

Change rules for retrying guards (and marking them broken)

See merge request tpo/core/arti!426

Adjust a comment

See merge request tpo/core/arti!428

Noticed this while reviewing !426

Pattern bindings after `@` weren't stabilized then :/

Move almost all of the rest of options.rs to arti crate

See merge request tpo/core/arti!425

Some error types indicate that the guard has failed as a dircache.
We should treat these errors as signs to close the circuit, and to
mark the guard as having failed.

We'll need this so that we can say "This guard behaved bogusly
as a directory cache; try somebody else."

This commit refactors the dirclient error type into two cases:
errors when constructing a circuit, and errors that occur once we
already have a one-hop circuit.  The latter can usually be
attributed to the specific cache we're talking to.

This commit also adds a function to expose the information about
which directory gave us the info.

We already have the ability to get peer information from ChanMgr
errors, and therefore from any RetryErrors that contain ChanMgr
errors.

This commit adds optional peer information to tor-proto errors, and
a function to expose whatever peer information is available.

It'll soon more convenient to pass in FallbackDirs as a slice of
references, rather than just a slice of FallbackDirs: I'm going to
be changing how we handle these in tor-dirmgr.

If all guards are down and they won't be retriable for a while, try
waiting that long to get whichever guard _is_ retriable.

Additionally, if we are making multiple circuit plans in parallel,
only report our planning as having failed if we failed at making
_all_ the plans.  Previously we treated any failure as fatal for the
other plans, which could lead to trouble in the case when guards
were all down or pending.

Part of #407.

When all guards are down, we would previously mark them all as up,
and retry aggressively.  But that's far too aggressive: if there's
something wrong with our ability to connect to guards, it makes us
hammer the network over and over, ignoring all the guard retry
timeouts in practice.

Instead,
  * We now allow the `pick_guard()` function to fail without
    automatically retrying.
  * We give different errors in the cases when all our guards are
    down, and when all of the guards selected by our active usage
    are down.
  * Our "guards are down" error includes the time at which a guard
    will next be retriable.

This is part of #407.

C tor used one schedule, and guard-spec specified another.  But in
reality we should probably use a randomized schedule to retry
guards, for the reasons explained in the documentation for
RetrySchedule.

I've chosen the minima to be not too far from our previous minima
for primary and non-primary guards.

This is part of #407.

UdpSocket: remove support for connect().

Closes #410

See merge request tpo/core/arti!424

Code motion and import fixups.

Making these fields pub(crate) is quite reasonable and does away with
the need for accessors.

We put this in cfg.rs, rather than (say) socks.rs, because it has
config relating to both socks.rs and dns.rs.

Code motion and import fixups.

Combine logging config and implementation in arti lib crate

See merge request tpo/core/arti!421

This was clumsy.  Now it is brought together it can be simplified.

This de-duplicates the code that was in those accessors, and is now in
filt_from_opt_str.

Code motion and direct field access.

There are no longer needed, because the code that uses this
configuration now lives in the same module as the configuration
itself.

Code motion and import fixups.

We are going to move LoggingConfig here.  We should follow the
already-public name IMO.

Code motion and import fixups.

Abolish some accessors in drmgr

See merge request tpo/core/arti!423

Ian Jackson authored 3 years ago and Nick Mathewson committed 3 years ago

This makes this information crate-private.  The crate can reasonably
just access it.

Ian Jackson authored 3 years ago and Nick Mathewson committed 3 years ago

Using accessors for crate-only fields is otiose.