//! Logic for manipulating a sampled set of guards, along with various

//! orderings on that sample.

mod candidate;

use crate::filter::GuardFilter;

use crate::guard::{Guard, NewlyConfirmed, Reachable};

use crate::skew::SkewObservation;

use crate::{

    ExternalActivity, GuardParams, GuardUsage, GuardUsageKind, PickGuardError, ids::GuardId,

};

use crate::{FirstHop, GuardSetSelector};

use tor_basic_utils::iter::{FilterCount, IteratorExt as _};

use tor_basic_utils::onionperf_types::{OnionperfEvent, OnionperfGuardStatus};

use tor_linkspec::{ByRelayIds, HasRelayIds};

use itertools::Itertools;

use rand::seq::IndexedRandom;

use serde::{Deserialize, Serialize};

use std::borrow::Cow;

use std::collections::{HashMap, HashSet};

use tracing::{debug, info, trace};

use web_time_compat::{Instant, SystemTime};

#[allow(unused_imports)]

pub(crate) use candidate::{Candidate, CandidateStatus, Universe, UniverseRef, WeightThreshold};

/// A set of sampled guards, along with various orderings on subsets

/// of the sample.

///

/// Every guard in a `GuardSet` is considered to be "sampled": that

/// is, selected from a network directory at some point in the past.

/// The guards in the sample are ordered (roughly) by the time at

/// which they were added.  This list is persistent.

///

/// Any guard which we've successfully used at least once is

/// considered "confirmed".  Confirmed guards are ordered (roughly) by

/// the time at which we first used them.  This list is persistent.

///

/// The guards which we would prefer to use are called "primary".

/// Primary guards are ordered from most- to least-preferred.

/// This list is not persistent, and is re-derived as needed.

///

/// These lists together define a "preference order".  All primary

/// guards come first in preference order.  Then come the non-primary

/// confirmed guards, in their confirmed order.  Finally come the

/// non-primary, non-confirmed guards, in their sampled order.

#[derive(Debug, Default, Clone, Deserialize)]

#[serde(from = "GuardSample")]

pub(crate) struct GuardSet {

    /// Map from identities to guards, for every guard in this sample.

    ///

    /// The key for each entry is a set of identities which we have

    /// good (trustworthy-enough) reason to link together.

    ///

    /// When we connect to a guard we require it to demonstrate

    /// that it has *all* of these identities;

    /// and we do pinning, so that we note down the other identities we discover it has,

    /// with the intent that we will require them in future.

    ///

    /// ### Sources of linkage:

    ///

    ///  * If we connect to a relay and it proves a set of identities,

    ///    that necessarily will include at least the ones we have already.

    ///    We can add any other identities we have discovered.

    ///    Justification: the owners of the old ids have made a statement

    ///    (via the connection protocols) that these other ids are also theirs,

    ///    and should be required in future.

    ///

    ///  * If we obtain a (full) descriptor for a relay, and check the

    ///    self-signatures by all the identities we have already,

    ///    we can add any other identities listed in the descriptor.

    ///    Justification: the owners of the old ids have made an explicit statement

    ///    that these other ids are also theirs,

    ///    and should be required in future.

    ///

    ///  * For a relay in the netdir, if the netdir links some ids together,

    ///    we can combine the entries.

    ///    Justification: the netdir is authoritative for netdir-based relays.

    ///

    ///  * For a configured bridge, if our configuration links some identities,

    ///    we must insist on all those identities.

    ///    So we combine them.

    ///

    /// ### Handling of conflicting entries:

    ///

    /// `ByRelayIds` will implicitly delete conflicting entries,

    /// simply forgetting about them.

    /// This is OK for netdir relays, since we do not expect this to occur in practice.

    ///

    /// For bridges, conflicts may in fact occur,

    /// since bridge lines are not issued by a single authority,

    /// and should be afforded limited trust.

    ///

    ///  * If the configuration contains bridge lines that mutually conflict,

    ///    affected bridge lines should be disregarded,

    ///    or the configuration rejected.

    ///

    ///  * If the configuration contains information which is inconsistent with

    ///    our past experience, we should discard the past experiences which

    ///    aren't reconcilable with the configuration.

    ///

    ///  * We may discover a linkage which demonstrates that the configuration

    ///    is wrong: for example, two bridge lines for identities X and Y,

    ///    but in fact there is only one bridge with both identities.

    ///    In this situation it is OK to effectively disregard some the configuration

    ///    entries which are at variance with reality, maybe with a warning,

    ///    but keeping at least one of every usable id set (actually existing bridge)

    ///    would be good.

    guards: ByRelayIds<Guard>,

    /// Identities of all the guards in the sample, in sample order.

    ///

    /// This contains the same elements as the keys of `guards`

    sample: Vec<GuardId>,

    /// Identities of all the confirmed guards in the sample, in

    /// confirmed order.

    ///

    /// This contains a subset of the values in `sample`.

    confirmed: Vec<GuardId>,

    /// Identities of all the primary guards, in preference order

    /// (from best to worst).

    ///

    /// This contains a subset of the values in `sample`.

    primary: Vec<GuardId>,

    /// Currently active filter that restricts which guards we can use.

    ///

    /// Note that all of the lists above (with the exception of `primary`)

    /// can hold guards that the filter doesn't permit.  This behavior

    /// is meant to give good security behavior in the presence of filters

    /// that change over time.

    active_filter: GuardFilter,

    /// If true, the active filter is "very restrictive".

    filter_is_restrictive: bool,

    /// Set to 'true' whenever something changes that would force us

    /// to call 'select_primary_guards()', and cleared whenever we call it.

    primary_guards_invalidated: bool,

    /// Fields from the state file that was used to make this `GuardSet` that

    /// this version of Arti doesn't understand.

    unknown_fields: HashMap<String, JsonValue>,

}

/// Which of our lists did a given guard come from?

#[derive(Debug, Copy, Clone, Eq, PartialEq)]

pub(crate) enum ListKind {

    /// A guard that came from the primary guard list.

    Primary,

    /// A non-primary guard that came from the confirmed guard list.

    Confirmed,

    /// A non-primary, non-confirmed guard.

    Sample,

    /// Not a guard at all, but a fallback directory.

    Fallback,

}

impl ListKind {

    /// Return true if this is a primary guard.

    /// Return true if this guard's origin indicates that you can use successful

    /// circuits built through it immediately without waiting for any other

    /// circuits to succeed or fail.

        }

}

impl GuardSet {

    /// Return the lengths of the different elements of the guard set.

    ///

    /// Used to report bugs or corruption in consistency.

    /// Remove all elements from this `GuardSet` that ought to be referenced by

    /// another element, but which are not.

    ///

    /// This method only removes corrupted elements and updates IDs in the ID

    /// list (possibly adding new IDs); it doesn't add guards or other data.

    /// It won't do anything if the `GuardSet` is well-formed.

        /// Remove every element of `id_list` that does not belong to some guard

        /// in `guards`, and update the others to have any extra identities

        /// listed in `guards`.

                }

    /// Assert that this `GuardSet` is internally consistent.

    ///

    /// Incidentally fixes the consistency of this `GuardSet` if needed.

    /// Return the guard that has every identity in `id`, if any.

    /// Replace the filter used by this `GuardSet` with `filter`.

    ///

    /// Removes all primary guards that the filter doesn't permit.

    ///

    /// If `restrictive` is true, this filter is treated as "extremely restrictive".

    /// Return the current filter for this `GuardSet`.

    /// Copy non-persistent status from every guard shared with `other`.

    ///

    /// This is used as part of our reload process when we don't own our state

    /// files, and we're reloading in order to find out what the other Arti

    /// instance thinks the guards are. At that point, `self` is the set of

    /// guards that we just loaded from state, and `other` is our old guards,

    /// which we are using only for their status information.

                } else {

                }

    /// Return a serializable state object that can be stored to disk

    /// to capture the current state of this GuardSet.

    /// Reconstruct a guard state from its serialized representation.

        // Fix any inconsistencies in the stored representation.

                "Resolved a consistency issue in stored guard state. Diagnostic codes: {:?}, {:?}",

                len_pre, len_post

            );

            n_guards = len_post.0,

            n_confirmed = len_post.2,

            "Guard set loaded."

        );

    /// Return `Ok(true)` if `id` is definitely a member of this set, and

    /// `Ok(false)` if it is definitely not a member.

    ///

    /// If we cannot tell, it's because there is a guard in this sample that has

    /// a _subset_ of the IDs in `id`. In that case, we return

    /// `Err(guard_ident)`, where `guard_ident`  is the identity of that guard.

                } else {

                }

            }

        }

    /// If there are not enough filter-permitted usable guards in this

    /// sample (according to the current active filter), then add

    /// more, up to the limits allowed by the parameters.

    ///

    /// This is the only function that adds new guards to the sample.

    ///

    /// Guards always start out un-confirmed.

    ///

    /// Return true if any guards were added.

    /// Implementation helper for extend_sample_as_needed.

    ///

    /// # Complications

    ///

    /// For spec conformance, we only consider our filter when selecting new

    /// guards if the filter is "very restrictive". That makes it possible that

    /// this function will add fewer filter-permitted guards than we had wanted.

    /// Because of that, this is a separate function, and

    /// extend_sample_as_needed runs it in a loop until it returns false.

        // What are the most guards we're willing to have in the sample?

        let WeightThreshold {

        // Ask the netdir for a set of guards we could use.

            } else {

                // The filter will probably reject a bunch of guards, but we sample

                // before filtering, so we make this larger on an ad-hoc basis.

            };

        // Add those candidates to the sample.

            // Don't add any more if we have met the minimal sample size, and we

            // have added too much weight.

            {

                // Can't add any more.

                // We've reached our target; no need to add more.

        }

    /// Add `relay` as a new guard.

    ///

    /// Does nothing if it is already a guard.

        // TODO: I don't think onionperf actually needs the guard fingerpint,

        // but if it does, add it here.

            onionperf = true,

            event = ?OnionperfEvent::Guard(OnionperfGuardStatus::New),

            guard_id = ?id,

        );

    /// Return the number of our primary guards that are missing directory

    /// information in `universe`.

    ///

    /// Note that "missing directory information" is not the same as "absent":

    /// in this case, we  are counting the primary guards where we cannot tell

    /// whether they appear in the universe or not because we have not yet

    /// downloaded their descriptors.

    /// Update the status of every guard  in this sample from a given source.

        // Call "fix consistency", in case any guards got a new ID.

    /// Re-build the list of primary guards.

    ///

    /// Primary guards are chosen according to preference order over all

    /// the guards in the set, restricted by the current filter.

    ///

    /// TODO: Enumerate all the times when this function needs to be called.

    ///

    /// TODO: Make sure this is called enough.

        // TODO-SPEC: This is not 100% what the spec says, but it does match what

        // Tor does.  We pick first from the confirmed guards,

        // then from any previous primary guards, and then from maybe-reachable

        // guards in the sample.

        // Only for logging.

            // Then we consider existing primary guards.

            // Finally, we look at the rest of the sample for guards not marked

            // as "unreachable".

            // We only consider each guard the first time it appears.

            // We only consider usable guards that the filter allows.

                } else {

                }

            // The first n_primary guards on that list are primary!

        // Clear exploratory_circ_pending for all primary guards.

        }

        // TODO: Recalculate retry times, perhaps, since we may have changed

        // the timeouts?

    /// Remove all guards which should expire `now`, according to the settings

    /// in `params`.

        // TODO: Might be more ideal to do this after the assert_consistency.

                    onionperf = true,

                    event = ?OnionperfEvent::Guard(OnionperfGuardStatus::Dropped),

                );

        }

    /// Return an iterator over the Id for every Guard in the sample that

    /// is not known to be Unreachable.

    /// Return an iterator that yields an element for every guard in

    /// this set, in preference order.

    ///

    /// Each element contains a `ListKind` that describes which list the

    /// guard was in, and a `&GuardId` that identifies the guard.

    ///

    /// Note that this function will return guards that are not

    /// accepted by the current active filter: the caller must apply

    /// that filter if appropriate.

    /// Like `preference_order_ids`, but yields `&Guard` instead of `&GuardId`.

    /// Return true if `guard_id` is an identity subset for any primary guard in this set.

        // (This could be yes/no/maybe.)

        // This is O(n), but the list is short.

    /// For every guard that has been marked as `Unreachable` for too long,

    /// mark it as `Unknown`.

    /// Return the earliest time at which any guard will be retriable.

    /// Mark every `Unreachable` primary guard as `Unknown`.

        }

    /// Return true if all of our primary guards are currently marked

    /// unreachable.

    /// Mark every `Unreachable` guard as `Unknown`.

    /// Record that an attempt has begun to use the guard with

    /// `guard_id`.

    /// Record that an attempt to use the guard with `guard_id` has just

    /// succeeded.

    ///

    /// If `how` is provided, it's an operation from outside the crate that the

    /// guard succeeded at doing.

            None => {

            }

    /// Record that an attempt to use the guard with `guard_id` has just failed.

    ///

            onionperf = true,

            event = ?OnionperfEvent::Guard(OnionperfGuardStatus::Down),

            ?guard_id,

        );

        // TODO use instant uniformly for in-process, and systemtime for storage?

    /// Record that an attempt to use the guard with `guard_id` has

    /// just been abandoned, without learning whether it succeeded or failed.

    /// Record that an attempt to use the guard with `guard_id` has

    /// just failed in a way that we could not definitively attribute to

    /// the guard.

    /// Record that a given guard has told us about clock skew.

    /// Return an iterator over all stored clock skew observations.

    /// Return whether the circuit manager can be allowed to use a

    /// circuit with the `guard_id`.

    ///

    /// Return `Some(bool)` if the circuit is usable, and `None` if we

    /// cannot yet be sure.

        // TODO-SPEC: This isn't what the spec says.  The spec is phrased

        // in terms of circuits blocking circuits, whereas this algorithm is

        // about guards blocking guards.

        //

        // Also notably, the spec also says:

        //

        // * Among guards that do not appear in {CONFIRMED_GUARDS},

        // {is_pending}==true guards have higher priority.

        // * Among those, the guard with earlier {last_tried_connect} time

        // has higher priority.

        // * Finally, among guards that do not appear in

        // {CONFIRMED_GUARDS} with {is_pending==false}, all have equal

        // priority.

        //

        // I believe this approach is fine too, but we ought to document it.

            // Circuits built to primary guards are always usable immediately.

            //

            // This has to be a special case, since earlier primary guards

            // don't block later ones.

        // Assuming that the guard is _not_ primary, then the rule is

        // fairly simple: we can use the guard if all the guards we'd

        // _rather_ use are either down, or have had their circuit

        // attempts pending for too long.

            {

                    (ListKind::Primary, Reachable::Untried | Reachable::Retriable) => {

                    }

                    (_, Reachable::Untried | Reachable::Retriable) => {

                    }

                }

        }

        // This guard is not even listed.

    /// Try to select a guard for a given `usage`.

    ///

    /// On success, returns the kind of guard that we got, and its filtered

    /// representation in a form suitable for use as a first hop.

    ///

    /// Label the returned guard as having come from `sample_id`.

    //

    // NOTE (nickm): I wish that we didn't have to take sample_id as an input,

    // but the alternative would be storing it as a member of `GuardSet`, which

    // makes things very complicated.

    /// Try to select a guard for a given `usage`.

    ///

    /// On success, returns the kind of guard that we got, and its identity.

        };

        // Counts of how many elements were rejected by which of the filters

        // below.

        //

        // Note that since we use `Iterator::take`, these counts won't cover the

        // whole guard sample on the successful case: only in the failing case,

        // when we fail to find any candidates.

            // Discard the guards that are down or unusable, and see if any

            // are left.

            // Now remove those that are excluded because we're already trying

            // them on an exploratory basis.

            // ...or because they don't support the operation we're

            // attempting...

            // ... or because we specifically filtered them out.

            // We only consider the first n_options such guards.

            // If there are any primary guards, we only consider those.

            None => {

                } else {

                };

            }

        }

    /// Return the guards whose bridge descriptors we should request, given our

    /// current configuration and status.

    ///

    /// (The output of this function is not reasonable unless this is a Bridge

    /// sample.)

    #[cfg(feature = "bridge-client")]

        /// This constant is here to improve our odds that we can get a working

        /// bridge if we have any per-circuit filters that would prevent us from

        /// using our preferred bridge.

        const MINIMUM: usize = 2;

        // Here we duplicate some but not all of the restrictions above in

        // pick_guard_id.  We skip those restrictions that are specific to only

        // certain kinds of circuits, and those that are temporary restrictions

        // encouraging us to try more guards.

        //

        // TODO: we may want to refactor this code and the code in pick_guard_id

        // above to share a single function.  Before we do that, however, I want

        // to experiment with this logic a bit to make sure that it works and

        // doesn't give us surprising results.

}

use serde::Serializer;

use tor_persist::JsonValue;

/// State object used to serialize and deserialize a [`GuardSet`].

#[derive(Default, Debug, Clone, Serialize, Deserialize)]

pub(crate) struct GuardSample<'a> {

    /// Equivalent to `GuardSet.guards.values()`, except in sample order.

    guards: Vec<Cow<'a, Guard>>,

    /// The identities for the confirmed members of `guards`, in confirmed order.

    confirmed: Cow<'a, [GuardId]>,

    /// Other data from the state file that this version of Arti doesn't recognize.

    #[serde(flatten)]

    remaining: HashMap<String, JsonValue>,

}

impl Serialize for GuardSet {

    {

}

impl<'a> From<&'a GuardSet> for GuardSample<'a> {

}

impl<'a> From<GuardSample<'a>> for GuardSet {

}

#[cfg(test)]

mod test {

    // @@ begin test lint list maintained by maint/add_warning @@

    #![allow(clippy::bool_assert_comparison)]

    #![allow(clippy::clone_on_copy)]

    #![allow(clippy::dbg_macro)]

    #![allow(clippy::mixed_attributes_style)]

    #![allow(clippy::print_stderr)]

    #![allow(clippy::print_stdout)]

    #![allow(clippy::single_char_pattern)]

    #![allow(clippy::unwrap_used)]

    #![allow(clippy::unchecked_time_subtraction)]

    #![allow(clippy::useless_vec)]

    #![allow(clippy::needless_pass_by_value)]

    #![allow(clippy::string_slice)] // See arti#2571

    //! <!-- @@ end test lint list maintained by maint/add_warning @@ -->

    use tor_linkspec::{HasRelayIds, RelayIdType};

    use tor_netdir::NetDir;

    use tor_netdoc::doc::netstatus::RelayWeight;

    use tor_netdoc::types::relay_flags::RelayFlag;

    use web_time_compat::{InstantExt, SystemTimeExt};

    use super::*;

    use crate::FirstHopId;

    use std::time::Duration;

    fn netdir() -> NetDir {

        use tor_netdir::testnet;

        testnet::construct_netdir().unwrap_if_sufficient().unwrap()

    }

    #[test]

    fn sample_test() {

        // Make a test network that gives every relay equal weight, and which

        // has 20 viable (Guard + V2Dir + DirCache=2) candidates.  Otherwise the

        // calculation of collision probability at the end of this function is

        // too tricky.

        let netdir = tor_netdir::testnet::construct_custom_netdir(|idx, builder, _| {

            // Give every node equal bandwidth.

            builder.rs.weight(RelayWeight::Measured(1000));

            // The default network has 40 relays, and the first 10 are

            // not Guard by default.

            if idx >= 10 {

                builder.rs.add_flags(RelayFlag::Guard);

                if idx >= 20 {

                    builder.rs.protos("DirCache=2".parse().unwrap());

                } else {

                    builder.rs.protos("".parse().unwrap());

                }

            }

        })

        .unwrap()

        .unwrap_if_sufficient()

        .unwrap();

        // Make sure that we got the numbers we expected.

        assert_eq!(40, netdir.relays().count());

        assert_eq!(

            30,

            netdir

                .relays()

                .filter(|r| r.low_level_details().is_suitable_as_guard())

                .count()

        );

        assert_eq!(

            20,

            netdir

                .relays()

                .filter(|r| r.low_level_details().is_suitable_as_guard()

                    && r.low_level_details().is_dir_cache())

                .count()

        );

        let params = GuardParams {

            min_filtered_sample_size: 5,

            max_sample_bw_fraction: 1.0,

            ..GuardParams::default()

        };

        let mut samples: Vec<HashSet<GuardId>> = Vec::new();

        for _ in 0..3 {

            let mut guards = GuardSet::default();

            guards.extend_sample_as_needed(SystemTime::get(), &params, &netdir);

            assert_eq!(guards.guards.len(), params.min_filtered_sample_size);

            assert_eq!(guards.confirmed.len(), 0);

            assert_eq!(guards.primary.len(), 0);

            guards.assert_consistency();

            // make sure all the guards are okay.

            for guard in guards.guards.values() {

                let id = FirstHopId::in_sample(GuardSetSelector::Default, guard.guard_id().clone());

                let relay = id.get_relay(&netdir).unwrap();

                assert!(relay.low_level_details().is_suitable_as_guard());

                assert!(relay.low_level_details().is_dir_cache());

                assert!(guards.guards.by_all_ids(&relay).is_some());

                {

                    assert!(!guard.is_expired(&params, SystemTime::get()));

                }

            }

            // Make sure that the sample doesn't expand any further.

            guards.extend_sample_as_needed(SystemTime::get(), &params, &netdir);

            assert_eq!(guards.guards.len(), params.min_filtered_sample_size);

            guards.assert_consistency();

            samples.push(guards.sample.into_iter().collect());

        }

        // The probability of getting the same sample 3 times in a row is (20 choose 5)^-2,

        // which is pretty low.  (About 1 in 240 million.)

        assert!(samples[0] != samples[1] || samples[1] != samples[2]);

    }

    #[test]

    fn persistence() {

        let netdir = netdir();

        let params = GuardParams {

            min_filtered_sample_size: 5,

            ..GuardParams::default()

        };

        let t1 = SystemTime::get();

        let t2 = t1 + Duration::from_secs(20);

        let mut guards = GuardSet::default();

        guards.extend_sample_as_needed(t1, &params, &netdir);

        // Pick a guard and mark it as confirmed.

        let id1 = guards.sample[0].clone();

        guards.record_success(&id1, &params, None, t2);

        assert_eq!(&guards.confirmed, std::slice::from_ref(&id1));

        // Encode the guards, then decode them.

        let state: GuardSample = (&guards).into();

        let guards2: GuardSet = state.into();

        assert_eq!(&guards2.sample, &guards.sample);

        assert_eq!(&guards2.confirmed, &guards.confirmed);

        assert_eq!(&guards2.confirmed, &[id1]);

        assert_eq!(

            guards

                .guards

                .values()

                .map(Guard::guard_id)

                .collect::<HashSet<_>>(),

            guards2

                .guards

                .values()

                .map(Guard::guard_id)

                .collect::<HashSet<_>>()

        );

        for g in guards.guards.values() {

            let g2 = guards2.guards.by_all_ids(g.guard_id()).unwrap();

            assert_eq!(format!("{:?}", g), format!("{:?}", g2));

        }

    }

    #[test]

    fn select_primary() {

        let netdir = netdir();

        let params = GuardParams {

            min_filtered_sample_size: 5,

            n_primary: 4,

            ..GuardParams::default()

        };

        let t1 = SystemTime::get();

        let t2 = t1 + Duration::from_secs(20);

        let t3 = t2 + Duration::from_secs(30);

        let mut guards = GuardSet::default();

        guards.extend_sample_as_needed(t1, &params, &netdir);

        // Pick a guard and mark it as confirmed.

        let id3 = guards.sample[3].clone();

        guards.record_success(&id3, &params, None, t2);

        assert_eq!(&guards.confirmed, std::slice::from_ref(&id3));

        let id1 = guards.sample[1].clone();

        guards.record_success(&id1, &params, None, t3);

        assert_eq!(&guards.confirmed, &[id3.clone(), id1.clone()]);

        // Select primary guards and make sure we're obeying the rules.

        guards.select_primary_guards(&params);

        assert_eq!(guards.primary.len(), 4);

        assert_eq!(&guards.primary[0], &id3);

        assert_eq!(&guards.primary[1], &id1);

        let p3 = guards.primary[2].clone();

        let p4 = guards.primary[3].clone();

        assert_eq!(

            [id1.clone(), id3.clone(), p3.clone(), p4.clone()]

                .iter()

                .unique()

                .count(),

            4

        );

        // Mark another guard as confirmed and see that the list changes to put

        // that guard right after the previously confirmed guards, but we keep

        // one of the previous unconfirmed primary guards.

        guards.record_success(&p4, &params, None, t3);

        assert_eq!(&guards.confirmed, &[id3.clone(), id1.clone(), p4.clone()]);

        guards.select_primary_guards(&params);

        assert_eq!(guards.primary.len(), 4);

        assert_eq!(&guards.primary[0], &id3);

        assert_eq!(&guards.primary[1], &id1);

        assert_eq!(&guards.primary, &[id3, id1, p4, p3]);

    }

    #[test]

    fn expiration() {

        let netdir = netdir();

        let params = GuardParams::default();

        let t1 = SystemTime::get();

        let mut guards = GuardSet::default();

        guards.extend_sample_as_needed(t1, &params, &netdir);

        // note that there are only 10 Guard+V2Dir nodes in the netdir().

        assert_eq!(guards.sample.len(), 10);

        // Mark one guard as confirmed; it will have a different timeout.

        // Pick a guard and mark it as confirmed.

        let id1 = guards.sample[0].clone();

        guards.record_success(&id1, &params, None, t1);

        assert_eq!(&guards.confirmed, &[id1]);

        let one_day = Duration::from_secs(86400);

        guards.expire_old_guards(&params, t1 + one_day * 30);

        assert_eq!(guards.sample.len(), 10); // nothing has expired.

        // This is long enough to make sure that the confirmed guard has expired.

        guards.expire_old_guards(&params, t1 + one_day * 70);

        assert_eq!(guards.sample.len(), 9);

        guards.expire_old_guards(&params, t1 + one_day * 200);

        assert_eq!(guards.sample.len(), 0);

    }

    #[test]

    fn sampling_and_usage() {

        let netdir = netdir();

        let params = GuardParams {

            min_filtered_sample_size: 5,

            n_primary: 2,

            ..GuardParams::default()

        };

        let st1 = SystemTime::get();

        let i1 = Instant::get();

        let sec = Duration::from_secs(1);

        let mut guards = GuardSet::default();

        guards.extend_sample_as_needed(st1, &params, &netdir);

        guards.select_primary_guards(&params);

        // First guard: try it, and let it fail.

        let usage = crate::GuardUsageBuilder::default().build().unwrap();

        let id1 = guards.primary[0].clone();

        let id2 = guards.primary[1].clone();

        let (src, id) = guards.pick_guard_id(&usage, &params, i1).unwrap();

        assert_eq!(src, ListKind::Primary);

        assert_eq!(&id, &id1);

        guards.record_attempt(&id, i1);

        guards.record_failure(&id, None, i1 + sec);

        // Second guard: try it, and try it again, and have it fail.

        let (src, id) = guards.pick_guard_id(&usage, &params, i1 + sec).unwrap();

        assert_eq!(src, ListKind::Primary);

        assert_eq!(&id, &id2);

        guards.record_attempt(&id, i1 + sec);

        let (src, id_x) = guards.pick_guard_id(&usage, &params, i1 + sec).unwrap();

        // We get the same guard this (second) time that we pick it too, since

        // it is a primary guard, and is_pending won't block it.

        assert_eq!(id_x, id);

        assert_eq!(src, ListKind::Primary);

        guards.record_attempt(&id_x, i1 + sec * 2);

        guards.record_failure(&id_x, None, i1 + sec * 3);

        guards.record_failure(&id, None, i1 + sec * 4);

        // Third guard: this one won't be primary.

        let (src, id3) = guards.pick_guard_id(&usage, &params, i1 + sec * 4).unwrap();

        assert_eq!(src, ListKind::Sample);

        assert!(!guards.primary.contains(&id3));

        guards.record_attempt(&id3, i1 + sec * 5);

        // Fourth guard: Third guard will be pending, so a different one gets

        // handed out here.

        let (src, id4) = guards.pick_guard_id(&usage, &params, i1 + sec * 5).unwrap();

        assert_eq!(src, ListKind::Sample);

        assert!(id3 != id4);

        assert!(!guards.primary.contains(&id4));

        guards.record_attempt(&id4, i1 + sec * 6);

        // Look at usability status: primary guards should be usable

        // immediately; third guard should be too (since primary