1
//! Parsing implementation for networkstatus documents.
2
//!
3
//! In Tor, a networkstatus documents describes a complete view of the
4
//! relays in the network: how many there are, how to contact them,
5
//! and so forth.
6
//!
7
//! A networkstatus document can either be a "votes" -- an authority's
8
//! view of the network, used as input to the voting process -- or a
9
//! "consensus" -- a combined view of the network based on multiple
10
//! authorities' votes, and signed by multiple authorities.
11
//!
12
//! A consensus document can itself come in two different flavors: a
13
//! plain (unflavoured) consensus has references to router descriptors, and
14
//! a "microdesc"-flavored consensus ("md") has references to
15
//! microdescriptors.
16
//!
17
//! To keep an up-to-date view of the network, clients download
18
//! microdescriptor-flavored consensuses periodically, and then
19
//! download whatever microdescriptors the consensus lists that the
20
//! client doesn't already have.
21
//!
22
//! For full information about the network status format, see
23
//! [dir-spec.txt](https://spec.torproject.org/dir-spec).
24
//!
25
//! # Limitations
26
//!
27
//! NOTE: The consensus format has changes time, using a
28
//! "consensus-method" mechanism.  This module is does not yet handle all
29
//! all historical consensus-methods.
30
//!
31
//! NOTE: This module _does_ parse some fields that are not in current
32
//! use, like relay nicknames, and the "published" times on
33
//! microdescriptors. We should probably decide whether we actually
34
//! want to do this.
35
//!
36
//! TODO: This module doesn't implement vote parsing at all yet.
37
//!
38
//! TODO: This module doesn't implement plain consensuses.
39
//!
40
//! TODO: We need an object safe trait that combines the common operations found
41
//! on netstatus documents, so we can store one in a `Box<dyn CommonNs>` or
42
//! something similar; otherwise interfacing applications have a hard time to
43
//! process netstatus documents in a flavor agnostic fashion.
44
//!
45
//! TODO: More testing is needed!
46
//!
47
//! TODO: There should be accessor functions for most of the fields here.
48
//! As with the other tor-netdoc types, I'm deferring those till I know what
49
//! they should be.
50

            
51
mod dir_source;
52
mod rs;
53

            
54
pub mod md;
55
#[cfg(feature = "plain-consensus")]
56
pub mod plain;
57
#[cfg(feature = "ns-vote")]
58
pub mod vote;
59

            
60
#[cfg(feature = "build_docs")]
61
mod build;
62

            
63
#[cfg(feature = "encode")]
64
use {
65
    crate::encode::{ItemValueEncodable, NetdocEncodable, NetdocEncoder}, //
66
    tor_error::Bug,
67
};
68
#[cfg(feature = "parse2")]
69
use {
70
    crate::parse2::{self, ArgumentStream, ItemValueParseable}, //
71
};
72

            
73
#[cfg(feature = "parse2")]
74
pub use {
75
    parse2::{ErrorProblem, IsStructural, ItemStream, KeywordRef, NetdocParseable, StopAt},
76
    proto_statuses_parse2_encode::ProtoStatusesNetdocParseAccumulator, //
77
};
78

            
79
#[cfg(all(feature = "parse2", feature = "plain-consensus"))]
80
use crate::doc::authcert::EncodedAuthCert;
81

            
82
use crate::doc::authcert::{AuthCert, AuthCertKeyIds};
83
use crate::parse::keyword::Keyword;
84
use crate::parse::parser::{Section, SectionRules, SectionRulesBuilder};
85
use crate::parse::tokenize::{Item, ItemResult, NetDocReader};
86
use crate::types::misc::*;
87
use crate::types::relay_flags::{self, DocRelayFlags};
88
use crate::util::PeekableIterator;
89
use crate::{Error, KeywordEncodable, NetdocErrorKind as EK, NormalItemArgument, Pos, Result};
90
use std::collections::{BTreeSet, HashMap, HashSet};
91
use std::fmt::{self, Display};
92
use std::result::Result as StdResult;
93
use std::str::FromStr;
94
use std::sync::Arc;
95
use std::{net, result, time};
96
use tor_error::{HasKind, bad_api_usage, internal};
97
use tor_protover::Protocols;
98

            
99
use derive_deftly::{Deftly, define_derive_deftly};
100
use digest::Digest;
101
use std::sync::LazyLock;
102
use tor_checkable::{ExternallySigned, timed::TimerangeBound};
103
use tor_llcrypto as ll;
104
use tor_llcrypto::pk::rsa::RsaIdentity;
105

            
106
use serde::{Deserialize, Deserializer};
107

            
108
#[cfg(feature = "build_docs")]
109
pub use build::MdConsensusBuilder;
110
#[cfg(all(feature = "build_docs", feature = "plain-consensus"))]
111
pub use build::PlainConsensusBuilder;
112
#[cfg(feature = "build_docs")]
113
ns_export_each_flavor! {
114
    ty: RouterStatusBuilder;
115
}
116

            
117
ns_export_each_variety! {
118
    ty: RouterStatus, Preamble;
119
}
120

            
121
#[deprecated]
122
#[cfg(feature = "ns_consensus")]
123
pub use PlainConsensus as NsConsensus;
124
#[deprecated]
125
#[cfg(feature = "ns_consensus")]
126
pub use PlainRouterStatus as NsRouterStatus;
127
#[deprecated]
128
#[cfg(feature = "ns_consensus")]
129
pub use UncheckedPlainConsensus as UncheckedNsConsensus;
130
#[deprecated]
131
#[cfg(feature = "ns_consensus")]
132
pub use UnvalidatedPlainConsensus as UnvalidatedNsConsensus;
133

            
134
#[cfg(feature = "ns-vote")]
135
pub use rs::{RouterStatusMdDigestsVote, SoftwareVersion};
136

            
137
pub use dir_source::{ConsensusAuthoritySection, DirSource, SupersededAuthorityKey};
138

            
139
/// `publiscation` field in routerstatus entry intro item other than in votes
140
///
141
/// Two arguments which are both ignored.
142
/// This used to be an ISO8601 timestamp in anomalous two-argument format.
143
///
144
/// Nowadays, according to the spec, it can be a dummy value.
145
/// So it can be a unit type.
146
///
147
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:r>,
148
/// except in votes which use [`Iso8601TimeSp`] instead.
149
///
150
/// **Not the same as** the `published` item:
151
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:published>
152
#[derive(Debug, Copy, Clone, Eq, PartialEq, Hash, Ord, PartialOrd, Default)]
153
#[allow(clippy::exhaustive_structs)]
154
pub struct IgnoredPublicationTimeSp;
155

            
156
/// The lifetime of a networkstatus document.
157
///
158
/// In a consensus, this type describes when the consensus may safely
159
/// be used.  In a vote, this type describes the proposed lifetime for a
160
/// consensus.
161
///
162
/// Aggregate of three netdoc preamble fields.
163
#[derive(Clone, Debug, Deftly)]
164
#[derive_deftly(Constructor)]
165
#[derive_deftly(Lifetime)]
166
#[cfg_attr(feature = "encode", derive_deftly(NetdocEncodableFields))]
167
#[cfg_attr(feature = "parse2", derive_deftly(NetdocParseableFields))]
168
// derive_deftly_adhoc disables unused deftly attribute checking, so we needn't cfg_attr them all
169
#[cfg_attr(not(any(feature = "parse2", feature = "encode")), derive_deftly_adhoc)]
170
#[allow(clippy::exhaustive_structs)]
171
pub struct Lifetime {
172
    /// `valid-after` --- Time at which the document becomes valid
173
    ///
174
    /// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:published>
175
    ///
176
    /// (You might see a consensus a little while before this time,
177
    /// since voting tries to finish up before the.)
178
    #[deftly(constructor)]
179
    #[deftly(netdoc(single_arg))]
180
    pub valid_after: Iso8601TimeSp,
181
    /// `fresh-until` --- Time after which there is expected to be a better version
182
    /// of this consensus
183
    ///
184
    /// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:published>
185
    ///
186
    /// You can use the consensus after this time, but there is (or is
187
    /// supposed to be) a better one by this point.
188
    #[deftly(constructor)]
189
    #[deftly(netdoc(single_arg))]
190
    pub fresh_until: Iso8601TimeSp,
191
    /// `valid-until` --- Time after which this consensus is expired.
192
    ///
193
    /// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:published>
194
    ///
195
    /// You should try to get a better consensus after this time,
196
    /// though it's okay to keep using this one if no more recent one
197
    /// can be found.
198
    #[deftly(constructor)]
199
    #[deftly(netdoc(single_arg))]
200
    pub valid_until: Iso8601TimeSp,
201

            
202
    #[doc(hidden)]
203
    #[deftly(netdoc(skip))]
204
    pub __non_exhaustive: (),
205
}
206

            
207
define_derive_deftly! {
208
    /// Bespoke derive for `Lifetime`, for `new` and accessors
209
    Lifetime:
210

            
211
    ${defcond FIELD not(approx_equal($fname, __non_exhaustive))}
212

            
213
    impl Lifetime {
214
        /// Construct a new Lifetime.
215
13851
        pub fn new(
216
13851
            $( ${when FIELD} $fname: time::SystemTime, )
217
13851
        ) -> Result<Self> {
218
            // Make this now because otherwise literal `valid_after` here in the body
219
            // has the wrong span - the compiler refuses to look at the argument.
220
            // But we can refer to the field names.
221
            let self_ = Lifetime {
222
                $( ${when FIELD} $fname: $fname.into(), )
223
                __non_exhaustive: (),
224
            };
225
            if self_.valid_after < self_.fresh_until && self_.fresh_until < self_.valid_until {
226
                Ok(self_)
227
            } else {
228
                Err(EK::InvalidLifetime.err())
229
            }
230
        }
231
      $(
232
        ${when FIELD}
233

            
234
        ${fattrs doc}
235
167798
        pub fn $fname(&self) -> time::SystemTime {
236
            *self.$fname
237
        }
238
      )
239
        /// Return true if this consensus is officially valid at the provided time.
240
530
        pub fn valid_at(&self, when: time::SystemTime) -> bool {
241
            *self.valid_after <= when && when <= *self.valid_until
242
        }
243

            
244
        /// Return the voting period implied by this lifetime.
245
        ///
246
        /// (The "voting period" is the amount of time in between when a consensus first
247
        /// becomes valid, and when the next consensus is expected to become valid)
248
53212
        pub fn voting_period(&self) -> time::Duration {
249
            let valid_after = self.valid_after();
250
            let fresh_until = self.fresh_until();
251
            fresh_until
252
                .duration_since(valid_after)
253
                .expect("Mis-formed lifetime")
254
        }
255
    }
256
}
257
use derive_deftly_template_Lifetime;
258

            
259
/// A single consensus method
260
///
261
/// These are integers, but we don't do arithmetic on them.
262
///
263
/// As defined here:
264
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:consensus-methods>
265
/// <https://spec.torproject.org/dir-spec/computing-consensus.html#flavor:microdesc>
266
///
267
/// As used in a `consensus-method` item:
268
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:consensus-method>
269
#[derive(Debug, Clone, Default, Eq, PartialEq, Ord, PartialOrd, Hash, Copy)] //
270
#[derive(derive_more::From, derive_more::Into, derive_more::Display, derive_more::FromStr)]
271
pub struct ConsensusMethod(u32);
272
impl NormalItemArgument for ConsensusMethod {}
273

            
274
/// A set of consensus methods
275
///
276
/// Implements `ItemValueParseable` as required for `consensus-methods`,
277
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:consensus-methods>
278
///
279
/// There is also [`consensus_methods_comma_separated`] for `m` lines in votes.
280
#[derive(Debug, Clone, Default, Eq, PartialEq, Deftly)]
281
#[cfg_attr(feature = "parse2", derive_deftly(ItemValueParseable))]
282
#[cfg_attr(feature = "encode", derive_deftly(ItemValueEncodable))]
283
#[non_exhaustive]
284
pub struct ConsensusMethods {
285
    /// Consensus methods.
286
    pub methods: BTreeSet<ConsensusMethod>,
287
}
288

            
289
/// Module for use with parse2's `with`, to parse one argument of comma-separated consensus methods
290
///
291
/// As found in an `m` item in a vote:
292
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:m>
293
#[cfg(feature = "parse2")]
294
pub mod consensus_methods_comma_separated {
295
    use super::*;
296
    use parse2::ArgumentError as AE;
297
    use std::result::Result;
298

            
299
    /// Parse
300
14
    pub fn from_args<'s>(args: &mut ArgumentStream<'s>) -> Result<ConsensusMethods, AE> {
301
14
        let mut methods = BTreeSet::new();
302
56
        for ent in args.next().ok_or(AE::Missing)?.split(',') {
303
56
            let ent = ent.parse().map_err(|_| AE::Invalid)?;
304
56
            if !methods.insert(ent) {
305
                return Err(AE::Invalid);
306
56
            }
307
        }
308
14
        Ok(ConsensusMethods { methods })
309
14
    }
310
}
311

            
312
/// A set of named network parameters.
313
///
314
/// These are used to describe current settings for the Tor network,
315
/// current weighting parameters for path selection, and so on.  They're
316
/// encoded with a space-separated K=V format.
317
///
318
/// A `NetParams<i32>` is part of the validated directory manager configuration,
319
/// where it is built (in the builder-pattern sense) from a transparent HashMap.
320
///
321
/// As found in `params` in a network status:
322
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:params>
323
///
324
/// The same syntax is also used, and this type used for parsing, in various other places,
325
/// for example routerstatus entry `w` items (bandwidth weights):
326
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:w>
327
//
328
// TODO DIRAUTH torspec#401 Replace `String` with a suitable newtype
329
// Currently:
330
//  - Our parser allows any keyword that makes it into a netdoc argument,
331
//    but it splits on the *first* `=` so a `NetParams<i32>` cannot parse a keyword with a `=`.
332
//  - We provide constructors that allow any `String`, even ones containing space, `=`,
333
//    newline, etc.
334
//  - Encoding throws `Bug` if the resulting document will be clearly garbage,
335
//    forbidding `=`, whitespace, and controls.  If the supplied keywords are bizarre,
336
//    it may generate surprising documents (eg, containing exciting Unicode).
337
#[derive(Debug, Clone, Default, Eq, PartialEq)]
338
pub struct NetParams<T> {
339
    /// Map from keys to values.
340
    params: HashMap<String, T>,
341
}
342

            
343
impl<T> NetParams<T> {
344
    /// Create a new empty list of NetParams.
345
    #[allow(unused)]
346
29158
    pub fn new() -> Self {
347
29158
        NetParams {
348
29158
            params: HashMap::new(),
349
29158
        }
350
29158
    }
351
    /// Retrieve a given network parameter, if it is present.
352
194497
    pub fn get<A: AsRef<str>>(&self, v: A) -> Option<&T> {
353
194497
        self.params.get(v.as_ref())
354
194497
    }
355
    /// Return an iterator over all key value pairs in an arbitrary order.
356
25448
    pub fn iter(&self) -> impl Iterator<Item = (&String, &T)> {
357
25448
        self.params.iter()
358
25448
    }
359
    /// Set or replace the value of a network parameter.
360
10368
    pub fn set(&mut self, k: String, v: T) {
361
10368
        self.params.insert(k, v);
362
10368
    }
363
}
364

            
365
impl<K: Into<String>, T> FromIterator<(K, T)> for NetParams<T> {
366
6966
    fn from_iter<I: IntoIterator<Item = (K, T)>>(i: I) -> Self {
367
        NetParams {
368
7013
            params: i.into_iter().map(|(k, v)| (k.into(), v)).collect(),
369
        }
370
6966
    }
371
}
372

            
373
impl<T> std::iter::Extend<(String, T)> for NetParams<T> {
374
4118
    fn extend<I: IntoIterator<Item = (String, T)>>(&mut self, iter: I) {
375
4118
        self.params.extend(iter);
376
4118
    }
377
}
378

            
379
impl<'de, T> Deserialize<'de> for NetParams<T>
380
where
381
    T: Deserialize<'de>,
382
{
383
    fn deserialize<D>(deserializer: D) -> std::result::Result<Self, D::Error>
384
    where
385
        D: Deserializer<'de>,
386
    {
387
        let params = HashMap::deserialize(deserializer)?;
388
        Ok(NetParams { params })
389
    }
390
}
391

            
392
/// A list of subprotocol versions that implementors should/must provide.
393
///
394
/// This struct represents a pair of (optional) items:
395
/// `recommended-FOO-protocols` and `required-FOO-protocols`.
396
///
397
/// Each consensus has two of these: one for relays, and one for clients.
398
///
399
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:required-relay-protocols>
400
#[derive(Debug, Clone, Default, PartialEq, serde::Serialize, serde::Deserialize)]
401
pub struct ProtoStatus {
402
    /// Set of protocols that are recommended; if we're missing a protocol
403
    /// in this list we should warn the user.
404
    ///
405
    /// `recommended-client-protocols` or `recommended-relay-protocols`
406
    recommended: Protocols,
407
    /// Set of protocols that are required; if we're missing a protocol
408
    /// in this list we should refuse to start.
409
    ///
410
    /// `required-client-protocols` or `required-relay-protocols`
411
    required: Protocols,
412
}
413

            
414
impl ProtoStatus {
415
    /// Check whether the list of supported protocols
416
    /// is sufficient to satisfy this list of recommendations and requirements.
417
    ///
418
    /// If any required protocol is missing, returns [`ProtocolSupportError::MissingRequired`].
419
    ///
420
    /// Otherwise, if no required protocol is missing, but some recommended protocol is missing,
421
    /// returns [`ProtocolSupportError::MissingRecommended`].
422
    ///
423
    /// Otherwise, if no recommended or required protocol is missing, returns `Ok(())`.
424
218
    pub fn check_protocols(
425
218
        &self,
426
218
        supported_protocols: &Protocols,
427
218
    ) -> StdResult<(), ProtocolSupportError> {
428
        // Required protocols take precedence, so we check them first.
429
218
        let missing_required = self.required.difference(supported_protocols);
430
218
        if !missing_required.is_empty() {
431
108
            return Err(ProtocolSupportError::MissingRequired(missing_required));
432
110
        }
433
110
        let missing_recommended = self.recommended.difference(supported_protocols);
434
110
        if !missing_recommended.is_empty() {
435
55
            return Err(ProtocolSupportError::MissingRecommended(
436
55
                missing_recommended,
437
55
            ));
438
55
        }
439

            
440
55
        Ok(())
441
218
    }
442
}
443

            
444
/// A subprotocol that is recommended or required in the consensus was not present.
445
#[derive(Clone, Debug, thiserror::Error)]
446
#[cfg_attr(test, derive(PartialEq))]
447
#[non_exhaustive]
448
pub enum ProtocolSupportError {
449
    /// At least one required protocol was not in our list of supported protocols.
450
    #[error("Required protocols are not implemented: {0}")]
451
    MissingRequired(Protocols),
452

            
453
    /// At least one recommended protocol was not in our list of supported protocols.
454
    ///
455
    /// Also implies that no _required_ protocols were missing.
456
    #[error("Recommended protocols are not implemented: {0}")]
457
    MissingRecommended(Protocols),
458
}
459

            
460
impl ProtocolSupportError {
461
    /// Return true if the suggested behavior for this error is a shutdown.
462
    pub fn should_shutdown(&self) -> bool {
463
        matches!(self, Self::MissingRequired(_))
464
    }
465
}
466

            
467
impl HasKind for ProtocolSupportError {
468
    fn kind(&self) -> tor_error::ErrorKind {
469
        tor_error::ErrorKind::SoftwareDeprecated
470
    }
471
}
472

            
473
/// A set of recommended and required protocols when running
474
/// in various scenarios.
475
///
476
/// Represents the collection of four items: `{recommended,required}-{client,relay}-protocols`.
477
///
478
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:required-relay-protocols>
479
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
480
pub struct ProtoStatuses {
481
    /// Lists of recommended and required subprotocol versions for clients
482
    client: ProtoStatus,
483
    /// Lists of recommended and required subprotocol versions for relays
484
    relay: ProtoStatus,
485
}
486

            
487
impl ProtoStatuses {
488
    /// Return the list of recommended and required protocols for running as a client.
489
212
    pub fn client(&self) -> &ProtoStatus {
490
212
        &self.client
491
212
    }
492

            
493
    /// Return the list of recommended and required protocols for running as a relay.
494
    pub fn relay(&self) -> &ProtoStatus {
495
        &self.relay
496
    }
497
}
498

            
499
/// A recognized 'flavor' of consensus document.
500
///
501
/// The enum is exhaustive because the addition/removal of a consensus flavor
502
/// should indeed be a breaking change, as it would inevitable require
503
/// interfacing code to think about the handling of it.
504
///
505
/// <https://spec.torproject.org/dir-spec/computing-consensus.html#flavors>
506
#[derive(Copy, Clone, Debug, Eq, PartialEq, Hash, Ord, PartialOrd)]
507
#[allow(clippy::exhaustive_enums)]
508
pub enum ConsensusFlavor {
509
    /// A "microdesc"-flavored consensus.  This is the one that
510
    /// clients and relays use today.
511
    Microdesc,
512
    /// A "networkstatus"-flavored consensus.  It's used for
513
    /// historical and network-health purposes.  Instead of listing
514
    /// microdescriptor digests, it lists digests of full relay
515
    /// descriptors.
516
    Plain,
517
}
518

            
519
impl ConsensusFlavor {
520
    /// Return the name of this consensus flavor.
521
2703
    pub fn name(&self) -> &'static str {
522
2703
        match self {
523
954
            ConsensusFlavor::Plain => "ns", // spec bug, now baked in
524
1749
            ConsensusFlavor::Microdesc => "microdesc",
525
        }
526
2703
    }
527
    /// Try to find the flavor whose name is `name`.
528
    ///
529
    /// For historical reasons, an unnamed flavor indicates an "Plain"
530
    /// document.
531
385
    pub fn from_opt_name(name: Option<&str>) -> Result<Self> {
532
385
        match name {
533
383
            Some("microdesc") => Ok(ConsensusFlavor::Microdesc),
534
2
            Some("ns") | None => Ok(ConsensusFlavor::Plain),
535
            Some(other) => {
536
                Err(EK::BadDocumentType.with_msg(format!("unrecognized flavor {:?}", other)))
537
            }
538
        }
539
385
    }
540
}
541

            
542
/// The signature of a single directory authority on a networkstatus document.
543
#[derive(Debug, Clone)]
544
#[non_exhaustive]
545
pub struct Signature {
546
    /// The name of the digest algorithm used to make the signature.
547
    ///
548
    /// Currently sha1 and sh256 are recognized.  Here we only support
549
    /// sha256.
550
    pub digestname: String,
551
    /// Fingerprints of the keys for the authority that made
552
    /// this signature.
553
    pub key_ids: AuthCertKeyIds,
554
    /// The signature itself.
555
    pub signature: Vec<u8>,
556
}
557

            
558
/// A collection of signatures that can be checked on a networkstatus document
559
#[derive(Debug, Clone)]
560
#[non_exhaustive]
561
pub struct SignatureGroup {
562
    /// The sha256 of the document itself
563
    pub sha256: Option<[u8; 32]>,
564
    /// The sha1 of the document itself
565
    pub sha1: Option<[u8; 20]>,
566
    /// The signatures listed on the document.
567
    pub signatures: Vec<Signature>,
568
}
569

            
570
/// A shared random value produced by the directory authorities.
571
#[derive(
572
    Debug, Clone, Copy, Eq, PartialEq, derive_more::From, derive_more::Into, derive_more::AsRef,
573
)]
574
// (This doesn't need to use CtByteArray; we don't really need to compare these.)
575
pub struct SharedRandVal([u8; 32]);
576

            
577
/// A shared-random value produced by the directory authorities,
578
/// along with meta-information about that value.
579
#[derive(Debug, Clone, Deftly)]
580
#[non_exhaustive]
581
#[cfg_attr(feature = "parse2", derive_deftly(ItemValueParseable))]
582
#[cfg_attr(feature = "encode", derive_deftly(ItemValueEncodable))]
583
pub struct SharedRandStatus {
584
    /// How many authorities revealed shares that contributed to this value.
585
    pub n_reveals: u8,
586
    /// The current random value.
587
    ///
588
    /// The properties of the secure shared-random system guarantee
589
    /// that this value isn't predictable before it first becomes
590
    /// live, and that a hostile party could not have forced it to
591
    /// have any more than a small number of possible random values.
592
    pub value: SharedRandVal,
593

            
594
    /// The time when this SharedRandVal becomes (or became) the latest.
595
    ///
596
    /// (This is added per proposal 342, assuming that gets accepted.)
597
    pub timestamp: Option<Iso8601TimeNoSp>,
598
}
599

            
600
/// Recognized weight fields on a single relay in a consensus
601
#[non_exhaustive]
602
#[derive(Debug, Clone, Copy)]
603
pub enum RelayWeight {
604
    /// An unmeasured weight for a relay.
605
    Unmeasured(u32),
606
    /// An measured weight for a relay.
607
    Measured(u32),
608
}
609

            
610
impl RelayWeight {
611
    /// Return true if this weight is the result of a successful measurement
612
26245
    pub fn is_measured(&self) -> bool {
613
26245
        matches!(self, RelayWeight::Measured(_))
614
26245
    }
615
    /// Return true if this weight is nonzero
616
24761
    pub fn is_nonzero(&self) -> bool {
617
24761
        !matches!(self, RelayWeight::Unmeasured(0) | RelayWeight::Measured(0))
618
24761
    }
619
}
620

            
621
/// Authority entry in a consensus - deprecated compatibility type alias
622
#[deprecated = "renamed to ConsensusAuthorityEntry"]
623
pub type ConsensusVoterInfo = ConsensusAuthorityEntry;
624

            
625
/// Authority entry in a plain consensus - type alias provided for consistency
626
pub type PlainAuthorityEntry = ConsensusAuthorityEntry;
627
/// Authority entry in an md consensus - type alias provided for consistency
628
pub type MdAuthorityEntry = ConsensusAuthorityEntry;
629

            
630
/// An authority entry as found in a consensus
631
///
632
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#section:authority-entry>
633
///
634
/// See also [`VoteAuthorityEntry`]
635
//
636
// We don't use the `each_variety` system for this because:
637
//  1. That avoids separating the two consensus authority entry types, which are identical
638
//  2. The only common fields are `dir-source` and `contact`, so there is little duplication
639
#[derive(Debug, Clone, Deftly)]
640
#[cfg_attr(feature = "parse2", derive_deftly(NetdocParseable))]
641
#[cfg_attr(feature = "encode", derive_deftly(NetdocEncodable))]
642
#[cfg_attr(not(any(feature = "parse2", feature = "encode")), derive_deftly_adhoc)]
643
#[derive_deftly(Constructor)]
644
#[allow(clippy::exhaustive_structs)]
645
pub struct ConsensusAuthorityEntry {
646
    /// Contents of the `dir-source` line about an authority
647
    #[deftly(constructor)]
648
    pub dir_source: DirSource,
649

            
650
    /// Human-readable contact information about the authority
651
    //
652
    // If more non-intro fields get added that are the same in votes and cosensuses,
653
    // consider using each_variety.rs or breaking those fields out into
654
    // `AuthorityEntryCommon` implementing `NetdocParseableFields`, or something.
655
    #[deftly(constructor)]
656
    pub contact: ContactInfo,
657

            
658
    /// Digest of the vote that the authority cast to contribute to
659
    /// this consensus.
660
    ///
661
    /// This is not a fixed-length, fixed-algorithm field.
662
    /// Bizarrely, the algorithm is supposed to be inferred from the length!
663
    /// <https://spec.torproject.org/dir-spec/consensus-formats.html#item:vote-digest>
664
    #[deftly(netdoc(single_arg))]
665
    #[deftly(constructor)]
666
    pub vote_digest: B16U,
667

            
668
    #[doc(hidden)]
669
    #[deftly(netdoc(skip))]
670
    pub __non_exhaustive: (),
671
}
672

            
673
/// An authority entry as found in a vote
674
///
675
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#section:authority-entry>
676
///
677
/// See also [`ConsensusAuthorityEntry`]
678
///
679
/// TODO DIRAUTH not all fields are here yet.
680
// They have individual comments, below.
681
#[derive(Debug, Clone, Deftly)]
682
#[cfg_attr(feature = "parse2", derive_deftly(NetdocParseable))]
683
#[cfg_attr(feature = "encode", derive_deftly(NetdocEncodable))]
684
#[cfg_attr(not(any(feature = "parse2", feature = "encode")), derive_deftly_adhoc)]
685
#[derive_deftly(Constructor)]
686
#[allow(clippy::exhaustive_structs)]
687
pub struct VoteAuthorityEntry {
688
    /// Contents of the `dir-source` line about an authority
689
    #[deftly(constructor)]
690
    pub dir_source: DirSource,
691

            
692
    /// Human-readable contact information about the authority
693
    #[deftly(constructor)]
694
    pub contact: ContactInfo,
695

            
696
    // TODO DIRAUTH missing field legacy-dir-key
697
    // TODO DIRAUTH missing field shared-rand-participate
698
    // TODO DIRAUTH missing field shared-rand-commit
699
    // TODO DIRAUTH missing field shared-rand-previous-value
700
    // TODO DIRAUTH missing field shared-rand-current-value
701
    //
702
    #[doc(hidden)]
703
    #[deftly(netdoc(skip))]
704
    pub __non_exhaustive: (),
705
}
706

            
707
// For `ConsensusAuthoritySection`, see `dir_source.rs`.
708

            
709
define_derive_deftly! {
710
    /// Ad-hoc derive, `impl NetdocParseable for VoteAuthoritySection`
711
    ///
712
    /// We can't derive from `VoteAuthoritySection` with the normal macros, because
713
    /// it's not a document, with its own intro item.  It's just a collection of sub-documents.
714
    /// The netdoc derive macros don't have support for that - and it would be a fairly
715
    /// confusing thing to support because you'd end up with nested multiplicities and a whole
716
    /// variety of "intro item keywords" that were keywords for arbitrary sub-documents.
717
    ///
718
    /// Instead, we do that ad-hoc here.  It's less confusing because we don't need to
719
    /// worry about multiplicity, and because we know what only the outer document is
720
    /// that will contain this.
721
    VoteAuthoritySection:
722

            
723
    ${defcond F_NORMAL not(fmeta(netdoc(skip)))}
724

            
725
    #[cfg(feature = "parse2")]
726
    impl NetdocParseable for VoteAuthoritySection {
727
2
        fn doctype_for_error() -> &'static str {
728
            "vote.authority.section"
729
        }
730
314
        fn is_intro_item_keyword(kw: KeywordRef<'_>) -> bool {
731
            VoteAuthorityEntry::is_intro_item_keyword(kw)
732
        }
733
82
        fn is_structural_keyword(kw: KeywordRef<'_>) -> Option<IsStructural> {
734
          $(
735
            ${when F_NORMAL}
736
            if let y @ Some(_) = $ftype::is_structural_keyword(kw) {
737
                return y;
738
            }
739
          )
740
            None
741
        }
742
2
        fn from_items<'s>(
743
2
            input: &mut ItemStream<'s>,
744
2
            stop_outer: stop_at!(),
745
2
        ) -> StdResult<Self, ErrorProblem> {
746
            let stop_inner = stop_outer
747
              $(
748
                ${when F_NORMAL}
749
                | StopAt($ftype::is_intro_item_keyword)
750
              )
751
            ;
752
            Ok(VoteAuthoritySection { $(
753
                ${when F_NORMAL}
754
                $fname: NetdocParseable::from_items(input, stop_inner)?,
755
            )
756
                __non_exhaustive: (),
757
            })
758
        }
759
    }
760

            
761
    #[cfg(feature = "encode")]
762
    impl NetdocEncodable for VoteAuthoritySection {
763
        fn encode_unsigned(&self, out: &mut NetdocEncoder) -> StdResult<(), Bug> {
764
          $(
765
            ${when F_NORMAL}
766
            self.$fname.encode_unsigned(out)?;
767
          )
768
          Ok(())
769
        }
770
    }
771
}
772

            
773
/// An authority section in a vote
774
///
775
/// <https://spec.torproject.org/dir-spec/consensus-formats.html#section:authority>
776
//
777
// We have split this out to help encapsulate vote/consensus-specific
778
// information in a forthcoming overall network status document type.
779
#[derive(Deftly, Clone, Debug)]
780
#[derive_deftly(VoteAuthoritySection, Constructor)]
781
#[allow(clippy::exhaustive_structs)]
782
#[cfg(all(feature = "parse2", feature = "plain-consensus"))]
783
pub struct VoteAuthoritySection {
784
    /// Authority entry
785
    #[deftly(constructor)]
786
    pub authority: VoteAuthorityEntry,
787

            
788
    /// Authority key certificate
789
    #[deftly(constructor)]
790
    pub cert: EncodedAuthCert,
791

            
792
    #[doc(hidden)]
793
    #[deftly(netdoc(skip))]
794
    pub __non_exhaustive: (),
795
}
796

            
797
/// The signed footer of a consensus netstatus.
798
#[derive(Debug, Clone)]
799
#[non_exhaustive]
800
pub struct Footer {
801
    /// Weights to be applied to certain classes of relays when choosing
802
    /// for different roles.
803
    ///
804
    /// For example, we want to avoid choosing exits for non-exit
805
    /// roles when overall the proportion of exits is small.
806
    pub weights: NetParams<i32>,
807
}
808

            
809
/// A consensus document that lists relays along with their
810
/// microdescriptor documents.
811
pub type MdConsensus = md::Consensus;
812

            
813
/// An MdConsensus that has been parsed and checked for timeliness,
814
/// but not for signatures.
815
pub type UnvalidatedMdConsensus = md::UnvalidatedConsensus;
816

            
817
/// An MdConsensus that has been parsed but not checked for signatures
818
/// and timeliness.
819
pub type UncheckedMdConsensus = md::UncheckedConsensus;
820

            
821
#[cfg(feature = "plain-consensus")]
822
/// A consensus document that lists relays along with their
823
/// router descriptor documents.
824
pub type PlainConsensus = plain::Consensus;
825

            
826
#[cfg(feature = "plain-consensus")]
827
/// An PlainConsensus that has been parsed and checked for timeliness,
828
/// but not for signatures.
829
pub type UnvalidatedPlainConsensus = plain::UnvalidatedConsensus;
830

            
831
#[cfg(feature = "plain-consensus")]
832
/// An PlainConsensus that has been parsed but not checked for signatures
833
/// and timeliness.
834
pub type UncheckedPlainConsensus = plain::UncheckedConsensus;
835

            
836
decl_keyword! {
837
    /// Keywords that can be used in votes and consensuses.
838
    // TODO: This is public because otherwise we can't use it in the
839
    // ParseRouterStatus crate.  But I'd rather find a way to make it
840
    // private.
841
    #[non_exhaustive]
842
    #[allow(missing_docs)]
843
    pub NetstatusKwd {
844
        // Header
845
        "network-status-version" => NETWORK_STATUS_VERSION,
846
        "vote-status" => VOTE_STATUS,
847
        "consensus-methods" => CONSENSUS_METHODS,
848
        "consensus-method" => CONSENSUS_METHOD,
849
        "published" => PUBLISHED,
850
        "valid-after" => VALID_AFTER,
851
        "fresh-until" => FRESH_UNTIL,
852
        "valid-until" => VALID_UNTIL,
853
        "voting-delay" => VOTING_DELAY,
854
        "client-versions" => CLIENT_VERSIONS,
855
        "server-versions" => SERVER_VERSIONS,
856
        "known-flags" => KNOWN_FLAGS,
857
        "flag-thresholds" => FLAG_THRESHOLDS,
858
        "recommended-client-protocols" => RECOMMENDED_CLIENT_PROTOCOLS,
859
        "required-client-protocols" => REQUIRED_CLIENT_PROTOCOLS,
860
        "recommended-relay-protocols" => RECOMMENDED_RELAY_PROTOCOLS,
861
        "required-relay-protocols" => REQUIRED_RELAY_PROTOCOLS,
862
        "params" => PARAMS,
863
        "bandwidth-file-headers" => BANDWIDTH_FILE_HEADERS,
864
        "bandwidth-file-digest" => BANDWIDTH_FILE_DIGEST,
865
        // "package" is now ignored.
866

            
867
        // header in consensus, voter section in vote?
868
        "shared-rand-previous-value" => SHARED_RAND_PREVIOUS_VALUE,
869
        "shared-rand-current-value" => SHARED_RAND_CURRENT_VALUE,
870

            
871
        // Voter section (both)
872
        "dir-source" => DIR_SOURCE,
873
        "contact" => CONTACT,
874

            
875
        // voter section (vote, but not consensus)
876
        "legacy-dir-key" => LEGACY_DIR_KEY,
877
        "shared-rand-participate" => SHARED_RAND_PARTICIPATE,
878
        "shared-rand-commit" => SHARED_RAND_COMMIT,
879

            
880
        // voter section (consensus, but not vote)
881
        "vote-digest" => VOTE_DIGEST,
882

            
883
        // voter cert beginning (but only the beginning)
884
        "dir-key-certificate-version" => DIR_KEY_CERTIFICATE_VERSION,
885

            
886
        // routerstatus
887
        "r" => RS_R,
888
        "a" => RS_A,
889
        "s" => RS_S,
890
        "v" => RS_V,
891
        "pr" => RS_PR,
892
        "w" => RS_W,
893
        "p" => RS_P,
894
        "m" => RS_M,
895
        "id" => RS_ID,
896

            
897
        // footer
898
        "directory-footer" => DIRECTORY_FOOTER,
899
        "bandwidth-weights" => BANDWIDTH_WEIGHTS,
900
        "directory-signature" => DIRECTORY_SIGNATURE,
901
    }
902
}
903

            
904
/// Shared parts of rules for all kinds of netstatus headers
905
55
static NS_HEADER_RULES_COMMON_: LazyLock<SectionRulesBuilder<NetstatusKwd>> = LazyLock::new(|| {
906
    use NetstatusKwd::*;
907
55
    let mut rules = SectionRules::builder();
908
55
    rules.add(NETWORK_STATUS_VERSION.rule().required().args(1..=2));
909
55
    rules.add(VOTE_STATUS.rule().required().args(1..));
910
55
    rules.add(VALID_AFTER.rule().required());
911
55
    rules.add(FRESH_UNTIL.rule().required());
912
55
    rules.add(VALID_UNTIL.rule().required());
913
55
    rules.add(VOTING_DELAY.rule().args(2..));
914
55
    rules.add(CLIENT_VERSIONS.rule());
915
55
    rules.add(SERVER_VERSIONS.rule());
916
55
    rules.add(KNOWN_FLAGS.rule().required());
917
55
    rules.add(RECOMMENDED_CLIENT_PROTOCOLS.rule().args(1..));
918
55
    rules.add(RECOMMENDED_RELAY_PROTOCOLS.rule().args(1..));
919
55
    rules.add(REQUIRED_CLIENT_PROTOCOLS.rule().args(1..));
920
55
    rules.add(REQUIRED_RELAY_PROTOCOLS.rule().args(1..));
921
55
    rules.add(PARAMS.rule());
922
55
    rules
923
55
});
924
/// Rules for parsing the header of a consensus.
925
55
static NS_HEADER_RULES_CONSENSUS: LazyLock<SectionRules<NetstatusKwd>> = LazyLock::new(|| {
926
    use NetstatusKwd::*;
927
55
    let mut rules = NS_HEADER_RULES_COMMON_.clone();
928
55
    rules.add(CONSENSUS_METHOD.rule().args(1..=1));
929
55
    rules.add(SHARED_RAND_PREVIOUS_VALUE.rule().args(2..));
930
55
    rules.add(SHARED_RAND_CURRENT_VALUE.rule().args(2..));
931
55
    rules.add(UNRECOGNIZED.rule().may_repeat().obj_optional());
932
55
    rules.build()
933
55
});
934
/*
935
/// Rules for parsing the header of a vote.
936
static NS_HEADER_RULES_VOTE: SectionRules<NetstatusKwd> = {
937
    use NetstatusKwd::*;
938
    let mut rules = NS_HEADER_RULES_COMMON_.clone();
939
    rules.add(CONSENSUS_METHODS.rule().args(1..));
940
    rules.add(FLAG_THRESHOLDS.rule());
941
    rules.add(BANDWIDTH_FILE_HEADERS.rule());
942
    rules.add(BANDWIDTH_FILE_DIGEST.rule().args(1..));
943
    rules.add(UNRECOGNIZED.rule().may_repeat().obj_optional());
944
    rules
945
};
946
/// Rules for parsing a single voter's information in a vote.
947
static NS_VOTERINFO_RULES_VOTE: SectionRules<NetstatusKwd> = {
948
    use NetstatusKwd::*;
949
    let mut rules = SectionRules::new();
950
    rules.add(DIR_SOURCE.rule().required().args(6..));
951
    rules.add(CONTACT.rule().required());
952
    rules.add(LEGACY_DIR_KEY.rule().args(1..));
953
    rules.add(SHARED_RAND_PARTICIPATE.rule().no_args());
954
    rules.add(SHARED_RAND_COMMIT.rule().may_repeat().args(4..));
955
    rules.add(SHARED_RAND_PREVIOUS_VALUE.rule().args(2..));
956
    rules.add(SHARED_RAND_CURRENT_VALUE.rule().args(2..));
957
    // then comes an entire cert: When we implement vote parsing,
958
    // we should use the authcert code for handling that.
959
    rules.add(UNRECOGNIZED.rule().may_repeat().obj_optional());
960
    rules
961
};
962
 */
963
/// Rules for parsing a single voter's information in a consensus
964
55
static NS_VOTERINFO_RULES_CONSENSUS: LazyLock<SectionRules<NetstatusKwd>> = LazyLock::new(|| {
965
    use NetstatusKwd::*;
966
55
    let mut rules = SectionRules::builder();
967
55
    rules.add(DIR_SOURCE.rule().required().args(6..));
968
55
    rules.add(CONTACT.rule().required());
969
55
    rules.add(VOTE_DIGEST.rule().required());
970
55
    rules.add(UNRECOGNIZED.rule().may_repeat().obj_optional());
971
55
    rules.build()
972
55
});
973
/// Shared rules for parsing a single routerstatus
974
static NS_ROUTERSTATUS_RULES_COMMON_: LazyLock<SectionRulesBuilder<NetstatusKwd>> =
975
55
    LazyLock::new(|| {
976
        use NetstatusKwd::*;
977
55
        let mut rules = SectionRules::builder();
978
55
        rules.add(RS_A.rule().may_repeat().args(1..));
979
55
        rules.add(RS_S.rule().required());
980
55
        rules.add(RS_V.rule());
981
55
        rules.add(RS_PR.rule().required());
982
55
        rules.add(RS_W.rule());
983
55
        rules.add(RS_P.rule().args(2..));
984
55
        rules.add(UNRECOGNIZED.rule().may_repeat().obj_optional());
985
55
        rules
986
55
    });
987

            
988
/// Rules for parsing a single routerstatus in an NS consensus
989
2
static NS_ROUTERSTATUS_RULES_PLAIN: LazyLock<SectionRules<NetstatusKwd>> = LazyLock::new(|| {
990
    use NetstatusKwd::*;
991
2
    let mut rules = NS_ROUTERSTATUS_RULES_COMMON_.clone();
992
2
    rules.add(RS_R.rule().required().args(8..));
993
2
    rules.build()
994
2
});
995

            
996
/*
997
/// Rules for parsing a single routerstatus in a vote
998
static NS_ROUTERSTATUS_RULES_VOTE: SectionRules<NetstatusKwd> = {
999
    use NetstatusKwd::*;
        let mut rules = NS_ROUTERSTATUS_RULES_COMMON_.clone();
        rules.add(RS_R.rule().required().args(8..));
        rules.add(RS_M.rule().may_repeat().args(2..));
        rules.add(RS_ID.rule().may_repeat().args(2..)); // may-repeat?
        rules
    };
*/
/// Rules for parsing a single routerstatus in a microdesc consensus
55
static NS_ROUTERSTATUS_RULES_MDCON: LazyLock<SectionRules<NetstatusKwd>> = LazyLock::new(|| {
    use NetstatusKwd::*;
55
    let mut rules = NS_ROUTERSTATUS_RULES_COMMON_.clone();
55
    rules.add(RS_R.rule().required().args(6..));
55
    rules.add(RS_M.rule().required().args(1..));
55
    rules.build()
55
});
/// Rules for parsing consensus fields from a footer.
55
static NS_FOOTER_RULES: LazyLock<SectionRules<NetstatusKwd>> = LazyLock::new(|| {
    use NetstatusKwd::*;
55
    let mut rules = SectionRules::builder();
55
    rules.add(DIRECTORY_FOOTER.rule().required().no_args());
    // consensus only
55
    rules.add(BANDWIDTH_WEIGHTS.rule());
55
    rules.add(UNRECOGNIZED.rule().may_repeat().obj_optional());
55
    rules.build()
55
});
impl ProtoStatus {
    /// Construct a ProtoStatus from two chosen keywords in a section.
770
    fn from_section(
770
        sec: &Section<'_, NetstatusKwd>,
770
        recommend_token: NetstatusKwd,
770
        required_token: NetstatusKwd,
770
    ) -> Result<ProtoStatus> {
        /// Helper: extract a Protocols entry from an item's arguments.
1540
        fn parse(t: Option<&Item<'_, NetstatusKwd>>) -> Result<Protocols> {
1540
            if let Some(item) = t {
1540
                item.args_as_str()
1540
                    .parse::<Protocols>()
1540
                    .map_err(|e| EK::BadArgument.at_pos(item.pos()).with_source(e))
            } else {
                Ok(Protocols::new())
            }
1540
        }
770
        let recommended = parse(sec.get(recommend_token))?;
770
        let required = parse(sec.get(required_token))?;
770
        Ok(ProtoStatus {
770
            recommended,
770
            required,
770
        })
770
    }
    /// Return the protocols that are listed as "required" in this `ProtoStatus`.
    ///
    /// Implementations may assume that relays on the network implement all the
    /// protocols in the relays' required-protocols list.  Implementations should
    /// refuse to start if they do not implement all the protocols on their own
    /// (client or relay) required-protocols list.
159
    pub fn required_protocols(&self) -> &Protocols {
159
        &self.required
159
    }
    /// Return the protocols that are listed as "recommended" in this `ProtoStatus`.
    ///
    /// Implementations should warn if they do not implement all the protocols
    /// on their own (client or relay) recommended-protocols list.
    pub fn recommended_protocols(&self) -> &Protocols {
        &self.recommended
    }
}
impl<T> std::str::FromStr for NetParams<T>
where
    T: std::str::FromStr,
    T::Err: std::error::Error,
{
    type Err = Error;
16990
    fn from_str(s: &str) -> Result<Self> {
        /// Helper: parse a single K=V pair.
18024
        fn parse_pair<U>(p: &str) -> Result<(String, U)>
18024
        where
18024
            U: std::str::FromStr,
18024
            U::Err: std::error::Error,
        {
18024
            let parts: Vec<_> = p.splitn(2, '=').collect();
18024
            if parts.len() != 2 {
                return Err(EK::BadArgument
                    .at_pos(Pos::at(p))
                    .with_msg("Missing = in key=value list"));
18024
            }
18024
            let num = parts[1].parse::<U>().map_err(|e| {
8
                EK::BadArgument
8
                    .at_pos(Pos::at(parts[1]))
8
                    .with_msg(e.to_string())
8
            })?;
18016
            Ok((parts[0].to_string(), num))
18024
        }
16990
        let params = s
16990
            .split(' ')
30491
            .filter(|p| !p.is_empty())
16990
            .map(parse_pair)
16990
            .collect::<Result<HashMap<_, _>>>()?;
16982
        Ok(NetParams { params })
16990
    }
}
impl FromStr for SharedRandVal {
    type Err = Error;
4
    fn from_str(s: &str) -> Result<Self> {
4
        let val: B64 = s.parse()?;
4
        let val = SharedRandVal(val.into_array()?);
4
        Ok(val)
4
    }
}
impl Display for SharedRandVal {
    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
        Display::fmt(&B64::from(Vec::from(self.0)), f)
    }
}
impl NormalItemArgument for SharedRandVal {}
impl SharedRandStatus {
    /// Parse a current or previous shared rand value from a given
    /// SharedRandPreviousValue or SharedRandCurrentValue.
6
    fn from_item(item: &Item<'_, NetstatusKwd>) -> Result<Self> {
6
        match item.kwd() {
4
            NetstatusKwd::SHARED_RAND_PREVIOUS_VALUE | NetstatusKwd::SHARED_RAND_CURRENT_VALUE => {}
            _ => {
2
                return Err(Error::from(internal!(
2
                    "wrong keyword {:?} on shared-random value",
2
                    item.kwd()
2
                ))
2
                .at_pos(item.pos()));
            }
        }
4
        let n_reveals: u8 = item.parse_arg(0)?;
4
        let value: SharedRandVal = item.parse_arg(1)?;
        // Added in proposal 342
4
        let timestamp = item.parse_optional_arg::<Iso8601TimeNoSp>(2)?;
4
        Ok(SharedRandStatus {
4
            n_reveals,
4
            value,
4
            timestamp,
4
        })
6
    }
    /// Return the actual shared random value.
848
    pub fn value(&self) -> &SharedRandVal {
848
        &self.value
848
    }
    /// Return the timestamp (if any) associated with this `SharedRandValue`.
1590
    pub fn timestamp(&self) -> Option<std::time::SystemTime> {
1590
        self.timestamp.map(|t| t.0)
1590
    }
}
impl DirSource {
    /// Parse a "dir-source" item
1157
    fn from_item(item: &Item<'_, NetstatusKwd>) -> Result<Self> {
1157
        if item.kwd() != NetstatusKwd::DIR_SOURCE {
            return Err(
                Error::from(internal!("Bad keyword {:?} on dir-source", item.kwd()))
                    .at_pos(item.pos()),
            );
1157
        }
1157
        let nickname = item
1157
            .required_arg(0)?
1157
            .parse()
1157
            .map_err(|e: InvalidNickname| {
                EK::BadArgument.at_pos(item.pos()).with_msg(e.to_string())
            })?;
1157
        let identity = item.parse_arg(1)?;
1157
        let hostname = item
1157
            .required_arg(2)?
1157
            .parse()
1157
            .map_err(|e: InvalidInternetHost| {
                EK::BadArgument.at_pos(item.pos()).with_msg(e.to_string())
            })?;
1157
        let ip = item.parse_arg(3)?;
1157
        let dir_port = item.parse_arg(4)?;
1157
        let or_port = item.parse_arg(5)?;
1157
        Ok(DirSource {
1157
            nickname,
1157
            identity,
1157
            hostname,
1157
            ip,
1157
            dir_port,
1157
            or_port,
1157
            __non_exhaustive: (),
1157
        })
1157
    }
}
impl ConsensusAuthorityEntry {
    /// Parse a single ConsensusAuthorityEntry from a voter info section.
1157
    fn from_section(sec: &Section<'_, NetstatusKwd>) -> Result<ConsensusAuthorityEntry> {
        use NetstatusKwd::*;
        // this unwrap should be safe because if there is not at least one
        // token in the section, the section is unparsable.
        #[allow(clippy::unwrap_used)]
1157
        let first = sec.first_item().unwrap();
1157
        if first.kwd() != DIR_SOURCE {
            return Err(Error::from(internal!(
                "Wrong keyword {:?} at start of voter info",
                first.kwd()
            ))
            .at_pos(first.pos()));
1157
        }
1157
        let dir_source = DirSource::from_item(sec.required(DIR_SOURCE)?)?;
1157
        let contact = sec.required(CONTACT)?;
        // Ideally we would parse_args_as_str but that requires us to
        // impl From<InvalidContactInfo> for crate::Error which is wrong
        // because many it's a footgun which lets you just write ? here
        // resulting in lack of position information.
        // (This is a general problem with the error handling in crate::parse.)
1157
        let contact = contact
1157
            .args_as_str()
1157
            .parse()
1157
            .map_err(|err: InvalidContactInfo| {
                EK::BadArgument
                    .with_msg(err.to_string())
                    .at_pos(contact.pos())
            })?;
1157
        let vote_digest = sec.required(VOTE_DIGEST)?.parse_arg::<B16U>(0)?;
1157
        Ok(ConsensusAuthorityEntry {
1157
            dir_source,
1157
            contact,
1157
            vote_digest,
1157
            __non_exhaustive: (),
1157
        })
1157
    }
}
impl Default for RelayWeight {
2
    fn default() -> RelayWeight {
2
        RelayWeight::Unmeasured(0)
2
    }
}
impl RelayWeight {
    /// Parse a routerweight from a "w" line.
2088
    fn from_item(item: &Item<'_, NetstatusKwd>) -> Result<RelayWeight> {
2088
        if item.kwd() != NetstatusKwd::RS_W {
6
            return Err(
6
                Error::from(internal!("Wrong keyword {:?} on W line", item.kwd()))
6
                    .at_pos(item.pos()),
6
            );
2082
        }
2082
        let params = item.args_as_str().parse()?;
2080
        Self::from_net_params(&params).map_err(|e| e.at_pos(item.pos()))
2088
    }
    /// Parse a routerweight from partially-parsed `w` line in the form of a `NetParams`
    ///
    /// This function is the common part shared between `parse2` and `parse`.
2546
    fn from_net_params(params: &NetParams<u32>) -> Result<RelayWeight> {
2546
        let bw = params.params.get("Bandwidth");
2546
        let unmeas = params.params.get("Unmeasured");
2546
        let bw = match bw {
2
            None => return Ok(RelayWeight::Unmeasured(0)),
2544
            Some(b) => *b,
        };
2544
        match unmeas {
440
            None | Some(0) => Ok(RelayWeight::Measured(bw)),
2104
            Some(1) => Ok(RelayWeight::Unmeasured(bw)),
            _ => Err(EK::BadArgument.with_msg("unmeasured value")),
        }
2546
    }
}
/// `parse2` impls for types in this modulea
///
/// Separate module to save on repeated `cfg` and for a separate namespace.
#[cfg(feature = "parse2")]
mod parse2_impls {
    use super::*;
    pub(super) use parse2::{
        ArgumentError as AE, ArgumentStream, ErrorProblem as EP, ItemArgumentParseable,
        ItemValueParseable, NetdocParseableFields, UnparsedItem,
    };
    use std::result::Result;
    impl ItemValueParseable for NetParams<i32> {
        fn from_unparsed(item: parse2::UnparsedItem<'_>) -> Result<Self, EP> {
            item.check_no_object()?;
            item.args_copy()
                .into_remaining()
                .parse()
                .map_err(item.invalid_argument_handler("parameters"))
        }
    }
    impl ItemValueParseable for RelayWeight {
466
        fn from_unparsed(item: parse2::UnparsedItem<'_>) -> Result<Self, EP> {
466
            item.check_no_object()?;
466
            (|| {
466
                let params = item.args_copy().into_remaining().parse()?;
466
                Self::from_net_params(&params)
            })()
466
            .map_err(item.invalid_argument_handler("weights"))
466
        }
    }
    impl ItemValueParseable for rs::SoftwareVersion {
466
        fn from_unparsed(mut item: parse2::UnparsedItem<'_>) -> Result<Self, EP> {
466
            item.check_no_object()?;
466
            item.args_mut()
466
                .into_remaining()
466
                .parse()
466
                .map_err(item.invalid_argument_handler("version"))
466
        }
    }
    impl ItemArgumentParseable for IgnoredPublicationTimeSp {
452
        fn from_args(a: &mut ArgumentStream) -> Result<IgnoredPublicationTimeSp, AE> {
926
            let mut next_arg = || a.next().ok_or(AE::Missing);
452
            let _: &str = next_arg()?;
452
            let _: &str = next_arg()?;
452
            Ok(IgnoredPublicationTimeSp)
452
        }
    }
}
/// `encode` impls for types in this modulea
///
/// Separate module to save on repeated `cfg` and for a separate namespace.
#[cfg(feature = "encode")]
mod encode_impls {
    use super::*;
    use std::result::Result;
    pub(crate) use {
        crate::encode::{ItemEncoder, ItemValueEncodable, NetdocEncodableFields},
        tor_error::Bug,
    };
    impl ItemValueEncodable for NetParams<i32> {
8
        fn write_item_value_onto(&self, mut out: ItemEncoder) -> Result<(), Bug> {
8
            for (k, v) in self.iter().collect::<BTreeSet<_>>() {
8
                if k.is_empty()
6
                    || k.chars()
17
                        .any(|c| c.is_whitespace() || c.is_control() || c == '=')
                {
                    // TODO torspec#401 see TODO in NetParams<T> definition
8
                    return Err(bad_api_usage!(
8
                        "tried to encode NetParms with unreasonable keyword {k:?}"
8
                    ));
                }
                out.args_raw_string(&format_args!("{k}={v}"));
            }
            Ok(())
8
        }
    }
}
impl Footer {
    /// Parse a directory footer from a footer section.
377
    fn from_section(sec: &Section<'_, NetstatusKwd>) -> Result<Footer> {
        use NetstatusKwd::*;
377
        sec.required(DIRECTORY_FOOTER)?;
377
        let weights = sec
377
            .maybe(BANDWIDTH_WEIGHTS)
377
            .args_as_str()
377
            .unwrap_or("")
377
            .parse()?;
375
        Ok(Footer { weights })
377
    }
}
/// `ProtoStatuses` parsing and encoding
///
/// Separate module to save on repeated `cfg` to hide the helper struct
#[cfg(any(feature = "encode", feature = "parse2"))]
mod proto_statuses_parse2_encode {
    #[cfg(feature = "encode")]
    use super::encode_impls::*;
    #[cfg(feature = "parse2")]
    use super::parse2_impls::*;
    use super::*;
    use paste::paste;
    use std::result::Result;
    /// Implements `NetdocParseableFields` for `ProtoStatuses`
    ///
    /// We have this macro so that it's impossible to write things like
    /// ```text
    ///      ProtoStatuses {
    ///          client: ProtoStatus {
    ///              recommended: something something recommended_relay_versions something,
    /// ```
    ///
    /// (The structure of `ProtoStatuses` means the normal parse2 derive won't work for it.
    /// Note the bug above: the recommended *relay* version info is put in the *client* field.
    /// Preventing this bug must involve: avoiding writing twice the field name elements,
    /// such as `relay` and `client`, during this kind of construction/conversion.)
    macro_rules! impl_proto_statuses { { $( $rr:ident $cr:ident; )* } => { paste! {
        #[derive(Deftly)]
        #[derive_deftly(NetdocParseableFields)]
        #[cfg(feature = "parse2")]
        // Only ProtoStatusesParseNetdocParseAccumulator is exposed.
        #[allow(unreachable_pub)]
        pub struct ProtoStatusesParseHelper {
            $(
                #[deftly(netdoc(default))]
                [<$rr _ $cr _protocols>]: Protocols,
            )*
        }
        /// Partially parsed `ProtoStatuses`
        #[cfg(feature = "parse2")]
        pub use ProtoStatusesParseHelperNetdocParseAccumulator
            as ProtoStatusesNetdocParseAccumulator;
        #[cfg(feature = "parse2")]
        impl NetdocParseableFields for ProtoStatuses {
            type Accumulator = ProtoStatusesNetdocParseAccumulator;
            fn is_item_keyword(kw: KeywordRef<'_>) -> bool {
                ProtoStatusesParseHelper::is_item_keyword(kw)
            }
            fn accumulate_item(
                acc: &mut Self::Accumulator,
                item: UnparsedItem<'_>,
            ) -> Result<(), EP> {
                ProtoStatusesParseHelper::accumulate_item(acc, item)
            }
            fn finish(acc: Self::Accumulator) -> Result<Self, EP> {
                let parse = ProtoStatusesParseHelper::finish(acc)?;
                let mut out = ProtoStatuses::default();
                $(
                    out.$cr.$rr = parse.[< $rr _ $cr _protocols >];
                )*
                Ok(out)
            }
        }
        #[cfg(feature = "encode")]
        impl NetdocEncodableFields for ProtoStatuses {
            fn encode_fields(&self, out: &mut NetdocEncoder) -> Result<(), Bug> {
              $(
                self.$cr.$rr.write_item_value_onto(
                    out.item(stringify!([<$rr _ $cr _protocols>]))
                )?;
              )*
                Ok(())
            }
        }
    } } }
    impl_proto_statuses! {
        required client;
        required relay;
        recommended client;
        recommended relay;
    }
}
/// Result of checking a single authority signature.
enum SigCheckResult {
    /// The signature checks out.  Great!
    Valid,
    /// The signature is invalid; no additional information could make it
    /// valid.
    Invalid,
    /// We can't check the signature because we don't have a
    /// certificate with the right signing key.
    MissingCert,
}
impl Signature {
    /// Parse a Signature from a directory-signature section
1127
    fn from_item(item: &Item<'_, NetstatusKwd>) -> Result<Signature> {
1127
        if item.kwd() != NetstatusKwd::DIRECTORY_SIGNATURE {
            return Err(Error::from(internal!(
                "Wrong keyword {:?} for directory signature",
                item.kwd()
            ))
            .at_pos(item.pos()));
1127
        }
1127
        let (alg, id_fp, sk_fp) = if item.n_args() > 2 {
            (
1119
                item.required_arg(0)?,
1119
                item.required_arg(1)?,
1119
                item.required_arg(2)?,
            )
        } else {
8
            ("sha1", item.required_arg(0)?, item.required_arg(1)?)
        };
1127
        let digestname = alg.to_string();
1127
        let id_fingerprint = id_fp.parse::<Fingerprint>()?.into();
1127
        let sk_fingerprint = sk_fp.parse::<Fingerprint>()?.into();
1127
        let key_ids = AuthCertKeyIds {
1127
            id_fingerprint,
1127
            sk_fingerprint,
1127
        };
1127
        let signature = item.obj("SIGNATURE")?;
1127
        Ok(Signature {
1127
            digestname,
1127
            key_ids,
1127
            signature,
1127
        })
1127
    }
    /// Return true if this signature has the identity key and signing key
    /// that match a given cert.
799
    fn matches_cert(&self, cert: &AuthCert) -> bool {
799
        cert.key_ids() == self.key_ids
799
    }
    /// If possible, find the right certificate for checking this signature
    /// from among a slice of certificates.
1171
    fn find_cert<'a>(&self, certs: &'a [AuthCert]) -> Option<&'a AuthCert> {
1265
        certs.iter().find(|&c| self.matches_cert(c))
1171
    }
    /// Try to check whether this signature is a valid signature of a
    /// provided digest, given a slice of certificates that might contain
    /// its signing key.
179
    fn check_signature(&self, signed_digest: &[u8], certs: &[AuthCert]) -> SigCheckResult {
179
        match self.find_cert(certs) {
57
            None => SigCheckResult::MissingCert,
122
            Some(cert) => {
122
                let key = cert.signing_key();
122
                match key.verify(signed_digest, &self.signature[..]) {
122
                    Ok(()) => SigCheckResult::Valid,
                    Err(_) => SigCheckResult::Invalid,
                }
            }
        }
179
    }
}
impl SignatureGroup {
    // TODO: these functions are pretty similar and could probably stand to be
    // refactored a lot.
    /// Helper: Return a pair of the number of possible authorities'
    /// signatures in this object for which we _could_ find certs, and
    /// a list of the signatures we couldn't find certificates for.
330
    fn list_missing(&self, certs: &[AuthCert]) -> (usize, Vec<&Signature>) {
330
        let mut ok: HashSet<RsaIdentity> = HashSet::new();
330
        let mut missing = Vec::new();
992
        for sig in &self.signatures {
992
            let id_fingerprint = &sig.key_ids.id_fingerprint;
992
            if ok.contains(id_fingerprint) {
                continue;
992
            }
992
            if sig.find_cert(certs).is_some() {
183
                ok.insert(*id_fingerprint);
183
                continue;
809
            }
809
            missing.push(sig);
        }
330
        (ok.len(), missing)
330
    }
    /// Given a list of authority identity key fingerprints, return true if
    /// this signature group is _potentially_ well-signed according to those
    /// authorities.
275
    fn could_validate(&self, authorities: &[&RsaIdentity]) -> bool {
275
        let mut signed_by: HashSet<RsaIdentity> = HashSet::new();
829
        for sig in &self.signatures {
829
            let id_fp = &sig.key_ids.id_fingerprint;
829
            if signed_by.contains(id_fp) {
                // Already found this in the list.
                continue;
829
            }
829
            if authorities.contains(&id_fp) {
442
                signed_by.insert(*id_fp);
442
            }
        }
275
        signed_by.len() > (authorities.len() / 2)
275
    }
    /// Return true if the signature group defines a valid signature.
    ///
    /// A signature is valid if it signed by more than half of the
    /// authorities.  This API requires that `n_authorities` is the number of
    /// authorities we believe in, and that every cert in `certs` belongs
    /// to a real authority.
59
    fn validate(&self, n_authorities: usize, certs: &[AuthCert]) -> bool {
        // A set of the authorities (by identity) who have have signed
        // this document.  We use a set here in case `certs` has more
        // than one certificate for a single authority.
59
        let mut ok: HashSet<RsaIdentity> = HashSet::new();
179
        for sig in &self.signatures {
179
            let id_fingerprint = &sig.key_ids.id_fingerprint;
179
            if ok.contains(id_fingerprint) {
                // We already checked at least one signature using this
                // authority's identity fingerprint.
                continue;
179
            }
179
            let d: Option<&[u8]> = match sig.digestname.as_ref() {
188
                "sha256" => self.sha256.as_ref().map(|a| &a[..]),
12
                "sha1" => self.sha1.as_ref().map(|a| &a[..]),
                _ => None, // We don't know how to find this digest.
            };
179
            if d.is_none() {
                // We don't support this kind of digest for this kind
                // of document.
                continue;
179
            }
            // Unwrap should be safe because of above `d.is_none()` check
            #[allow(clippy::unwrap_used)]
179
            match sig.check_signature(d.as_ref().unwrap(), certs) {
122
                SigCheckResult::Valid => {
122
                    ok.insert(*id_fingerprint);
122
                }
57
                _ => continue,
            }
        }
59
        ok.len() > (n_authorities / 2)
59
    }
}
#[cfg(test)]
mod test {
    // @@ begin test lint list maintained by maint/add_warning @@
    #![allow(clippy::bool_assert_comparison)]
    #![allow(clippy::clone_on_copy)]
    #![allow(clippy::dbg_macro)]
    #![allow(clippy::mixed_attributes_style)]
    #![allow(clippy::print_stderr)]
    #![allow(clippy::print_stdout)]
    #![allow(clippy::single_char_pattern)]
    #![allow(clippy::unwrap_used)]
    #![allow(clippy::unchecked_time_subtraction)]
    #![allow(clippy::useless_vec)]
    #![allow(clippy::needless_pass_by_value)]
    //! <!-- @@ end test lint list maintained by maint/add_warning @@ -->
    use super::*;
    use hex_literal::hex;
    #[cfg(all(feature = "ns-vote", feature = "parse2"))]
    use {
        crate::parse2::{NetdocUnverified as _, ParseInput, parse_netdoc},
        std::fs,
    };
    const CERTS: &str = include_str!("../../testdata/authcerts2.txt");
    const CONSENSUS: &str = include_str!("../../testdata/mdconsensus1.txt");
    #[cfg(feature = "plain-consensus")]
    const PLAIN_CERTS: &str = include_str!("../../testdata2/cached-certs");
    #[cfg(feature = "plain-consensus")]
    const PLAIN_CONSENSUS: &str = include_str!("../../testdata2/cached-consensus");
    fn read_bad(fname: &str) -> String {
        use std::fs;
        use std::path::PathBuf;
        let mut path = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
        path.push("testdata");
        path.push("bad-mdconsensus");
        path.push(fname);
        fs::read_to_string(path).unwrap()
    }
    #[test]
    fn parse_and_validate_md() -> Result<()> {
        use std::net::SocketAddr;
        use tor_checkable::{SelfSigned, Timebound};
        let mut certs = Vec::new();
        for cert in AuthCert::parse_multiple(CERTS)? {
            let cert = cert?.check_signature()?.dangerously_assume_timely();
            certs.push(cert);
        }
        let auth_ids: Vec<_> = certs.iter().map(|c| c.id_fingerprint()).collect();
        assert_eq!(certs.len(), 3);
        let (_, _, consensus) = MdConsensus::parse(CONSENSUS)?;
        let consensus = consensus.dangerously_assume_timely().set_n_authorities(3);
        // The set of authorities we know _could_ validate this cert.
        assert!(consensus.authorities_are_correct(&auth_ids));
        // A subset would also work.
        assert!(consensus.authorities_are_correct(&auth_ids[0..1]));
        {
            // If we only believe in an authority that isn't listed,
            // that won't work.
            let bad_auth_id = (*b"xxxxxxxxxxxxxxxxxxxx").into();
            assert!(!consensus.authorities_are_correct(&[&bad_auth_id]));
        }
        let missing = consensus.key_is_correct(&[]).err().unwrap();
        assert_eq!(3, missing.len());
        assert!(consensus.key_is_correct(&certs).is_ok());
        let missing = consensus.key_is_correct(&certs[0..1]).err().unwrap();
        assert_eq!(2, missing.len());
        // here is a trick that had better not work.
        let same_three_times = vec![certs[0].clone(), certs[0].clone(), certs[0].clone()];
        let missing = consensus.key_is_correct(&same_three_times).err().unwrap();
        assert_eq!(2, missing.len());
        assert!(consensus.is_well_signed(&same_three_times).is_err());
        assert!(consensus.key_is_correct(&certs).is_ok());
        let consensus = consensus.check_signature(&certs)?;
        assert_eq!(6, consensus.relays().len());
        let r0 = &consensus.relays()[0];
        assert_eq!(
            r0.md_digest(),
            &hex!("73dabe0a0468f4f7a67810a18d11e36731bb1d2ec3634db459100609f3b3f535")
        );
        assert_eq!(
            r0.rsa_identity().as_bytes(),
            &hex!("0a3057af2910415794d8ea430309d9ac5f5d524b")
        );
        assert!(!r0.weight().is_measured());
        assert!(!r0.weight().is_nonzero());
        let pv = &r0.protovers();
        assert!(pv.supports_subver("HSDir", 2));
        assert!(!pv.supports_subver("HSDir", 3));
        let ip4 = "127.0.0.1:5002".parse::<SocketAddr>().unwrap();
        let ip6 = "[::1]:5002".parse::<SocketAddr>().unwrap();
        assert!(r0.addrs().any(|a| a == ip4));
        assert!(r0.addrs().any(|a| a == ip6));
        Ok(())
    }
    #[test]
    #[cfg(feature = "plain-consensus")]
    fn parse_and_validate_ns() -> Result<()> {
        use tor_checkable::{SelfSigned, Timebound};
        let mut certs = Vec::new();
        for cert in AuthCert::parse_multiple(PLAIN_CERTS)? {
            let cert = cert?.check_signature()?.dangerously_assume_timely();
            certs.push(cert);
        }
        let auth_ids: Vec<_> = certs.iter().map(|c| c.id_fingerprint()).collect();
        assert_eq!(certs.len(), 4);
        let (_, _, consensus) = PlainConsensus::parse(PLAIN_CONSENSUS)?;
        let consensus = consensus.dangerously_assume_timely().set_n_authorities(3);
        // The set of authorities we know _could_ validate this cert.
        assert!(consensus.authorities_are_correct(&auth_ids));
        // A subset would also work.
        assert!(consensus.authorities_are_correct(&auth_ids[0..1]));
        assert!(consensus.key_is_correct(&certs).is_ok());
        let _consensus = consensus.check_signature(&certs)?;
        Ok(())
    }
    #[test]
    #[cfg(all(feature = "plain-consensus", feature = "incomplete"))]
    fn parse2_vote() -> anyhow::Result<()> {
        let file = "testdata2/v3-status-votes--1";
        let text = fs::read_to_string(file)?;
        // TODO replace the poc struct here when we have parsing of proper whole votes
        use crate::parse2::poc::netstatus::NetworkStatusUnverifiedVote;
        let input = ParseInput::new(&text, file);
        let doc: NetworkStatusUnverifiedVote = parse_netdoc(&input)?;
        println!("{doc:?}");
        println!("{:#?}", doc.inspect_unverified().0.r[0]);
        Ok(())
    }
    #[test]
    fn test_bad() {
        use crate::Pos;
        fn check(fname: &str, e: &Error) {
            let content = read_bad(fname);
            let res = MdConsensus::parse(&content);
            assert!(res.is_err());
            assert_eq!(&res.err().unwrap(), e);
        }
        check(
            "bad-flags",
            &EK::BadArgument
                .at_pos(Pos::from_line(27, 1))
                .with_msg("Flags out of order"),
        );
        check(
            "bad-md-digest",
            &EK::BadArgument
                .at_pos(Pos::from_line(40, 3))
                .with_msg("Invalid base64"),
        );
        check(
            "bad-weight",
            &EK::BadArgument
                .at_pos(Pos::from_line(67, 141))
                .with_msg("invalid digit found in string"),
        );
        check(
            "bad-weights",
            &EK::BadArgument
                .at_pos(Pos::from_line(51, 13))
                .with_msg("invalid digit found in string"),
        );
        check(
            "wrong-order",
            &EK::WrongSortOrder.at_pos(Pos::from_line(52, 1)),
        );
        check(
            "wrong-start",
            &EK::UnexpectedToken
                .with_msg("vote-status")
                .at_pos(Pos::from_line(1, 1)),
        );
        check("wrong-version", &EK::BadDocumentVersion.with_msg("10"));
    }
    fn gettok(s: &str) -> Result<Item<'_, NetstatusKwd>> {
        let mut reader = NetDocReader::new(s)?;
        let tok = reader.next().unwrap();
        assert!(reader.next().is_none());
        tok
    }
    #[test]
    fn test_weight() {
        let w = gettok("w Unmeasured=1 Bandwidth=6\n").unwrap();
        let w = RelayWeight::from_item(&w).unwrap();
        assert!(!w.is_measured());
        assert!(w.is_nonzero());
        let w = gettok("w Bandwidth=10\n").unwrap();
        let w = RelayWeight::from_item(&w).unwrap();
        assert!(w.is_measured());
        assert!(w.is_nonzero());
        let w = RelayWeight::default();
        assert!(!w.is_measured());
        assert!(!w.is_nonzero());
        let w = gettok("w Mustelid=66 Cheato=7 Unmeasured=1\n").unwrap();
        let w = RelayWeight::from_item(&w).unwrap();
        assert!(!w.is_measured());
        assert!(!w.is_nonzero());
        let w = gettok("r foo\n").unwrap();
        let w = RelayWeight::from_item(&w);
        assert!(w.is_err());
        let w = gettok("r Bandwidth=6 Unmeasured=Frog\n").unwrap();
        let w = RelayWeight::from_item(&w);
        assert!(w.is_err());
        let w = gettok("r Bandwidth=6 Unmeasured=3\n").unwrap();
        let w = RelayWeight::from_item(&w);
        assert!(w.is_err());
    }
    #[test]
    fn test_netparam() {
        let p = "Hello=600 Goodbye=5 Fred=7"
            .parse::<NetParams<u32>>()
            .unwrap();
        assert_eq!(p.get("Hello"), Some(&600_u32));
        let p = "Hello=Goodbye=5 Fred=7".parse::<NetParams<u32>>();
        assert!(p.is_err());
        let p = "Hello=Goodbye Fred=7".parse::<NetParams<u32>>();
        assert!(p.is_err());
        #[cfg(feature = "encode")]
        {
            use crate::encode::{ItemValueEncodable, NetdocEncoder};
            for bad_kw in ["What=The", "", "\n", "\0"] {
                let p = [(bad_kw, 42)].into_iter().collect::<NetParams<i32>>();
                let mut d = NetdocEncoder::new();
                let d = (|| {
                    let i = d.item("bad-psrams");
                    p.write_item_value_onto(i)?;
                    d.finish()
                })();
                let _: tor_error::Bug = d.expect_err(bad_kw);
            }
        }
    }
    #[test]
    fn test_sharedrand() {
        let sr =
            gettok("shared-rand-previous-value 9 5LodY4yWxFhTKtxpV9wAgNA9N8flhUCH0NqQv1/05y4\n")
                .unwrap();
        let sr = SharedRandStatus::from_item(&sr).unwrap();
        assert_eq!(sr.n_reveals, 9);
        assert_eq!(
            sr.value.0,
            hex!("e4ba1d638c96c458532adc6957dc0080d03d37c7e5854087d0da90bf5ff4e72e")
        );
        assert!(sr.timestamp.is_none());
        let sr2 = gettok(
            "shared-rand-current-value 9 \
                    5LodY4yWxFhTKtxpV9wAgNA9N8flhUCH0NqQv1/05y4 2022-01-20T12:34:56\n",
        )
        .unwrap();
        let sr2 = SharedRandStatus::from_item(&sr2).unwrap();
        assert_eq!(sr2.n_reveals, sr.n_reveals);
        assert_eq!(sr2.value.0, sr.value.0);
        assert_eq!(
            sr2.timestamp.unwrap().0,
            humantime::parse_rfc3339("2022-01-20T12:34:56Z").unwrap()
        );
        let sr = gettok("foo bar\n").unwrap();
        let sr = SharedRandStatus::from_item(&sr);
        assert!(sr.is_err());
    }
    #[test]
    fn test_protostatus() {
        let my_protocols: Protocols = "Link=7 Cons=1-5 Desc=3-10".parse().unwrap();
        let outcome = ProtoStatus {
            recommended: "Link=7".parse().unwrap(),
            required: "Desc=5".parse().unwrap(),
        }
        .check_protocols(&my_protocols);
        assert!(outcome.is_ok());
        let outcome = ProtoStatus {
            recommended: "Microdesc=4 Link=7".parse().unwrap(),
            required: "Desc=5".parse().unwrap(),
        }
        .check_protocols(&my_protocols);
        assert_eq!(
            outcome,
            Err(ProtocolSupportError::MissingRecommended(
                "Microdesc=4".parse().unwrap()
            ))
        );
        let outcome = ProtoStatus {
            recommended: "Microdesc=4 Link=7".parse().unwrap(),
            required: "Desc=5 Cons=5-12 Wombat=15".parse().unwrap(),
        }
        .check_protocols(&my_protocols);
        assert_eq!(
            outcome,
            Err(ProtocolSupportError::MissingRequired(
                "Cons=6-12 Wombat=15".parse().unwrap()
            ))
        );
    }
    #[test]
    fn serialize_protostatus() {
        let ps = ProtoStatuses {
            client: ProtoStatus {
                recommended: "Link=1-5 LinkAuth=2-5".parse().unwrap(),
                required: "Link=5 LinkAuth=3".parse().unwrap(),
            },
            relay: ProtoStatus {
                recommended: "Wombat=20-30 Knish=20-30".parse().unwrap(),
                required: "Wombat=20-22 Knish=25-27".parse().unwrap(),
            },
        };
        let json = serde_json::to_string(&ps).unwrap();
        let ps2 = serde_json::from_str(json.as_str()).unwrap();
        assert_eq!(ps, ps2);
        let ps3: ProtoStatuses = serde_json::from_str(
            r#"{
            "client":{
                "required":"Link=5 LinkAuth=3",
                "recommended":"Link=1-5 LinkAuth=2-5"
            },
            "relay":{
                "required":"Wombat=20-22 Knish=25-27",
                "recommended":"Wombat=20-30 Knish=20-30"
            }
        }"#,
        )
        .unwrap();
        assert_eq!(ps, ps3);
    }
}