[tor-bugs] #1184 [Tor Client]: Sending useless relay cells after the destroy cell

[Tor Bug Tracker & Wiki]

#1184: Sending useless relay cells after the destroy cell
--------------------------------+-------------------------------------------
 Reporter:  arma                |         Type:  defect    
   Status:  needs_review        |     Priority:  minor     
Milestone:  Tor: 0.2.2.x-final  |    Component:  Tor Client
  Version:  0.2.2.6-alpha       |   Resolution:  None      
 Keywords:                      |       Parent:            
--------------------------------+-------------------------------------------

Comment(by arma):

 Geez. I just tried to go answer the question "is it the case that when we
 try to move a cell from circ's cell queue onto the outbuf, we notice that
 circ->n_conn is null and choose not to send the cell", which moved to
 "where the heck do we move cells from the circ cell queue onto the outbuf
 other than connection_or_flush_from_first_active_circuit() which seems to
 only move one cell and then stop", which moved to "are there any cases
 where an inactive circuit moves cells to the outbuf" (I think no), which
 moved to "at what point in closing a circuit do we clear its cell queue"
 (I guess when we're freeing it and not before).

 Then I noticed in connection_edge_process_relay_cell() that we call
 {{{
 circuit_set_n_circid_orconn(circ, 0, NULL);
 }}}
 after the destroy cell (sounds good), but now I'm wondering why we don't
 call that from the two cases in _circuit_mark_for_close() that send
 destroy cells. Is it because in those two cases the circuit is going to
 get marked, which is just as good as setting its n_circid and n_conn to
 0,null, for some reason I haven't found yet?

 What a mess. :/

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/1184#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online