[tor-bugs] #23429 [Core Tor/Tor]: hs: assert on rend_data when pruning the v2 service list

[Tor Bug Tracker & Wiki]

#23429: hs: assert on rend_data when pruning the v2 service list
------------------------------+--------------------------------
     Reporter:  dgoulet       |      Owner:  dgoulet
         Type:  defect        |     Status:  assigned
     Priority:  Very High     |  Milestone:  Tor: 0.3.2.x-final
    Component:  Core Tor/Tor  |    Version:
     Severity:  Normal        |   Keywords:  tor-hs, prop224
Actual Points:                |  Parent ID:
       Points:                |   Reviewer:
      Sponsor:                |
------------------------------+--------------------------------
 Reported by ahf:

 {{{
 Sep 07 18:02:40.000 [err] tor_assertion_failed_(): Bug:
 src/or/rendservice.c:561: rend_service_prune_list_impl_: Assertion
 ocirc->rend_data failed; aborting. (on Tor 0.3.2.0-alpha-dev
 acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug: Assertion ocirc->rend_data failed in
 rend_service_prune_list_impl_ at src/or/rendservice.c:561. Stack trace:
 (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     ./bin/tor(log_backtrace+0x42)
 [0x7fa7d0ad0f52] (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     ./bin/tor(tor_assertion_failed_+0x94)
 [0x7fa7d0aeb594] (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:
 ./bin/tor(rend_service_prune_list+0x32f) [0x7fa7d09da46f] (on Tor 0.3.2.0
 -alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     ./bin/tor(hs_config_service_all+0x87c)
 [0x7fa7d0ab583c] (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     ./bin/tor(set_options+0x16ca)
 [0x7fa7d0a4b98a] (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:
 ./bin/tor(options_init_from_string+0x3e0) [0x7fa7d0a4cb40] (on Tor 0.3.2.0
 -alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:
 ./bin/tor(options_init_from_torrc+0x1e2) [0x7fa7d0a4cde2] (on Tor 0.3.2.0
 -alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     ./bin/tor(+0x51c79) [0x7fa7d09a9c79]
 (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     /usr/lib/x86_64-linux-
 gnu/libevent-2.0.so.5(event_base_loop+0xa7b) [0x7fa7cffde24b] (on Tor
 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     ./bin/tor(do_main_loop+0x24d)
 [0x7fa7d09a841d] (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     ./bin/tor(tor_main+0x1c25)
 [0x7fa7d09abbb5] (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     ./bin/tor(main+0x19) [0x7fa7d09a3d59]
 (on Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug:     /lib/x86_64-linux-
 gnu/libc.so.6(__libc_start_main+0xf5) [0x7fa7cf3cff45] (on Tor 0.3.2.0
 -alpha-dev acfdc4afc126ba23)
 Sep 07 18:02:40.000 [err] Bug: ./bin/tor(+0x4bdab) [0x7fa7d09a3dab] (on
 Tor 0.3.2.0-alpha-dev acfdc4afc126ba23)
 }}}

 The reason is because we iterate over intro circuit in the pruning process
 so we can remove any intro circuit for a service that has been removed.
 However, by doing so we were asserting on `rend_data` but now we have
 `hs_ident` for v3 services.

 Another occurrence of this can be found in `rend_service_del_ephemeral()`
 which also iterates over all circuits...

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23429>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online