[tor-bugs] #23712 [Core Tor/Tor]: sched: DESTROY cell on a circuit bypasses the scheduler

[Tor Bug Tracker & Wiki]

#23712: sched: DESTROY cell on a circuit bypasses the scheduler
-------------------------------------------------+-------------------------
 Reporter:  dgoulet                              |          Owner:  (none)
     Type:  defect                               |         Status:
                                                 |  assigned
 Priority:  Medium                               |      Milestone:  Tor:
                                                 |  unspecified
Component:  Core Tor/Tor                         |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tor-sched, 034-triage-20180328,      |  Actual Points:
  034-removed-20180328                           |
Parent ID:  #23993                               |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by dgoulet):

 Reviving this. Things have changed since the initial report 2 years ago.
 But things are still not good:

 1. `circuitmux_append_destroy_cell()` only triggers a flush with
 `channel_flush_from_first_active_circuit` if the channel has no queued
 writes which translates to "Do we have data in the outbuf?".

  This is wrong. Lets assume we do have data in the outbuf, then the flush
 is not triggered but then it means the channel has to become active to be
 considered for a flush. And the only way this can happen is if at least
 one cell is put on it.

  Which means that a `DESTROY` cell can stay in the queue of the channel
 for an arbitrary amount of time without being sent.

 2. The second problem is that calling
 `channel_flush_from_first_active_circuit()` does _not_ guarantee that the
 `DESTROY` cell is sent.

 So `circuitmux_append_destroy_cell()` is really not doing the right thing
 in many ways.

 == Solution ==

 I think the initial branch has it correct `bug23712_032_01` that is we
 simply need to callback the scheduler telling it that the channel has
 waiting cells and be done.

 The comment:13 I believe is refers to the fact that it won't fix the full
 priority problem for relay cells vs destroy cells but should fix the issue
 of lingering `DESTROY` cells.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23712#comment:20>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online