[tor-bugs] #28970 [Core Tor/Tor]: tor_bug_occurred_(): Bug: ../src/or/hs_client.c:624: setup_intro_circ_auth_key: Non-fatal assertion

[Tor Bug Tracker & Wiki]

#28970: tor_bug_occurred_(): Bug: ../src/or/hs_client.c:624:
setup_intro_circ_auth_key: Non-fatal assertion
-------------------------------------------------+-------------------------
 Reporter:  torcrash                             |          Owner:  asn
     Type:  defect                               |         Status:
                                                 |  assigned
 Priority:  High                                 |      Milestone:  Tor:
                                                 |  0.4.0.x-final
Component:  Core Tor/Tor                         |        Version:  Tor:
                                                 |  0.3.4.9
 Severity:  Critical                             |     Resolution:
 Keywords:  tor-client, tor-hs, postfreeze-ok,   |  Actual Points:
  040-must                                       |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by asn):

 Thanks for the report.

 The second non-fatal assert seems reasonable given the lack of error-
 checking of `setup_intro_circ_auth_key()`, but that's not the actual bug.

 The actual bug is the lack of descriptor when setting up an intro circuit.
 Where did the descriptor go between launching the intro circuit and the
 intro circ opening?

 This could happen naturally given a very rare race condition: If we fetch
 a new consensus before the intro circuit opens (but after launching it)
 and we call `cache_clean_v3_as_client()` and the descriptor was old,
 perhaps it expires, gets cleaned and causes the bug.

 But I don't believe in very rare race conditions, so I'd take the bug
 explanation more easily. However, to debug such a bug we would need info
 logs. Can someone reproduce this or submit info logs for this?

 Thank you very much! :)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/28970#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online