URGENT: patch needed ASAP for authority bug

[Scott Bennett]

     I believe I spotted an authority bug with pretty severe consequences
this a.m.  It is having seriously bad effect on the star heavyweight node
of the tor network, Olaf Selke's blutmagie.  I can't submit a PR for it
due to the flyspray web page's problems with letting me log in, and Olaf
wrote me that he's at work at the moment and can't submit a PR until he
gets home after work.  So please read on, and if someone would please
submit an urgent PR for this, we (and probably others) would appreciate it.
If you do, please shoot a note off to Olaf <olaf.selke at blutmagie.de> to
let him know about it, so he won't submit a duplicate PR.  I don't think
a fix for this one should wait for the next release.  Instead, patches for
both "stable" and "alpha" branches should be made available to authority
operators as soon as someone can come up with them.  (Only the authorities
need to be fixed right away because the bug is somewhere in the authority
code for generating consensus entries.)
     Here's what I found.  blutmagie's torrc is set up for a target
throughput rate of 18000 KB/s and a maximum burst rate of 24000 KB/s.
Olaf noticed that blutmagie was being swamped by a horrendous load of
incoming connections nearly all the time, so he tried using
MaxAdvertisedBandwidth to reduce the frequency of inbound connections.
He repeatedly lowered the maximum advertised rate, and blutmagie's
descriptor correctly reflects that, now showing a target rate of 2000 KB/s,
but the connection rate showed no apparent change.  He recently began
reporting this trouble on OR-TALK, IIRC, but no one seemed to know why the
limit on the advertised target rate, even when set so low compared to the
actual rate and also compared to the rates published by other heavyweight
nodes, why the advertised rate didn't reduce the load.
     The problem lies in the consensus document, where it shows (or did
an hour or so ago),

w Bandwidth=27900

Note that 27900 KB/s is considerably higher than the maximum burst rate
in the descriptor and is 13.95 times the supposed maximum advertised rate.
That means that, while old client versions that use the values in the
descriptors in their route selection process will probably honor the maximum
advertised rate of 2000 KB/s, newer clients use the rate in the consensus,
27900 KB/s, in theirs, thus continuing to drown blutmagie in an ongoing
flood of incoming connections.
     The authorities are currently disregarding the limit published in every
node's descriptor and instead are conjuring up their own numbers.  This needs
to stop and right away.


                                  Scott Bennett, Comm. ASMELG, CFIAG
**********************************************************************
* Internet:       bennett at cs.niu.edu                              *
*--------------------------------------------------------------------*
* "A well regulated and disciplined militia, is at all times a good  *
* objection to the introduction of that bane of all free governments *
* -- a standing army."                                               *
*    -- Gov. John Hancock, New York Journal, 28 January 1790         *
**********************************************************************