BUG in purpose_needs_anonymity if switch not matched.

I believe that this should never trigger, but if it does, it
suggests that there was a gap between is_sensitive_dir_purpose and
purpose_needs_anonymity that we need to fill.  Related to 20077.

2 files changed, 12 insertions, 2 deletions

diff --git a/src/or/directory.c b/src/or/directory.c
index abe1372ec6..facd58849a 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -149,10 +149,17 @@ purpose_needs_anonymity(uint8_t dir_purpose, uint8_t router_purpose)
     case DIR_PURPOSE_FETCH_EXTRAINFO:
     case DIR_PURPOSE_FETCH_MICRODESC:
       return 0;
+    case DIR_PURPOSE_HAS_FETCHED_RENDDESC_V2:
+    case DIR_PURPOSE_UPLOAD_RENDDESC_V2:
+    case DIR_PURPOSE_FETCH_RENDDESC_V2:
+      return 1;
+    case DIR_PURPOSE_SERVER:
     default:
-      break;
+      log_warn(LD_BUG, "Called with dir_purpose=%d, router_purpose=%d",
+               dir_purpose, router_purpose);
+      tor_assert_nonfatal_unreached();
+      return 1; /* Assume it needs anonymity; better safe than sorry. */
   }
-  return 1;
 }
 
 /** Return a newly allocated string describing <b>auth</b>. Only describes
diff --git a/src/test/test_dir.c b/src/test/test_dir.c
index 0f6166d718..d9c565cc8a 100644
--- a/src/test/test_dir.c
+++ b/src/test/test_dir.c
@@ -3257,7 +3257,10 @@ test_dir_purpose_needs_anonymity_returns_true_by_default(void *arg)
 {
   (void)arg;
 
+  tor_capture_bugs_(1);
   tt_int_op(1, ==, purpose_needs_anonymity(0, 0));
+  tt_int_op(1, ==, smartlist_len(tor_get_captured_bug_log_()));
+  tor_end_capture_bugs_();
  done: ;
 }