Bug 40827: Add additional logs and checks for 0-leg conflux case

2 files changed, 37 insertions, 4 deletions

diff --git a/src/core/or/conflux.c b/src/core/or/conflux.c
index c979077e1f..eb004b3626 100644
--- a/src/core/or/conflux.c
+++ b/src/core/or/conflux.c
@@ -536,7 +536,7 @@ conflux_note_cell_sent(conflux_t *cfx, circuit_t *circ, uint8_t relay_command)
 
 /** Find the leg with lowest non-zero curr_rtt_usec, and
  * pick it for our current leg. */
-static inline void
+static inline bool
 conflux_pick_first_leg(conflux_t *cfx)
 {
   conflux_leg_t *min_leg = NULL;
@@ -555,8 +555,20 @@ conflux_pick_first_leg(conflux_t *cfx)
   } CONFLUX_FOR_EACH_LEG_END(leg);
 
   if (!min_leg) {
-    // Get the 0th leg; if it does not exist, assert
-    tor_assert(smartlist_len(cfx->legs) > 0);
+    // Get the 0th leg; if it does not exist, log the set.
+    // Bug 40827 managed to hit this, so let's dump the sets
+    // in case it happens again.
+    if (BUG(smartlist_len(cfx->legs) <= 0)) {
+      // Since we have no legs, we have no idea if this is really a client
+      // or server set. Try to find any that match:
+      log_warn(LD_BUG, "Matching client sets:");
+      conflux_log_set(cfx, true);
+      log_warn(LD_BUG, "Matching server sets:");
+      conflux_log_set(cfx, false);
+      log_warn(LD_BUG, "End conflux set dump");
+      return false;
+    }
+
     min_leg = smartlist_get(cfx->legs, 0);
     tor_assert(min_leg);
     if (BUG(min_leg->linked_sent_usec == 0)) {
@@ -572,6 +584,8 @@ conflux_pick_first_leg(conflux_t *cfx)
   cfx->cells_until_switch = 0;
 
   cfx->curr_leg = min_leg;
+
+  return true;
 }
 
 /**
@@ -589,7 +603,8 @@ conflux_decide_next_circ(conflux_t *cfx)
   /* If we don't have a current leg yet, pick one.
    * (This is the only non-const operation in this function). */
   if (!cfx->curr_leg) {
-    conflux_pick_first_leg(cfx);
+    if (!conflux_pick_first_leg(cfx))
+      return NULL;
   }
 
   /* First, check if we can switch. */
diff --git a/src/core/or/relay.c b/src/core/or/relay.c
index 2c722f01cc..01e07ee82b 100644
--- a/src/core/or/relay.c
+++ b/src/core/or/relay.c
@@ -2352,6 +2352,24 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial,
     return -1;
   }
 
+  // Bug 40827: With conflux, we suspect marked circuits were getting here.
+  // We think we fixed it, but let's add a check and log sets if it still
+  // happens.
+  if (BUG(circ->marked_for_close)) {
+    log_warn(LD_BUG,
+             "called on circ that's already marked for close at %s:%d.",
+             circ->marked_for_close_file, circ->marked_for_close);
+    if (CIRCUIT_IS_CONFLUX(circ)) {
+      if (circ->conflux) {
+        conflux_log_set(circ->conflux, CIRCUIT_IS_ORIGIN(circ));
+      } else {
+        log_warn(LD_BUG, "  - circ is unlinked conflux");
+      }
+    }
+    conn->end_reason = END_STREAM_REASON_INTERNAL;
+    return -1;
+  }
+
   if (circuit_consider_stop_edge_reading(circ, cpath_layer))
     return 0;