Allow intro points to expire somewhat gracefully

The Right Way to expire an intro point is to establish a new one to
replace it, publish a new descriptor that doesn't list any expiring intro
points, and *then*, once our upload attempts for the new descriptor have
ended (whether in success or failure), close the expiring intro points.

Unfortunately, we can't find out when the new descriptor has actually been
uploaded, so we'll have to settle for a five-minute timer.

There should be no significant behaviour changes due to this commit (only
a log-message change or two), despite the rather massive overhaul, so this
commit doesn't include a changes/ file.  (The commit that teaches
intro_point_should_expire_now to return non-zero gets a changes/ file,
though.)

1 files changed, 10 insertions, 0 deletions

diff --git a/src/or/or.h b/src/or/or.h
index e1bd25c738..9e4cd89cf1 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -3493,6 +3493,16 @@ typedef struct rend_intro_point_t {
    * published, or -1 if this intro point has not yet been
    * published. */
   time_t time_published;
+
+  /** (Service side only) The time at which we decided that this intro
+   * point should start expiring, or -1 if this intro point is not yet
+   * expiring.
+   *
+   * This field also serves as a flag to indicate that we have decided
+   * to expire this intro point, in case intro_point_should_expire_now
+   * flaps (perhaps due to a clock jump; perhaps due to other
+   * weirdness, or even a (present or future) bug). */
+  time_t time_expiring;
 } rend_intro_point_t;
 
 /** Information used to connect to a hidden service.  Used on both the