Make pending libevent actions cancelable

This avoids a dangling pointer issue in the 3412 code, and should
fix bug 4599.

2 files changed, 23 insertions, 4 deletions

diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index e868b7b78d..246b08ad77 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -492,6 +492,9 @@ connection_or_about_to_close(or_connection_t *or_conn)
   time_t now = time(NULL);
   connection_t *conn = TO_CONN(or_conn);
 
+  if (or_conn->pending_action)
+    tor_cancel_libevent_action(or_conn->pending_action);
+
   /* Remember why we're closing this connection. */
   if (conn->state != OR_CONN_STATE_OPEN) {
     /* Inform any pending (not attached) circs that they should
@@ -1153,20 +1156,34 @@ connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn)
   }
 }
 
-/** Invoked on the server side using a timer from inside
- * tor_tls_got_client_hello() when the server receives excess
- * renegotiation attempts; probably indicating a DoS. */
+/*DOCDOC*/
 static void
-connection_or_close_connection_cb(void *_conn)
+close_connection_libevent_cb(void *_conn)
 {
   or_connection_t *or_conn = _conn;
   connection_t *conn = TO_CONN(or_conn);
 
+  or_conn->pending_action = NULL;
+
   connection_stop_reading(conn);
   if (!conn->marked_for_close)
     connection_mark_for_close(conn);
 }
 
+/* DOCDOC */
+static void
+connection_or_close_connection_cb(void *_conn)
+{
+  /* We can't close their connection from in here since it's an OpenSSL
+     callback, so we set a libevent event that triggers in the next event
+     loop and closes the connection. */
+  or_connection_t *or_conn = _conn;
+  if (or_conn->_base.marked_for_close || or_conn->pending_action)
+    return;
+  or_conn->pending_action =
+    tor_run_in_libevent_loop(close_connection_libevent_cb, or_conn);
+}
+
 /** Move forward with the tls handshake. If it finishes, hand
  * <b>conn</b> to connection_tls_finish_handshake().
  *
diff --git a/src/or/or.h b/src/or/or.h
index 546fe17bf3..185d20d429 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -1272,6 +1272,8 @@ typedef struct or_connection_t {
   unsigned active_circuit_pqueue_last_recalibrated;
   struct or_connection_t *next_with_same_id; /**< Next connection with same
                                               * identity digest as this one. */
+
+  tor_libevent_action_t *pending_action;
 } or_connection_t;
 
 /** Subtype of connection_t for an "edge connection" -- that is, an entry (ap)