hs: Remove intro point expiring node if no circuit

Once a second, we go over all services and consider the validity of the intro
points. Now, also try to remove expiring nodes that have no more circuit
associated to them. This is possible if we moved an intro point object
previously to that list and the circuit actually timed out or was closed by
the introduction point itself.

Signed-off-by: David Goulet <dgoulet@torproject.org>

changes/bug21302

@@ -0,0 +1,8 @@
+  o Minor bugfixes (hidden service):
+    - Two possible underflow which would ultimately lead to creating a lot of
+      introduction points circuits and closing them in a non stop loop. Fixes
+      bug 21302; bugfix on tor-0.2.7.2-alpha.
+    - Cleanup expiring intro point nodes if no circuit is associated to it
+      anymore. It was causing, rarely, the service to not open enough
+      introduction points circuit in the case we had dead expiring nodes.;
+      bugfix on tor-0.2.7.2-alpha.

src/or/rendservice.c

@@ -3907,6 +3907,19 @@ remove_invalid_intro_points(rend_service_t *service,
 {
   tor_assert(service);
 
+  /* Remove any expired nodes that doesn't have a circuit. */
+  SMARTLIST_FOREACH_BEGIN(service->expiring_nodes, rend_intro_point_t *,
+                          intro) {
+    origin_circuit_t *intro_circ =
+      find_intro_circuit(intro, service->pk_digest);
+    if (intro_circ) {
+      continue;
+    }
+    /* No more circuit, cleanup the into point object. */
+    SMARTLIST_DEL_CURRENT(service->expiring_nodes, intro);
+    rend_intro_point_free(intro);
+  } SMARTLIST_FOREACH_END(intro);
+
   SMARTLIST_FOREACH_BEGIN(service->intro_nodes, rend_intro_point_t *,
                           intro) {
     /* Find the introduction point node object. */