GitLab

In can_relaunch_service_rendezvous_point() we check

  if (circ->build_state->failure_count > MAX_REND_FAILURES ||
      circ->build_state->expiry_time <= time(NULL)) {

for whether to abort the relaunch.

But in retry_service_rendezvous_point(), we do this:

  /* Transfer build state information to the new circuit state in part to
   * catch any other failures. */
  new_circ->build_state->failure_count = bstate->failure_count++;

That ++ increments the failure_count for the old circuit, which means the new circuit gets a failure_count of 0. No new circuits ever have a failure count of anything other than 0.

The legacy onion services handle it better, by doing

  newstate->failure_count = oldstate->failure_count+1;