hs: Do not allow more than one control cell on a circuit
This is the list of HS control cell that is they are all for establishing a circuit or/and "connection" between HS entities (IP, RP, Service, client):
RELAY_COMMAND_ESTABLISH_INTRO: RELAY_COMMAND_ESTABLISH_RENDEZVOUS: RELAY_COMMAND_INTRODUCE1: RELAY_COMMAND_INTRODUCE2: RELAY_COMMAND_INTRODUCE_ACK: RELAY_COMMAND_INTRO_ESTABLISHED: RELAY_COMMAND_RENDEZVOUS1: RELAY_COMMAND_RENDEZVOUS2: RELAY_COMMAND_RENDEZVOUS_ESTABLISHED:
It appears that anyone can send an arbitrary amount of those cells on the same circuit. Even to the point that tor allows a rendezvous circuit to become an intro circuit.
The only special one is
INTRODUCE2 which is by-design are sent a lot on the same circuit.
The only cell currently limited to 1 cell is
INTRODUCE1 since we do not allow multiple introductions on the same client circuit for DoS reasons.
But the rest should only be seen once on a circuit. Lets restrict them and if we see more, then we close the circuit due to a protocol error. This would limit side-channels.