I can send (almost) any cell I want before the VERSIONS or NETINFO cell
While debugging legacy/trac#4368 (moved) I noticed that I can send a CREATE cell right out of the gate after the v2 handshake finishes, when the other side is expecting a VERSIONS cell or (later) a NETINFO cell. My cell will be quietly dropped with (by default) a log_info message.
Similarly, I can send CREATE cells interspersed in the VERSIONS / CERTS / NETINFO cells in the v3 handshake, with no complaints louder than info.
But the spec says things like
No other intervening cell types are allowed.
When this handshake is in use, the first cell must still be VERSIONS, and no other cell type is allowed to intervene besides those specified, except for PADDING and VPADDING cells.
If this is a feature, meaning we're trying to be forgiving about arbitrary future behavior, we should make it clearer in the spec.
If it's a bug, we should think about how thoroughly to fix it.
I think at least some part of this is a bug, for example because we don't call or_handshake_state_record_cell() on the CREATE cells in the v3 handshake case since we drop them first.