2 files changed, 22 insertions, 3 deletions
diff --git a/crates/tor-proto/src/client/reactor/circuit.rs b/crates/tor-proto/src/client/reactor/circuit.rs
index d49c500db..4d56524e5 100644
--- a/crates/tor-proto/src/client/reactor/circuit.rs
+++ b/crates/tor-proto/src/client/reactor/circuit.rs
@@ -29,6 +29,7 @@ use crate::crypto::handshake::ntor_v3::{NtorV3Client, NtorV3PublicKey};
 use crate::crypto::handshake::{ClientHandshake, KeyGenerator};
 use crate::memquota::{CircuitAccount, SpecificAccount as _, StreamAccount};
 use crate::stream::cmdcheck::{AnyCmdChecker, StreamStatus};
+use crate::stream::flow_ctrl::state::WithSidechannelMitigations;
 use crate::stream::msg_streamid;
 use crate::streammap;
 use crate::tunnel::TunnelScopedCircId;
@@ -746,7 +747,16 @@ impl Circuit {
         if let Some(msg) = res {
             cfg_if::cfg_if! {
                 if #[cfg(feature = "hs-service")] {
-                    return self.handle_incoming_stream_request(handlers, msg, streamid, hopnum, leg);
+                    return self.handle_incoming_stream_request(
+                        handlers,
+                        msg,
+                        streamid,
+                        hopnum,
+                        leg,
+                        // This is an onion service stream,
+                        // so we want sidechannel mitigations for flow control.
+                        WithSidechannelMitigations::Enabled,
+                    );
                 } else {
                     return Err(
                         Error::CircProto(format!("Cannot handle {} cells on this circuit", msg.cmd())),
@@ -846,6 +856,7 @@ impl Circuit {
         stream_id: StreamId,
         hop_num: HopNum,
         leg: UniqId,
+        with_sidechannel_mitigations: WithSidechannelMitigations,
     ) -> Result<Option<CircuitCmd>> {
         use tor_cell::relaycell::msg::EndReason;
         use tor_error::into_internal;
@@ -937,6 +948,7 @@ impl Circuit {
             self.chan_sender.time_provider(),
             stream_id,
             cmd_checker,
+            with_sidechannel_mitigations,
             &memquota,
         )?;
 
diff --git a/crates/tor-proto/src/client/reactor/circuit/circhop.rs b/crates/tor-proto/src/client/reactor/circuit/circhop.rs
index c2e27fe1d..0fd30eda9 100644
--- a/crates/tor-proto/src/client/reactor/circuit/circhop.rs
+++ b/crates/tor-proto/src/client/reactor/circuit/circhop.rs
@@ -9,6 +9,7 @@ use crate::congestion::CongestionControl;
 use crate::crypto::cell::HopNum;
 use crate::memquota::StreamAccount;
 use crate::stream::cmdcheck::AnyCmdChecker;
+use crate::stream::flow_ctrl::state::WithSidechannelMitigations;
 use crate::streammap::{self, StreamEntMut, StreamMap};
 use crate::tunnel::TunnelScopedCircId;
 use crate::util::tunnel_activity::TunnelActivity;
@@ -354,10 +355,16 @@ impl CircHop {
         time_prov: &DynTimeProvider,
         stream_id: StreamId,
         cmd_checker: AnyCmdChecker,
+        with_sidechannel_mitigations: WithSidechannelMitigations,
         memquota: &StreamAccount,
     ) -> Result<ReactorStreamComponents> {
-        self.outbound
-            .add_ent_with_id(time_prov, stream_id, cmd_checker, memquota)
+        self.outbound.add_ent_with_id(
+            time_prov,
+            stream_id,
+            cmd_checker,
+            with_sidechannel_mitigations,
+            memquota,
+        )
     }
 
     /// Note that we received an END message (or other message indicating the end of