daemon/tls, daemon/worker: fix rehandshake processing

diff --git a/NEWS b/NEWS
index b1ac3024805a18c97f79c2a6d61863e837c5cf46..dcd94a1686472111d56aa428ef2cecc41f0173ac 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,7 @@ Bugfixes
 --------
 - http module: only run prometheus in parent process if using --forks=N,
   as the submodule collects metrics from all sub-processes as well.
+- policy.TLS_FORWARD fixes (!714)
 - fix build with -DNOVERBOSELOG (#424)
 
 Improvements

diff --git a/daemon/tls.c b/daemon/tls.c
index 008eb042707579fcc3d15054c66cb9bd80a0add5..3a3863981f433879d1753a3aa0389f9da85fe58f 100644 (file)
--- a/daemon/tls.c
+++ b/daemon/tls.c
@@ -482,6 +482,9 @@ ssize_t tls_process_input_data(struct session *s, const uint8_t *buf, ssize_t nr
                        continue;
                } else if (count == GNUTLS_E_REHANDSHAKE) {
                        /* See https://www.gnutls.org/manual/html_node/Re_002dauthentication.html */
+                       struct sockaddr *peer = session_get_peer(s);
+                       kr_log_verbose("[%s] TLS rehandshake with %s has started\n",
+                                      logstring,  kr_straddr(peer));
                        tls_set_hs_state(tls_p, TLS_HS_IN_PROGRESS);
                        while (tls_p->handshake_state <= TLS_HS_IN_PROGRESS) {
                                int err = tls_handshake(tls_p, tls_p->handshake_cb);

diff --git a/daemon/worker.c b/daemon/worker.c
index cc7f9b07cc78d571fdbe666dd7d4241dd184e12a..aafcf9027c14da0f94dd8707eaffc4e86bda8450 100644 (file)
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -713,8 +713,19 @@ static int session_tls_hs_cb(struct session *session, int status)
                }
        }
 
-       ret = worker_add_tcp_connected(worker, peer, session);
-       if (deletion_res == kr_ok() && ret == kr_ok()) {
+       ret = kr_ok();
+       if (deletion_res == kr_ok()) {
+               /* peer was in the waiting list, add to the connected list. */
+               ret = worker_add_tcp_connected(worker, peer, session);
+       } else {
+               /* peer wasn't in the waiting list.
+                * In this case it must be successful rehandshake.
+                * Peer must be already in the connected list. */
+               const char *key = tcpsess_key(peer);
+               assert(key);
+               assert(map_contains(&worker->tcp_connected, key) != 0);
+       }
+       if (ret == kr_ok()) {
                while (!session_waitinglist_is_empty(session)) {
                        struct qr_task *t = session_waitinglist_get(session);
                        ret = qr_task_send(t, session, NULL, NULL);