server: purge sessticket_pool on server reload if creds changed

diff --git a/distro/pkg/deb/libknot15.symbols b/distro/pkg/deb/libknot15.symbols
index 0c7250b5500904e1249ed863bc155607b2b31840..78853bbd75c4cf3f737f1e5a9f8b0fd5d61dc337 100644 (file)
--- a/distro/pkg/deb/libknot15.symbols
+++ b/distro/pkg/deb/libknot15.symbols
@@ -10,6 +10,7 @@ libknot.so.15 libknot15 #MINVER#
  KNOT_DUMP_STYLE_DEFAULT@Base 3.4.0
  knot_creds_cert@Base 3.4.0
  knot_creds_free@Base 3.4.0
+ knot_creds_hash@Base 3.5.0
  knot_creds_init@Base 3.4.0
  knot_creds_init_peer@Base 3.4.0
  knot_creds_update@Base 3.4.0

diff --git a/src/contrib/conn_pool.c b/src/contrib/conn_pool.c
index 76eb4978368cdce80800e3e4a6f858d3f18f525e..2cc4e397e411f742a57a0f31f8f3b68a1ac49420 100644 (file)
--- a/src/contrib/conn_pool.c
+++ b/src/contrib/conn_pool.c
@@ -112,18 +112,23 @@ conn_pool_t *conn_pool_init(size_t capacity, knot_timediff_t timeout,
        return pool;
 }
 
-void conn_pool_deinit(conn_pool_t *pool)
+void conn_pool_purge(conn_pool_t *pool)
 {
        if (pool != NULL) {
-               pthread_cancel(pool->closing_thread);
-               pthread_join(pool->closing_thread, NULL);
-
                conn_pool_fd_t fd;
                knot_time_t unused;
                while ((fd = get_old(pool, 0, &unused)) != CONN_POOL_FD_INVALID) {
                        pool->close_cb(fd);
                }
+       }
+}
 
+void conn_pool_deinit(conn_pool_t *pool)
+{
+       if (pool != NULL) {
+               pthread_cancel(pool->closing_thread);
+               pthread_join(pool->closing_thread, NULL);
+               conn_pool_purge(pool);
                pthread_mutex_destroy(&pool->mutex);
                free(pool);
        }

diff --git a/src/contrib/conn_pool.h b/src/contrib/conn_pool.h
index 7f815e1d89f7ad83e22132aad46d1fea452a2e82..3d81f4b520a87918edd87bcde88d4dffa10f0f09 100644 (file)
--- a/src/contrib/conn_pool.h
+++ b/src/contrib/conn_pool.h
@@ -52,6 +52,13 @@ conn_pool_t *conn_pool_init(size_t capacity, knot_timediff_t timeout,
                             conn_pool_close_cb_t close_cb,
                             conn_pool_invalid_cb_t invalid_cb);
 
+/*!
+ * \brief Purges the pool.
+ *
+ * \param pool  Connection pool.
+ */
+void conn_pool_purge(conn_pool_t *pool);
+
 /*!
  * \brief Deallocate the pool, close all connections, terminate closing thread.
  *

diff --git a/src/knot/server/server.c b/src/knot/server/server.c
index 6b77777f714cffa977ad2062d388d604f4b6a07c..68e39bbae726f85f9d430b27a238d163b6848d24 100644 (file)
--- a/src/knot/server/server.c
+++ b/src/knot/server/server.c
@@ -1509,6 +1509,13 @@ static int reconfigure_remote_pool(conf_t *conf, server_t *server)
                        }
                        global_sessticket_pool = new_pool;
                }
+       } else if (server->quic_creds != NULL) {
+               static uint64_t hash = 0;
+               uint64_t curr_hash = knot_creds_hash(server->quic_creds);
+               if (hash != curr_hash) {
+                       conn_pool_purge(global_sessticket_pool);
+               }
+               hash = curr_hash;
        }
 
        val = conf_get(conf, C_SRV, C_RMT_RETRY_DELAY);

diff --git a/src/libknot/quic/tls_common.c b/src/libknot/quic/tls_common.c
index 8bf9872e46910d902276489c315fe238e20d8565..65cab40cc7ae77e2e6536b189d8c7fca82ed1779 100644 (file)
--- a/src/libknot/quic/tls_common.c
+++ b/src/libknot/quic/tls_common.c
@@ -603,3 +603,9 @@ int knot_tls_cert_check(struct gnutls_session_int *session,
 {
        return knot_tls_cert_check_hostnames(session, creds->peer_hostnames);
 }
+
+_public_
+uint64_t knot_creds_hash(struct knot_creds *creds)
+{
+       return creds->creds_hash;
+}

diff --git a/src/libknot/quic/tls_common.h b/src/libknot/quic/tls_common.h
index 77668d3032893e1a50bd2b71165f874f3e887c60..783bda04652698f3f421e25e86db08e3b3e2f941 100644 (file)
--- a/src/libknot/quic/tls_common.h
+++ b/src/libknot/quic/tls_common.h
@@ -176,4 +176,13 @@ int knot_tls_cert_check_hostnames(struct gnutls_session_int *session,
 int knot_tls_cert_check(struct gnutls_session_int *session,
                         struct knot_creds *creds);
 
+/*!
+ * \brief Returns hashed creds sources for creds change detection.
+ *
+ * \param creds   TLS credentials.
+ *
+ * \return Hash of creds sources.
+ */
+uint64_t knot_creds_hash(struct knot_creds *creds);
+
 /*! @} */

diff --git a/tests-extra/tests/quic/xfr/test.py b/tests-extra/tests/quic/xfr/test.py
index dd35c2d56d185a28a282f1a094afd67341117aa8..51ae88df29d30eaa1fe10085ae56bb17a36b78b1 100644 (file)
--- a/tests-extra/tests/quic/xfr/test.py
+++ b/tests-extra/tests/quic/xfr/test.py
@@ -20,9 +20,6 @@ zones = t.zone(".") + rnd_zones
 
 t.link(zones, master, slave)
 
-for z in zones:
-    master.zones[z.name].zfile.update_soa(retry=10) # WARNING this inhibits the effect of some issue that QUIC communication fails sometimes. This SHOULD be removed and the QUIC issue fixed!
-
 for z in rnd_zones:
     master.dnssec(z).enable = True
 
@@ -98,9 +95,7 @@ try:
     else:
         master.fill_cert_key()
     slave.gen_confile()
-    #slave.reload() doesn't work for hostname, restart instead till fixed
-    slave.stop()
-    slave.start()
+    slave.reload()
     serials = upd_check_zones(master, slave, rnd_zones, serials)
 
     # Check slave not authenticated due to bad cert-key
@@ -126,9 +121,7 @@ try:
     else:
         slave.fill_cert_key()
     master.gen_confile()
-    #master.reload() doesn't work for hostname, restart instead till fixed
-    master.stop()
-    master.start()
+    master.reload()
     serials = upd_check_zones(master, slave, rnd_zones, serials)
 
 finally:

diff --git a/tests-extra/tests/tls/xfr/test.py b/tests-extra/tests/tls/xfr/test.py
index 92292b242ccb8d17e959754030356dc5cddcd8f5..55536d611d985466f4146a9064be1d6bcae5568b 100644 (file)
--- a/tests-extra/tests/tls/xfr/test.py
+++ b/tests-extra/tests/tls/xfr/test.py
@@ -99,9 +99,7 @@ try:
     else:
         master.fill_cert_key()
     slave.gen_confile()
-    #slave.reload() doesn't work for hostname, restart instead till fixed
-    slave.stop()
-    slave.start()
+    slave.reload()
     serials = upd_check_zones(master, slave, rnd_zones, serials)
 
     # Check slave not authenticated due to bad cert-key
@@ -127,9 +125,7 @@ try:
     else:
         slave.fill_cert_key()
     master.gen_confile()
-    #master.reload() doesn't work for hostname, restart instead till fixed
-    master.stop()
-    master.start()
+    master.reload()
     serials = upd_check_zones(master, slave, rnd_zones, serials)
 
 finally: