Avoid using sock->iface and sock->peer from the lower transport

This commit modifies TLS Stream and DNS-over-HTTPS transports so that
they do not use the "sock->iface" and "sock->peer" of the lower level
transport directly.

That did not cause any problems before, as things worked as expected,
but with the introduction of PROXYv2 support we use handles to store
the information in both PROXY Stream and UDP Proxy
transports. Therefore, in order to propagate the information (like
addresses), extracted from PROXYv2 headers, from the lower level
transports to the higher-level ones, we need to get that information
from the lower-level handles rather than sockets. That means that we
should get the peer and interface addresses using the intended
APIs ("isc_nmhandle_peeraddr()" and "isc_nmhandle_localaddr()").

diff --git a/lib/isc/netmgr/http.c b/lib/isc/netmgr/http.c
index e4083e5edb9b34bded8f2f6f8bcebc3a61575d5d..19775aefdb870aadfef4feb47e146499491340c2 100644 (file)
--- a/lib/isc/netmgr/http.c
+++ b/lib/isc/netmgr/http.c
@@ -1385,8 +1385,8 @@ transport_connect_cb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
        transp_sock->h2.session = session;
        http_sock->h2.connect.tlsctx = NULL;
        /* otherwise we will get some garbage output in DIG */
-       http_sock->iface = handle->sock->iface;
-       http_sock->peer = handle->sock->peer;
+       http_sock->iface = isc_nmhandle_localaddr(handle);
+       http_sock->peer = isc_nmhandle_peeraddr(handle);
 
        transp_sock->h2.connect.post = http_sock->h2.connect.post;
        transp_sock->h2.connect.uri = http_sock->h2.connect.uri;
@@ -1672,6 +1672,7 @@ server_on_begin_headers_callback(nghttp2_session *ngsession,
        isc_nm_http_session_t *session = (isc_nm_http_session_t *)user_data;
        isc_nmsocket_t *socket = NULL;
        isc__networker_t *worker = NULL;
+       isc_sockaddr_t local;
 
        if (frame->hd.type != NGHTTP2_HEADERS ||
            frame->headers.cat != NGHTTP2_HCAT_REQUEST)
@@ -1689,10 +1690,9 @@ server_on_begin_headers_callback(nghttp2_session *ngsession,
 
        worker = session->handle->sock->worker;
        socket = isc_mem_get(worker->mctx, sizeof(isc_nmsocket_t));
-       isc__nmsocket_init(socket, worker, isc_nm_httpsocket,
-                          (isc_sockaddr_t *)&session->handle->sock->iface,
-                          NULL);
-       socket->peer = session->handle->sock->peer;
+       local = isc_nmhandle_localaddr(session->handle);
+       isc__nmsocket_init(socket, worker, isc_nm_httpsocket, &local, NULL);
+       socket->peer = isc_nmhandle_peeraddr(session->handle);
        socket->h2 = (isc_nmsocket_h2_t){
                .psock = socket,
                .stream_id = frame->hd.stream_id,

diff --git a/lib/isc/netmgr/tlsstream.c b/lib/isc/netmgr/tlsstream.c
index 6f4d4f495c385f728e9b55f020211dde8351074d..0fad37737b88726a41a89445397ec358e7ea4f86 100644 (file)
--- a/lib/isc/netmgr/tlsstream.c
+++ b/lib/isc/netmgr/tlsstream.c
@@ -882,6 +882,7 @@ tlslisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
        isc_nmsocket_t *tlslistensock = (isc_nmsocket_t *)cbarg;
        isc_nmsocket_t *tlssock = NULL;
        isc_tlsctx_t *tlsctx = NULL;
+       isc_sockaddr_t local;
 
        /* If accept() was unsuccessful we can't do anything */
        if (result != ISC_R_SUCCESS) {
@@ -899,12 +900,13 @@ tlslisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
                return (ISC_R_CANCELED);
        }
 
+       local = isc_nmhandle_localaddr(handle);
        /*
         * We need to create a 'wrapper' tlssocket for this connection.
         */
        tlssock = isc_mem_get(handle->sock->worker->mctx, sizeof(*tlssock));
        isc__nmsocket_init(tlssock, handle->sock->worker, isc_nm_tlssocket,
-                          &handle->sock->iface, NULL);
+                          &local, NULL);
 
        /* We need to initialize SSL now to reference SSL_CTX properly */
        tlsctx = tls_get_listener_tlsctx(tlslistensock, isc_tid());
@@ -922,7 +924,7 @@ tlslisten_acceptcb(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
        tlssock->accept_cbarg = tlslistensock->accept_cbarg;
        isc__nmsocket_attach(handle->sock, &tlssock->listener);
        isc_nmhandle_attach(handle, &tlssock->outerhandle);
-       tlssock->peer = handle->sock->peer;
+       tlssock->peer = isc_nmhandle_peeraddr(handle);
        tlssock->read_timeout =
                atomic_load_relaxed(&handle->sock->worker->netmgr->init);
 
@@ -1242,8 +1244,8 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t result, void *cbarg) {
 
        INSIST(VALID_NMHANDLE(handle));
 
-       tlssock->iface = handle->sock->iface;
-       tlssock->peer = handle->sock->peer;
+       tlssock->iface = isc_nmhandle_localaddr(handle);
+       tlssock->peer = isc_nmhandle_peeraddr(handle);
        if (isc__nm_closing(worker)) {
                result = ISC_R_SHUTTINGDOWN;
                goto error;