push.rocks/smartproxy
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(rustproxy): prevent TLS route reload certificate mismatches and tighten passthrough connection handling

Browse Source
This commit is contained in:
Jürgen Kunz
2026-03-16 03:01:16 +00:00
parent 8cefe9d66a
commit 8cdb95a853
4 changed files with 46 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
rust/crates/rustproxy/src/lib.rs
View File

@@ -632,15 +632,13 @@ impl RustProxy {
let new_manager = Arc::new(new_manager);
self.route_table.store(Arc::clone(&new_manager));
// Update listener manager
// Update listener manager.
// IMPORTANT: TLS configs must be swapped BEFORE the route manager so that
// new routes only become visible after their certs are loaded. The reverse
// order (routes first) creates a window where connections match new routes
// but get the old TLS acceptor, causing cert mismatches.
if let Some(ref mut listener) = self.listener_manager {
listener.update_route_manager(Arc::clone(&new_manager));
// Cancel connections on routes that were removed or disabled
listener.invalidate_removed_routes(&active_route_ids);
// Prune HTTP proxy caches (rate limiters, regex cache, round-robin counters)
listener.prune_http_proxy_caches(&active_route_ids);
// Update TLS configs
// 1. Update TLS configs first (so new certs are available before new routes)
let mut tls_configs = Self::extract_tls_configs(&routes);
if let Some(ref cm_arc) = self.cert_manager {
let cm = cm_arc.lock().await;
@@ -661,6 +659,13 @@ impl RustProxy {
}
listener.set_tls_configs(tls_configs);
// 2. Now swap the route manager (new routes become visible with certs already loaded)
listener.update_route_manager(Arc::clone(&new_manager));
// Cancel connections on routes that were removed or disabled
listener.invalidate_removed_routes(&active_route_ids);
// Prune HTTP proxy caches (rate limiters, regex cache, round-robin counters)
listener.prune_http_proxy_caches(&active_route_ids);
// Add new ports
for port in &new_ports {
if !old_ports.contains(port) {