Keep queued replies with the folded forward

A port-0 reply naming a port another registration stands for merges the
two, since one bind gets one registration. The requests still queued
against the entry that goes named that same bind, so FwdReplyRebind()
hands them to the survivor. Left naming nothing, a cancel among them
settles no forward and the merged one keeps matching opens.

- FwdReplyRebind() repoints queued slots before the stale entry is
  unlinked and FwdReplyVoid() clears them
- Test folds a port-0 reply onto a forward with a cancel already
  queued, and checks the cancel takes the survivor down

Author: ejohnstown

src/internal.c

@@ -3986,6 +3986,21 @@ static void FwdReplyVoid(WOLFSSH* ssh, const WOLFSSH_FWD_REMOTE* entry)
 }
 
 
+/* Hand every queued slot naming one forward over to another. A slot names the
+ * bind it asked about, so when two registrations turn out to be the same bind,
+ * the surviving one is what those requests were about. */
+static void FwdReplyRebind(WOLFSSH* ssh, const WOLFSSH_FWD_REMOTE* from,
+        WOLFSSH_FWD_REMOTE* to)
+{
+    WOLFSSH_FWD_REPLY* reply;
+
+    for (reply = ssh->fwdReplyHead; reply != NULL; reply = reply->next) {
+        if (reply->entry == from)
+            reply->entry = to;
+    }
+}
+
+
 static void FwdRemoteUnlink(WOLFSSH* ssh, void* heap,
         WOLFSSH_FWD_REMOTE* entry)
 {
@@ -4149,6 +4164,11 @@ static void FwdRemoteSettle(WOLFSSH* ssh, WOLFSSH_FWD_REMOTE* entry,
 
             WLOG(WS_LOG_INFO, "Remote forward reply named a port already "
                     "registered");
+            /* Requests still queued on the stale entry asked about this bind,
+             * so they answer for the entry that stands at it now. Unlinking
+             * without this leaves them naming nothing, and a cancel among
+             * them would settle no forward. */
+            FwdReplyRebind(ssh, dup, entry);
             FwdRemoteUnlink(ssh, ssh->ctx->heap, dup);
         }
     }

tests/regress.c

@@ -5409,6 +5409,47 @@ static void TestForwardedTcpipPortZeroReplyFoldsDuplicate(void)
     FreeChannelOpenHarness(&harness);
 }
 
+/* A cancel queued against the entry the fold drops still names that bind, so
+ * the surviving registration is what it answers for. */
+static void TestForwardedTcpipPortZeroFoldSettlesQueuedCancel(void)
+{
+    ChannelOpenHarness harness;
+    byte reply[64];
+    word32 replySz;
+
+    InitFwdRemoteHarness(&harness);
+
+    AssertIntEQ(wolfSSH_FwdRemoteSetup(harness.ssh, "127.0.0.1", 8080, 1),
+            WS_SUCCESS);
+    AssertIntEQ(wolfSSH_FwdRemoteSetup(harness.ssh, "127.0.0.1", 0, 1),
+            WS_SUCCESS);
+    AssertIntEQ(wolfSSH_FwdRemoteCancel(harness.ssh, "127.0.0.1", 8080, 1),
+            WS_SUCCESS);
+    AssertIntEQ(FwdRemoteCount(harness.ssh), 2);
+
+    /* The peer refused the explicit setup, but the cancel still names that
+     * registration, so it stands for now. */
+    FeedRequestFailure(&harness);
+    AssertIntEQ(FwdRemoteCount(harness.ssh), 2);
+
+    /* The port-0 request got the port the refused one asked for. One bind,
+     * one registration. */
+    replySz = BuildRequestSuccessPortPacket(8080, reply, sizeof(reply));
+    AssertIntEQ(FeedOnePacket(&harness, reply, replySz), WS_SUCCESS);
+    AssertIntEQ(FwdRemoteCount(harness.ssh), 1);
+
+    /* The cancel went out after both setups, so it is the last word on the
+     * bind and matching stops on it alone. */
+    AssertForwardedOpenRefused(&harness, "127.0.0.1", 8080);
+
+    /* Confirming it takes the merged registration down with it. */
+    FeedRequestSuccess(&harness);
+    AssertIntEQ(FwdRemoteCount(harness.ssh), 0);
+    AssertForwardedOpenRefused(&harness, "127.0.0.1", 8080);
+
+    FreeChannelOpenHarness(&harness);
+}
+
 static void TestForwardedTcpipRepliesPairInSendOrder(void)
 {
     ChannelOpenHarness harness;
@@ -10843,6 +10884,7 @@ int main(int argc, char** argv)
     TestForwardedTcpipConfirmedCancelDropsEarlierSuccess();
     TestForwardedTcpipConfirmedCancelThenSetupBinds();
     TestForwardedTcpipPortZeroReplyFoldsDuplicate();
+    TestForwardedTcpipPortZeroFoldSettlesQueuedCancel();
     TestForwardedTcpipPostSendErrorStillRegisters();
     TestForwardedTcpipFailedSendRegistersNothing();
     TestForwardedTcpipReentrantSetupDuringSend();