fix(tunnel): read the served TLS leaf after the handshake #8

Merged

kmendell merged 1 commit from fix/tls-certificate-kind-race into main

2026-08-21 13:45:58 -05:00

eresto commented

2026-08-21 13:41:02 -05:00

Owner

Make certificateKindConn.kind atomic, and read the served kind after the hello has arrived. The read was not just racy but nearly always empty there: the handshake had not run yet, so tlsKind silently fell back to whatever the node reported.

tls.NewListener hands back a *tls.Conn before any handshake has run, so the handshake happens on whichever goroutine reads the conn first. In Serve that goroutine is yamux's recvLoop, which meant selectCert's SetCertificateKind raced with Serve's own TLSServedKind read a line later, tripping the race detector in TestEndToEnd. Make certificateKindConn.kind atomic, and read the served kind after the hello has arrived. The read was not just racy but nearly always empty there: the handshake had not run yet, so tlsKind silently fell back to whatever the node reported.

eresto added 1 commit

2026-08-21 13:41:02 -05:00

fix(tunnel): read the served TLS leaf after the handshake

CI / lint (pull_request) Successful in 45s

Details

CI / test (pull_request) Successful in 2m40s

Details

CI / nix (pull_request) Successful in 3m14s

Details

f971865292

tls.NewListener hands back a *tls.Conn before any handshake has run, so
the handshake happens on whichever goroutine reads the conn first. In
Serve that goroutine is yamux's recvLoop, which meant selectCert's
SetCertificateKind raced with Serve's own TLSServedKind read a line
later, tripping the race detector in TestEndToEnd.

Make certificateKindConn.kind atomic, and read the served kind after the
hello has arrived. The read was not just racy but nearly always empty
there: the handshake had not run yet, so tlsKind silently fell back to
whatever the node reported.