From 26e8e3112bc394162f8f2c76fb1ef661b15ab0a4 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Mon, 17 Aug 2026 10:03:16 -0400
Subject: [PATCH] MT#55283 retain TLS ID for answer role change

DTLS connections created during an offer are passive by default. If the
answer requires a role change to active, don't reset the TLS ID, as we
have no way to communicate this change until a re-invite, which would
then lead to an unexpected reset of the connection.

Related: #2156

Change-Id: I49dcd93d63840a223c41a59c74e2f270d0a08f62
(cherry picked from commit 001d8fe4c6e202443cdb771476e05447f61aefd9)
(cherry picked from commit c4e515f2216af3bdd34c14a4d8f359617ff2f433)
---
 daemon/dtls.c | 52 ++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 35 insertions(+), 17 deletions(-)

diff --git a/daemon/dtls.c b/daemon/dtls.c
index a9520b274..456d92005 100644
--- a/daemon/dtls.c
+++ b/daemon/dtls.c
@@ -688,6 +688,34 @@ static long dtls_bio_callback_wrap(BIO *bio, int oper, const char *argp, int arg
 }
 #endif
 
+
+// leaves TLS ID intact
+static void dtls_connection_reset(struct dtls_connection *c) {
+	if (c->ssl_ctx || c->ssl)
+		ilogs(crypto, LOG_DEBUG, "Resetting DTLS connection context");
+
+	if (c->ssl_ctx)
+		SSL_CTX_free(c->ssl_ctx);
+	if (c->ssl)
+		SSL_free(c->ssl);
+	if (!c->init) {
+		if (c->r_bio)
+			BIO_free(c->r_bio);
+		if (c->w_bio)
+			BIO_free(c->w_bio);
+	}
+	obj_release(c->sfd);
+
+	c->ssl_ctx = NULL;
+	c->ssl = NULL;
+	c->r_bio = NULL;
+	c->w_bio = NULL;
+	c->ps = NULL;
+	ZERO(c->fsin);
+	c->init = c->active = c->connected = 0;
+}
+
+
 int dtls_connection_init(struct dtls_connection *d, struct packet_stream *ps, int active,
 		struct dtls_cert *cert)
 {
@@ -701,7 +729,7 @@ int dtls_connection_init(struct dtls_connection *d, struct packet_stream *ps, in
 	if (d->init) {
 		if ((d->active && active) || (!d->active && !active))
 			goto done;
-		dtls_connection_cleanup(d);
+		dtls_connection_reset(d);
 	}
 
 	d->ps = ps;
@@ -781,7 +809,8 @@ int dtls_connection_init(struct dtls_connection *d, struct packet_stream *ps, in
 
 	d->active = active ? 1 : 0;
 
-	random_string(d->tls_id, sizeof(d->tls_id));
+	while (memcmp(d->tls_id, (unsigned char [sizeof(d->tls_id)]) {0}, sizeof(d->tls_id)) == 0)
+		random_string(d->tls_id, sizeof(d->tls_id));
 
 done:
 	return 0;
@@ -1007,22 +1036,11 @@ void dtls_shutdown(struct packet_stream *ps) {
 		ilogs(crypto, LOG_DEBUG, "Reuse SRTP crypto key");
 }
 
-void dtls_connection_cleanup(struct dtls_connection *c) {
-	if (c->ssl_ctx || c->ssl)
-		ilogs(crypto, LOG_DEBUG, "Resetting DTLS connection context");
 
-	if (c->ssl_ctx)
-		SSL_CTX_free(c->ssl_ctx);
-	if (c->ssl)
-		SSL_free(c->ssl);
-	if (!c->init) {
-		if (c->r_bio)
-			BIO_free(c->r_bio);
-		if (c->w_bio)
-			BIO_free(c->w_bio);
-	}
-	obj_release(c->sfd);
-	ZERO(*c);
+// full reset including TLS ID
+void dtls_connection_cleanup(struct dtls_connection *c) {
+	dtls_connection_reset(c);
+	ZERO(c->tls_id);
 }