tlslib, worker: remove dead code orphaned by the listen-clear-file removal

Commit 5cf457b4 ("Removed the listen-clear-file config option", Dec
2020) deleted the only code path that could ever construct a
SOCK_TYPE_UNIX worker connection, but left every branch that handled
it in place. Since then ws->session has been unconditionally non-NULL
and ws->conn_type unconditionally not SOCK_TYPE_UNIX for every worker,
making all of the following unreachable:

 - tlslib.c: recv_remaining(), _cstp_recv_packet() (the non-TLS CSTP
   reassembly path hardened in the previous commit), and
   tls_has_session_cert() (zero callers) deleted outright; cstp_cork/
   cstp_uncork/cstp_send/cstp_recv_packet/cstp_recv/cstp_close/
   cstp_fatal_close collapsed to their TLS-only body.
 - worker-http.c, worker-auth.c, worker-vpn.c, main.c: dead
   ws->session == NULL / ws->conn_type == SOCK_TYPE_UNIX branches
   removed or simplified to their live half.
 - worker-proxyproto.c: parse_ssl_tlvs() and its TLV structs/macros
   removed. This proxy-protocol SSL-CN extraction was itself only
   ever invoked from the same dead SOCK_TYPE_UNIX branch, so it has
   been as unreachable as the rest since 2020 despite a recent,
   otherwise-correct bug fix.
 - tests/cstp-recv.c deleted (exercised only the removed reassembly
   path); tests/proxyproto-v2.c trimmed to the still-live IPv6
   address-parsing regression test.
 - doc/sample.config: dropped the stale "TCP or UNIX socket" wording
   for listen-proxy-proto left over from the same 2020 removal; only
   a TCP socket is ever listened on for the proxy protocol now.

Narrows the worker's attack surface to the code paths a client can
actually reach, and removes a source of wasted maintenance effort.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

doc/requirements/internal/main.md

@@ -113,8 +113,11 @@ proxy-protocol connections happens later once the real client address is
 known from the PROXY protocol header.
 **Strength:** MUST NOT
 **Status:** DERIVED
-**Source:** src/main.c:1173-1186 (`if (ws->conn_type != SOCK_TYPE_UNIX &&
-!GETRCONFIG(s)->listen_proxy_proto)`)
+**Source:** src/main.c:1174-1186 (`if (!GETRCONFIG(s)->listen_proxy_proto)`).
+Previously guarded by `ws->conn_type != SOCK_TYPE_UNIX && ...` too; that
+clause was always true (`SOCK_TYPE_UNIX` has been unreachable since
+`listen-clear-file`'s removal, commit `5cf457b4`) and was dropped as dead
+code — this requirement's substance is unaffected.
 **Acceptance:** [SEC] Confirmed — the post-PROXY-header ban check exists at
 src/main-worker-cmd.c:387-405, in the `CMD_SESSION_INFO` handler. Sequencing:
 the worker calls `parse_proxy_proto_header()` (src/worker-vpn.c:895) to

doc/requirements/internal/worker.md

@@ -427,33 +427,6 @@ activates for that session even though `udp-port` is globally configured;
 (b) configure `udp-port = 0` and confirm the same.
 **Links:** REQ-WORKER-SEC-003
 
-### REQ-WORKER-NET-004 — Non-TLS CSTP packet reassembly reports failure on incomplete reads, never a truncated packet as success
-
-**Requirement:** `_cstp_recv_packet()`, when `ws->session == NULL` (CSTP
-carried in plaintext over a UNIX socket, e.g. terminated by a
-TLS-terminating proxy in front of ocserv), MUST treat any `recv()` failure
-or peer-closed condition encountered while assembling the 8-byte CSTP
-header or the declared-length body as a hard error for that read, and MUST
-NOT return a byte count implying a complete packet unless the full
-requested length was actually received. `recv_remaining()` MUST return
-either exactly the requested `left` byte count, or a negative error code
-(`GNUTLS_E_PREMATURE_TERMINATION` on peer close, or the `recv()` error
-otherwise) — it MUST NOT return a partial, positive byte count that a
-caller's `ret <= 0` check would treat as success, since that would surface
-stale/uninitialized buffer bytes to `parse_cstp_data` as if they were
-received client data.
-**Strength:** MUST
-**Status:** DERIVED
-**Source:** src/tlslib.c:158-183 (`recv_remaining`), src/tlslib.c:189-225
-(`_cstp_recv_packet`)
-**Acceptance:** negative, local, unit — `tests/cstp-recv.c`: a peer sends a
-full 8-byte CSTP header declaring an N-byte body, writes fewer than N body
-bytes, then closes the socket; confirm `_cstp_recv_packet()` returns a
-negative value, not `8+N` as if the packet were fully received.
-**Links:** REQ-PROTO-DATA-001 (this requirement supplies the precondition —
-a truthful `buf_size` — that REQ-PROTO-DATA-001's length-mismatch check
-depends on)
-
 ## Completeness notes
 
 - **`worker-vpn.c` main loops** (`tls_mainloop`, `dtls_mainloop`,

doc/requirements/protocol/unified.md

@@ -459,13 +459,7 @@ OC-PROTO itself does not mandate the close-on-violation behavior (it is silent);
 OCSERV's choice (close) is the only behavior on record from any source, so there
 is no competing variant — this is "MAJORITY of 1 source that addresses the
 question at all."
-**Note**: this requirement's `buf_size != 8 + pktlen` check can only detect a
-truncated body if `buf_size` (the worker's `data.size`, ultimately the return
-value of `_cstp_recv_packet`/`recv_remaining` in `src/tlslib.c`) truthfully
-reflects the number of bytes actually read from the socket — see
-REQ-WORKER-NET-004, which makes that precondition hold for the non-TLS
-(UNIX-socket-proxied) CSTP path.
-**Links**: REQ-PROTO-CONN-006, REQ-WORKER-NET-004
+**Links**: REQ-PROTO-CONN-006
 
 ### REQ-PROTO-DATA-002
 **Requirement**: The CSTP/DTLS payload type byte MUST be one of `0x00` (DATA),

doc/sample.config

@@ -251,8 +251,8 @@ max-same-clients = 2
 
 # When the server receives connections from a proxy, like haproxy
 # which supports the proxy protocol, set this to obtain the correct
-# client addresses. The proxy protocol would then be expected in
-# the TCP or UNIX socket (not the UDP one). Although both v1
+# client addresses. The proxy protocol would then be expected on
+# the TCP socket (not the UDP one). Although both v1
 # and v2 versions of proxy protocol are supported, the v2 version
 # is recommended as it is more efficient in parsing.
 # This option is global and cannot be set at vhost level.