worker: when receiving auth_cookie_reply from main update the SID

That fixes an issue where the worker didn't know its correct
SID, because (1) we didn't always send the SID as cookie - corrected in
the previous patch, and (2) openconnect client doesn't honour all cookies,
only the webvpnc one. In all cases it is more trustworthy to check our
view of the SID rather than rely on the cookie.

Resolves issue with stats not being transmitted to sec-module when
using certificate authentication.

src/ipc.proto

@@ -51,7 +51,7 @@ message auth_cookie_request_msg
 message auth_reply_msg
 {
 	required AUTH_REP reply = 1;
-	optional bytes session_id = 3;
+	optional bytes session_id = 3; /* dtls */
 	optional string vname = 4;
 	optional string user_name = 5;
 	optional string group_name = 25;
@@ -78,6 +78,7 @@ message auth_reply_msg
 	optional string ipv4_network = 27;
 	optional string ipv6_network = 28;
 	repeated string no_routes = 29;
+	required bytes sid = 30;
 }
 
 /* RESUME_FETCH_REQ + RESUME_DELETE_REQ */

src/main-auth.c

@@ -65,6 +65,9 @@ int send_cookie_auth_reply(main_server_st* s, struct proc_st* proc,
 		msg.session_id.data = proc->dtls_session_id;
 		msg.session_id.len = sizeof(proc->dtls_session_id);
 
+		msg.sid.data = proc->sid;
+		msg.sid.len = sizeof(proc->sid);
+
 		msg.vname = proc->tun_lease.name;
 		msg.user_name = proc->username;
 		msg.group_name = proc->groupname;

src/worker-auth.c

@@ -525,11 +525,15 @@ static int recv_cookie_auth_reply(worker_st * ws)
 		if (socketfd != -1) {
 			ws->tun_fd = socketfd;
 
-			if (msg->vname == NULL || msg->user_name == NULL) {
+			if (msg->vname == NULL || msg->user_name == NULL || msg->sid.len != sizeof(ws->sid)) {
 				ret = ERR_AUTH_FAIL;
 				goto cleanup;
 			}
 
+			/* update our sid */
+			memcpy(ws->sid, msg->sid.data, sizeof(ws->sid));
+			ws->sid_set = 1;
+
 			strlcpy(ws->vinfo.name, msg->vname, sizeof(ws->vinfo.name));
 			strlcpy(ws->username, msg->user_name, sizeof(ws->username));