--client-disconnect executes after failed --client-connect

[tct]

The --client-disconnect script is executed even after a failed --client-connect script execution.

Server log:

<FAIL> * EasyTLS-client-connect => vars loaded => CN:ss-c-arch => Kill client signal => ==192.168.1.2=1225 => conn_trac_disconnect FAIL => temp-files deleted

failed to read generic_ext_md_file
2021-08-21 20:33:40 us=867575 arch/192.168.1.2:1225 WARNING: Failed running command (--client-connect): external program exited with error status: 18
<EXOK> * EasyTLS-client-disconnect => vars loaded => CN:ss-c-arch => X509 serial matched => client_ext_md_file loaded => disconnection success => 88cca7a5b9df705560a0764a427478fe327194ce1d28dd0a6feaf5e797ff5531=650953F06CFC5E2B5B5C4B4820E50D936C90A595=192.168.1.2=1225 => conn_trac_disconnect FAIL => temp-files deleted
2021-08-21 20:33:44 us=53200 arch/192.168.1.2:1225 PUSH: Received control message: 'PUSH_REQUEST'
2021-08-21 20:33:44 us=53309 arch/192.168.1.2:1225 Delayed exit in 5 seconds
2021-08-21 20:33:44 us=53392 arch/192.168.1.2:1225 SENT CONTROL [arch]: 'AUTH_FAILED' (status=1)
2021-08-21 20:33:49 us=614513 arch/192.168.1.2:1225 SIGTERM[soft,delayed-exit] received, client-instance exiting

[tct]

The manual states the following:

--client-disconnect cmd

Like --client-connect but called on client instance shutdown. Will not be called unless the --client-connect script and plugins (if defined) were previously called on this instance with successful (0) status returns.

The exception to this rule is if the --client-disconnect command or plugins are cascaded , and at least one client-connect function succeeded, then ALL of the client-disconnect functions for scripts and plugins will be called on client instance object deletion, even in cases where some of the related client-connect functions returned an error status.

Define: cascaded

My server uses:

1. --tls-crypt-v2-verify (Succeeds). Should not be considered cascaded . Because this verification is for a TLS-Crypt-V2 key only and has no other access to the server environment.

2. --tls-verify (Succeeds). Questionable cascaded status ?

3. --auth-user-pass-verify (Succeeds). This is probably the cascading element which is causing the confusion. I will test without for comparison.

[tct]

Update : Removing only --auth-user-pass-verify the result is the same.

The other two scripts above complete successfully, is it the --tls-verify stage causing the strange behaviour ?

[tct]

Further testing :

• If --tls-crypt-v2-verify succeeds
• and --tls-verify is not configured
• and --client-connect fails
• then --client-disconnect still executes

Essentially, if any script during connection setup succeeds then --client-disconnect is executed.