From 91ef8ad02ea29b37acb25793ea89f53db6b7f4b7 Mon Sep 17 00:00:00 2001
From: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Date: Tue, 7 Nov 2017 17:27:13 -0500
Subject: [PATCH] Fix regression involving cluster listener

---
 vault/request_forwarding.go | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/vault/request_forwarding.go b/vault/request_forwarding.go
index e1b95e3a227c..10e6a9a5781e 100644
--- a/vault/request_forwarding.go
+++ b/vault/request_forwarding.go
@@ -122,12 +122,19 @@ func (c *Core) startForwarding() error {
 
 				// Accept the connection
 				conn, err := tlsLn.Accept()
-				if err != nil || conn == nil {
+				if err != nil {
+					if err, ok := err.(net.Error); ok && !err.Timeout() {
+						c.logger.Debug("core: non-timeout error accepting on cluster port", "error", err)
+					}
 					if conn != nil {
 						conn.Close()
 					}
 					continue
 				}
+				if conn == nil {
+					continue
+				}
+				defer conn.Close()
 
 				// Type assert to TLS connection and handshake to populate the
 				// connection state
@@ -137,14 +144,14 @@ func (c *Core) startForwarding() error {
 					if c.logger.IsDebug() {
 						c.logger.Debug("core: error handshaking cluster connection", "error", err)
 					}
-					conn.Close()
+					tlsConn.Close()
 					continue
 				}
 
 				switch tlsConn.ConnectionState().NegotiatedProtocol {
 				case requestForwardingALPN:
 					if !ha {
-						conn.Close()
+						tlsConn.Close()
 						continue
 					}
 
@@ -153,15 +160,15 @@ func (c *Core) startForwarding() error {
 					rpcServer := c.rpcServer
 					c.clusterParamsLock.RUnlock()
 					go func() {
-						defer conn.Close()
-						fws.ServeConn(conn, &http2.ServeConnOpts{
+						fws.ServeConn(tlsConn, &http2.ServeConnOpts{
 							Handler: rpcServer,
 						})
+						tlsConn.Close()
 					}()
 
 				default:
 					c.logger.Debug("core: unknown negotiated protocol on cluster port")
-					conn.Close()
+					tlsConn.Close()
 					continue
 				}
 			}