]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: quic: SSL/TCP handshake failures with OpenSSL 3.5
authorFrederic Lecaille <flecaille@haproxy.com>
Mon, 7 Jul 2025 10:01:22 +0000 (12:01 +0200)
committerFrederic Lecaille <flecaille@haproxy.com>
Mon, 7 Jul 2025 10:01:22 +0000 (12:01 +0200)
commitfb0324eb09cf00a65048a05fbcfbfb89bcdc6e25
tree87fe361dcfeae03bcebb5fd0665bdd23f59a66e0
parentd0bd0595da63d26865bce0d08d4221c8bf240251
BUG/MEDIUM: quic: SSL/TCP handshake failures with OpenSSL 3.5

This bug arrived with this commit:

    MINOR: quic: OpenSSL 3.5 internal QUIC custom extension for transport parameters reset

To make QUIC connection succeed with OpenSSL 3.5 API, a call to quic_ssl_set_tls_cbs()
was needed from several callback which call SSL_set_SSL_CTX(). This has as side effect
to set the QUIC callbacks used by the OpenSSL 3.5 API.

But quic_ssl_set_tls_cbs() was also called for TCP sessions leading the SSL stack
to run QUIC code, if the QUIC support is enabled.

To fix this, simply ignore the TCP connections inspecting the <ssl_qc_app_data_index>
index value which is NULL for such connections.

Must be backported to 3.2.
src/quic_ssl.c