]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: ssl: Don't store the ALPN for check connections
authorOlivier Houchard <ohouchard@haproxy.com>
Tue, 9 Dec 2025 15:17:08 +0000 (16:17 +0100)
committerOlivier Houchard <cognet@ci0.org>
Tue, 9 Dec 2025 15:43:31 +0000 (16:43 +0100)
commitbe4e1220c23fd45096e94006beac3b16453470ab
tree76d1d14a60c821103cff9e1c571b214628e2501c
parentdcce9369129f6ca9b8eed6b451c0e20c226af2e3
BUG/MEDIUM: ssl: Don't store the ALPN for check connections

When establishing check connections, do not store the negociated ALPN
into the server's path_param if the connection is a check connection, as
it may use different SSL parameters than the regular connections. To do
so, only store them if the CO_FL_SSL_NO_CACHED_INFO is not set.
Otherwise, the check ALPN may be stored, and the wrong mux can be used
for regular connections, which will end up generating 502s.

This should fix Github issue #3207

This should be backported to 3.3.
src/ssl_sock.c