]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: quic-be/ssl_sock: TLS callback called without connection
authorFrederic Lecaille <flecaille@haproxy.com>
Thu, 20 Nov 2025 10:10:56 +0000 (11:10 +0100)
committerFrederic Lecaille <flecaille@haproxy.com>
Thu, 20 Nov 2025 10:36:57 +0000 (11:36 +0100)
commitfab7da0fd0a67a9e7286839efca95ecdbf3a059e
treecef2591b3a6a187c63c5106f7a8e260b64477692
parent8438ca273f4b174b51b5ff2a504ff5d2278134af
BUG/MEDIUM: quic-be/ssl_sock: TLS callback called without connection

Contrary to TCP, QUIC does not SSL_free() its SSL *  object when its ->close()
XPRT callback is called. This has as side effect to trigger some BUG_ON(!conn)
with <conn> the connection from TLS callbacks registered at configuration
parsing time, so after this <conn> have been released.

This is the case for instance with ssl_sock_srv_verifycbk() whose role is to
add some checks to the built-in server certificate verification process.

This patch prevents the pointer to <conn> dereferencing inside several callbacks
shared between TCP and QUIC.

Thank you to @InputOutputZ for its report in GH #3188.

As the QUIC backend feature arrived with the current 3.3 dev, no need to backport.
src/ssl_sock.c