]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
CLEANUP: quic: Missing succesful SSL handshake backend trace (OpenSSL 3.5)
authorFrederic Lecaille <flecaille@haproxy.com>
Tue, 4 Nov 2025 07:20:31 +0000 (08:20 +0100)
committerFrederic Lecaille <flecaille@haproxy.com>
Fri, 14 Nov 2025 16:50:49 +0000 (17:50 +0100)
This very minor issue impacts only the backend when compiled against OpenSSL 3.5
with QUIC API (HAVE_OPENSSL_QUIC).

The "SSL handshake OK" trace was not dumped by a TRACE() call. This was very
annoying when debugging.

Modify the concerned code section which is a bit ugly and simplify it.
The TRACE() call is done at a unique location for now on.

Should be backported to 3.2 to ease any further backport.

src/quic_ssl.c

index 6031cadabdbfd886f539c9f8f25c2f6dbb3b741d..22f0d04ab12504add826d58c2f38980f9c00a9de 100644 (file)
@@ -968,10 +968,7 @@ int qc_ssl_do_hanshake(struct quic_conn *qc, struct ssl_sock_ctx *ctx)
                }
 #endif
 
-#ifndef HAVE_OPENSSL_QUIC
-               TRACE_PROTO("SSL handshake OK", QUIC_EV_CONN_IO_CB, qc, &state);
-               ssl_sock_update_counters(ctx->ssl, counters, counters_px, qc_is_back(qc));
-#else
+#ifdef HAVE_OPENSSL_QUIC
                /* Hack to support O-RTT with the OpenSSL 3.5 QUIC API.
                 * SSL_do_handshake() succeeds at the first call. Why? |-(
                 * This prevents the handshake CRYPTO data to be sent.
@@ -987,12 +984,10 @@ int qc_ssl_do_hanshake(struct quic_conn *qc, struct ssl_sock_ctx *ctx)
                                            QUIC_EV_CONN_IO_CB, qc, &state, &ssl_err);
                                goto out;
                        }
-                       else {
-                               TRACE_PROTO("SSL handshake OK", QUIC_EV_CONN_IO_CB, qc, &state);
-                               ssl_sock_update_counters(ctx->ssl, counters, counters_px, qc_is_back(qc));
-                       }
                }
 #endif
+               TRACE_PROTO("SSL handshake OK", QUIC_EV_CONN_IO_CB, qc, &state);
+               ssl_sock_update_counters(ctx->ssl, counters, counters_px, qc_is_back(qc));
 
                /* Check the alpn could be negotiated */
                if (!qc_is_back(qc)) {