From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Wed, 15 Jul 2026 15:11:22 +0000 (+0200)
Subject: BUG/MINOR: ssl: fix proxy lookup for show ssl sni
X-Git-Url: http://git.kaiwu.me/http/doc/$%7BGITURL%7D/static/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=9993f29007cac184ce8b9ab42e4ba8c780f38da6;p=haproxy.git

BUG/MINOR: ssl: fix proxy lookup for show ssl sni

Command "show ssl sni" accepts an extra option -f to restrict output to
a single frontend. If the specified proxy is not found, an error message
should be displayed. However, this does not behave as expected as no
error is reported and the first proxy in the list is used as a sort of
fallback.

This patch fixes the command parsing function when -f is used. The loop
is now interrupted as soon as a matching entry is found. After the loop,
if local variable <px> is still NULL, it indicates that no matching
entry was found. The error message is displayed as intended and the
command is not executed.

This must be backported up to 3.2.
---

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index d612c9d02..c3de2cbd8 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -1876,10 +1876,11 @@ static int cli_parse_show_sni(char **args, char *payload, struct appctx *appctx,
 				if (strcmp(px->id, args[cur_arg+1]) == 0) {
 					ctx->px = px;
 					ctx->options |= SHOW_SNI_OPT_1FRONTEND;
+					break;
 				}
 			}
 			cur_arg++; /* skip the argument */
-			if (ctx->px == NULL)
+			if (px == NULL)
 				return cli_err(appctx, "Couldn't find the specified frontend!\n");
 
 		} else if (strcmp(args[cur_arg], "-A") == 0) {