From 9993f29007cac184ce8b9ab42e4ba8c780f38da6 Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Wed, 15 Jul 2026 17:11:22 +0200 Subject: [PATCH] BUG/MINOR: ssl: fix proxy lookup for show ssl sni Command "show ssl sni" accepts an extra option -f to restrict output to a single frontend. If the specified proxy is not found, an error message should be displayed. However, this does not behave as expected as no error is reported and the first proxy in the list is used as a sort of fallback. This patch fixes the command parsing function when -f is used. The loop is now interrupted as soon as a matching entry is found. After the loop, if local variable is still NULL, it indicates that no matching entry was found. The error message is displayed as intended and the command is not executed. This must be backported up to 3.2. --- src/ssl_ckch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c index d612c9d02..c3de2cbd8 100644 --- a/src/ssl_ckch.c +++ b/src/ssl_ckch.c @@ -1876,10 +1876,11 @@ static int cli_parse_show_sni(char **args, char *payload, struct appctx *appctx, if (strcmp(px->id, args[cur_arg+1]) == 0) { ctx->px = px; ctx->options |= SHOW_SNI_OPT_1FRONTEND; + break; } } cur_arg++; /* skip the argument */ - if (ctx->px == NULL) + if (px == NULL) return cli_err(appctx, "Couldn't find the specified frontend!\n"); } else if (strcmp(args[cur_arg], "-A") == 0) { -- 2.47.3