From: Olivier Houchard <ohouchard@haproxy.com>
Date: Fri, 16 Oct 2026 15:05:11 +0000 (+0200)
Subject: BUG/MEDIUM: server: Don't use the cached ALPN for websocket
X-Git-Tag: v3.5-dev10~69
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=73ce20faa03e8c2670abc78bf7da73bb8bbe2bf5;p=haproxy.git

BUG/MEDIUM: server: Don't use the cached ALPN for websocket

When using websockets, we may end up using a different ALPN than the one
we usually use with the server, so do not reuse the cached ALPN, if any,
and do not cache the one we used for that connection. Otherwise, we may
end up with websocket connections that will attempt to use the wrong
mux, and end in error.
Not making any attempt at caching the ALPN means we can't easily use
0RTT with websockets, but I do not believe this is a big problem.

This will hopefully help with github issue #3473.

This should be backported up to 3.3.
---

diff --git a/src/backend.c b/src/backend.c
index 1c374676e..2f0fe7ea2 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -2161,8 +2161,15 @@ int connect_server(struct stream *s)
 				break;
 			}
 
-			if (!conn_update_alpn(srv_conn, ist(alpn), force))
+			if (!conn_update_alpn(srv_conn, ist(alpn), force)) {
+				/*
+				 * Possibly the ALPN will be different,
+				 * so don't use any cached value.
+				 */
+				may_start_mux_now = 0;
+				srv_conn->flags |= CO_FL_SSL_NO_CACHED_INFO;
 				DBG_TRACE_STATE("update alpn for websocket", STRM_EV_STRM_PROC|STRM_EV_CS_ST, s);
+			}
 		}
 #endif
 	}