]> git.kaiwu.me - haproxy.git/commit
BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f'
authorWilliam Lallemand <wlallemand@haproxy.com>
Tue, 18 Aug 2026 15:16:54 +0000 (15:16 +0000)
committerWilliam Lallemand <wlallemand@haproxy.com>
Tue, 18 Aug 2026 15:18:48 +0000 (15:18 +0000)
commit5fcdcb7dc32b399d957c413844cdaed1478b00b6
treebb48077d3a3252a771a68859581c5c6bf4b01973
parentb39eb58ec706fb119a1aecc53f22b4581a399241
BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f'

Coverity (CID 1664029, GH #3466) points out that `px == NULL` after the
list_for_each_entry loop in cli_parse_show_sni() can never be true:
list_for_each_entry's loop variable, when the list is exhausted without
a break, is a container_of-derived pointer computed from the list
head's address, never NULL. This left the "-f <bogus-frontend>" case
silently falling through instead of erroring: the bug pre-dates
9993f29007, which fixed the found case (adding the missing break) but
kept comparing the wrong thing for the not-found case. Track "found"
explicitly instead.

Add reg-tests/ssl/show_ssl_sni_filter.vtc to cover the -f option,
including the not-found error case.

This must be backported to 3.2.
reg-tests/ssl/show_ssl_sni_filter.vtc [new file with mode: 0644]
src/ssl_ckch.c