From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 27 Oct 2026 14:11:34 +0000 (+0100)
Subject: BUG/MINOR: mux_quic: fix ALPN retrieval from server
X-Git-Tag: v3.5-dev10~20
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=2cf6bbff69cea9af250a27ad8e866f0825befe94;p=haproxy.git

BUG/MINOR: mux_quic: fix ALPN retrieval from server

On backend side, ALPN may be retrieved from the server when 0-RTT is
used. This requires the server lock to protect concurrent modification
of the server access.

This code was badly written as server ALPN was still accessed outside of
the lock. Fix this by copying the server ALPN in a local string before
releasing the lock.

This also fixes the detection of an empty server ALPN to avoid an
unnecessary call to quic_alpn_to_app_ops().

This must be backported up to 3.4.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index a0bc0a110..94c4ea890 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -30,9 +30,11 @@
 #include <haproxy/quic_tx.h>
 #include <haproxy/quic_utils.h>
 #include <haproxy/session.h>
+#include <haproxy/server-t.h>
 #include <haproxy/ssl_sock-t.h>
 #include <haproxy/stconn.h>
 #include <haproxy/time.h>
+#include <haproxy/tools.h>
 #include <haproxy/trace.h>
 #include <haproxy/xprt_qmux.h>
 #include <haproxy/xref.h>
@@ -1908,7 +1910,8 @@ int qcc_install_app_ops(struct qcc *qcc)
 	struct connection *conn = qcc->conn;
 	const struct qcc_app_ops *app_ops;
 	struct server *srv;
-	const char *alpn;
+	char srv_alpn[MAX_ALPN_SIZE];
+	const char *alpn = NULL;
 	int alpn_len;
 
 	TRACE_ENTER(QMUX_EV_QCC_NEW, conn);
@@ -1919,12 +1922,13 @@ int qcc_install_app_ops(struct qcc *qcc)
 
 		srv = __objt_server(conn->target);
 		HA_RWLOCK_RDLOCK(SERVER_LOCK, &srv->path_params.param_lock);
-		alpn = srv->path_params.nego_alpn;
+		strlcpy2(srv_alpn, srv->path_params.nego_alpn, MAX_ALPN_SIZE);
 		HA_RWLOCK_RDUNLOCK(SERVER_LOCK, &srv->path_params.param_lock);
 
-		if (!alpn)
+		if (!*srv_alpn)
 			goto err;
-		alpn_len = strlen(srv->path_params.nego_alpn);
+		alpn = srv_alpn;
+		alpn_len = strlen(srv_alpn);
 	}
 
 	app_ops = quic_alpn_to_app_ops(alpn, alpn_len);