From: William Lallemand <wlallemand@haproxy.com>
Date: Tue, 18 Aug 2026 12:01:55 +0000 (+0000)
Subject: BUILD: ssl: disable the TLS1.3 session timeout clamp on wolfSSL
X-Git-Tag: v3.5-dev5~21
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=379a07153a80d0c276e5956f5fe18b530b03fbe2;p=haproxy.git

BUILD: ssl: disable the TLS1.3 session timeout clamp on wolfSSL

wolfSSL's OpenSSL compat layer declares wolfSSL_get_SSL_CTX() (aka
SSL_get_SSL_CTX()) taking a non-const WOLFSSL*, unlike OpenSSL's
const-correct SSL_get_SSL_CTX(const SSL *ssl). Calling it from
ssl_sock_infocbk(), which only has a const SSL *, fails the build:

  src/ssl_sock.c:1772:60: error: passing 'const SSL *' (aka 'const
  struct WOLFSSL *') to parameter of type 'WOLFSSL *' (aka 'struct
  WOLFSSL *') discards qualifiers
  [-Werror,-Wincompatible-pointer-types-discards-qualifiers]

Beyond the build failure, the clamp itself doesn't appear to behave
correctly against wolfSSL's TLS1.3 session/ticket handling, so skip
the whole thing on wolfSSL builds instead of only working around the
compile error.

Must be backported in every stable branches along with 9f1d590
("BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session
renewals")
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index bfb8ce1b0..19ad9c52a 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1753,7 +1753,7 @@ static void ssl_sock_infocbk(const SSL *ssl, int where, int ret)
 			}
 		}
 
-#ifdef TLS1_3_VERSION
+#if defined(TLS1_3_VERSION) && !defined(USE_OPENSSL_WOLFSSL)
 	/* Reduce TLS1.3 session timeout so it doesn't reset at each new
 	 * resumed connection */