From: Willy Tarreau <w@1wt.eu>
Date: Wed, 30 Sep 2026 09:23:40 +0000 (+0200)
Subject: BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext
X-Git-Tag: v3.5-dev8~81
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=c3c0abc6554517d93eb2a88fb532dfe5818ada0b;p=haproxy.git

BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext

req.ssl_ec_ext is documented to return "a boolean identifying if client
sent the Supported Elliptic Curves Extension", but like a few other such
sample fetch functions, it fails to return false and incorrectly returns
a fetch failure instead. It must properly return false when the hello
parses correctly but doesn't have the EC extension instead of making the
sample fetch fail as if the hello was unparsable.

The bug was in the initial version in 1.6-dev3 with commit 5fc7d7e8ce
("MINOR: Add sample fetch to detect Supported Elliptic Curves Extension"),
so this fix can be backported to all stable branches.
---

diff --git a/src/payload.c b/src/payload.c
index 50da7c8a1..dbc4a69ca 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -333,8 +333,12 @@ smp_fetch_req_ssl_ec_ext(const struct arg *args, struct sample *smp, const char
 		hs_len -= 4 + ext_len;
 		data   += 4 + ext_len;
 	}
-	/* server name not found */
-	goto not_ssl_hello;
+
+	/* EC not found */
+	smp->data.type = SMP_T_BOOL;
+	smp->data.u.sint = 0;
+	smp->flags = SMP_F_VOLATILE;
+	return 1;
 
  too_short:
 	smp->flags = SMP_F_MAY_CHANGE;