507e7be573
Daniel Stenberg
2026-03-25
Subject
url: do not reuse a non-tls starttls connection if new requires TLS
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/url.c+5 -1
| @@ -723,7 +723,7 @@ struct url_conn_match { | |
| BIT(want_proxy_ntlm_http); | |
| BIT(want_nego_http); | |
| BIT(want_proxy_nego_http); | |
| - | |
| + | BIT(req_tls); /* require TLS use from a clear-text start */ |
| BIT(wait_pipe); | |
| BIT(force_reuse); | |
| BIT(seen_pending_conn); | |
| @@ -875,6 +875,9 @@ static bool url_match_ssl_use(struct connectdata *conn, | |
| (get_protocol_family(conn->scheme) != m->needle->scheme->protocol)) | |
| return FALSE; | |
| } | |
| + | else if(m->req_tls) |
| + | /* a clear-text STARTTLS protocol with required TLS */ |
| + | return FALSE; |
| return TRUE; | |
| } | |
| @@ -1333,6 +1336,7 @@ static bool url_attach_existing(struct Curl_easy *data, | |
| (needle->scheme->protocol & PROTO_FAMILY_HTTP); | |
| #endif | |
| #endif | |
| + | match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; |
| /* Find a connection in the pool that matches what "data + needle" | |
| * requires. If a suitable candidate is found, it is attached to "data". */ | |