Use the service's ssl_client_mode, not the last one configured

ssl_filter_open() copies ssl_client_mode into the service's
configuration, but the filters deciding when to begin TLS towards the
server read the global value instead: the last ssl_client_mode in the
configuration applied to every service, and a reload changed it for the
services still running.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Vladimir Dubrovin 2026-10-13 15:30:03 +03:00
parent ea65f3834b
commit bab80ef684

View File

@ -781,7 +781,7 @@ static FILTER_ACTION ssl_filter_client(void *fo, struct clientparam * param, voi
}
static FILTER_ACTION ssl_filter_connect(void *fc, struct clientparam * param){
if(PCONF->cli && !client_mode) {
if(PCONF->cli && !PCONF->client_mode) {
if(docli(param)) {
return REJECT;
}
@ -790,7 +790,7 @@ static FILTER_ACTION ssl_filter_connect(void *fc, struct clientparam * param){
}
static FILTER_ACTION ssl_filter_afterauth(void *fc, struct clientparam * param){
if(PCONF->cli && client_mode == 1) {
if(PCONF->cli && PCONF->client_mode == 1) {
if(docli(param)) {
return REJECT;
}
@ -808,7 +808,7 @@ static FILTER_ACTION ssl_filter_predata(void *fc, struct clientparam * param){
if(!param->redirectfunc) param->redirectfunc = proxyfunc;
return CONTINUE;
}
else if(PCONF->cli && client_mode == 2) {
else if(PCONF->cli && PCONF->client_mode == 2) {
if(docli(param)) {
return REJECT;
}
@ -817,7 +817,7 @@ static FILTER_ACTION ssl_filter_predata(void *fc, struct clientparam * param){
}
static FILTER_ACTION ssl_parent(struct clientparam * param){
if(PCONF->cli && client_mode == 3) {
if(PCONF->cli && PCONF->client_mode == 3) {
if(docli(param)) {
return REJECT;
}