Use the service's ssl_client_mode, not the last one configured

ssl_filter_open() copies ssl_client_mode into the service's
configuration, but the filters deciding when to begin TLS towards the
server read the global value instead: the last ssl_client_mode in the
configuration applied to every service, and a reload changed it for the
services still running.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit bab80ef684)
This commit is contained in:
Vladimir Dubrovin 2026-10-13 15:30:03 +03:00
parent 41edaa9757
commit c89a7b14c7

View File

@ -779,7 +779,7 @@ static FILTER_ACTION ssl_filter_client(void *fo, struct clientparam * param, voi
}
static FILTER_ACTION ssl_filter_connect(void *fc, struct clientparam * param){
if(PCONF->cli && !client_mode) {
if(PCONF->cli && !PCONF->client_mode) {
if(docli(param)) {
return REJECT;
}
@ -788,7 +788,7 @@ static FILTER_ACTION ssl_filter_connect(void *fc, struct clientparam * param){
}
static FILTER_ACTION ssl_filter_afterauth(void *fc, struct clientparam * param){
if(PCONF->cli && client_mode == 1) {
if(PCONF->cli && PCONF->client_mode == 1) {
if(docli(param)) {
return REJECT;
}
@ -806,7 +806,7 @@ static FILTER_ACTION ssl_filter_predata(void *fc, struct clientparam * param){
if(!param->redirectfunc) param->redirectfunc = proxyfunc;
return CONTINUE;
}
else if(PCONF->cli && client_mode == 2) {
else if(PCONF->cli && PCONF->client_mode == 2) {
if(docli(param)) {
return REJECT;
}
@ -815,7 +815,7 @@ static FILTER_ACTION ssl_filter_predata(void *fc, struct clientparam * param){
}
static FILTER_ACTION ssl_parent(struct clientparam * param){
if(PCONF->cli && client_mode == 3) {
if(PCONF->cli && PCONF->client_mode == 3) {
if(docli(param)) {
return REJECT;
}