From 507e7be573b0a76fca597b75ff7cb27a66e7d865 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 24 Mar 2026 08:35:08 +0100 Subject: [PATCH] url: do not reuse a non-tls starttls connection if new requires TLS Reported-by: Arkadi Vainbrand Closes #21082 --- lib/url.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/url.c b/lib/url.c index 860009a7eb..cffd10215e 100644 --- a/lib/url.c +++ b/lib/url.c @@ -723,7 +723,7 @@ struct url_conn_match { BIT(want_proxy_ntlm_http); BIT(want_nego_http); BIT(want_proxy_nego_http); - + BIT(req_tls); /* require TLS use from a clear-text start */ BIT(wait_pipe); BIT(force_reuse); BIT(seen_pending_conn); @@ -875,6 +875,9 @@ static bool url_match_ssl_use(struct connectdata *conn, (get_protocol_family(conn->scheme) != m->needle->scheme->protocol)) return FALSE; } + else if(m->req_tls) + /* a clear-text STARTTLS protocol with required TLS */ + return FALSE; return TRUE; } @@ -1333,6 +1336,7 @@ static bool url_attach_existing(struct Curl_easy *data, (needle->scheme->protocol & PROTO_FAMILY_HTTP); #endif #endif + match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; /* Find a connection in the pool that matches what "data + needle" * requires. If a suitable candidate is found, it is attached to "data". */