quic: gate mbedtls_ssl_get_alpn_protocol on LWS_HAVE probe#3598
quic: gate mbedtls_ssl_get_alpn_protocol on LWS_HAVE probe#3598vikramdattu wants to merge 5 commits into
Conversation
context.c:1375, lws_plat_init return false because not enough memory,then call elops_destroy_context1_uv will crash.
crypto-quic.c calls mbedtls_ssl_get_alpn_protocol() unconditionally under LWS_WITH_MBEDTLS, but ssl_pm.c already guards the same call behind LWS_HAVE_mbedtls_ssl_get_alpn_protocol. With an mbedtls build that lacks the symbol (e.g. mbedtls 4.x where ALPN access changed), QUIC linking fails. Mirror the ssl_pm.c pattern so prot stays NULL and the surrounding if (plen) branch is a clean no-op when the probe says the symbol is unavailable.
|
@lws-team PTAL, would it make sense to add a CI entry just for this? Let me know if needed. |
lws-team
force-pushed
the
main
branch
24 times, most recently
from
c6ac0b1 to
a564cf6
Compare
lws-team
force-pushed
the
main
branch
2 times, most recently
from
3e8ec88 to
46886c8
Compare
|
Thanks, this is on main now. FWIW AFAIK no upstream mbedtls can do quic / h3. However I have a patch series https://libwebsockets.org/git/mbedtls/log?h=development which adds the missing pieces to upstream development branch, and it's tested in Linux + lws main branch and seems functional. I plan to look into your new idf-6 with this next week, if you're interested you're very welcome to try it first. |
|
Thanks for getting these onto main, Andy! For ESP-IDF v6 we're on stock IDF mbedTLS 4 and only use lws for the WSS signaling channel (plain TLS, no QUIC/H3). So the quic/h3 mbedtls series isn't in the path, and hence, I would not be able to have useful contributions there. My related changes mostly on quic were to guard the usage properly. |
2 participants
crypto-quic.ccallsmbedtls_ssl_get_alpn_protocol()unconditionallyunder
LWS_WITH_MBEDTLS, butssl_pm.c:1054already guards the samecall behind
LWS_HAVE_mbedtls_ssl_get_alpn_protocol. With an mbedtlsbuild that lacks the symbol (e.g. mbedtls 4.x where ALPN access
changed), QUIC linking fails with an undefined-symbol error.
Mirror the
ssl_pm.cpattern soprotstaysNULLand thesurrounding
if (plen)branch is a clean no-op when the probe saysthe symbol is unavailable. Two-line patch.