Skip to content

ngtcp2: fail handshake directly#21712

Closed
icing wants to merge 2 commits into
curl:masterfrom
icing:ngtcp2-handshake-fail-fix
Closed

ngtcp2: fail handshake directly#21712
icing wants to merge 2 commits into
curl:masterfrom
icing:ngtcp2-handshake-fail-fix

Conversation

@icing
Copy link
Copy Markdown
Contributor

@icing icing commented May 21, 2026

When certificate verification fails, error out of the handshake callback, forcing ngtcp2 to stop processing the connection any further.

When certificate verification fails, error out of the handshake
callback, forcing ngtcp2 to stop processing the connection any
further.
@github-actions github-actions Bot added the HTTP/3 h3 or quic related label May 21, 2026
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR changes the ngtcp2 HTTP/3 backend to abort QUIC processing immediately when TLS peer verification fails by failing out of the handshake-completed callback, and by consistently surfacing the stored verification error back to the caller.

Changes:

  • Return NGTCP2_ERR_CALLBACK_FAILURE from cf_ngtcp2_handshake_completed() when Curl_vquic_tls_verify_peer() fails.
  • Propagate ctx->tls_vrfy_result as the effective CURLcode result from cf_ngtcp2_recv(), cf_ngtcp2_send(), and cf_ngtcp2_connect() when set.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread lib/vquic/curl_ngtcp2.c
Comment thread lib/vquic/curl_ngtcp2.c
@bagder bagder closed this in 7b9613f May 22, 2026
outcast36 pushed a commit to greearb/curl that referenced this pull request Jun 3, 2026
When certificate verification fails, error out of the handshake
callback, forcing ngtcp2 to stop processing the connection any further.

Closes curl#21712
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

HTTP/3 h3 or quic related

Development

Successfully merging this pull request may close these issues.

3 participants