From 289c4daaa2788c28d8d57def13233fe0c2d1716c Mon Sep 17 00:00:00 2001 From: Rongsong Shen Date: Sat, 30 May 2026 03:37:13 +0000 Subject: [PATCH] fix(ha-bootstrap): use TLS client context for outgoing vote RPCs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ha->ssl_ctx is created with TLS_server_method() (for incoming iomgr connections). vote_request_thread was calling SSL_connect() on this server-method context, which OpenSSL rejects immediately — causing every vote thread to fail with SSL_ERROR_SSL and goto deny. Fix: create a fresh TLS_client_method() context with SSL_VERIFY_NONE for each outgoing vote connection. This is safe because the election protocol is authenticated by the vote RPC payload (term, config_tag) not by the TLS certificate chain. The SSL_CTX_free after SSL_new is correct — SSL_new increments the reference count internally, so freeing the ctx leaves the ssl object valid. --- src/controller/ha.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/controller/ha.c b/src/controller/ha.c index 12641c03..de99c2c4 100644 --- a/src/controller/ha.c +++ b/src/controller/ha.c @@ -1080,9 +1080,15 @@ static void *vote_request_thread(void *arg) fcntl(sock, F_SETFL, flags & ~O_NONBLOCK); } - /* ── 2. SSL handshake ────────────────────────────────── */ + /* ── 2. SSL handshake (client side) ─────────────────── */ if (ha->ssl_ctx) { - ssl = SSL_new((SSL_CTX *)ha->ssl_ctx); + /* ha->ssl_ctx was created with TLS_server_method (for incoming connections). + * SSL_connect requires a client-method context, so create one on-demand. */ + SSL_CTX *client_ctx = SSL_CTX_new(TLS_client_method()); + if (!client_ctx) goto deny; + SSL_CTX_set_verify(client_ctx, SSL_VERIFY_NONE, NULL); + ssl = SSL_new(client_ctx); + SSL_CTX_free(client_ctx); /* ssl holds a reference; safe to free ctx */ if (!ssl) goto deny; SSL_set_fd(ssl, sock); int sr;