Updated sts_handle_capability to return FALSE after logging the no‑TLS warning, so the insecure upgrade path doesn’t stop capability negotiation; it still returns TRUE only when an STS upgrade/reconnect is initiated or already in progress.

Confirmed inbound_cap_ls only returns early when sts_upgrade_triggered is set by sts_handle_capability, which now only happens for real upgrade/reconnect initiation or in‑progress upgrades.
This commit is contained in:
2026-02-04 12:42:04 -07:00
parent 2ecf1c18fb
commit 3d030a96b7

View File

@@ -588,12 +588,13 @@ sts_handle_capability (struct server *serv, const char *value)
serv->disconnect (serv->server_session, FALSE, -1); serv->disconnect (serv->server_session, FALSE, -1);
serv->connect (serv, host_copy, (int) port, serv->no_login); serv->connect (serv, host_copy, (int) port, serv->no_login);
} }
return TRUE;
#else #else
PrintTextf (serv->server_session, PrintTextf (serv->server_session,
_("STS upgrade requested for %s, but TLS is not available.\n"), _("STS upgrade requested for %s, but TLS is not available.\n"),
hostname); hostname);
return FALSE;
#endif #endif
return TRUE;
} }
if (!has_duration) if (!has_duration)