mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 06:11:32 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: ssl: Handle early data with BoringSSL

Browse Source 
BoringSSL early data differ from OpenSSL 1.1.1 implementation. When early
handshake is done, SSL_in_early_data report if SSL_read will be done on early
data. CO_FL_EARLY_SSL_HS and CO_FL_EARLY_DATA can be adjust accordingly.
This commit is contained in:
Emmanuel Hocdet 2017-11-23 12:40:07 +01:00 committed by Willy Tarreau
parent 45a66ccc55
commit ca6a957c5d
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/ssl_sock.c
View File

@ -5000,7 +5000,7 @@ static int ssl_sock_init(struct connection *conn)
/* leave init state and start handshake */ /* leave init state and start handshake */
conn->flags |= CO_FL_SSL_WAIT_HS | CO_FL_WAIT_L6_CONN; conn->flags |= CO_FL_SSL_WAIT_HS | CO_FL_WAIT_L6_CONN;
#if OPENSSL_VERSION_NUMBER >= 0x10101000L #if OPENSSL_VERSION_NUMBER >= 0x10101000L || defined(OPENSSL_IS_BORINGSSL)
conn->flags |= CO_FL_EARLY_SSL_HS; conn->flags |= CO_FL_EARLY_SSL_HS;
#endif #endif
@ -5271,6 +5271,10 @@ reneg_ok:
} }
} }
#ifdef OPENSSL_IS_BORINGSSL
if ((conn->flags & CO_FL_EARLY_SSL_HS) && !SSL_in_early_data(conn->xprt_ctx))
conn->flags &= ~CO_FL_EARLY_SSL_HS;
#endif
/* The connection is now established at both layers, it's time to leave */ /* The connection is now established at both layers, it's time to leave */
conn->flags &= ~(flag | CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN); conn->flags &= ~(flag | CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN);
return 1; return 1;
@ -5376,6 +5380,16 @@ static int ssl_sock_to_buf(struct connection *conn, struct buffer *buf, int coun
} else } else
#endif #endif
ret = SSL_read(conn->xprt_ctx, bi_end(buf), try); ret = SSL_read(conn->xprt_ctx, bi_end(buf), try);
#ifdef OPENSSL_IS_BORINGSSL
if (conn->flags & CO_FL_EARLY_SSL_HS) {
if (SSL_in_early_data(conn->xprt_ctx)) {
if (ret > 0)
conn->flags |= CO_FL_EARLY_DATA;
} else {
conn->flags &= ~(CO_FL_EARLY_SSL_HS | CO_FL_EARLY_DATA);
}
}
#endif
if (conn->flags & CO_FL_ERROR) { if (conn->flags & CO_FL_ERROR) {
/* CO_FL_ERROR may be set by ssl_sock_infocbk */ /* CO_FL_ERROR may be set by ssl_sock_infocbk */
goto out_error; goto out_error;