mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 06:11:32 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: ssl: fix 0-RTT for BoringSSL

Browse Source 
Since BoringSSL commit 777a2391 "Hold off flushing NewSessionTicket until write.",
0-RTT doesn't work. It appears that half-RTT data (response from 0-RTT) never
worked before the BoringSSL fix. For HAProxy the regression come from 010941f8
"BUG/MEDIUM: ssl: Use the early_data API the right way.": the problem is link to
the logic of CO_FL_EARLY_SSL_HS used for OpenSSL. With BoringSSL, handshake is
done before reading early data, 0-RTT data and half-RTT data are processed as
normal data: CO_FL_EARLY_SSL_HS/CO_FL_EARLY_DATA is not needed, simply remove
it.

This should be backported to all versions till 1.8.
This commit is contained in:
Emmanuel Hocdet 2019-08-05 18:04:16 +02:00 committed by Olivier Houchard
parent 1263540fe8
commit f967c31e75
1 changed files with 2 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/ssl_sock.c
View File

@ -5297,7 +5297,7 @@ static int ssl_sock_init(struct connection *conn, void **xprt_ctx)
/* leave init state and start handshake */ /* leave init state and start handshake */
conn->flags |= CO_FL_SSL_WAIT_HS | CO_FL_WAIT_L6_CONN; conn->flags |= CO_FL_SSL_WAIT_HS | CO_FL_WAIT_L6_CONN;
#if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L) || defined(OPENSSL_IS_BORINGSSL) #if (HA_OPENSSL_VERSION_NUMBER >= 0x10101000L)
conn->flags |= CO_FL_EARLY_SSL_HS; conn->flags |= CO_FL_EARLY_SSL_HS;
#endif #endif
@ -5577,10 +5577,6 @@ reneg_ok:
} }
} }
#ifdef OPENSSL_IS_BORINGSSL
if ((conn->flags & CO_FL_EARLY_SSL_HS) && !SSL_in_early_data(ctx->ssl))
conn->flags &= ~CO_FL_EARLY_SSL_HS;
#endif
/* The connection is now established at both layers, it's time to leave */ /* The connection is now established at both layers, it's time to leave */
conn->flags &= ~(flag | CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN); conn->flags &= ~(flag | CO_FL_WAIT_L4_CONN | CO_FL_WAIT_L6_CONN);
return 1; return 1;
@ -5829,16 +5825,7 @@ static size_t ssl_sock_to_buf(struct connection *conn, void *xprt_ctx, struct bu
} else } else
#endif #endif
ret = SSL_read(ctx->ssl, b_tail(buf), try); ret = SSL_read(ctx->ssl, b_tail(buf), try);
#ifdef OPENSSL_IS_BORINGSSL
if (conn->flags & CO_FL_EARLY_SSL_HS) {
if (SSL_in_early_data(ctx->ssl)) {
if (ret > 0)
conn->flags |= CO_FL_EARLY_DATA;
} else {
conn->flags &= ~(CO_FL_EARLY_SSL_HS);
}
}
#endif
if (conn->flags & CO_FL_ERROR) { if (conn->flags & CO_FL_ERROR) {
/* CO_FL_ERROR may be set by ssl_sock_infocbk */ /* CO_FL_ERROR may be set by ssl_sock_infocbk */
goto out_error; goto out_error;