BUG/MEDIUM: ssl: don't use MSG_MORE for kTLS control records

ha_ssl_write() also applies the application's SEND_MORE hint to kTLS
control records. Linux rejects TLS_SET_RECORD_TYPE with MSG_MORE with
EINVAL. If application data are still buffered, the failed close_notify
leaves the response tail unsent when the socket closes.
Fix that by just not using MSG_MORE for control records.

This should be backported up to 3.3.

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index b9fcf36c8cda40ec5faf294048d4e3950e04cba5..7c8b954b68f70f69b8ef4c10b1d08bef71aea79a 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -344,7 +344,7 @@ static int ha_ssl_write(BIO *h, const char *buf, int num)
        tmpbuf.area = (void *)(uintptr_t)buf;
        tmpbuf.data = num;
        tmpbuf.head = 0;
-       flags = (ctx->xprt_st & SSL_SOCK_SEND_MORE) ? CO_SFL_MSG_MORE : 0;
+       flags = (!msg_control && (ctx->xprt_st & SSL_SOCK_SEND_MORE)) ? CO_SFL_MSG_MORE : 0;
        ret = ctx->xprt->snd_buf(ctx->conn, ctx->xprt_ctx, &tmpbuf, num, msg_control, msg_controllen, flags);
        BIO_clear_retry_flags(h);
 #ifdef HA_USE_KTLS