From 565247ec5575eec188667d2365011eac723d8084 Mon Sep 17 00:00:00 2001 From: Olivier Houchard Date: Wed, 22 Jul 2026 18:33:28 +0200 Subject: [PATCH] BUG/MEDIUM: ssl: Spell HAVE_VANILLA_OPENSSL correctly Use HAVE_VANILLA_OPENSSL, which is what we actually define when we're linked against OpenSSL, and not USE_VANILLA_OPENSSL. Not using the right macro means we may start splicing with kTLS while there are still data available in OpenSSL's internal buffers, leading to data not being properly read. This should be backported up to 3.3. --- src/ssl_sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ssl_sock.c b/src/ssl_sock.c index 36a2d1887..aa495dc57 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -8350,7 +8350,7 @@ static int ssl_sock_get_capability(struct connection *conn, void *xprt_ctx, enum ret = arg; if ((ctx->flags & (SSL_SOCK_F_KTLS_RECV | SSL_SOCK_F_KTLS_SEND)) == (SSL_SOCK_F_KTLS_RECV | SSL_SOCK_F_KTLS_SEND)) { -#ifdef USE_VANILLA_OPENSSL +#ifdef HAVE_VANILLA_OPENSSL /* * We can splice yet if there's still * data in OpenSSL internal buffers -- 2.47.3