]> git.kaiwu.me - haproxy.git/commit
projects / haproxy.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 466c7bd) | patch
BUG/MEDIUM: ssl: don't use MSG_MORE for kTLS control records
authorOlivier Houchard <ohouchard@haproxy.com>
Mon, 9 Nov 2026 13:37:09 +0000 (14:37 +0100)
committerOlivier Houchard <cognet@ci0.org>
Mon, 9 Nov 2026 13:44:38 +0000 (14:44 +0100)
commit17424b4a277e85b8779f92dca63fb73ec6b1899c
tree0214d824066835f56f8986dd33922eeb6a5c0b83tree | snapshot
parent466c7bd75f468e29139ca40a27f2ccb32a40931ecommit | diff
BUG/MEDIUM: ssl: don't use MSG_MORE for kTLS control records

ha_ssl_write() also applies the application's SEND_MORE hint to kTLS
control records. Linux rejects TLS_SET_RECORD_TYPE with MSG_MORE with
EINVAL. If application data are still buffered, the failed close_notify
leaves the response tail unsent when the socket closes.
Fix that by just not using MSG_MORE for control records.

This should be backported up to 3.3.
src/ssl_sock.c diff | blob | history
haproxy upstream