From: Olivier Houchard <ohouchard@haproxy.com>
Date: Mon, 9 Nov 2026 13:37:09 +0000 (+0100)
Subject: BUG/MEDIUM: ssl: don't use MSG_MORE for kTLS control records
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=17424b4a277e85b8779f92dca63fb73ec6b1899c;p=haproxy.git

BUG/MEDIUM: ssl: don't use MSG_MORE for kTLS control records

ha_ssl_write() also applies the application's SEND_MORE hint to kTLS
control records. Linux rejects TLS_SET_RECORD_TYPE with MSG_MORE with
EINVAL. If application data are still buffered, the failed close_notify
leaves the response tail unsent when the socket closes.
Fix that by just not using MSG_MORE for control records.

This should be backported up to 3.3.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index b9fcf36c8..7c8b954b6 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -344,7 +344,7 @@ static int ha_ssl_write(BIO *h, const char *buf, int num)
 	tmpbuf.area = (void *)(uintptr_t)buf;
 	tmpbuf.data = num;
 	tmpbuf.head = 0;
-	flags = (ctx->xprt_st & SSL_SOCK_SEND_MORE) ? CO_SFL_MSG_MORE : 0;
+	flags = (!msg_control && (ctx->xprt_st & SSL_SOCK_SEND_MORE)) ? CO_SFL_MSG_MORE : 0;
 	ret = ctx->xprt->snd_buf(ctx->conn, ctx->xprt_ctx, &tmpbuf, num, msg_control, msg_controllen, flags);
 	BIO_clear_retry_flags(h);
 #ifdef HA_USE_KTLS