From: Olivier Houchard <ohouchard@haproxy.com>
Date: Wed, 19 Aug 2026 14:09:41 +0000 (+0200)
Subject: MINOR: ssl: Forbid using ssl-mode-async with per tgroup fd tables
X-Git-Tag: v3.5-dev5~6
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=8b99228f79244cb7c656b1e351f8a33858c31b80;p=haproxy.git

MINOR: ssl: Forbid using ssl-mode-async with per tgroup fd tables

ssl-mode-async requires file descriptors global to the process, which is
not true with tune.fd.tables per-thread-group, so just forbid it.
---

diff --git a/src/cfgparse-ssl.c b/src/cfgparse-ssl.c
index 9bf23cf4d..08a9ade9e 100644
--- a/src/cfgparse-ssl.c
+++ b/src/cfgparse-ssl.c
@@ -2675,6 +2675,21 @@ end:
 REGISTER_CONFIG_POST_SECTION("listen",   post_section_frontend_crt_init);
 REGISTER_CONFIG_POST_SECTION("frontend", post_section_frontend_crt_init);
 
+static int cfgparse_ssl_post_check(void)
+{
+	int err_code = 0;
+
+	if (global_ssl.async && (global.tune.options & GTUNE_NO_TG_FD_SHARING) &&
+	    (global.nbtgroups > 1)) {
+		err_code |= ERR_FATAL | ERR_ALERT;
+		ha_alert("tune.fd.tables per-thread-group is incompatible with ssl-mode-async\n");
+		goto out;
+	}
+out:
+	return err_code;
+}
+
+REGISTER_POST_CHECK(cfgparse_ssl_post_check);
 
 /* Note: must not be declared <const> as its list will be overwritten.
  * Please take care of keeping this list alphabetically sorted, doing so helps