]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: ssl: 0-RTT initialized at the wrong place for AWS-LC
authorWilliam Lallemand <wlallemand@haproxy.com>
Tue, 30 Jul 2024 12:54:44 +0000 (14:54 +0200)
committerWilliam Lallemand <wlallemand@haproxy.com>
Tue, 30 Jul 2024 16:53:08 +0000 (18:53 +0200)
commit1889b86561ee67696760111c6df5759c628430dc
tree64bd01c419a0d8f39dec7f136e2ee654c5f680cd
parent56eefd6827b42afcefed7cc41d2cc38f5c1a2172
BUG/MEDIUM: ssl: 0-RTT initialized at the wrong place for AWS-LC

Revert patch fcc8255 "MINOR: ssl_sock: Early data disabled during
SSL_CTX switching (aws-lc)". The patch was done in the wrong callback
which is never built for AWS-LC, and applies options on the SSL_CTX
instead of the SSL, which should never be done elsewhere than in the
configuration parsing.

This was probably triggered by successfully linking haproxy against
AWS-LC without using USE_OPENSSL_AWSLC.

The patch also reintroduced SSL_CTX_set_early_data_enabled() in the
ssl_quic_initial_ctx() and ssl_sock_initial_ctx(). So the initial_ctx
does have the right setting, but it still needs to be applied to the
selected SSL_CTX in the clienthello, because we need it on the selected
SSL_CTX.

Must be backported to 3.0. (ssl_clienthello.c part was in ssl_sock.c)
src/quic_ssl.c
src/ssl_clienthello.c
src/ssl_sock.c