]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: ssl: revert empty handshake detection in OpenSSL <= 1.0.2
authorLukas Tribus <lukas@ltri.eu>
Mon, 8 Jul 2019 12:29:15 +0000 (14:29 +0200)
committerWilly Tarreau <w@1wt.eu>
Tue, 9 Jul 2019 02:47:18 +0000 (04:47 +0200)
commit497991613469b588b969f94aea2228720a1bddab
tree2a76da67c672ae0296ec784ff6fe4b4356dce866
parenta1ab97316f34dc3b478cd076b76b01c0e23b8769
BUG/MINOR: ssl: revert empty handshake detection in OpenSSL <= 1.0.2

Commit 54832b97 ("BUILD: enable several LibreSSL hacks, including")
changed empty handshake detection in OpenSSL <= 1.0.2 and LibreSSL,
from accessing packet_length directly (not available in LibreSSL) to
calling SSL_state() instead.

However, SSL_state() appears to be fully broken in both OpenSSL and
LibreSSL.

Since there is no possibility in LibreSSL to detect an empty handshake,
let's not try (like BoringSSL) and restore this functionality for
OpenSSL 1.0.2 and older, by reverting to the previous behavior.

Should be backported to 2.0.
src/ssl_sock.c