]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG: ssl: send payload gets corrupted if tune.ssl.maxrecord is used
authorKevin Hester <kevinh@geeksville.com>
Thu, 30 May 2013 22:12:41 +0000 (15:12 -0700)
committerWilly Tarreau <w@1wt.eu>
Fri, 31 May 2013 10:17:04 +0000 (12:17 +0200)
commitcad8234b00c52ca1ec96f78158bc9a734fa73ec1
treee70b27eb438310149e9fb9fb3f14a8f59f04783a
parentba2ffd18b5e6b70896c8ab024b8271e1309fe606
BUG: ssl: send payload gets corrupted if tune.ssl.maxrecord is used

We were using "tune.ssl.maxrecord 2000" and discovered an interesting
problem: SSL data sent from the server to the client showed occasional
corruption of the payload data.

The root cause was:
When ssl_max_record is smaller than the requested send amount
the ring buffer wrapping wasn't properly adjusting the
number of bytes to send.

I solved this by selecting the initial size based on the number
of output bytes that can be sent without splitting _before_ checking
against ssl_max_record.
src/ssl_sock.c