]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: ssl: empty connections reported as errors.
authorEmeric Brun <ebrun@haproxy.com>
Thu, 16 Aug 2018 09:36:40 +0000 (11:36 +0200)
committerWilly Tarreau <w@1wt.eu>
Thu, 16 Aug 2018 09:59:59 +0000 (11:59 +0200)
Empty connection is reported as handshake error
even if dont-log-null is specified.

This bug affect is a regression du to:

BUILD: ssl: fix to build (again) with boringssl

New openssl 1.1.1 defines OPENSSL_NO_HEARTBEATS as boring ssl
so the test was replaced by OPENSSL_IS_BORINGSSL

This fix should be backported on 1.8

src/ssl_sock.c

index 7e8739a633b9a492dab66986fcb62d2dc85d7400..064d728bde540f64ee389ca71ffcf6c2419ab903 100644 (file)
@@ -5138,7 +5138,7 @@ int ssl_sock_handshake(struct connection *conn, unsigned int flag)
                                if (!errno && conn->flags & CO_FL_WAIT_L4_CONN)
                                        conn->flags &= ~CO_FL_WAIT_L4_CONN;
                                if (!conn->err_code) {
-#ifdef OPENSSL_NO_HEARTBEATS  /* BoringSSL */
+#ifdef OPENSSL_IS_BORINGSSL /* BoringSSL */
                                        conn->err_code = CO_ER_SSL_HANDSHAKE;
 #else
                                        int empty_handshake;
@@ -5222,7 +5222,7 @@ check_error:
                        if (!errno && conn->flags & CO_FL_WAIT_L4_CONN)
                                conn->flags &= ~CO_FL_WAIT_L4_CONN;
                        if (!conn->err_code) {
-#ifdef OPENSSL_NO_HEARTBEATS  /* BoringSSL */
+#ifdef OPENSSL_IS_BORINGSSL  /* BoringSSL */
                                conn->err_code = CO_ER_SSL_HANDSHAKE;
 #else
                                int empty_handshake;