]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: ssl: Don't always treat SSL_ERROR_SYSCALL as unrecovarable.
authorOlivier Houchard <ohouchard@haproxy.com>
Tue, 13 Feb 2018 14:17:23 +0000 (15:17 +0100)
committerWilly Tarreau <w@1wt.eu>
Wed, 14 Feb 2018 17:44:28 +0000 (18:44 +0100)
commit7e2e505006feb8f3b4a7f9e0ac5e89b5a8c4895e
tree5ec37bda618f2030d2f555b063cc879420b911e4
parent41ccb194d1d14669e0592e5373ef5776f099e82a
BUG/MEDIUM: ssl: Don't always treat SSL_ERROR_SYSCALL as unrecovarable.

Bart Geesink reported some random errors appearing under the form of
termination flags SD in the logs for connections involving SSL traffic
to reach the servers.

Tomek Gacek and Mateusz Malek finally narrowed down the problem to commit
c2aae74 ("MEDIUM: ssl: Handle early data with OpenSSL 1.1.1"). It happens
that the special case of SSL_ERROR_SYSCALL isn't handled anymore since
this commit.

SSL_read() might return <= 0, and SSL_get_erro() return SSL_ERROR_SYSCALL,
without meaning the connection is gone. Before flagging the connection
as in error, check the errno value.

This should be backported to 1.8.
src/ssl_sock.c