From: Olivier Houchard <ohouchard@haproxy.com>
Date: Wed, 22 Jul 2026 16:33:28 +0000 (+0200)
Subject: BUG/MEDIUM: ssl: Spell HAVE_VANILLA_OPENSSL correctly
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=565247ec5575eec188667d2365011eac723d8084;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: ssl: Spell HAVE_VANILLA_OPENSSL correctly

Use HAVE_VANILLA_OPENSSL, which is what we actually define when we're
linked against OpenSSL, and not USE_VANILLA_OPENSSL.
Not using the right macro means we may start splicing with kTLS while
there are still data available in OpenSSL's internal buffers, leading to
data not being properly read.

This should be backported up to 3.3.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 36a2d1887..aa495dc57 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -8350,7 +8350,7 @@ static int ssl_sock_get_capability(struct connection *conn, void *xprt_ctx, enum
 			ret = arg;
 			if ((ctx->flags & (SSL_SOCK_F_KTLS_RECV | SSL_SOCK_F_KTLS_SEND)) ==
 			                  (SSL_SOCK_F_KTLS_RECV | SSL_SOCK_F_KTLS_SEND)) {
-#ifdef USE_VANILLA_OPENSSL
+#ifdef HAVE_VANILLA_OPENSSL
 				/*
 				 * We can splice yet if there's still
 				 * data in OpenSSL internal buffers