From: Olivier Houchard <ohouchard@haproxy.com>
Date: Thu, 23 Jul 2026 23:12:33 +0000 (+0200)
Subject: BUILD: ssl: Do not use SSL3_MT_KEY_UPDATE, hardcode 24 instead
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=d129398c6cce9ed9be18ed66f6b07839e9d10252;p=thirdparty%2Fhaproxy.git

BUILD: ssl: Do not use SSL3_MT_KEY_UPDATE, hardcode 24 instead

Not every SSL lib provides SSL3_MT_KEY_UPDATE, so just hardcode 24
instead.
This should be backported up to 2.8, when
91004114fe8816f848025fe71def4ea23e72a5f6 will be backported.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index bba0e8bdb..c1bf57400 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -2243,7 +2243,7 @@ static void ssl_sock_keyupdate_ratelimit(int write_p, int version,
 	/* only count KeyUpdate messages received from the peer */
 	if (write_p || content_type != SSL3_RT_HANDSHAKE)
 		return;
-	if (len < 1 || ((const unsigned char *)buf)[0] != SSL3_MT_KEY_UPDATE)
+	if (len < 1 || ((const unsigned char *)buf)[0] != 24 /* SSL3_MT_KEY_UPDATE */)
 		return;
 
 	conn = ssl_sock_get_conn(ssl, &ctx);