commit 010941f87605e8219d25becdbc652350a687d6a2
author Olivier Houchard <ohouchard@haproxy.com> Fri May 03 20:56:19 2019 +0200
committer Olivier Houchard <cognet@ci0.org> Fri May 03 21:00:10 2019 +0200
tree 38c222fbc343a69a6bef0b3d70e1ec94465574b0
parent c40efc19194a7b21137f9d2b3a39e83003689fef

BUG/MEDIUM: ssl: Use the early_data API the right way.

We can only read early data if we're a server, and write if we're a client,
so don't attempt to mix both.

This should be backported to 1.8 and 1.9.

src/ssl_sock.c

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index b26c4fd..f2d80e8 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -5830,7 +5830,7 @@
 	if (!ctx)
 		goto out_error;
 
-	if (conn->flags & CO_FL_HANDSHAKE)
+	if (conn->flags & (CO_FL_HANDSHAKE | CO_FL_EARLY_SSL_HS))
 		/* a handshake was requested */
 		return 0;
 
@@ -5861,7 +5861,7 @@
 		}
 
 #if (OPENSSL_VERSION_NUMBER >= 0x10101000L)
-		if (!SSL_is_init_finished(ctx->ssl)) {
+		if (!SSL_is_init_finished(ctx->ssl) && conn_is_back(conn)) {
 			unsigned int max_early;
 
 			if (objt_listener(conn->target))
@@ -5876,8 +5876,7 @@
 			if (try + ctx->sent_early_data > max_early) {
 				try -= (try + ctx->sent_early_data) - max_early;
 				if (try <= 0) {
-					if (!(conn->flags & CO_FL_EARLY_SSL_HS))
-						conn->flags |= CO_FL_SSL_WAIT_HS | CO_FL_WAIT_L6_CONN;
+					conn->flags |= CO_FL_SSL_WAIT_HS | CO_FL_WAIT_L6_CONN;
 					break;
 				}
 			}
@@ -5885,10 +5884,8 @@
 			if (ret == 1) {
 				ret = written_data;
 				ctx->sent_early_data += ret;
-				if (objt_server(conn->target)) {
-					conn->flags &= ~CO_FL_EARLY_SSL_HS;
+				if (objt_server(conn->target))
 					conn->flags |= CO_FL_SSL_WAIT_HS | CO_FL_WAIT_L6_CONN | CO_FL_EARLY_DATA;
-				}
 
 			}