tree 253bc79996383f96fb70539d7443867bb662a320
parent c192b0ab95ea05d85437a96766c46f1af14d7f69
author Olivier Houchard <ohouchard@haproxy.com> 1579787856 +0100
committer Olivier Houchard <cognet@ci0.org> 1579788071 +0100

BUG/MEDIUM: 0rtt: Only consider the SSL handshake.

We only add the Early-data header, or get ssl_fc_has_early to return 1, if
we didn't already did the SSL handshake, as otherwise, we know the early
data were fine, and there's no risk of replay attack. But to do so, we
wrongly checked CO_FL_HANDSHAKE, we have to check CO_FL_SSL_WAIT_HS instead,
as we don't care about the status of any other handshake.

This should be backported to 2.1, 2.0, and 1.9.

When deciding if we should add the Early-Data header, or if the sample fetch
should return