tree 04c723a8f7d04bd7f0ac70f1a49f760744b72a92
parent eca6087ad17c734f665567a033e1400d775fe0d6
author Emmanuel Hocdet <manu@gandi.net> 1565021056 +0200
committer Willy Tarreau <w@1wt.eu> 1565293226 +0200
encoding latin1

BUG/MINOR: ssl: fix 0-RTT for BoringSSL

Since BoringSSL commit 777a2391 "Hold off flushing NewSessionTicket until write.",
0-RTT doesn't work. It appears that half-RTT data (response from 0-RTT) never
worked before the BoringSSL fix. For HAProxy the regression come from 010941f8
"BUG/MEDIUM: ssl: Use the early_data API the right way.": the problem is link to
the logic of CO_FL_EARLY_SSL_HS used for OpenSSL. With BoringSSL, handshake is
done before reading early data, 0-RTT data and half-RTT data are processed as
normal data: CO_FL_EARLY_SSL_HS/CO_FL_EARLY_DATA is not needed, simply remove
it.

This should be backported to all versions till 1.8.

(cherry picked from commit f967c31e75b087daeb1cc2cdba432df0b170f2f8)
Signed-off-by: Willy Tarreau <w@1wt.eu>