tree 6a649926e86c7abe4f72bd1ebf1e98fe4911f4a7
parent 5dfdd4a63097d77035cb46e3a17d2fdfa56073c7
author Rob Allen <robert.allen1@ibm.com> 1556871092 +0100
committer William Lallemand <wlallemand@haproxy.org> 1557231115 +0200

BUG/MINOR: mworker/ssl: close OpenSSL FDs on reload

From OpenSSL 1.1.1, the default behaviour is to maintain open FDs to any
random devices that get used by the random number library. As a result,
those FDs leak when the master re-execs on reload; since those FDs are
not marked FD_CLOEXEC or O_CLOEXEC, they also get inherited by children.
Eventually both master and children run out of FDs.

OpenSSL 1.1.1 introduces a new function to control whether the random
devices are kept open. When clearing the keep-open flag, it also closes
any currently open FDs, so it can be used to clean-up open FDs too.
Therefore, a call to this function is made in mworker_reload prior to
re-exec.

The call is guarded by whether SSL is in use, because it will cause
initialisation of the OpenSSL random number library if that has not
already been done.

This should be backported to 1.9 and 1.8.