tree d4e00fd1e5b815feb14c255e4db29011937789db
parent 63b220d7d7afffc1c148d58de46c42ab3195f5f5
author Olivier Houchard <ohouchard@haproxy.com> 1579787856 +0100
committer Willy Tarreau <w@1wt.eu> 1579870430 +0100
encoding latin1

BUG/MEDIUM: 0rtt: Only consider the SSL handshake.

We only add the Early-data header, or get ssl_fc_has_early to return 1, if
we didn't already did the SSL handshake, as otherwise, we know the early
data were fine, and there's no risk of replay attack. But to do so, we
wrongly checked CO_FL_HANDSHAKE, we have to check CO_FL_SSL_WAIT_HS instead,
as we don't care about the status of any other handshake.

This should be backported to 2.1, 2.0, and 1.9.

When deciding if we should add the Early-Data header, or if the sample fetch
should return

(cherry picked from commit 220a26c31647b8cfd76f3922d08cb2e847e3009e)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 00ae17b75d20b30ab445970afb6a15f5d11cf257)
Signed-off-by: Willy Tarreau <w@1wt.eu>