BUG/MEDIUM: ssl: 0-RTT initialized at the wrong place for AWS-LC
authorWilliam Lallemand <wlallemand@haproxy.com>
Tue, 30 Jul 2024 12:54:44 +0000 (14:54 +0200)
committerChristopher Faulet <cfaulet@haproxy.com>
Tue, 3 Sep 2024 16:33:00 +0000 (18:33 +0200)
commit5072a968c37e1bf596e7ebd1a9dd127144cf366b
tree5d4b792a24618629baceec97db265486942330f3
parent5bf426baa43d7dcd908406d0c11354f14868e634
BUG/MEDIUM: ssl: 0-RTT initialized at the wrong place for AWS-LC

Revert patch fcc8255 "MINOR: ssl_sock: Early data disabled during
SSL_CTX switching (aws-lc)". The patch was done in the wrong callback
which is never built for AWS-LC, and applies options on the SSL_CTX
instead of the SSL, which should never be done elsewhere than in the
configuration parsing.

This was probably triggered by successfully linking haproxy against
AWS-LC without using USE_OPENSSL_AWSLC.

The patch also reintroduced SSL_CTX_set_early_data_enabled() in the
ssl_quic_initial_ctx() and ssl_sock_initial_ctx(). So the initial_ctx
does have the right setting, but it still needs to be applied to the
selected SSL_CTX in the clienthello, because we need it on the selected
SSL_CTX.

Must be backported to 3.0. (ssl_clienthello.c part was in ssl_sock.c)

(cherry picked from commit 1889b86561ee67696760111c6df5759c628430dc)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
src/quic_ssl.c
src/ssl_sock.c