]> git.kaiwu.me - haproxy.git/commit
BUG/MINOR: ssl: Use the sequence number with kTLS and TLS 1.2
authorOlivier Houchard <ohouchard@haproxy.com>
Wed, 6 May 2026 16:32:51 +0000 (18:32 +0200)
committerWilliam Lallemand <wlallemand@irq6.net>
Wed, 6 May 2026 19:37:18 +0000 (21:37 +0200)
commit753a282373b450b5c4e558c85d22b226a49030f6
tree2665d0ec8db171f9cfb91abebfa6bb72fa9752d9
parent2be674418947d75e057a11f78c2c730513351865
BUG/MINOR: ssl: Use the sequence number with kTLS and TLS 1.2

When using TLS 1.2 and kTLS, use the sequence number as the explicit
nonce (what the linux kTLS API calls "iv"), as is strongly recommanded,
and done by most TLS implementations, instead of trying to generate a
pseudo random-number.
In practice, it changes nothing, because the kernel would override that
with the sequence number anyway, but there is no need to have confusing
code that uses statistical_prng_range() anyway.

This should be backported to 3.3.
src/ssl_sock.c