Hi again Karol, On Thu, Jul 23, 2026 at 07:34:36PM +0200, Olivier Houchard wrote: > Hi Karol, > > And it seems to work (HAProxy receives the data from the server and > > forwards > > it to the client). > > Of course it's not a proper solution but unfortunately I'm not familiar > > enough > > with the HAProxy architecture to make a proper fix. > > Thanks a lot for reporting! > There is code in ssl_sock_to_buf() to take care of exactly that problem, > but obviously you managed, with a bit of a different timing, to get that > case when haproxy switched to using splicing already, so it will do no > good here. I'm actually working in that area, and I have a fix that > should take care of that for OpenSSL already. Now I'm gonna fix that for > AWS-LC too, and I'll let you know when I think it should now work. >
It's now done, hopefully commit da4e71d6d647d6f60d24fbdaba489c04fd275844 will fix that problem. It is the same idea as to what you suggested, draining the record if splicing fails, just done a bit differently. Regards, Olivier
