[Bug 295942] SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE data corruption on files > 128KB

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295942

[email protected] changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |gs-bugs.freebsd.org@gluelog
                   |                            |ic.com

--- Comment #9 from [email protected] ---
Possible solution:
ktls broken in 15.0-RELEASE-p10
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296498

---

Information for reproduction testing with lighttpd:

lighttpd mod_openssl uses kTLS in *two* ways: to enable openssl option
SSL_OP_ENABLE_KTLS, and to use SSL_sendfile() on files.
Both are enabled by default when lighttpd checks system "kern.ipc.tls.enable"
at lighttpd startup.  Both can be disabled with lighttpd.conf configuration:
ssl.openssl.ssl-conf-cmd += ("Options" => "-KTLS")
and then restarting lighttpd.

If you want to test if the issue you are seeing is limited to SSL_sendfile,
then to keep SSL_OP_ENABLE_KTLS, but disable lighttpd SSL_sendfile on files,
then you can rebuild lighttpd with this patch:

--- a/src/mod_openssl.c
+++ b/src/mod_openssl.c
@@ -4744,7 +4744,7 @@ connection_read_cq_ssl (connection * const con,
chunkqueue * const cq, off_t max
          * so check each time for HTTP/2 so that we do not re-enable */
         if (hctx->r->http_version < HTTP_VERSION_2
             && BIO_get_ktls_send(SSL_get_wbio(hctx->ssl)) > 0)
-            con->network_write = connection_write_cq_ssl_ktls;
+            con->network_write = connection_write_cq_ssl;
       #endif
       #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
         if (hctx->alpn) {

-- 
You are receiving this mail because:
You are the assignee for the bug.