Skip to content

Fix HTTP/2 stalls on large TLS records

Latest

Choose a tag to compare

@bneradt bneradt released this 26 Oct 14:12
ba726f6

Bug fixes

  • verifier-server no longer stalls on HTTP/2 requests that end inside a large TLS record. When a peer sent a TLS record larger than the server's 10 KiB read buffer, OpenSSL kept the rest of the record decrypted where poll(2) could not see it. If a request's END_STREAM was in that tail, the server waited on an idle socket and never answered the request. Proxies that merge many small DATA frames into one record under load hit this, and it caused intermittent hangs in ATS's http2_flow_control test. The server now checks OpenSSL's buffered data before it polls the socket. (#413)

    Thanks to @bryancall for finding and fixing this issue.