From: Rafael Sadowski <rafael@sizeofvoid.org>
Subject: Re: Relayd doesn't like ecdsa
To: Mischa <openbsd@mlst.nl>
Cc: Omar Polo <op@omarpolo.com>, Theo Buehler <tb@theobuehler.org>,  Tech <tech@openbsd.org>
Date: Mon, 15 Jun 2026 16:09:11 +0200

On Wed Jun 03, 2026 at 12:45:27PM +0200, Mischa wrote:
> Hi Rafael,
> 
> Not sure if this is relevant in this thread but...
> I got this message yesterday and the relayd process stopped.
> This is with the initial patch which Omar provided, running on 7.9.
> 
> Jun  2 21:18:49 obsdams relayd[69181]: ecdsae_send_enc_imsg: priv ecdsa poll
> timeout, keyop #29f3
> Jun  2 21:18:49 obsdams relayd[69181]: fatal in relay: proc_dispatch: relay
> 1 got invalid imsg 61 peerid -1 from ca 1
> Jun  2 21:18:49 obsdams relayd[33605]: lost child: pid 69181 exited
> abnormally
> Jun  2 21:18:50 obsdams relayd[33597]: ecdsae_send_enc_imsg: imsgbuf_flush:
> Broken pipe
> 
> Mischa
> 

I think you ran into the RELAY_TLS_PRIV_TIMEOUT (hard-coded 1sec) and
Omas's diff do not handle IMSG_CA_ECDSA_SIGN in relay_dispatch_ca
properly:

diff --git a/relay.c b/relay.c
index 2f6ec5d..0c6dae0 100644
--- a/relay.c
+++ b/relay.c
@@ -1980,6 +1980,7 @@ relay_dispatch_ca(int fd, struct privsep_proc *p, struct imsg *imsg)
 	switch (imsg_get_type(imsg)) {
 	case IMSG_CA_PRIVENC:
 	case IMSG_CA_PRIVDEC:
+	case IMSG_CA_ECDSA_SIGN:
 		log_warnx("%s: priv%s result after timeout", __func__,
 		    imsg_get_type(imsg) == IMSG_CA_PRIVENC ? "enc" : "dec");
 		return (0);