Maxim Dounin
January 25, 2022 10:10AM
details: https://hg.nginx.org/nginx/rev/e30f7dc7f143
branches:
changeset: 7997:e30f7dc7f143
user: Maxim Dounin <mdounin@mdounin.ru>
date: Mon Jan 24 17:18:50 2022 +0300
description:
SSL: always renewing tickets with TLSv1.3 (ticket #1892).

Chrome only uses TLS session tickets once with TLS 1.3, likely following
RFC 8446 Appendix C.4 recommendation. With OpenSSL, this works fine with
built-in session tickets, since these are explicitly renewed in case of
TLS 1.3 on each session reuse, but results in only two connections being
reused after an initial handshake when using ssl_session_ticket_key.

Fix is to always renew TLS session tickets in case of TLS 1.3 when using
ssl_session_ticket_key, similarly to how it is done by OpenSSL internally.

diffstat:

src/event/ngx_event_openssl.c | 16 +++++++++++++++-
1 files changed, 15 insertions(+), 1 deletions(-)

diffs (26 lines):

diff -r 5d88e2bf92b3 -r e30f7dc7f143 src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c Sat Jan 22 00:28:51 2022 +0300
+++ b/src/event/ngx_event_openssl.c Mon Jan 24 17:18:50 2022 +0300
@@ -4451,7 +4451,21 @@ ngx_ssl_session_ticket_key_callback(ngx_
return -1;
}

- return (i == 0) ? 1 : 2 /* renew */;
+ /* renew if TLSv1.3 */
+
+#ifdef TLS1_3_VERSION
+ if (SSL_version(ssl_conn) == TLS1_3_VERSION) {
+ return 2;
+ }
+#endif
+
+ /* renew if non-default key */
+
+ if (i != 0) {
+ return 2;
+ }
+
+ return 1;
}
}

_______________________________________________
nginx-devel mailing list -- nginx-devel@nginx.org
To unsubscribe send an email to nginx-devel-leave@nginx.org
Subject Author Views Posted

[nginx] SSL: always renewing tickets with TLSv1.3 (ticket #1892).

Maxim Dounin 233 January 25, 2022 10:10AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 93
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready