> On 28 Sep 2022, at 00:14, Maxim Dounin <mdounin@mdounin.ru> wrote:
>
> Hello!
>
> On Mon, Sep 26, 2022 at 02:11:17PM +0400, Sergey Kandaurov wrote:
>
>>> On 17 Sep 2022, at 00:58, Maxim Dounin <mdounin@mdounin.ru> wrote:
>>>
>>> On Thu, Sep 15, 2022 at 09:36:31AM +0400, Sergey Kandaurov wrote:
>>>
>>>>> On 26 Aug 2022, at 07:01, Maxim Dounin <mdounin@mdounin.ru> wrote:
>>>>>
>>>>> # HG changeset patch
>>>>> # User Maxim Dounin <mdounin@mdounin.ru>
>>>>> # Date 1661481945 -10800
>>>>> # Fri Aug 26 05:45:45 2022 +0300
>>>>> # Node ID 2cd8fbeb4edc5a99b725585edc02a16a8a0c503e
>>>>> # Parent 069a4813e8d6d7ec662d282a10f5f7062ebd817f
>>>>> SSL: disabled saving tickets to session cache.
>>>>>
>>>>> OpenSSL for TLSv1.3 tries to save tickets into session cache "because some
>>>>> applications just want to know about the creation of a session". To avoid
>>>>> trashing session cache with useless data, we do not save such sessions now.
>>>>>
>>>>
>>>> For the record, BoringSSL doesn't seem to call new_session_cb for TLSv1.3
>>>> at all, so there is no way to resume sessions with SSL_OP_NO_TICKET set.
>>>> In contrary, OpenSSL emits stateful tickets in this case, which contain
>>>> dummy session id used then as a session cache lookup key on server
>>>> (much like session ids in TLSv1.2)
>>>>
>>>> OTOH, without SSL_OP_NO_TICKET set, OpenSSL emits self-containing tickets
>>>> with enough info to resume session, so nothing to lookup in session cache.
>>>> The latter makes impractical storing something in session cache, except
>>>> to use the callback for things like tracking "the creation of a session".
>>>> Namely, OpenSSL puts session (i.e. something that SSL_get_session returns)
>>>> and supplementary info to session ticket message as the ticket value.
>>>
>>> It looks like you are trying to introduce "stateful tickets" and
>>> "self-containing tickets" terms, which is somewhat confusing
>>> unless carefully explained. OpenSSL itself tries to use terms
>>> "stateful tickets" and "stateless tickets", with the similar
>>> drawbacks.
>>
>> Indeed, OpenSSL SSL_OP_NO_TICKET documentation is what I refer to.
>> While OpenSSL terms may look odd, they are useful to describe the
>> difference (and tricks) in TLSv1.3 session resumption with and
>> without SSL_OP_NO_TICKET, as implemented to OpenSSL specifically.
>
> Sure. The problem is that OpenSSL's SSL_OP_NO_TICKET
> documentation is far from perfect, and I would rather avoid using
> it for anything but explanation of how SSL_OP_NO_TICKET works with
> TLSv1.3.
>
>>> A better explanation would be to follow generic term "session
>>> ticket", as originally introduced in RFC 4507 for TLS session
>>> resumption without server-side state.
>>>
>>> In these terms (as always used before introduction of TLSv1.3 and
>>> currently used in many places, including nginx own documentation
>>> and the source code) there are two basic mechanisms to resume
>>> sessions: server-side session cache and session tickets (used to
>>> resume sessions without server-side state).
>>>
>>> Without SSL_OP_NO_TICKET set, OpenSSL uses tickets as long as
>>> supported by the client.
>>>
>>> With SSL_OP_NO_TICKET set, OpenSSL does not use tickets, and uses
>>> server-side session cache instead (if configured).
>>>
>>> The only difference between TLSv1.3 and previous protocols is how
>>> session ids are sent to the client if server-side session cache is
>>> used. In case of SSL and TLS up to and including TLSv1.2, session
>>> ids are sent in the dedicated fields of the ServerHello and
>>> ClientHello handshake messages. In case of TLSv1.3, dedicated
>>> fields were removed, so session ids are sent in the
>>> NewSessionTicket messages ("a database lookup key" in terms of RFC
>>> 8446).
>>>
>>>> With these thoughts in mind, I think log could be clarified to emphasize:
>>>> - it's not tickets that are stored in cache
>>>> - with SSL_OP_NO_TICKET set TLSv1.3 session are still saved to lookup by id.
>>>
>>> Hope it is clear enough now.
>>
>> What I'd like to clarify is the difference between session and (session)
>> ticket applied to session cache. Ticket is a container used to envelope
>> session state (essentially, a session) and send in the NewSessionTicket
>> message "to resume sessions and avoid keeping per-client session state",
>> as seen in RFC 8446, 4.6.1 (and somewhat similar in 4507/5077).
>>
>> struct {
>> uint32 ticket_lifetime;
>> uint32 ticket_age_add;
>> opaque ticket_nonce<0..255>;
>> opaque ticket<1..2^16-1>;
>> Extension extensions<0..2^16-2>;
>> } NewSessionTicket;
>>
>> So it looks inappropriate to say that tickets are saved in cache.
>> OTOH, "ticket" can be seen a correct wording if speaking in terms
>> of NewSessionTicket ticket field, or in contrast to "session id"
>> synthesized by OpenSSL for the SSL_OP_NO_TICKET case in TLSv1.3.
>> In that sense, I'm fine with using "ticket" (not to say changing
>> "ticket" to "session" or "session state" brings a tautology).
>> However this looks not so important to spend more time on this,
>> I'm fine with either case.
>
> Sure, it would be more correct to say something like "OpenSSL
> tries to save sessions into session cache while using tickets for
> stateless session resumption" (mostly borrowed from
> SSL_OP_NO_TICKET documentation in OpenSSL 1.0.2[1]). I've used
> "tickets" instead of "sessions using tickets for stateless session
> resumption", as it's clearly shorter and only slightly less correct.
>
> [1] https://www.openssl.org/docs/man1.0.2/man3/SSL_set_options.html
>
> Updated with the above wording for clarity (still with the same
> summary line though, for simplicity):
>
> # HG changeset patch
> # User Maxim Dounin <mdounin@mdounin.ru>
> # Date 1664290542 -10800
> # Tue Sep 27 17:55:42 2022 +0300
> # Node ID e6b5a2aa0dd91a7f497014359e19458c78f480b3
> # Parent a423e314c22fe99fe9faf28f033c266426993105
> SSL: disabled saving tickets to session cache.
>
> OpenSSL tries to save TLSv1.3 sessions into session cache even when using
> tickets for stateless session resumption, "because some applications just
> want to know about the creation of a session". To avoid trashing session
> cache with useless data, we do not save such sessions now.
>
> diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
> --- a/src/event/ngx_event_openssl.c
> +++ b/src/event/ngx_event_openssl.c
> @@ -3818,6 +3818,23 @@ ngx_ssl_new_session(ngx_ssl_conn_t *ssl_
> ngx_ssl_session_cache_t *cache;
> u_char buf[NGX_SSL_MAX_SESSION_SIZE];
>
> +#ifdef TLS1_3_VERSION
> +
> + /*
> + * OpenSSL tries to save TLSv1.3 sessions into session cache
> + * even when using tickets for stateless session resumption,
> + * "because some applications just want to know about the creation
> + * of a session"; do not cache such sessions
> + */
> +
> + if (SSL_version(ssl_conn) == TLS1_3_VERSION
> + && (SSL_get_options(ssl_conn) & SSL_OP_NO_TICKET) == 0)
> + {
> + return 0;
> + }
> +
> +#endif
> +
> len = i2d_SSL_SESSION(sess, NULL);
>
> /* do not cache too big session */
>

Looks good.

--
Sergey Kandaurov

_______________________________________________
nginx-devel mailing list -- nginx-devel@nginx.org
To unsubscribe send an email to nginx-devel-leave@nginx.org