comparison src/event/ngx_event_openssl.h @ 8084:0f3d98e4bcc5

SSL: automatic rotation of session ticket keys. As long as ssl_session_cache in shared memory is configured, session ticket keys are now automatically generated in shared memory, and rotated periodically. This can be beneficial from forward secrecy point of view, and also avoids increased CPU usage after configuration reloads. This also helps BoringSSL to properly resume sessions in configurations with multiple worker processes and no ssl_session_ticket_key directives, as BoringSSL tries to automatically rotate session ticket keys and does this independently in different worker processes, thus breaking session resumption between worker processes.
author Maxim Dounin <mdounin@mdounin.ru>
date Wed, 12 Oct 2022 20:14:53 +0300
parents c71e113b57d8
children 043006e5a0b1
comparison
equal deleted inserted replaced
8083:e13a271bdd40 8084:0f3d98e4bcc5
145 #endif 145 #endif
146 }; 146 };
147 147
148 148
149 typedef struct { 149 typedef struct {
150 u_char name[16];
151 u_char hmac_key[32];
152 u_char aes_key[32];
153 time_t expire;
154 unsigned size:8;
155 unsigned shared:1;
156 } ngx_ssl_ticket_key_t;
157
158
159 typedef struct {
150 ngx_rbtree_t session_rbtree; 160 ngx_rbtree_t session_rbtree;
151 ngx_rbtree_node_t sentinel; 161 ngx_rbtree_node_t sentinel;
152 ngx_queue_t expire_queue; 162 ngx_queue_t expire_queue;
163 ngx_ssl_ticket_key_t ticket_keys[2];
153 time_t fail_time; 164 time_t fail_time;
154 } ngx_ssl_session_cache_t; 165 } ngx_ssl_session_cache_t;
155
156
157 #ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB
158
159 typedef struct {
160 size_t size;
161 u_char name[16];
162 u_char hmac_key[32];
163 u_char aes_key[32];
164 } ngx_ssl_ticket_key_t;
165
166 #endif
167 166
168 167
169 #define NGX_SSL_SSLv2 0x0002 168 #define NGX_SSL_SSLv2 0x0002
170 #define NGX_SSL_SSLv3 0x0004 169 #define NGX_SSL_SSLv3 0x0004
171 #define NGX_SSL_TLSv1 0x0008 170 #define NGX_SSL_TLSv1 0x0008