mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 14:21:25 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: Add sample fetch which identifies if the SSL session has been resumed

Browse Source 
Signed-off-by: Nenad Merdanovic <nmerdan@anine.io>
This commit is contained in:
Nenad Merdanovic 2015-05-18 02:28:57 +02:00 committed by Willy Tarreau
parent c6985f0f6c
commit 26ea822190
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/configuration.txt
View File

@ -11962,6 +11962,10 @@ ssl_fc_has_sni : boolean
that the SSL library is build with support for TLS extensions enabled (check that the SSL library is build with support for TLS extensions enabled (check
haproxy -vv). haproxy -vv).
ssl_fc_is_resumed: boolean
Returns true if the SSL/TLS session has been resumed through the use of
SSL session cache or TLS tickets.
ssl_fc_npn : string ssl_fc_npn : string
This extracts the Next Protocol Negotiation field from an incoming connection This extracts the Next Protocol Negotiation field from an incoming connection
made via a TLS transport layer and locally deciphered by haproxy. The result made via a TLS transport layer and locally deciphered by haproxy. The result

14
src/ssl_sock.c
View File

@ -3716,6 +3716,19 @@ smp_fetch_ssl_fc_has_sni(const struct arg *args, struct sample *smp, const char
#endif #endif
} }
/* boolean, returns true if client session has been resumed */
static int
smp_fetch_ssl_fc_is_resumed(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct connection *conn = objt_conn(smp->sess->origin);
smp->type = SMP_T_BOOL;
smp->data.uint = (conn && conn->xprt == &ssl_sock) &&
conn->xprt_ctx &&
SSL_session_reused(conn->xprt_ctx);
return 1;
}
/* string, returns the used cipher if front conn. transport layer is SSL. /* string, returns the used cipher if front conn. transport layer is SSL.
* This function is also usable on backend conn if the fetch keyword 5th * This function is also usable on backend conn if the fetch keyword 5th
* char is 'b'. * char is 'b'.
@ -4876,6 +4889,7 @@ static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
{ "ssl_fc_cipher", smp_fetch_ssl_fc_cipher, 0, NULL, SMP_T_STR, SMP_USE_L5CLI }, { "ssl_fc_cipher", smp_fetch_ssl_fc_cipher, 0, NULL, SMP_T_STR, SMP_USE_L5CLI },
{ "ssl_fc_has_crt", smp_fetch_ssl_fc_has_crt, 0, NULL, SMP_T_BOOL, SMP_USE_L5CLI }, { "ssl_fc_has_crt", smp_fetch_ssl_fc_has_crt, 0, NULL, SMP_T_BOOL, SMP_USE_L5CLI },
{ "ssl_fc_has_sni", smp_fetch_ssl_fc_has_sni, 0, NULL, SMP_T_BOOL, SMP_USE_L5CLI }, { "ssl_fc_has_sni", smp_fetch_ssl_fc_has_sni, 0, NULL, SMP_T_BOOL, SMP_USE_L5CLI },
{ "ssl_fc_is_resumed", smp_fetch_ssl_fc_is_resumed, 0, NULL, SMP_T_BOOL, SMP_USE_L5CLI },
#ifdef OPENSSL_NPN_NEGOTIATED #ifdef OPENSSL_NPN_NEGOTIATED
{ "ssl_fc_npn", smp_fetch_ssl_fc_npn, 0, NULL, SMP_T_STR, SMP_USE_L5CLI }, { "ssl_fc_npn", smp_fetch_ssl_fc_npn, 0, NULL, SMP_T_STR, SMP_USE_L5CLI },
#endif #endif