mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-12-02 16:21:27 +01:00
Code Issues Projects Releases Wiki Activity

MINOR: quic-be: Save the backend 0-RTT parameters

Browse Source 
For both TCP and QUIC connections, this is ssl_sess_new_srv_cb() callback which
is called when a new SSL session is created. Its role is to save the session to
be reused for the next sessions.

This patch modifies this callback to save the QUIC parameters to be reused
for the next 0-RTT sessions (or during SSL session resumption).

The already existing path_params->nego_alpn member is used to store the ALPN as
this is done for TCP alongside path_params->tps new quic_early_transport_params
struct used to save the QUIC transport parameters to be reused for 0-RTT sessions.
This commit is contained in:
Frederic Lecaille 2025-07-31 17:56:02 +02:00
parent 41e40eb431
commit 5309dfb56b
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/haproxy/server-t.h
View File

@ -325,6 +325,9 @@ enum renegotiate_mode {
struct path_parameters { struct path_parameters {
__decl_thread(HA_RWLOCK_T param_lock); __decl_thread(HA_RWLOCK_T param_lock);
char nego_alpn[MAX_ALPN_SIZE]; char nego_alpn[MAX_ALPN_SIZE];
#ifdef USE_QUIC
struct quic_early_transport_params tps;
#endif
}; };
struct proxy; struct proxy;

26
src/ssl_sock.c
View File

@ -4181,6 +4181,9 @@ static int ssl_sess_new_srv_cb(SSL *ssl, SSL_SESSION *sess)
int len; int len;
unsigned char *ptr; unsigned char *ptr;
const char *sni; const char *sni;
#ifdef USE_QUIC
struct quic_conn *qc = SSL_get_ex_data(ssl, ssl_qc_app_data_index);
#endif
/* determine the required len to store this new session */ /* determine the required len to store this new session */
len = i2d_SSL_SESSION(sess, NULL); len = i2d_SSL_SESSION(sess, NULL);
@ -4233,6 +4236,29 @@ static int ssl_sess_new_srv_cb(SSL *ssl, SSL_SESSION *sess)
/* if there wasn't an old sni but there is a new one */ /* if there wasn't an old sni but there is a new one */
s->ssl_ctx.reused_sess[tid].sni = strdup(sni); s->ssl_ctx.reused_sess[tid].sni = strdup(sni);
} }
#ifdef USE_QUIC
/* The selected ALPN is not stored without SSL session. */
if (qc && (s->ssl_ctx.options & SRV_SSL_O_EARLY_DATA) &&
s->ssl_ctx.reused_sess[tid].ptr) {
const char *alpn = NULL;
int len;
if (ssl_sock_get_alpn(conn, qc->xprt_ctx, &alpn, &len)) {
struct quic_early_transport_params *etps = &s->path_params.tps;
if (len < sizeof(s->path_params.nego_alpn) &&
(len != strlen(s->path_params.nego_alpn) ||
memcmp(&s->path_params.nego_alpn, alpn, len) != 0)) {
HA_RWLOCK_WRLOCK(SERVER_LOCK, &s->path_params.param_lock);
memcpy(&s->path_params.nego_alpn, alpn, len);
s->path_params.nego_alpn[len] = 0;
/* The transport parameters are not stored without ALPN */
qc_early_transport_params_cpy(qc, etps, &qc->tx.params);
HA_RWLOCK_WRUNLOCK(SERVER_LOCK, &s->path_params.param_lock);
}
}
}
#endif
HA_RWLOCK_WRUNLOCK(SSL_SERVER_LOCK, &s->ssl_ctx.reused_sess[tid].sess_lock); HA_RWLOCK_WRUNLOCK(SSL_SERVER_LOCK, &s->ssl_ctx.reused_sess[tid].sess_lock);
HA_RWLOCK_RDUNLOCK(SSL_SERVER_LOCK, &s->ssl_ctx.lock); HA_RWLOCK_RDUNLOCK(SSL_SERVER_LOCK, &s->ssl_ctx.lock);
} else { } else {