bryancall commented on code in PR #13711:
URL: https://github.com/apache/trafficserver/pull/13711#discussion_r4076585665
##########
src/iocore/net/SSLSessionCache.cc:
##########
@@ -54,12 +54,12 @@ SSLOriginSessionCache::~SSLOriginSessionCache()
TS_NO_THREAD_SAFETY_ANALYSIS //
void
SSLOriginSessionCache::insert_session(const std::string &lookup_key,
SSL_SESSION *sess, SSL *ssl)
{
- size_t len = i2d_SSL_SESSION(sess, nullptr); // make sure we're not going to
need more than SSL_MAX_ORIG_SESSION_SIZE bytes
+ size_t len = i2d_SSL_SESSION(sess, nullptr);
/* do not cache a session that's too big. */
- if (len > static_cast<size_t>(SSL_MAX_ORIG_SESSION_SIZE)) {
- Dbg(dbg_ctl_ssl_origin_session_cache, "Unable to save SSL session because
size of %zd exceeds the max of %d", len,
- SSL_MAX_ORIG_SESSION_SIZE);
+ if (len > SSLConfigParams::origin_session_max_size) {
+ Dbg(dbg_ctl_ssl_origin_session_cache, "Unable to save SSL session because
size of %zd exceeds the max of %zu", len,
+ SSLConfigParams::origin_session_max_size);
return;
} else if (len == 0) {
Dbg(dbg_ctl_ssl_origin_session_cache, "Unable to save SSL session because
size is 0");
Review Comment:
**Fixing — done in ff7ca82.** Correct, and it predates this PR.
`i2d_SSL_SESSION()` returns an `int` and reports failure as a non-positive
value, so assigning straight into a `size_t` turned a serialization failure
into a very large length that then misreported itself as an oversized session —
and the old `len == 0` branch could never catch it, because the wrap is never
zero. Now captured as an `int`, `<= 0` treated as failure, and only widened
after that.
##########
src/records/RecordsConfig.cc:
##########
@@ -1245,6 +1245,9 @@ static constexpr RecordElement RecordsConfig[] =
,
{RECT_CONFIG, "proxy.config.ssl.origin_session_cache.size", RECD_INT,
"10240", RECU_RESTART_TS, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
,
+ {RECT_CONFIG, "proxy.config.ssl.origin_session_cache.max_session_size",
RECD_INT, "8192", RECU_RESTART_TS, RR_NULL,
+ RECC_INT, "[0-65536]", RECA_NULL}
Review Comment:
**Fixing — done in ff7ca82, and tightened further than suggested.** The
floor is now **4096** rather than 1. That is the value the limit was fixed at
before it became configurable, so no setting can cache less than ATS always
did, and `proxy.config.ssl.origin_session_cache.enabled` remains the way to
disable the cache. Both bounds and the reason for each are documented in the
admin guide.
##########
tests/gold_tests/tls/tls_origin_session_reuse_large.test.py:
##########
@@ -0,0 +1,145 @@
+'''
+'''
Review Comment:
**Fixing — done in ff7ca82.** Removed. (It was copied from the existing
`tls_origin_session_reuse.test.py`, which carries the same empty docstring; not
worth propagating.)
##########
src/records/RecordsConfig.cc:
##########
@@ -1245,6 +1245,9 @@ static constexpr RecordElement RecordsConfig[] =
,
{RECT_CONFIG, "proxy.config.ssl.origin_session_cache.size", RECD_INT,
"10240", RECU_RESTART_TS, RR_NULL, RECC_NULL, nullptr, RECA_NULL}
,
+ {RECT_CONFIG, "proxy.config.ssl.origin_session_cache.max_session_size",
RECD_INT, "8192", RECU_RESTART_TS, RR_NULL,
+ RECC_INT, "[0-65536]", RECA_NULL}
Review Comment:
**Not fixing — this reading is incorrect.** `RecordElement` takes the
validation *kind* and its *expression* as two separate fields, so an entry with
a real range is nine fields and looks exactly like this one:
```c
{RECT_CONFIG, "proxy.config.mlock_enabled", RECD_INT, "0", RECU_RESTART_TS,
RR_NULL, RECC_INT, "[0-2]", RECA_NULL}
```
The `nullptr` you are comparing against in the preceding
`origin_session_cache.size` entry *is* that expression slot — it is null there
because that entry uses `RECC_NULL` and has no range to express. Here the slot
holds `"[4096-65536]"`, so nothing is missing and `RECA_NULL` binds to the
access field as intended. Resolving as invalid.
##########
src/iocore/net/P_SSLConfig.h:
##########
@@ -73,6 +73,7 @@ struct SSLConfigParams : public ConfigInfo {
int verify_depth;
int ssl_origin_session_cache{0};
int ssl_origin_session_cache_size{0};
+ int ssl_origin_session_max_size{0};
Review Comment:
**Fixing**, in the next push. Combined with @bneradt's P2 below — enforcing
the range at the assignment means this value wants a wider unsigned type
anyway, so the two changes land together rather than separately.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
