bryancall commented on code in PR #13711: URL: https://github.com/apache/trafficserver/pull/13711#discussion_r4077171450
########## doc/admin-guide/files/records.yaml.en.rst: ########## @@ -4675,6 +4675,29 @@ SSL Termination Setting a value less than or equal to ``0`` effectively disables SSL session cache for the origin server. +.. ts:cv:: CONFIG proxy.config.ssl.origin_session_cache.max_session_size INT 8192 + + The largest origin session |TS| will place in the origin session cache, measured + as the size in bytes of its ASN.1 form. A session over this size is not cached, + and every connection to that origin performs a full handshake. + + A serialized session carries the origin's certificate and the session ticket the + origin issued, so the size is set by the origin, not by |TS|. Two common cases + run large: an origin with a big certificate, and any mutual-TLS origin, because a + stateless ticket has to encode the client certificate |TS| presented in order to + resume the authenticated session. The default accommodates both. + + The accepted range is 4096 to 65536. The floor is the size this was fixed at before + it became configurable, so no setting can cache less than |TS| always did; disable the + cache with :ts:cv:`proxy.config.ssl.origin_session_cache.enabled` instead. The ceiling + keeps the serialization buffer in ``SSLSessionDup()`` within the thread stack. + + Raise this if :ts:stat:`proxy.process.ssl.ssl_origin_session_cache_hit` stays at + zero while :ts:stat:`proxy.process.ssl.ssl_origin_session_cache_miss` climbs; the + ``ssl.origin_session_cache`` debug tag reports each session refused for its size. + Note that the cache holds up to :ts:cv:`proxy.config.ssl.origin_session_cache.size` + entries, so this value bounds the memory that cache can occupy. Review Comment: **Fixed in a3774a6.** Fair — the sentence claimed more than the setting delivers. It now says what is actually bounded, the serialized size accepted for insertion and the duplication buffer sized from it, and states that the in-memory footprint of the cached `SSL_SESSION` objects tracks that only approximately. ########## src/iocore/net/SSLSessionCache.h: ########## @@ -40,9 +40,16 @@ * surprised and this turns out to be too small, there is an assertion gaurd to Review Comment: **Fixed in a3774a6.** Corrected. Pre-existing, but it is in the comment directly above the constant this PR changes, so it may as well go now. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
