<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Helvetica, Arial, sans-serif">Hello and many thanks for
your reply.</font><br>
<br>
<div class="moz-cite-prefix">On 10/10/2014 10:57 PM, Yichun Zhang
(agentzh) wrote:<br>
</div>
<blockquote
cite="mid:CAB4Tn6NCQtATx5w4E==+cq7+EH0AiNi4NYzSD3VSuXnBFBDrMw@mail.gmail.com"
type="cite">
<pre wrap="">Hello!
</pre>
<pre wrap="">Fortunately this does not have to be in the nginx core :)</pre>
</blockquote>
I came to the conclusion that this shouldn't even be in nginx core.
OpenSSL should be updated. Of course a few nginx changes would come
with that (exposing some configuration settings). There's more
that's problematic with session tickets in OpenSSL: only
AES128-CBC-SHA256 while ignoring chosen cipher. Let's hope that some
OpenSSL / C crack will update that at some point in the future.
Luckily we have now a few forks and ReSSL might be just the project
that brings us a real interface to work against.<br>
<br>
<blockquote
cite="mid:CAB4Tn6NCQtATx5w4E==+cq7+EH0AiNi4NYzSD3VSuXnBFBDrMw@mail.gmail.com"
type="cite">
<pre wrap="">We're using the ngx_lua module [1] to periodically update the session
ticket keys from external shared data services (like memcached).
To be more specific, we're using ngx_lua's init_worker_by_lua [2] to
create a re-occurring timer (via ngx.timer.at [3]) and fetch a new
ticket key from external data sources via the nonblocking
lua-resty-memcached library [4] and add that into the existing queue
used by OpenSSL via LuaJIT FFI [5].
Also, we use the lua_shared_dict [6] to reduce traffic to the external
data source online.
No patches are needed for the nginx core :)
In this "add-on" implementation, the ticket keys are also shared
across all our machines.
Best regards,
-agentzh
[1] <a class="moz-txt-link-freetext" href="https://github.com/openresty/lua-nginx-module">https://github.com/openresty/lua-nginx-module</a>
[2] <a class="moz-txt-link-freetext" href="https://github.com/openresty/lua-nginx-module#init_worker_by_lua">https://github.com/openresty/lua-nginx-module#init_worker_by_lua</a>
[3] <a class="moz-txt-link-freetext" href="https://github.com/openresty/lua-nginx-module#ngxtimerat">https://github.com/openresty/lua-nginx-module#ngxtimerat</a>
[4] <a class="moz-txt-link-freetext" href="https://github.com/openresty/lua-resty-memcached">https://github.com/openresty/lua-resty-memcached</a>
[5] <a class="moz-txt-link-freetext" href="http://luajit.org/ext_ffi.html">http://luajit.org/ext_ffi.html</a>
[6] <a class="moz-txt-link-freetext" href="https://github.com/openresty/lua-nginx-module#lua_shared_dict">https://github.com/openresty/lua-nginx-module#lua_shared_dict</a>
</pre>
</blockquote>
I'm currently working on a solution that only relies on a POSIX
compatible shell interpreter without any additions to nginx. The
only requirement is version 1.5.7 (which you have as well).<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/Fleshgrinder/nginx-session-ticket-key-rotation">https://github.com/Fleshgrinder/nginx-session-ticket-key-rotation</a><br>
<br>
It's work in progress right now and will only be Debian / Ubuntu
compatible when it's finished. I'll also integrate syncing in
clusters and compatibility with other operating systems if I find
the time.<br>
<br>
@anyone If you have the time to review my work and approach, please
do so. I'd love feedback!<br>
<br>
Regards Richard<br>
<br>
PS: You should open source your solution. :)<br>
</body>
</html>