<div dir="ltr">Nate,<div><br><div>In the meanwhile I followed the thread and actually found your revised patches. I was able to apply them successfully.</div><div><br></div><div>I realised I didn't ran configure with the --with-http-ssl flag (since I don't use http) when building nginx. This explains why the ssl_psk_file was not recognized. After building http module, the parameter was recognized properly.</div><div><br></div><div>However, since I use stream and not http, I'll not be able to test this patch since it only wotks for ssl http module.</div><div><br></div><div>Regarding the PSK, in a DTLS use case I prefer loading the PSK file on startup in an in-memory store for example. Then, if some keys are to be changed while the server is running, the in-memory store is refreshed without stopping the server (think SIGHUP or reload). This avoid all clients being disconnected when the server is restarted to reload the PSK file.</div><div><br></div><div>Would any progress being made on this on the stream module I'll be able to give it a try.</div><div><br></div><div>Thank you ! </div><div><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2018-01-26 5:14 GMT+01:00 Karstens, Nate <span dir="ltr"><<a href="mailto:Nate.Karstens@garmin.com" target="_blank">Nate.Karstens@garmin.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_-3719311165620069113WordSection1">
<p class="MsoNormal">Sékine,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The link you sent is old, the latest set of patches is here:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="http://mailman.nginx.org/pipermail/nginx-devel/2017-September/010460.html" target="_blank">http://mailman.nginx.org/<wbr>pipermail/nginx-devel/2017-<wbr>September/010460.html</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Does that improve things?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">These were developed using TLS, not DTLS. I don’t have any experience with DTLS, so that might be unrelated.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">One of the conversations we had earlier in the development process was choosing between two different approaches to managing the PSK file:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="m_-3719311165620069113MsoListParagraph" style="margin-left:0in">The PSK file may be updated as needed (so it must be readable by the worker threads). This is the approach used with the current patches.<u></u><u></u></li><li class="m_-3719311165620069113MsoListParagraph" style="margin-left:0in">The PSK file is read into memory once at startup by the master process. This allows the file permissions to be read only for root, but requires the config file to be refreshed if the
PSK file is changed.<u></u><u></u></li></ol>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Would you mind providing feedback on which approach works better for your environment, and why? Sending it to the mailing list is preferred, or you can just reply to this email.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks, <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Nate<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b>From:</b> Sékine Coulibaly [mailto:<a href="mailto:scoulibaly@gmail.com" target="_blank">scoulibaly@gmail.com</a>] <br>
<b>Sent:</b> Thursday, January 25, 2018 10:23 AM<br>
<b>To:</b> Karstens, Nate <<a href="mailto:Nate.Karstens@garmin.com" target="_blank">Nate.Karstens@garmin.com</a>>; <a href="mailto:mdounin@mdounin.ru" target="_blank">mdounin@mdounin.ru</a><br>
<b>Subject:</b> Fwd: Add support for PSK cipher suites patch<u></u><u></u></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">---------- Forwarded message ----------<br>
From: <b>Sékine Coulibaly</b> <<a href="mailto:scoulibaly@gmail.com" target="_blank">scoulibaly@gmail.com</a>><br>
Date: 2018-01-25 17:07 GMT+01:00<br>
Subject: Add support for PSK cipher suites patch<br>
To: <a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<br>
<u></u><u></u></p>
<div>
<pre style="white-space:pre-wrap;font-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-decoration-style:initial;text-decoration-color:initial;word-spacing:0px"><span style="color:black">Nate,Maxim,<u></u><u></u></span></pre>
<pre style="white-space:pre-wrap;font-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-decoration-style:initial;text-decoration-color:initial;word-spacing:0px"><span style="color:black">I found a patch here (<a href="http://mailman.nginx.org/pipermail/nginx-devel/2017-September/010449.html" target="_blank">http://mailman.nginx.org/<wbr>pipermail/nginx-devel/2017-<wbr>September/010449.html</a>) regarding the PSK spport in Nginx. I can not make the new parameter ssl_psk_file work.<u></u><u></u></span></pre>
<pre style="white-space:pre-wrap;font-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-decoration-style:initial;text-decoration-color:initial;word-spacing:0px"><span style="color:black">I applied it to release-1.13.5 successfully.<u></u><u></u></span></pre>
<pre style="white-space:pre-wrap;font-variant-ligatures:normal;font-variant-caps:normal;text-align:start;text-decoration-style:initial;text-decoration-color:initial;word-spacing:0px"><span style="color:black">I updated my nginx.conf to <u></u><u></u></span></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial"><span style="color:black">stream {<u></u><u></u></span></pre>
<pre><span style="color:black"> upstream dtls_udp_upstreams {<u></u><u></u></span></pre>
<pre><span style="color:black"> hash $remote_addr:remote_port;<u></u><u></u></span></pre>
<pre><span style="color:black"> server <a href="http://preprod.mycorp.com:5685" target="_blank">preprod.mycorp.com:5685</a>;<u></u><u></u></span></pre>
<pre><span style="color:black"> }<u></u><u></u></span></pre>
<pre><span style="color:black"><u></u> <u></u></span></pre>
<pre><span style="color:black"><u></u> <u></u></span></pre>
<pre><span style="color:black"> server {<u></u><u></u></span></pre>
<pre><span style="color:black"> listen 5684 udp ssl;<u></u><u></u></span></pre>
<pre><span style="color:black"> ssl_protocols DTLSv1.2;<u></u><u></u></span></pre>
<pre><span style="color:black"> ssl_ciphers PSK-AES128-CBC-SHA;<u></u><u></u></span></pre>
<pre><span style="color:black"> ssl_psk_file /tmp/cred.txt;<u></u><u></u></span></pre>
<pre><span style="color:black"> ssl_certificate /tmp/server.pem;<u></u><u></u></span></pre>
<pre><span style="color:black"> ssl_certificate_key /tmp/server.key;<u></u><u></u></span></pre>
<pre><span style="color:black"> proxy_pass dtls_udp_upstreams;<u></u><u></u></span></pre>
<pre><span style="color:black"> }<u></u><u></u></span></pre>
<pre><span style="color:black"><u></u> <u></u></span></pre>
<pre><span style="color:black">My issue is that although /t</span>mp/cred.txt file exists, Nginx returns :<u></u><u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial">nginx: [emerg] unknown directive "ssl_psk_file" in /tmp/nginx.conf:26.<u></u><u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial"><u></u> <u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial">I checked the source files, it looks like the patch has been correctly applied.<u></u><u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial">Would you mind posting the complete/corrected patch I could apply and test ?<u></u><u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial">I'm using DTLS client with PSK load-balancer and I could experiment the setup.<u></u><u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial"><u></u> <u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial">My patching application looks like :<u></u><u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial"><span style="color:black">git checkout release-1.13.5</span><u></u><u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial"><span style="color:black">patch -p1 -i pskpatch.diff</span><u></u><u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial"><u></u> <u></u></pre>
<pre style="text-align:start;text-decoration-style:initial;text-decoration-color:initial"><span style="color:black">Thank you !</span><u></u><u></u></pre>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient(s) and contain information that may be Garmin confidential and/or Garmin legally privileged. If you have received this email in error, please notify the sender
by reply email and delete the message. Any disclosure, copying, distribution or use of this communication (including attachments) by someone other than the intended recipient is prohibited. Thank you.<br>
</font>
</div>
</blockquote></div><br></div>