aws / aws/s2n-tls

Observability for TLS session resumption

Open
#1,002 0 comments 0 reactions 0 assignees View on GitHub
priority/medium size/medium type/api
Dominant language
C
Stars
4.8k
Forks
802
Avg merge
5d 22h
Merged PRs (30d)
33

Description

**Problem:**
Currently there are not many ways to get insights into session resumption metrics.
Such as:

1. If resumption was attempted. Currently it can be obtained it for session ids via `s2n_config_set_cache_retrieve_callback` (which is called when session id is provided). However, no way to check if a ticket was provided.
1. Successful resumption. Can be determined via `s2n_connection_is_session_resumed`.
1. Session age both resumed and expired. So it would be possible to build a histogram of session ages and tune key lifetime and rotation settings.
1. Failed resumptions by category:
- Expired session.
- Expired session ticket.
- Missing key.
- Unknown session ticket.
- Other (if any).

**Proposed Solution:**

Add methods for accessing the missing items.

Contributor guide

Open the contributing guide

Research direction

Start with s2n_config_set_cache_retrieve_callback and s2n_connection_is_session_resumed, then trace how session IDs and tickets are handled. Define the API surface needed to expose resumption attempts, session age, and categorized failures; done means callers can collect the listed metrics for resumed and expired sessions.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
observability-sre, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.