Observability for TLS session resumption
- Dominant language
- C
- Stars
- 4.8k
- Forks
- 802
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 33
Description
**Problem:**
Currently there are not many ways to get insights into session resumption metrics.
Such as:
1. If resumption was attempted. Currently it can be obtained it for session ids via `s2n_config_set_cache_retrieve_callback` (which is called when session id is provided). However, no way to check if a ticket was provided.
1. Successful resumption. Can be determined via `s2n_connection_is_session_resumed`.
1. Session age both resumed and expired. So it would be possible to build a histogram of session ages and tune key lifetime and rotation settings.
1. Failed resumptions by category:
- Expired session.
- Expired session ticket.
- Missing key.
- Unknown session ticket.
- Other (if any).
**Proposed Solution:**
Add methods for accessing the missing items.
Contributor guide
Research direction
Start with s2n_config_set_cache_retrieve_callback and s2n_connection_is_session_resumed, then trace how session IDs and tickets are handled. Define the API surface needed to expose resumption attempts, session age, and categorized failures; done means callers can collect the listed metrics for resumed and expired sessions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- observability-sre, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100