openresty / openresty/lua-resty-core

no ssl session caching happen, always new session ID!

Open
#402 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Lua
Stars
853
Forks
286
Avg merge
35m
Merged PRs (30d)
1

Description

hey there, i'm using ngx.ssl.session with memcached and want to implement distributed ssl session caching. i check that for every request ( when i open browser or send ctrl+F5 ) , new session id is coming from my browser to my openresty server so new key add to memcached and never cached sessions reused becuase session id is key of stored session object in memcached
also i'm using openssl 1.1.1f and openresty 1.21.4
what is my problem? can u help ?
thanks best regards
following is my openresty configuration

`
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;

lua_package_path '/usr/local/openresty/lua-resty-memcached/lib/?.lua;/usr/local/openresty/lualib/resty/?.lua;;';

    ssl_session_fetch_by_lua_block {
            local ssl_sess = require "ngx.ssl.session"
            local sess_id, err = ssl_sess.get_session_id()
            if not sess_id then
                    ngx.log(ngx.ERR, "failed to get session ID: ", err)
                    return
            end

            local function retrieve_by_id(sess_id)
                local memcached = require "resty.memcached"
                local memc, err = memcached:new()
                if not memc then
                        ngx.say("failed to instantiate memc: ", err)
                        return
                end
                memc:set_timeout(1000) -- 1 sec

                local ok, err = memc:connect("127.0.0.1", 11211)
                if not ok then
                        ngx.say("connection to memcache failed",err)
                        return
                end

                local ok, err = memc:get(sess_id)
                return ok
            end


            local sess, err = retrieve_by_id(sess_id)
            if not sess then
                    if err then
                            ngx.log(ngx.ERR, "failed to look up the session by ID ",sess_id, ": ", err)
                            return
                    end
                    return
            end

            local ok, err = ssl_sess.set_serialized_session(sess)
            ngx.log(ngx.ERR, "setting session by value: ",sess)
            if not ok then
                ngx.log(ngx.ERR, "failed to set SSL session for ID ", sess_id, ": ", err)
                return
            end


    }


    ssl_session_store_by_lua_block {
            local ssl_sess = require "ngx.ssl.session"

            local sess_id, err = ssl_sess.get_session_id()
            if not sess_id then
                    ngx.log(ngx.ERR, "failed to get session ID: ", err)
                    return
            end

            local sess, err = ssl_sess.get_serialized_session()
            if not sess then
                    ngx.log(ngx.ERR, "failed to get SSL session from the ","current connection: ", err)
                    return
            end
            ngx.log(ngx.ERR, "getting session by value: ",sess)


            local function my_save_ssl_session_by_id(sess_id, sess)
                    local memcached = require "resty.memcached"
                    local memc, err = memcached:new()
                    if not memc then
                            ngx.say("failed to instantiate memc: ", err)
                            return
                    end
                    memc:set_timeout(1000) -- 1 sec

                    local ok, err = memc:connect("127.0.0.1", 11211)
                    if not ok then
                            ngx.say("connection to memcached failed",err)
                            return
                    end

                    local ok, err = memc:set(sess_id, sess, 86400)
                    if not ok then
                            ngx.say("failed to set session and id on memcached: ",err)
                            return
                    end
                    return ok
            end


            local function save_it(premature, sess_id, sess)
                    local sess, err = my_save_ssl_session_by_id(sess_id, sess)
                    if not sess then
                            if err then
                                    ngx.log(ngx.ERR, "failed to save the session by ID ", sess_id, ": ", err)
                                    return ngx.exit(ngx.ERROR)
                            end
                            return
                    end
            end

            local ok, err = ngx.timer.at(0, save_it, sess_id, sess)
            if not ok then
                    ngx.log(ngx.ERR, "failed to create a 0-delay timer: ", err)
                    return
            end
    }


    server {

            listen 443 ssl;
            server_name test.com;

            ssl_certificate /root/test.com-cert.pem;
            ssl_certificate_key /root/test.com-key.pem;

            location / {
                    proxy_pass http://somewhere;
            }
    }

}
`

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the ssl_session_fetch_by_lua_block and ssl_session_store_by_lua_block in the provided OpenResty configuration, reproducing the behavior with OpenSSL 1.1.1f and OpenResty 1.21.4. Check the session lookup and storage path in memcached and determine why sessions are not reused; done means a documented cause and reproducible resolution.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.