Repository navigation
SSL session management #52353
Description
| BPO | 8106 |
|---|---|
| Nosy | @jcea, @pitrou, @giampaolo, @tiran, @lilydjwg, @dstufft |
| Dependencies | |
| Superseder |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2016-09-08.15:28:50.735>
created_at = <Date 2010-03-10.01:20:51.223>
labels = ['extension-modules', 'type-feature']
title = 'SSL session management'
updated_at = <Date 2016-09-08.15:28:50.733>
user = 'https://github.com/jcea'bugs.python.org fields:
activity = <Date 2016-09-08.15:28:50.733>
actor = 'christian.heimes'
assignee = 'none'
closed = True
closed_date = <Date 2016-09-08.15:28:50.735>
closer = 'christian.heimes'
components = ['Extension Modules']
creation = <Date 2010-03-10.01:20:51.223>
creator = 'jcea'
dependencies = ['8550']
files = []
hgrepos = []
issue_num = 8106
keywords = []
message_count = 5.0
messages = ['100777', '104368', '118438', '216685', '275049']
nosy_count = 10.0
nosy_names = ['jcea', 'janssen', 'pitrou', 'giampaolo.rodola', 'christian.heimes', 'lilydjwg', 'dstufft', 'fweimer', 'WadeC', 'mladen.milosevic']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'needs patch'
status = 'closed'
superseder = '19500'
type = 'enhancement'
url = 'https://bugs.python.org/issue8106'
versions = ['Python 3.6']
Activity
jcea commentedon Mar 10, 2010
Current SSL module doesn't manage SSL sessions, so any connection must do the full SSL handshake.
SSL/TLS support session restarting, when an old SSL context is used in a new connection, so you don't need to do the full SSL handshake.
This is a huge performance improvement.
I think SSL module should keep a small pool of sessions in core, to reuse. Better yet:
a) In SSL sockets, a method should be added to get the SSL context.
b) When creating a SSL socket, in client mode, a new optional parameter should be accepted, for a SSL context.
c) When creating a SSL socket, in server mode, we have two options: a) provide a dictionary or similar, with different contexts for possible clients connections or, better b) provide a callback the SSL module will call when getting an incoming connection, with a session ID as a parameter. The callback can provide a session SSL state or "None". This second approach allow for session management, like expiration or persistence to disk.
(the second option is equivalent to the first if the dict-like object includes this logic inside)
What do you think?.
pitrou commentedon Apr 27, 2010
bpo-8550 is probably a prerequisite for implementing this properly.
pitrou commentedon Oct 12, 2010
http://www.openssl.org/docs/ssl/SSL_CTX_set_session_cache_mode.html suggests that SSL session caching already occurs by default in server mode:
“SSL_SESS_CACHE_SERVER
A nice and easy thing to do would be to export the statistics given by http://www.openssl.org/docs/ssl/SSL_CTX_sess_number.html# .
pitrou commentedon Apr 17, 2014
Ok, I propose the following plan:
There is however, one complication (from OpenSSL man pages):
"""SSL_SESSION objects keep internal link information about the session cache list, when being inserted into one SSL_CTX object's session cache. One SSL_SESSION object, regardless of its reference count, must therefore only be used with one SSL_CTX object (and the SSL objects created from this SSL_CTX object)."""
So we would somehow also need to keep a pointer to the SSL context in our session object wrapper, and check that the session isn't reused with another context... (yuck)
tiran commentedon Sep 8, 2016
I'm going to implement sessions in bpo-19500.