TS-4104: return 1 on a new ticket created

[oknet]

ref: https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_set_tlsext_ticket_key_cb.html

[bryancall]

Both HTTPD and NGiNX return a 0 in this case:
https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.9/modules/ssl/ssl_engine_kernel.c - search for ssl_callback_SessionTicket
https://trac.nginx.org/nginx/browser/nginx/src/event/ngx_event_openssl.c#L2867

However, looking at the documentation it does sound like a 1 should be returned. Does the behavior change when you return a 1?

OpenSSL docs:
https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_set_tlsext_ticket_key_cb.html

[oknet]

please checking log message in the JIRA Issue TS-4104 for the different between 0 and 1.

according the logs, handshake restart if return 0 or handshake finished if return 1.

[bryancall]

@oknet What log are you referring to? I ran ATS with traffic_server -T ssl and didn't see a difference in the debug messages. Also, I session ticket was created and able to be reused in both cases.

I was using openssl on the command line with:
openssl s_client -connect 127.0.0.1:4443 < /dev/null -sess_out sess
openssl s_client -connect 127.0.0.1:4443 < /dev/null -sess_in sess

[repodude]

Were you able to confirm issue and fix with wireshark? Should be easy enough to see if session ticket is generated in both cases. OpenSSL should set enc=1 when either no ticket is presented, so it could be triggered without setting a ticket on a test client. You should then be able to see the new session in ticket as plain text in the handshake.

[oknet]

@bryancall the traffic.out log for current ATS release:

[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) create ticket for a new session.
[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) ssl_callback_info ssl: 0x2b0544006840 where: 8193 ret: 1
[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) ssl_callback_info ssl: 0x2b0544006840 where: 8193 ret: 1
[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) ssl_callback_info ssl: 0x2b0544006840 where: 8193 ret: 1
[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) ssl_callback_info ssl: 0x2b0544006840 where: 8193 ret: 1
[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) ssl_callback_info ssl: 0x2b0544006840 where: 32 ret: 1
[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) ssl_callback_info ssl: 0x2b0544006840 where: 8194 ret: 1
[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) trace=FALSE
[Dec 28 21:01:12.742] Server {0x2b052fe4b700} DEBUG: (ssl) SSL server handshake completed successfully

the traffic.out log if return 1 here:

[Dec 30 12:47:16.838] Server {0x2b6ec9340700} DEBUG: (ssl) create ticket for a new session.
[Dec 30 12:47:16.838] Server {0x2b6ec9340700} DEBUG: (ssl) trace=FALSE
[Dec 30 12:47:16.838] Server {0x2b6ec9340700} DEBUG: (ssl) SSL server handshake completed successfully

[bryancall]

With and without the return code change I get:
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLUtils.cc:1972 (ssl_callback_session_ticket)> (ssl) create ticket for a new session.
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLUtils.cc:1617 (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x165d0c0 where: 8193 ret: 1
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLUtils.cc:1617 (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x165d0c0 where: 8193 ret: 1
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLUtils.cc:1617 (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x165d0c0 where: 8193 ret: 1
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLUtils.cc:1617 (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x165d0c0 where: 8193 ret: 1
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLUtils.cc:1617 (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x165d0c0 where: 32 ret: 1
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLUtils.cc:1617 (ssl_callback_info)> (ssl) ssl_callback_info ssl: 0x165d0c0 where: 8194 ret: 1
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLNetVConnection.cc:1112 (sslServerHandShakeEvent)> (ssl) trace=FALSE
[Jan 15 11:27:31.471] Server {0x7f231793e840} DEBUG: <SSLNetVConnection.cc:1133 (sslServerHandShakeEvent)> (ssl) SSL server handshake completed successfully

I am running Fedora 23 with updated package and openssl-1.0.2e-3.fc23.x86_64. What OS are you running?

My config:
[bcall@homer trafficserver]$ grep 4443 records.config ; tail -1 ssl_multicert.config
CONFIG proxy.config.http.server_ports STRING 8080 4443:ssl
dest_ip=* ssl_cert_name=localhost.crt ssl_key_name=localhost.key

[oknet]

my baseOS is Debian 7.8，but the openssl upgraded to 1.0.2d with testing