RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
haproxy/include/proto/shctx.h

52 lines
1.5 KiB
C
Raw Normal View History

MEDIUM: ssl: add shared memory session cache implementation. This SSL session cache was developped at Exceliance and is the same that was proposed for stunnel and stud. It makes use of a shared memory area between the processes so that sessions can be handled by any process. It is only useful when haproxy runs with nbproc > 1, but it does not hurt performance at all with nbproc = 1. The aim is to totally replace OpenSSL's internal cache. The cache is optimized for Linux >= 2.6 and specifically for x86 platforms. On Linux/x86, it makes use of futexes for inter-process locking, with some x86 assembly for the locked instructions. On other architectures, GCC builtins are used instead, which are available starting from gcc 4.1. On other operating systems, the locks fall back to pthread mutexes so libpthread is automatically linked. It is not recommended since pthreads are much slower than futexes. The lib is only linked if SSL is enabled.
2012-09-03 09:14:36 +00:00
/*
* shctx.h - shared context management functions for SSL
*
* Copyright (C) 2011-2012 EXCELIANCE
*
* Author: Emeric Brun - emeric@exceliance.fr
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*/
#ifndef SHCTX_H
#define SHCTX_H
#include <openssl/ssl.h>
#include <stdint.h>
MEDIUM: ssl: manage shared cache by blocks for huge sessions. Sessions using client certs are huge (more than 1 kB) and do not fit in session cache, or require a huge cache. In this new implementation sshcachesize set a number of available blocks instead a number of available sessions. Each block is large enough (128 bytes) to store a simple session (without client certs). Huge sessions will take multiple blocks depending on client certificate size. Note: some unused code for session sync with remote peers was temporarily removed.
2012-11-28 17:47:52 +00:00
#ifndef SHSESS_BLOCK_MIN_SIZE
#define SHSESS_BLOCK_MIN_SIZE 128
MEDIUM: ssl: add shared memory session cache implementation. This SSL session cache was developped at Exceliance and is the same that was proposed for stunnel and stud. It makes use of a shared memory area between the processes so that sessions can be handled by any process. It is only useful when haproxy runs with nbproc > 1, but it does not hurt performance at all with nbproc = 1. The aim is to totally replace OpenSSL's internal cache. The cache is optimized for Linux >= 2.6 and specifically for x86 platforms. On Linux/x86, it makes use of futexes for inter-process locking, with some x86 assembly for the locked instructions. On other architectures, GCC builtins are used instead, which are available starting from gcc 4.1. On other operating systems, the locks fall back to pthread mutexes so libpthread is automatically linked. It is not recommended since pthreads are much slower than futexes. The lib is only linked if SSL is enabled.
2012-09-03 09:14:36 +00:00
#endif
#ifndef SHSESS_MAX_DATA_LEN
MEDIUM: ssl: manage shared cache by blocks for huge sessions. Sessions using client certs are huge (more than 1 kB) and do not fit in session cache, or require a huge cache. In this new implementation sshcachesize set a number of available blocks instead a number of available sessions. Each block is large enough (128 bytes) to store a simple session (without client certs). Huge sessions will take multiple blocks depending on client certificate size. Note: some unused code for session sync with remote peers was temporarily removed.
2012-11-28 17:47:52 +00:00
#define SHSESS_MAX_DATA_LEN 4096
MEDIUM: ssl: add shared memory session cache implementation. This SSL session cache was developped at Exceliance and is the same that was proposed for stunnel and stud. It makes use of a shared memory area between the processes so that sessions can be handled by any process. It is only useful when haproxy runs with nbproc > 1, but it does not hurt performance at all with nbproc = 1. The aim is to totally replace OpenSSL's internal cache. The cache is optimized for Linux >= 2.6 and specifically for x86 platforms. On Linux/x86, it makes use of futexes for inter-process locking, with some x86 assembly for the locked instructions. On other architectures, GCC builtins are used instead, which are available starting from gcc 4.1. On other operating systems, the locks fall back to pthread mutexes so libpthread is automatically linked. It is not recommended since pthreads are much slower than futexes. The lib is only linked if SSL is enabled.
2012-09-03 09:14:36 +00:00
#endif
BUG/MEDIUM: ssl: Fix handshake failure on session resumption with client cert. Openssl session_id_context was not set on cached sessions so handshake returns an error.
2012-11-26 17:37:12 +00:00
#ifndef SHCTX_APPNAME
#define SHCTX_APPNAME "haproxy"
#endif
BUG/MAJOR: ssl: Fallback to private session cache if current lock mode is not supported. Process shared mutex seems not supported on some OSs (FreeBSD). This patch checks errors on mutex lock init to fallback on a private session cache (per process cache) in error cases.
2014-05-07 14:10:18 +00:00
#define SHCTX_E_ALLOC_CACHE -1
#define SHCTX_E_INIT_LOCK -2
MEDIUM: ssl: add shared memory session cache implementation. This SSL session cache was developped at Exceliance and is the same that was proposed for stunnel and stud. It makes use of a shared memory area between the processes so that sessions can be handled by any process. It is only useful when haproxy runs with nbproc > 1, but it does not hurt performance at all with nbproc = 1. The aim is to totally replace OpenSSL's internal cache. The cache is optimized for Linux >= 2.6 and specifically for x86 platforms. On Linux/x86, it makes use of futexes for inter-process locking, with some x86 assembly for the locked instructions. On other architectures, GCC builtins are used instead, which are available starting from gcc 4.1. On other operating systems, the locks fall back to pthread mutexes so libpthread is automatically linked. It is not recommended since pthreads are much slower than futexes. The lib is only linked if SSL is enabled.
2012-09-03 09:14:36 +00:00
/* Allocate shared memory context.
MEDIUM: ssl: manage shared cache by blocks for huge sessions. Sessions using client certs are huge (more than 1 kB) and do not fit in session cache, or require a huge cache. In this new implementation sshcachesize set a number of available blocks instead a number of available sessions. Each block is large enough (128 bytes) to store a simple session (without client certs). Huge sessions will take multiple blocks depending on client certificate size. Note: some unused code for session sync with remote peers was temporarily removed.
2012-11-28 17:47:52 +00:00
* <size> is the number of allocated blocks into cache (default 128 bytes)
* A block is large enough to contain a classic session (without client cert)
MINOR: ssl: Setting global tune.ssl.cachesize value to 0 disables SSL session cache.
2012-12-28 13:41:32 +00:00
* If <size> is set less or equal to 0, ssl cache is disabled.
MEDIUM: ssl: manage shared cache by blocks for huge sessions. Sessions using client certs are huge (more than 1 kB) and do not fit in session cache, or require a huge cache. In this new implementation sshcachesize set a number of available blocks instead a number of available sessions. Each block is large enough (128 bytes) to store a simple session (without client certs). Huge sessions will take multiple blocks depending on client certificate size. Note: some unused code for session sync with remote peers was temporarily removed.
2012-11-28 17:47:52 +00:00
* Set <use_shared_memory> to 1 to use a mapped shared memory instead
* of private. (ignored if compiled with USE_PRIVATE_CACHE=1).
* Returns: -1 on alloc failure, <size> if it performs context alloc,
* and 0 if cache is already allocated.
*/
MINOR: ssl: disable shared memory and locks on session cache if nbproc == 1 We don't needa to lock the memory when there is a single process. This can make a difference on small systems where locking is much more expensive than just a test.
2012-09-24 13:48:52 +00:00
int shared_context_init(int size, int use_shared_memory);
MEDIUM: ssl: add shared memory session cache implementation. This SSL session cache was developped at Exceliance and is the same that was proposed for stunnel and stud. It makes use of a shared memory area between the processes so that sessions can be handled by any process. It is only useful when haproxy runs with nbproc > 1, but it does not hurt performance at all with nbproc = 1. The aim is to totally replace OpenSSL's internal cache. The cache is optimized for Linux >= 2.6 and specifically for x86 platforms. On Linux/x86, it makes use of futexes for inter-process locking, with some x86 assembly for the locked instructions. On other architectures, GCC builtins are used instead, which are available starting from gcc 4.1. On other operating systems, the locks fall back to pthread mutexes so libpthread is automatically linked. It is not recommended since pthreads are much slower than futexes. The lib is only linked if SSL is enabled.
2012-09-03 09:14:36 +00:00
/* Set shared cache callbacks on an ssl context.
* Set session cache mode to server and disable openssl internal cache.
* Shared context MUST be firstly initialized */
void shared_context_set_cache(SSL_CTX *ctx);
#endif /* SHCTX_H */