Sortix nightly manual
This manual documents Sortix nightly, a development build that has not been officially released. You can instead view this document in the latest official manual.
NAME
SSL_CTX_set_tlsext_ticket_key_cb — set a callback for session ticket processingSYNOPSIS
#include <openssl/tls1.h>SSL_CTX_set_tlsext_ticket_key_cb(SSL_CTX sslctx, int (*cb)(SSL *s, unsigned char key_name[16], unsigned char iv[EVP_MAX_IV_LENGTH], EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc));
DESCRIPTION
SSL_CTX_set_tlsext_ticket_key_cb() sets a callback function cb for handling session tickets for the ssl context sslctx. Session tickets, defined in RFC 5077, provide an enhanced session resumption capability where the server implementation is not required to maintain per session state.- 2
- This indicates that the ctx and hctx have been set and the session can continue on those parameters. Additionally it indicates that the session ticket is in a renewal period and should be replaced. The OpenSSL library will call cb again with an enc argument of 1 to set the new ticket (see RFC 5077 3.3 paragraph 2).
- 1
- This indicates that the ctx and hctx have been set and the session can continue on those parameters.
- 0
-
This indicates that it was not possible to set/retrieve a session ticket and the SSL/TLS session will continue by negotiating a set of cryptographic parameters or using the alternate SSL/TLS resumption mechanism, session ids.
- less than 0
- This indicates an error.
RETURN VALUES
This function returns 0 to indicate that the callback function was set.EXAMPLES
Reference Implementation:SSL_CTX_set_tlsext_ticket_key_cb(SSL, ssl_tlsext_ticket_key_cb); .... static int ssl_tlsext_ticket_key_cb(SSL *s, unsigned char key_name[16], unsigned char *iv, EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc) { if (enc) { /* create new session */ if (RAND_bytes(iv, EVP_MAX_IV_LENGTH)) return -1; /* insufficient random */ key = currentkey(); /* something you need to implement */ if (!key) { /* current key doesn't exist or isn't valid */ key = createkey(); /* something that you need to implement. * createkey needs to initialise a name, * an aes_key, a hmac_key, and optionally * an expire time. */ if (!key) /* key couldn't be created */ return 0; } memcpy(key_name, key->name, 16); EVP_EncryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, key->aes_key, iv); HMAC_Init_ex(&hctx, key->hmac_key, 16, EVP_sha256(), NULL); return 1; } else { /* retrieve session */ key = findkey(name); if (!key || key->expire < now()) return 0; HMAC_Init_ex(&hctx, key->hmac_key, 16, EVP_sha256(), NULL); EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, key->aes_key, iv ); if (key->expire < (now() - RENEW_TIME)) /* this session will get a new ticket * even though the current is still valid */ return 2; return 1; } }