BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC

SSL_CTX_set_timeout() is documented on BoringSSL/AWS-LC as covering only
TLS 1.2 (or earlier) sessions. TLS 1.3 sessions on these libs have their
own, separate lifetime knob, SSL_CTX_set_session_psk_dhe_timeout(), which
HAProxy never called. As a result, "tune.ssl.lifetime" silently had no
effect on TLS 1.3 sessions when built against BoringSSL/AWS-LC, which
instead defaulted to those libs' hardcoded 2-day PSK/DHE timeout.

Also call SSL_CTX_set_session_psk_dhe_timeout() with the same configured
value when tune.ssl.lifetime is set, on BoringSSL/AWS-LC builds.

Note there is still a separate, hardcoded 7-day authentication timeout
underneath this on these libs, with no public API to override it, so the
effective cap there becomes min(tune.ssl.lifetime, 7 days) rather than an
exact match to tune.ssl.lifetime.

Must be backported in every stable branches.

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 582f67d8f2fa965419709bf5ee99c503307638d0..bfb8ce1b0ef14834648354defbc659bb600776b4 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4270,8 +4270,14 @@ ssl_sock_initial_ctx(struct bind_conf *bind_conf)
                mode |= SSL_MODE_ASYNC;
 #endif
        SSL_CTX_set_mode(ctx, mode);
-       if (global_ssl.life_time)
+       if (global_ssl.life_time) {
                SSL_CTX_set_timeout(ctx, global_ssl.life_time);
+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+               /* SSL_CTX_set_timeout() above only covers TLS1.2 and below on
+                * these libs, TLS1.3 has its own separate "psk_dhe" lifetime */
+               SSL_CTX_set_session_psk_dhe_timeout(ctx, global_ssl.life_time);
+#endif
+       }
 
 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
 # if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)