From: William Lallemand Date: Tue, 18 Aug 2026 11:32:48 +0000 (+0000) Subject: BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC X-Git-Tag: v3.5-dev5~22 X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=819b73ce0a8a93f10d0b283e3c9343ebdc429601;p=haproxy.git BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC SSL_CTX_set_timeout() is documented on BoringSSL/AWS-LC as covering only TLS 1.2 (or earlier) sessions. TLS 1.3 sessions on these libs have their own, separate lifetime knob, SSL_CTX_set_session_psk_dhe_timeout(), which HAProxy never called. As a result, "tune.ssl.lifetime" silently had no effect on TLS 1.3 sessions when built against BoringSSL/AWS-LC, which instead defaulted to those libs' hardcoded 2-day PSK/DHE timeout. Also call SSL_CTX_set_session_psk_dhe_timeout() with the same configured value when tune.ssl.lifetime is set, on BoringSSL/AWS-LC builds. Note there is still a separate, hardcoded 7-day authentication timeout underneath this on these libs, with no public API to override it, so the effective cap there becomes min(tune.ssl.lifetime, 7 days) rather than an exact match to tune.ssl.lifetime. Must be backported in every stable branches. --- diff --git a/src/ssl_sock.c b/src/ssl_sock.c index 582f67d8f..bfb8ce1b0 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -4270,8 +4270,14 @@ ssl_sock_initial_ctx(struct bind_conf *bind_conf) mode |= SSL_MODE_ASYNC; #endif SSL_CTX_set_mode(ctx, mode); - if (global_ssl.life_time) + if (global_ssl.life_time) { SSL_CTX_set_timeout(ctx, global_ssl.life_time); +#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC) + /* SSL_CTX_set_timeout() above only covers TLS1.2 and below on + * these libs, TLS1.3 has its own separate "psk_dhe" lifetime */ + SSL_CTX_set_session_psk_dhe_timeout(ctx, global_ssl.life_time); +#endif + } #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME # if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)