ticketKeys returns the ticketKeys for this connection. If configForClient has explicitly set keys, those will be returned. Otherwise, the keys on c will be used and may be rotated if auto-managed. During rotation, any expired session ticket keys are deleted from c.sessionTicketKeys. If the session t
(configForClient *Config)
| 861 | // is not fresh, then a new session ticket key will be |
| 862 | // created and prepended to c.sessionTicketKeys. |
| 863 | func (c *Config) ticketKeys(configForClient *Config) []ticketKey { |
| 864 | // If the ConfigForClient callback returned a Config with explicitly set |
| 865 | // keys, use those, otherwise just use the original Config. |
| 866 | if configForClient != nil { |
| 867 | configForClient.mutex.RLock() |
| 868 | if configForClient.SessionTicketsDisabled { |
| 869 | return nil |
| 870 | } |
| 871 | configForClient.initLegacySessionTicketKeyRLocked() |
| 872 | if len(configForClient.sessionTicketKeys) != 0 { |
| 873 | ret := configForClient.sessionTicketKeys |
| 874 | configForClient.mutex.RUnlock() |
| 875 | return ret |
| 876 | } |
| 877 | configForClient.mutex.RUnlock() |
| 878 | } |
| 879 | |
| 880 | c.mutex.RLock() |
| 881 | defer c.mutex.RUnlock() |
| 882 | if c.SessionTicketsDisabled { |
| 883 | return nil |
| 884 | } |
| 885 | c.initLegacySessionTicketKeyRLocked() |
| 886 | if len(c.sessionTicketKeys) != 0 { |
| 887 | return c.sessionTicketKeys |
| 888 | } |
| 889 | // Fast path for the common case where the key is fresh enough. |
| 890 | if len(c.autoSessionTicketKeys) > 0 && c.time().Sub(c.autoSessionTicketKeys[0].created) < ticketKeyRotation { |
| 891 | return c.autoSessionTicketKeys |
| 892 | } |
| 893 | |
| 894 | // autoSessionTicketKeys are managed by auto-rotation. |
| 895 | c.mutex.RUnlock() |
| 896 | defer c.mutex.RLock() |
| 897 | c.mutex.Lock() |
| 898 | defer c.mutex.Unlock() |
| 899 | // Re-check the condition in case it changed since obtaining the new lock. |
| 900 | if len(c.autoSessionTicketKeys) == 0 || c.time().Sub(c.autoSessionTicketKeys[0].created) >= ticketKeyRotation { |
| 901 | var newKey [32]byte |
| 902 | if _, err := io.ReadFull(c.rand(), newKey[:]); err != nil { |
| 903 | panic(fmt.Sprintf("unable to generate random session ticket key: %v", err)) |
| 904 | } |
| 905 | valid := make([]ticketKey, 0, len(c.autoSessionTicketKeys)+1) |
| 906 | valid = append(valid, c.ticketKeyFromBytes(newKey)) |
| 907 | for _, k := range c.autoSessionTicketKeys { |
| 908 | // While rotating the current key, also remove any expired ones. |
| 909 | if c.time().Sub(k.created) < ticketKeyLifetime { |
| 910 | valid = append(valid, k) |
| 911 | } |
| 912 | } |
| 913 | c.autoSessionTicketKeys = valid |
| 914 | } |
| 915 | return c.autoSessionTicketKeys |
| 916 | } |
| 917 | |
| 918 | // SetSessionTicketKeys updates the session ticket keys for a server. |
| 919 | // |
no test coverage detected