You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by "pixitha (via GitHub)" <gi...@apache.org> on 2025/10/28 18:18:15 UTC
[I] Missing TLS negotiated group for client with KEMs [trafficserver]
pixitha opened a new issue, #12622:
URL: https://github.com/apache/trafficserver/issues/12622
Our build is based on 10.1.0 ASF, which should include https://github.com/apache/trafficserver/pull/11844 but we're seeing most of the counters for OTHER instead:
```
proxy.process.ssl.group.user_agent.OTHER 79585703
proxy.process.ssl.group.user_agent.P-256 18643569
proxy.process.ssl.group.user_agent.P-384 12096
proxy.process.ssl.group.user_agent.P-521 0
proxy.process.ssl.group.user_agent.X25519 143839343
proxy.process.ssl.group.user_agent.P-224 0
proxy.process.ssl.group.user_agent.X448 0
proxy.process.ssl.group.user_agent.ffdhe2048 0
proxy.process.ssl.group.user_agent.ffdhe3072 0
proxy.process.ssl.group.user_agent.ffdhe4096 0
proxy.process.ssl.group.user_agent.ffdhe6144 0
proxy.process.ssl.group.user_agent.ffdhe8192 0
```
I would have expected to see `proxy.process.ssl.group.user_agent.X25519MLKEM768` here, as this box has openssl 3.5.2
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Missing TLS negotiated group for client with KEMs [trafficserver]
Posted by "bneradt (via GitHub)" <gi...@apache.org>.
bneradt commented on issue #12622:
URL: https://github.com/apache/trafficserver/issues/12622#issuecomment-3468616702
Thanks for the feedback @masaori335!
I've implemented a fix that adds dynamic TLS group registration (commit c5af89e21). The changes include:
1. **Added missing KEM groups** to the hardcoded list: X448MLKEM1024 and SecP384r1MLKEM1024
2. **Implemented dynamic registration**: When an unknown group is encountered during handshake, it's automatically registered as a metric. This ensures forward-compatibility with any new groups OpenSSL might add in the future.
This should resolve the issue where KEMs were showing up as "OTHER" instead of their actual group names like X25519MLKEM768.
Regarding `SSL_CTX_get0_implemented_groups`: I attempted to use this function to dynamically discover all supported groups at initialization (similar to how BoringSSL uses `SSL_get_all_group_names`), but I'm having difficulty getting it to work correctly. Could you provide an example of how to use `SSL_CTX_get0_implemented_groups` properly? The macro signature suggests it takes a STACK_OF(OPENSSL_CSTRING) but I'm getting segfaults when trying to use it.
In the meantime, the dynamic registration approach should handle the issue effectively.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Missing TLS negotiated group for client with KEMs [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on issue #12622:
URL: https://github.com/apache/trafficserver/issues/12622#issuecomment-3464834846
We check the group by `NID_X25519MLKEM768`. This is working with BoringSSL, but probably, OpenSSL defines the group in different way. Let check it.
https://github.com/apache/trafficserver/blob/577cbed448295a263e7911c7baadabbed6f927de/src/iocore/net/SSLStats.cc#L113-L115
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Missing TLS negotiated group for client with KEMs [trafficserver]
Posted by "bneradt (via GitHub)" <gi...@apache.org>.
bneradt closed issue #12622: Missing TLS negotiated group for client with KEMs
URL: https://github.com/apache/trafficserver/issues/12622
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Missing TLS negotiated group for client with KEMs [trafficserver]
Posted by "masaori335 (via GitHub)" <gi...@apache.org>.
masaori335 commented on issue #12622:
URL: https://github.com/apache/trafficserver/issues/12622#issuecomment-3465126502
I checked OpenSSL 3.5 and found below
- `NID_X25519MLKEM768` is not defined like other TLS groups
- `SSL_CTX_get0_implemented_groups` function is introduced
https://docs.openssl.org/master/man3/SSL_CTX_set1_curves/
It looks like we need to use the new function to list up TLS groups instead of these ifdefs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org