You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by br...@apache.org on 2014/10/10 22:46:45 UTC
[3/3] git commit: TS-3127: Update documentation
TS-3127: Update documentation
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo
Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/d2cef5fb
Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/d2cef5fb
Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/d2cef5fb
Branch: refs/heads/master
Commit: d2cef5fbcc251303abad1197961ea46cf5d08844
Parents: 6eb4db7
Author: Brian Geffon <br...@apache.org>
Authored: Fri Oct 10 13:46:31 2014 -0700
Committer: Brian Geffon <br...@apache.org>
Committed: Fri Oct 10 13:46:31 2014 -0700
----------------------------------------------------------------------
doc/reference/configuration/records.config.en.rst | 5 +++++
1 file changed, 5 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/trafficserver/blob/d2cef5fb/doc/reference/configuration/records.config.en.rst
----------------------------------------------------------------------
diff --git a/doc/reference/configuration/records.config.en.rst b/doc/reference/configuration/records.config.en.rst
index 486a58c..07244b7 100644
--- a/doc/reference/configuration/records.config.en.rst
+++ b/doc/reference/configuration/records.config.en.rst
@@ -2186,6 +2186,11 @@ SSL Termination
This configuration specifies the lifetime of SSL session cache
entries in seconds. If it is ``0``, then the SSL library will use
a default value, typically 300 seconds.
+
+.. ts:cv:: CONFIG proxy.config.ssl.session_cache.auto_clear INT 1
+
+ This will set the OpenSSL auto clear flag. Auto clear is enabled by
+ default with ``1`` it can be disabled by changing this setting to ``0``.
.. ts:cv:: CONFIG proxy.config.ssl.session_cache.size INT 102400
Re: [3/3] git commit: TS-3127: Update documentation
Posted by Brian Geffon <br...@gmail.com>.
This setting has no affect on the ATS session cache implementation, only
the OpenSSL implementation. But you're correct in your assessment. So with
this option someone will need to force flush. This is something we plan on
exposing via a new API.
"Normally the session cache is checked for expired sessions every 255
connections using the SSL_CTX_flush_sessions(3)
<https://www.openssl.org/docs/ssl/SSL_CTX_flush_sessions.html#> function.
Since this may lead to a delay which cannot be controlled, the automatic
flushing may be disabled and SSL_CTX_flush_sessions(3)
<https://www.openssl.org/docs/ssl/SSL_CTX_flush_sessions.html#> can be
called explicitly by the application."
On Friday, October 10, 2014, Leif Hedstrom <zw...@apache.org> wrote:
>
> On Oct 10, 2014, at 1:46 PM, briang@apache.org <javascript:;> wrote:
>
> >
> > +
> > +.. ts:cv:: CONFIG proxy.config.ssl.session_cache.auto_clear INT 1
> > +
> > + This will set the OpenSSL auto clear flag. Auto clear is enabled by
> > + default with ``1`` it can be disabled by changing this setting to
> ``0``.
> >
> > .. ts:cv:: CONFIG proxy.config.ssl.session_cache.size INT 102400
> >
> >
>
>
> What’s the effect of turning off this new setting? Does that leave the
> session cache in a state where it grows boundless? Does it leave it up to
> ATS itself to clear it? And if so, do we? Or can a plugin be implemented to
> clear the cache?
>
> — Leif
>
>
Re: [3/3] git commit: TS-3127: Update documentation
Posted by Leif Hedstrom <zw...@apache.org>.
On Oct 10, 2014, at 1:46 PM, briang@apache.org wrote:
>
> +
> +.. ts:cv:: CONFIG proxy.config.ssl.session_cache.auto_clear INT 1
> +
> + This will set the OpenSSL auto clear flag. Auto clear is enabled by
> + default with ``1`` it can be disabled by changing this setting to ``0``.
>
> .. ts:cv:: CONFIG proxy.config.ssl.session_cache.size INT 102400
>
>
What’s the effect of turning off this new setting? Does that leave the session cache in a state where it grows boundless? Does it leave it up to ATS itself to clear it? And if so, do we? Or can a plugin be implemented to clear the cache?
— Leif