{"id":2219429,"url":"http://patchwork.ozlabs.org/api/patches/2219429/?format=json","web_url":"http://patchwork.ozlabs.org/project/openvswitch/patch/CYYPR12MB873260E211A48F7F62206C9CBF51A@CYYPR12MB8732.namprd12.prod.outlook.com/","project":{"id":47,"url":"http://patchwork.ozlabs.org/api/projects/47/?format=json","name":"Open vSwitch","link_name":"openvswitch","list_id":"ovs-dev.openvswitch.org","list_email":"ovs-dev@openvswitch.org","web_url":"http://openvswitch.org/","scm_url":"git@github.com:openvswitch/ovs.git","webscm_url":"https://github.com/openvswitch/ovs","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"","list_archive_url":null,"date":"2026-04-02T23:58:29","name":"[ovs-dev,v2] stream-ssl: Disable TLS session tickets","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"996fe56017aceeafebccf32ace143d0f86320714","submitter":{"id":92951,"url":"http://patchwork.ozlabs.org/api/people/92951/?format=json","name":"Mykola Yurchenko","email":"myurchenko@nvidia.com"},"delegate":{"id":57772,"url":"http://patchwork.ozlabs.org/api/users/57772/?format=json","username":"imaximets","first_name":"Ilya","last_name":"Maximets","email":"i.maximets@samsung.com"},"mbox":"http://patchwork.ozlabs.org/project/openvswitch/patch/CYYPR12MB873260E211A48F7F62206C9CBF51A@CYYPR12MB8732.namprd12.prod.outlook.com/mbox/","series":[{"id":498568,"url":"http://patchwork.ozlabs.org/api/series/498568/?format=json","web_url":"http://patchwork.ozlabs.org/project/openvswitch/list/?series=498568","date":"2026-04-02T23:58:29","name":"[ovs-dev,v2] stream-ssl: Disable TLS session tickets","version":2,"mbox":"http://patchwork.ozlabs.org/series/498568/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2219429/comments/","check":"warning","checks":"http://patchwork.ozlabs.org/api/patches/2219429/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","dev@openvswitch.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ovs-dev@lists.linuxfoundation.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=Nvidia.com header.i=@Nvidia.com header.a=rsa-sha256\n header.s=selector2 header.b=mS0g50Nv;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)","smtp1.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key,\n unprotected) header.d=Nvidia.com header.i=@Nvidia.com header.a=rsa-sha256\n header.s=selector2 header.b=mS0g50Nv","smtp1.osuosl.org;\n dmarc=pass (p=reject dis=none) header.from=nvidia.com","dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=nvidia.com;"],"Received":["from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fmzMh5YRDz1yCs\n\tfor ; Fri, 03 Apr 2026 10:58:40 +1100 (AEDT)","from localhost (localhost [127.0.0.1])\n\tby smtp1.osuosl.org (Postfix) with ESMTP id 71ABB81454;\n\tThu, 2 Apr 2026 23:58:38 +0000 (UTC)","from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id BbLW8r0wrCRs; Thu, 2 Apr 2026 23:58:37 +0000 (UTC)","from lists.linuxfoundation.org (lf-lists.osuosl.org\n [IPv6:2605:bc80:3010:104::8cd3:938])\n\tby smtp1.osuosl.org (Postfix) with ESMTPS id 8B1CA80DF1;\n\tThu, 2 Apr 2026 23:58:37 +0000 (UTC)","from lf-lists.osuosl.org (localhost [127.0.0.1])\n\tby lists.linuxfoundation.org (Postfix) with ESMTP id 56439C0070;\n\tThu, 2 Apr 2026 23:58:37 +0000 (UTC)","from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138])\n by lists.linuxfoundation.org (Postfix) with ESMTP id F3F2DC003D\n for ; Thu, 2 Apr 2026 23:58:35 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp1.osuosl.org (Postfix) with ESMTP id CE6E880E0F\n for ; Thu, 2 Apr 2026 23:58:35 +0000 (UTC)","from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id D7KqBru5KD_z for ;\n Thu, 2 Apr 2026 23:58:35 +0000 (UTC)","from PH7PR06CU001.outbound.protection.outlook.com\n (mail-westus3azlp170100009.outbound.protection.outlook.com\n [IPv6:2a01:111:f403:c107::9])\n by smtp1.osuosl.org (Postfix) with ESMTPS id E56A280DF1\n for ; Thu, 2 Apr 2026 23:58:34 +0000 (UTC)","from CYYPR12MB8732.namprd12.prod.outlook.com (2603:10b6:930:c8::9)\n by MW4PR12MB5626.namprd12.prod.outlook.com (2603:10b6:303:169::13) with\n Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.16; Thu, 2 Apr\n 2026 23:58:30 +0000","from CYYPR12MB8732.namprd12.prod.outlook.com\n ([fe80::8757:50ed:28c5:e322]) by CYYPR12MB8732.namprd12.prod.outlook.com\n ([fe80::8757:50ed:28c5:e322%4]) with mapi id 15.20.9769.014; Thu, 2 Apr 2026\n 23:58:29 +0000"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections -\n client-ip=2605:bc80:3010:104::8cd3:938; helo=lists.linuxfoundation.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp1.osuosl.org 8B1CA80DF1","OpenDKIM Filter v2.11.0 smtp1.osuosl.org E56A280DF1"],"Received-SPF":"Pass (mailfrom) identity=mailfrom;\n client-ip=2a01:111:f403:c107::9;\n helo=ph7pr06cu001.outbound.protection.outlook.com;\n envelope-from=myurchenko@nvidia.com; receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp1.osuosl.org E56A280DF1","ARC-Seal":"i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=ADL/WYBvrcdZGrkrVtXqF240kxEQa6fnthuW3nmko12Mfm3cau/OKNiGAOWQ9njGW0jIth3285OIo+MR5yUebJdcMZ7GZi+CqHJgZnlhN6E/k/LW+RUKsZl60JaweZNkzD2CV/daxe4RFWonFSeGDvwJSlErWbaU5h0GTVvTf1DSTzI039cZhSaLi7B60r8S3Mx06PmroOylq6Fw8gbyAxzTh32mS18Fv0YTocmUjRCzLSgO1HgMlVbQJktbFF8vxVz5mAO+e86vzqFuxddE9yfoiAVzzW704ksF8XLLj5F2hOS3uyqJTtVNSsrnL5MzulWqhVzegsiWtiP+8Z/LNw==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=8eVBqu0uLVIXGT2BXeg3ln7T0cpgB4ytOyNr7ZVCY+8=;\n b=RYr1k1CNBcPBlAnq9DmxixHephwpsuEYWiqSseNulmkV4Eg3YA7z0mlddsluNVIuBi/4x4a6W3oyJ1CLBMBJhGcY+/KMhdKPUuRuGd40Y2vVoh1LqN2/YWN2b9ShKdkvonq/jY1f6DOk51NNQ2Yk6HhSP1f9o8cKlIdrq8nMwfuayj/ORqs2ZW0WMjj/P5sjruGUrwB7Tiifw/u1RUr0KMDFb7fXWvRsN0kU5uRVEY5BERJZM1DG7uFlO0tLqTwTXZaBpwOxmT8MuiSKu44AHAsRUbDmZdhr79LYVbLFXhNWGdHJp7MzLYe5jFtBB+oq8le6gdLIKuWi7aaV1up4SQ==","ARC-Authentication-Results":"i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com;\n dkim=pass header.d=nvidia.com; arc=none","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com;\n s=selector2;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=8eVBqu0uLVIXGT2BXeg3ln7T0cpgB4ytOyNr7ZVCY+8=;\n b=mS0g50NvtqQ33NBSxNXVVQhWXvABG3nNU9nHcs5nlI05yZIxl8S+SbN4SsiPenriGgsep+VtMiImO8auWzi+7Z622R4uapu5TJEPQlXsL+NDiHg+O5vSMlycoGxNWNhKvAD6y1c5QASUXI8oqrTQRQl2txSPr5qnVExYo0xkFPnaFB0cqYyUTPbnl1u3dhg6LW9MgdrxC+2VSrBxPkoo+QIeuT4JO2JX2quM3qtx3vkcMQVLH1Z4lgT7elBelPnZr7ur0ejey6kBP9aB8aASy+qTEsDZgUmlyhXnaYCDWbFjt8rCtG4DE1pgjfI6/ooJFbjjf+p5AGNg+jGcaK1beg==","To":"\"dev@openvswitch.org\" ","Thread-Topic":"[PATCH v2] stream-ssl: Disable TLS session tickets","Thread-Index":"AQHcwvs7nSgsRIWIiE+4o0Lc+3JFXQ==","Date":"Thu, 2 Apr 2026 23:58:29 +0000","Message-ID":"\n ","Accept-Language":"en-US","Content-Language":"en-US","X-MS-Has-Attach":"","X-MS-TNEF-Correlator":"","x-ms-reactions":"allow","authentication-results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=Nvidia.com header.i=@Nvidia.com header.a=rsa-sha256\n header.s=selector2 header.b=mS0g50Nv;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org\n (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org;\n envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org)","smtp1.osuosl.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key,\n unprotected) header.d=Nvidia.com header.i=@Nvidia.com header.a=rsa-sha256\n header.s=selector2 header.b=mS0g50Nv","smtp1.osuosl.org;\n dmarc=pass (p=reject dis=none) header.from=nvidia.com","dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=nvidia.com;"],"x-ms-publictraffictype":"Email","x-ms-traffictypediagnostic":"CYYPR12MB8732:EE_|MW4PR12MB5626:EE_","x-ms-office365-filtering-correlation-id":"5d9c8dbc-3b58-49b9-9e47-08de9113bd40","x-ms-exchange-senderadcheck":"1","x-ms-exchange-antispam-relay":"0","x-microsoft-antispam":"BCL:0;\n ARA:13230040|366016|1800799024|376014|8096899003|38070700021|18002099003|56012099003;","x-microsoft-antispam-message-info":"\n 8vRLD3WizNSW0QkOb2QFJiw7e9WWP33YGCxqCLVhOjz6lgaFsGkfp2sd1H0cVYxCQr9BhUoyF6OK7mVyhVHLyxpAbU6L/IhGCobgIPa2/hKqCUxwkVh9NRY1EdhFENhpyr10tBokTetdBt/d8rlEwiWnkowjxAOTe6j5MJYF/yKQm4W4RMay+FZtRBC+DOSVY5i+Q8vH1Z13ZOO7UwC/HuXScf7w3+33Lm6TZWihBUG9vMIJsQvPPLQnMJAJe9JOXAfsSR0Rp8DCQtz/cyFbfXaHpyZ1rfaM+amHAeOb0HUxJjcZW0o1vipMM2u3HOGD0OcGBUz/4psrOwWAPNIl6yaYWFK22VxjLcHYBGy94c1eczO34QWQ5HK1qr8D4xTlw3L54zlRZC2CDuBJHW2WzxainxHvU65BcDTOnEQ2Rt1nCzwz0703yLz0b3JYSaJnyygYt62AWJow9IYAC63UwCv2DvIx7hOJcMf/qLg43BCB4xFpM6/iZbEB8c0RLHV8Tk4L2n46WXXTfx2C84pDWxl+eaFg5dtq0li4r13ho27rDWD1aGYIhp8JEYUi1bLBj0WD6A27uX9eBKrPNYN7aY2OxyAm29dmOdaHVUInHraN9M2Lj1jIgnYUw6zT31IdlL2zlT/FEPKFhgNHjb1q3qBscg0pnekVW9rcIF3rnEdcsHDtxblOxgTSk0fzPLQfboiqSl5xAwlgjdmV3C07guuVuYdqKb1kKX/CpEoZQjoU3zQxnKr2aqPsflXg9Ybo9Kl/FnbVhUM+PuST2Hp7imTWppaZ7v2r9K7RV89zD60=","x-forefront-antispam-report":"CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;\n IPV:NLI; SFV:NSPM; H:CYYPR12MB8732.namprd12.prod.outlook.com; PTR:; CAT:NONE;\n SFS:(13230040)(366016)(1800799024)(376014)(8096899003)(38070700021)(18002099003)(56012099003);\n DIR:OUT; SFP:1101;","x-ms-exchange-antispam-messagedata-chunkcount":"1","x-ms-exchange-antispam-messagedata-0":"\n fJtyFL3VyMPHSXZMbaEi6mlt1Eg4Q71MEWUn0JXuqEKfOqZKi9VsGJQW/uQGWDt71ToqQRxTmLH3RY7Zyd3+Ycv9CyWd3Vmm4LqXX5Xn463irhuIjNYwllFoz2Fd2vitt14o3fdpTC5hjwf4N0VK66aolI3zsR0obQrwyIufmmApLpf3WVUukeUI2VUgDMwXKwAat/htzkg+rZG0T4BtQgczSTL0DPBXUxlPZwqPlHmC3zFGe6pH8NCLZGgOLRJnqB51fITy4bgm+uatVI8mL2WqxSgMGlYya1Cyq2NyZVg5wKiM/aYGEsUVYGz7y68auXTKs6H4GRQ9iuGaQ7D0tG7dPz67r7clw66WdYG3B+pBcZpFUtOoK7CuHyNG0MUeAdkGlNgiLLkXNqlSyhW646r8t1QK3bQFDnf2+OKtxerW5d/UQQkD3SaIOrWzpX4TzWDGjz6TsjBYKmFef18X7xXAzSvFOBTjUJHI7Ff+WD50OfTuLC9xkfYBebltHYk4F+NGK294+56WUUfwkFo6ZxQazPAxWqN9MVYNVP7PaCjj+uXlSuWJLn2b75bu7EpBH3j1S5sECC43zR4rGPL4w5z5t2CcfwOnYTg8MKQ5o/9jzxtMiHpArHutWhPgbNF46sHO8TrS16+F9uS+5nrGzNPXnWLYj/XakYnFmgvfbyOT/ACXpp3TwUaZyV3KZSD5PoQz/G2OeXBIW7Hwd/FuyEFniSKSdveZ1qZT+7AmBqm4lH3AHTD+lx35LsR4A/8gMflfIJk8yA4v64vA80vw92gm5SMprsKhllH8WbjVMB9J8IuTRjU8vqrQT//srqp9ShFaKqazf78QQ9WipysA/YXz4m6OHHdyp/HhCKWoC9f8CQzbtCtqmQXBscFWnZCXj84s7+caXzErlFQ/SEtLxcwOcYzUNt+2PZtCVD3rmsZAdV24dKuNp9SxhPklX332yDsJrtffKhr5Z6EOHWH+uv0sfweZAGzqc+IQSBuKJhKhi2ZBuDyqGLlPAo3Satrt1HtKQhafyOfE+4NJ8FX4qDsqUS4bCl7dvmRrtGFHm7s/4PwHEQDMwqyyU0hZZBwokt2nb5epWfutAbz8og5J6UaxDptMWwx8BURc7s7DRAMtiGHZMbh2kU8tfoOfiZrL011r55M+Kz6uv47RiW0XaNqdwu6hHMhUoUMXnDfS+eMewlHDuWxeGaX8RvJgEOdULhm8zv141SCGadRqM20Es2BBXT2HmNMgg+TA6LcZA3uZ3iRTth19zndt9LTwBJv4rffVUFpXnueBJ5UuMVTTYEywHBcMqFviwN4u7jD7D/gdCSfadSYHvKQ48nv5yTWHo2g9Cystpd+irewzlz8SohpQ6EN08EFC9Aky9Ev3gSdhS4DbVPgxNaw6Sb6uE+jcR4Lf5MqHBNdBDcK3+KayyEmtLyXQ2ZnE8RRKD4jBDuYubRwR8lYh5eN/JzgNKFjadToio4iER2o1wTv/AMei0hrM6kGiVzzcBmKMb/EUCjnlIrT4RTs4jo7QcN+l9M14P0gh7gTPPbUtp7UiJS27ICBosYebIcQzilFltqraHCytcIAMms4J6xJv6NhlrVkZLCDnCNxShCdOhbL9P1Qg01nVs4tfxWPY2x/PmTsjsS42XAQiK24xZMK8L33LQVhkRsqMiSC5P8+IJXAHpa8eLe4rqFCsY7DFVAmrDqteVq8OSxZlntanA/xIO9SbfRzi6F+Tk0DNROAwEi/RQcYgDcGOxrtBMlqbGr4q3qnIkPk=","MIME-Version":"1.0","X-OriginatorOrg":"Nvidia.com","X-MS-Exchange-CrossTenant-AuthAs":"Internal","X-MS-Exchange-CrossTenant-AuthSource":"CYYPR12MB8732.namprd12.prod.outlook.com","X-MS-Exchange-CrossTenant-Network-Message-Id":"\n 5d9c8dbc-3b58-49b9-9e47-08de9113bd40","X-MS-Exchange-CrossTenant-originalarrivaltime":"02 Apr 2026 23:58:29.8091 (UTC)","X-MS-Exchange-CrossTenant-fromentityheader":"Hosted","X-MS-Exchange-CrossTenant-id":"43083d15-7273-40c1-b7db-39efd9ccc17a","X-MS-Exchange-CrossTenant-mailboxtype":"HOSTED","X-MS-Exchange-CrossTenant-userprincipalname":"\n 2IIyAkjRUYYm3bqiaYYNtbyI9y8yxddAn0WtzI1wm3KadwmcvEdrhbY0y6f+ltmuWkCCIvl6FASkAUnLOY+LTQ==","X-MS-Exchange-Transport-CrossTenantHeadersStamped":"MW4PR12MB5626","X-Content-Filtered-By":"Mailman/MimeDel 2.1.30","Subject":"[ovs-dev] [PATCH v2] stream-ssl: Disable TLS session tickets","X-BeenThere":"ovs-dev@openvswitch.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","From":"Mykola Yurchenko via dev ","Reply-To":"Mykola Yurchenko ","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"ovs-dev-bounces@openvswitch.org","Sender":"\"dev\" "},"content":"OVS currently does not support TLS session resumption. The server side\n\nsession cache is disabled (SSL_SESS_CACHE_OFF) and no session id\ncontext is configured. However, clients may still send stateless\ntickets, causing SSL_accept() to fail with \"session id context\nuninitialized\".\n\nDisable stateless session tickets with SSL_OP_NO_TICKET so that\nclients do not attempt resumption.\n\nSigned-off-by: Mykola Yurchenko \n---\n\nVersion 2:\n - Use SSL_OP_NO_TICKET instead of SSL_CTX_set_session_id_context()\n to avoid enabling session resumption. [Ilya Maximets]\n\n lib/stream-ssl.c | 1 +\n 1 file changed, 1 insertion(+)\n\n--\n2.51.0","diff":"diff --git a/lib/stream-ssl.c b/lib/stream-ssl.c\nindex c8eb26b..9b468e0 100644\n--- a/lib/stream-ssl.c\n+++ b/lib/stream-ssl.c\n@@ -1080,6 +1080,7 @@ do_ssl_init(void)\n SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,\n NULL);\n SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);\n+ SSL_CTX_set_options(ctx, SSL_OP_NO_TICKET);\n SSL_CTX_set_cipher_list(ctx, \"DEFAULT:@SECLEVEL=2\");\n\n return 0;\n","prefixes":["ovs-dev","v2"]}