[feature request] SSL early data config option support for streams about angie HOT 2 OPEN

Hello.

I see that this patch is very similar to this one: https://mailman.nginx.org/pipermail/nginx-devel/2020-June/013211.html
Is it the same patch or maybe you are an author?

AFAIK, the main reason it is not merged is the lack of ability to signal early data to application.
In HTTP you can pass custom header with a value taken from corresponding variable, so the
application can decide if it is willing to accept early data in this context or not (considering replay attacks).
In stream, this is not possible: there is no means to pass anything extra to proxied application, what raises
security questions.

Can you please elaborate on your specific use case? What protocol are you using and what benefit are you expecting?

from angie.

Hello.

I see that this patch is very similar to this one: https://mailman.nginx.org/pipermail/nginx-devel/2020-June/013211.html Is it the same patch or maybe you are an author?

AFAIK, the main reason it is not merged is the lack of ability to signal early data to application. In HTTP you can pass custom header with a value taken from corresponding variable, so the application can decide if it is willing to accept early data in this context or not (considering replay attacks). In stream, this is not possible: there is no means to pass anything extra to proxied application, what raises security questions.

Can you please elaborate on your specific use case? What protocol are you using and what benefit are you expecting?

I am not the patch author. I simply found improvement methods referenced in this patch. In the context of streaming, the 0-RTT feature is needed. For example, in the case of DNS over TLS (DoT), it involves encrypting TCP-based DNS traffic directly with SSL. Enabling 0-RTT enhances performance.

For simple requests like DNS, since it's possible to transmit the requester's IP to the backend DNS program using proxy_protocol, the backend only needs to impose limits on the number of requests per IP, which does not pose a security issue.

from angie.