Method rotateECHKeys

modules/caddytls/ech.go:190–280

rotateECHKeys updates the ECH keys/configs that are outdated if rotation is needed. It should be called in a write lock on ech.configsMu. If a lock is already obtained in storage, then pass true for storageSynced. This function sets/updates the stdlib-ready key list only if a rotation occurs.

(ctx caddy.Context, logger *zap.Logger, storageSynced bool)

//
// This function sets/updates the stdlib-ready key list only if a rotation occurs.
func (ech *ECH) rotateECHKeys(ctx caddy.Context, logger *zap.Logger, storageSynced bool) error {
	storage := ctx.Storage()

	// all existing configs are now loaded; rotate keys "regularly" as recommended by the spec
	// (also: "Rotating too frequently limits the client anonymity set." - but the more server
	// names, the more frequently rotation can be done safely)
	const (
		rotationInterval = 24 * time.Hour * 30
		deleteAfter      = 24 * time.Hour * 90
	)

	if !ech.rotationNeeded(rotationInterval, deleteAfter) {
		return nil
	}

	// sync this operation across cluster if not already
	if !storageSynced {
		if err := storage.Lock(ctx, echStorageLockName); err != nil {
			return err
		}
		defer func() {
			if err := storage.Unlock(ctx, echStorageLockName); err != nil {
				logger.Error("unable to unlock ECH rotation in storage", zap.Error(err))
			}
		}()
	}

	// update what storage has, in case another instance already updated things
	if _, err := ech.setConfigsFromStorage(ctx, logger); err != nil {
		return fmt.Errorf("updating ECH keys from storage: %v", err)
	}

	// iterate the updated list and do any updates as needed
	for publicName := range ech.configs {
		for i := 0; i < len(ech.configs[publicName]); i++ {
			cfg := ech.configs[publicName][i]
			if time.Since(cfg.meta.Created) >= rotationInterval && cfg.meta.Replaced.IsZero() {
				// key is due for rotation and it hasn't been replaced yet; do that now
				logger.Debug("ECH config is due for rotation",
					zap.String("public_name", cfg.RawPublicName),
					zap.Uint8("id", cfg.ConfigID),
					zap.Time("created", cfg.meta.Created),
					zap.Duration("age", time.Since(cfg.meta.Created)),
					zap.Duration("rotation_interval", rotationInterval))

				// start by generating and storing the replacement ECH config
				newCfg, err := generateAndStoreECHConfig(ctx, publicName)
				if err != nil {
					return fmt.Errorf("generating and storing new replacement ECH config: %w", err)
				}

				// mark the key as replaced so we don't rotate it again, and instead delete it later
				ech.configs[publicName][i].meta.Replaced = time.Now()

				// persist the updated metadata
				metaBytes, err := json.Marshal(ech.configs[publicName][i].meta)
				if err != nil {
					return fmt.Errorf("marshaling updated ECH config metadata: %v", err)