dnsdist: Rename disableTickets to sessionTickets

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index 4f52440929c6c5ea1fdd92afc3c9dae5776497b0..1d85f758ec5bba6254125c6f4fa1faf71efa6f20 100644 (file)
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -1514,8 +1514,8 @@ void setupLuaConfig(bool client)
             frontend->d_numberOfTicketsKeys = std::stoi(boost::get<const string>((*vars)["numberOfTicketsKeys"]));
           }
 
-          if (vars->count("disableTickets")) {
-            frontend->d_disableTickets = boost::get<bool>((*vars)["disableTickets"]);
+          if (vars->count("sessionTickets")) {
+            frontend->d_enableTickets = boost::get<bool>((*vars)["sessionTickets"]);
           }
         }
 

diff --git a/pdns/dnsdistdist/docs/reference/config.rst b/pdns/dnsdistdist/docs/reference/config.rst
index a0ee1e01fe9d425fc3e649320dec8c63f6c7070d..f4ebf5959d8ce547c871f939c6ff2aa043d376ad 100644 (file)
--- a/pdns/dnsdistdist/docs/reference/config.rst
+++ b/pdns/dnsdistdist/docs/reference/config.rst
@@ -91,7 +91,7 @@ Listen Sockets
   .. versionadded:: 1.3.0
   .. versionchanged:: 1.3.1
     ``certFile(s)`` and ``keyFile(s)`` parameters accept a list of files.
-    ``disableTickets`` option added.
+    ``sessionTickets`` option added.
 
   Listen on the specified address and TCP port for incoming DNS over TLS connections, presenting the specified X.509 certificate.
 
@@ -113,7 +113,7 @@ Listen Sockets
   * ``numberOfTicketsKeys``: int - The maximum number of tickets keys to keep in memory at the same time, if the provider supports it (GnuTLS doesn't, OpenSSL does). Only one key is marked as active and used to encrypt new tickets while the remaining ones can still be used to decrypt existing tickets after a rotation. Default to 5.
   * ``ticketKeyFile``: str - The path to a file from where TLS tickets keys should be loaded, to support RFC 5077. These keys should be rotated often and never written to persistent storage to preserve forward secrecy. The default is to generate a random key. The OpenSSL provider supports several tickets keys to be able to decrypt existing sessions after the rotation, while the GnuTLS provider only supports one key.
   * ``ticketsKeysRotationDelay``: int - Set the delay before the TLS tickets key is rotated, in seconds. Default is 43200 (12h).
-  * ``disableTickets``: bool - Disable the use of session resumption via session tickets. Default is false, meaning tickets are enabled.
+  * ``sessionTickets``: bool - Whether session resumption via session tickets is enabled. Default is true, meaning tickets are enabled.
 
 .. function:: setLocal(address[, options])
 

diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index 0b14cf6f5313040b899f4cf808d1279d865d2eef..4c83f2ff888c84b916a37fae5f13db4dd1b83c71 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -372,7 +372,7 @@ public:
       SSL_OP_SINGLE_ECDH_USE |
       SSL_OP_CIPHER_SERVER_PREFERENCE;
 
-    if (fe.d_disableTickets) {
+    if (!fe.d_enableTickets) {
       sslOptions |= SSL_OP_NO_TICKET;
     }
 
@@ -650,7 +650,7 @@ class GnuTLSConnection: public TLSConnection
 {
 public:
 
-  GnuTLSConnection(int socket, unsigned int timeout, const gnutls_certificate_credentials_t creds, const gnutls_priority_t priorityCache, std::shared_ptr<GnuTLSTicketsKey>& ticketsKey, bool disableTickets): d_ticketsKey(ticketsKey)
+  GnuTLSConnection(int socket, unsigned int timeout, const gnutls_certificate_credentials_t creds, const gnutls_priority_t priorityCache, std::shared_ptr<GnuTLSTicketsKey>& ticketsKey, bool enableTickets): d_ticketsKey(ticketsKey)
   {
     unsigned int sslOptions = GNUTLS_SERVER;
 #ifdef GNUTLS_NO_SIGNAL
@@ -673,7 +673,7 @@ public:
       throw std::runtime_error("Error setting ciphers to TLS connection");
     }
 
-    if (!disableTickets && d_ticketsKey) {
+    if (enableTickets && d_ticketsKey) {
       const gnutls_datum_t& key = d_ticketsKey->getKey();
       if (gnutls_session_ticket_enable_server(d_conn, &key) != GNUTLS_E_SUCCESS) {
         gnutls_deinit(d_conn);
@@ -779,7 +779,7 @@ private:
 class GnuTLSIOCtx: public TLSCtx
 {
 public:
-  GnuTLSIOCtx(const TLSFrontend& fe): d_disableTickets(fe.d_disableTickets)
+  GnuTLSIOCtx(const TLSFrontend& fe): d_enableTickets(fe.d_enableTickets)
   {
     int rc = 0;
     d_ticketsKeyRotationDelay = fe.d_ticketsKeyRotationDelay;
@@ -838,12 +838,12 @@ public:
   {
     handleTicketsKeyRotation(now);
 
-    return std::unique_ptr<GnuTLSConnection>(new GnuTLSConnection(socket, timeout, d_creds, d_priorityCache, d_ticketsKey, d_disableTickets));
+    return std::unique_ptr<GnuTLSConnection>(new GnuTLSConnection(socket, timeout, d_creds, d_priorityCache, d_ticketsKey, d_enableTickets));
   }
 
   void rotateTicketsKey(time_t now) override
   {
-    if (d_disableTickets) {
+    if (!d_enableTickets) {
       return;
     }
 
@@ -856,7 +856,7 @@ public:
 
   void loadTicketsKeys(const std::string& file) override
   {
-    if (d_disableTickets) {
+    if (!d_enableTickets) {
       return;
     }
 
@@ -876,7 +876,7 @@ private:
   gnutls_certificate_credentials_t d_creds{nullptr};
   gnutls_priority_t d_priorityCache{nullptr};
   std::shared_ptr<GnuTLSTicketsKey> d_ticketsKey{nullptr};
-  bool d_disableTickets{false};
+  bool d_enableTickets{true};
 };
 
 #endif /* HAVE_GNUTLS */

diff --git a/pdns/dnsdistdist/tcpiohandler.hh b/pdns/dnsdistdist/tcpiohandler.hh
index 287e93760e1bef1be9054923e9039f49bfba209f..b276994e27ad83a7849edcdff30947e103f1411a 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.hh
+++ b/pdns/dnsdistdist/tcpiohandler.hh
@@ -139,7 +139,7 @@ public:
   int d_tcpFastOpenQueueSize{0};
   uint8_t d_numberOfTicketsKeys{5};
   bool d_reusePort{false};
-  bool d_disableTickets{false};
+  bool d_enableTickets{true};
 
 private:
   std::shared_ptr<TLSCtx> d_ctx{nullptr};