dnsdist: Add an option to disable TLS session resumption via tickets

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index 54bf579f3b51a170fd8464fe71cf077b9bb25da0..0526ae18df4185244d818d1cd200b3094d9c5234 100644 (file)
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -1513,6 +1513,10 @@ void setupLuaConfig(bool client)
           if (vars->count("numberOfTicketsKeys")) {
             frontend->d_numberOfTicketsKeys = std::stoi(boost::get<const string>((*vars)["numberOfTicketsKeys"]));
           }
+
+          if (vars->count("disableTickets")) {
+            frontend->d_disableTickets = boost::get<bool>((*vars)["disableTickets"]);
+          }
         }
 
         try {

diff --git a/pdns/dnsdistdist/docs/reference/config.rst b/pdns/dnsdistdist/docs/reference/config.rst
index e0714efd7008771f52be015659374cfffe11aa82..e14a1099d237970f80ab9da97ce1c05babf499f2 100644 (file)
--- a/pdns/dnsdistdist/docs/reference/config.rst
+++ b/pdns/dnsdistdist/docs/reference/config.rst
@@ -91,6 +91,7 @@ Listen Sockets
   .. versionadded:: 1.3.0
   .. versionchanged:: 1.3.1
     ``certFile(s)`` and ``keyFile(s)`` parameters accept a list of files.
+    ``disableTickets`` option added.
 
   Listen on the specified address and TCP port for incoming DNS over TLS connections, presenting the specified X.509 certificate.
 
@@ -112,6 +113,7 @@ Listen Sockets
   * ``numberOfTicketsKeys``: int - The maximum number of tickets keys to keep in memory at the same time, if the provider supports it (GnuTLS doesn't, OpenSSL does). Only one key is marked as active and used to encrypt new tickets while the remaining ones can still be used to decrypt existing tickets after a rotation. Default to 5.
   * ``ticketKeyFile``: str - The path to a file from where TLS tickets keys should be loaded, to support RFC 5077. These keys should be rotated often and never written to persistent storage to preserve forward secrecy. The default is to generate a random key. The OpenSSL provider supports several tickets keys to be able to decrypt existing sessions after the rotation, while the GnuTLS provider only supports one key.
   * ``ticketsKeysRotationDelay``: int - Set the delay before the TLS tickets key is rotated, in seconds. Default is 43200 (12h).
+  * ``dibaleTickets``: bool - Disable the use of session resumption via session tickets. Default is false, meaning tickets are enabled.
 
 .. function:: setLocal(address[, options])
 

diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index 0fbf16c7c632adc2d28ba54251b8ae7752585dce..0b14cf6f5313040b899f4cf808d1279d865d2eef 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -363,7 +363,7 @@ public:
   {
     d_ticketsKeyRotationDelay = fe.d_ticketsKeyRotationDelay;
 
-    static const int sslOptions =
+    int sslOptions =
       SSL_OP_NO_SSLv2 |
       SSL_OP_NO_SSLv3 |
       SSL_OP_NO_COMPRESSION |
@@ -372,6 +372,10 @@ public:
       SSL_OP_SINGLE_ECDH_USE |
       SSL_OP_CIPHER_SERVER_PREFERENCE;
 
+    if (fe.d_disableTickets) {
+      sslOptions |= SSL_OP_NO_TICKET;
+    }
+
     if (s_users.fetch_add(1) == 0) {
       ERR_load_crypto_strings();
       OpenSSL_add_ssl_algorithms();
@@ -646,15 +650,16 @@ class GnuTLSConnection: public TLSConnection
 {
 public:
 
-  GnuTLSConnection(int socket, unsigned int timeout, const gnutls_certificate_credentials_t creds, const gnutls_priority_t priorityCache, std::shared_ptr<GnuTLSTicketsKey>& ticketsKey): d_ticketsKey(ticketsKey)
+  GnuTLSConnection(int socket, unsigned int timeout, const gnutls_certificate_credentials_t creds, const gnutls_priority_t priorityCache, std::shared_ptr<GnuTLSTicketsKey>& ticketsKey, bool disableTickets): d_ticketsKey(ticketsKey)
   {
-    d_socket = socket;
-
-    if (gnutls_init(&d_conn, GNUTLS_SERVER
+    unsigned int sslOptions = GNUTLS_SERVER;
 #ifdef GNUTLS_NO_SIGNAL
-                    | GNUTLS_NO_SIGNAL
+    sslOptions |= GNUTLS_NO_SIGNAL;
 #endif
-          ) != GNUTLS_E_SUCCESS) {
+
+    d_socket = socket;
+
+    if (gnutls_init(&d_conn, sslOptions) != GNUTLS_E_SUCCESS) {
       throw std::runtime_error("Error creating TLS connection");
     }
 
@@ -668,7 +673,7 @@ public:
       throw std::runtime_error("Error setting ciphers to TLS connection");
     }
 
-    if (d_ticketsKey) {
+    if (!disableTickets && d_ticketsKey) {
       const gnutls_datum_t& key = d_ticketsKey->getKey();
       if (gnutls_session_ticket_enable_server(d_conn, &key) != GNUTLS_E_SUCCESS) {
         gnutls_deinit(d_conn);
@@ -774,7 +779,7 @@ private:
 class GnuTLSIOCtx: public TLSCtx
 {
 public:
-  GnuTLSIOCtx(const TLSFrontend& fe)
+  GnuTLSIOCtx(const TLSFrontend& fe): d_disableTickets(fe.d_disableTickets)
   {
     int rc = 0;
     d_ticketsKeyRotationDelay = fe.d_ticketsKeyRotationDelay;
@@ -833,11 +838,15 @@ public:
   {
     handleTicketsKeyRotation(now);
 
-    return std::unique_ptr<GnuTLSConnection>(new GnuTLSConnection(socket, timeout, d_creds, d_priorityCache, d_ticketsKey));
+    return std::unique_ptr<GnuTLSConnection>(new GnuTLSConnection(socket, timeout, d_creds, d_priorityCache, d_ticketsKey, d_disableTickets));
   }
 
   void rotateTicketsKey(time_t now) override
   {
+    if (d_disableTickets) {
+      return;
+    }
+
     auto newKey = std::make_shared<GnuTLSTicketsKey>();
     d_ticketsKey = newKey;
     if (d_ticketsKeyRotationDelay > 0) {
@@ -847,6 +856,10 @@ public:
 
   void loadTicketsKeys(const std::string& file) override
   {
+    if (d_disableTickets) {
+      return;
+    }
+
     auto newKey = std::make_shared<GnuTLSTicketsKey>(file);
     d_ticketsKey = newKey;
     if (d_ticketsKeyRotationDelay > 0) {
@@ -863,6 +876,7 @@ private:
   gnutls_certificate_credentials_t d_creds{nullptr};
   gnutls_priority_t d_priorityCache{nullptr};
   std::shared_ptr<GnuTLSTicketsKey> d_ticketsKey{nullptr};
+  bool d_disableTickets{false};
 };
 
 #endif /* HAVE_GNUTLS */

diff --git a/pdns/dnsdistdist/tcpiohandler.hh b/pdns/dnsdistdist/tcpiohandler.hh
index 2f4a2dfe2536669e7fb8685a858fd34733bea55b..287e93760e1bef1be9054923e9039f49bfba209f 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.hh
+++ b/pdns/dnsdistdist/tcpiohandler.hh
@@ -139,6 +139,7 @@ public:
   int d_tcpFastOpenQueueSize{0};
   uint8_t d_numberOfTicketsKeys{5};
   bool d_reusePort{false};
+  bool d_disableTickets{false};
 
 private:
   std::shared_ptr<TLSCtx> d_ctx{nullptr};