dnsdist: Add a setting to control the number of stored sessions

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index ce7e6dafe434f5d4c0a9e50f30784d9f4c26bcce..960fdc2f1d72d9854b2f06a1374b957bbf3bbbff 100644 (file)
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -1541,6 +1541,10 @@ void setupLuaConfig(bool client)
           if (vars->count("sessionTickets")) {
             frontend->d_enableTickets = boost::get<bool>((*vars)["sessionTickets"]);
           }
+
+          if (vars->count("numberOfStoredSessions")) {
+            frontend->d_maxStoredSessions = boost::get<int>((*vars)["numberOfStoredSessions"]);
+          }
         }
 
         try {

diff --git a/pdns/dnsdistdist/docs/reference/config.rst b/pdns/dnsdistdist/docs/reference/config.rst
index 0889ebe584070fec6a66268f7b608076c51805ad..bda9952fbc49d3800b3a72c54d4db6f1335b3520 100644 (file)
--- a/pdns/dnsdistdist/docs/reference/config.rst
+++ b/pdns/dnsdistdist/docs/reference/config.rst
@@ -92,6 +92,8 @@ Listen Sockets
   .. versionchanged:: 1.3.1
     ``certFile(s)`` and ``keyFile(s)`` parameters accept a list of files.
     ``sessionTickets`` option added.
+  .. versionchanged:: 1.3.3
+    ``numberOfStoredSessions`` option added.
 
   Listen on the specified address and TCP port for incoming DNS over TLS connections, presenting the specified X.509 certificate.
 
@@ -113,6 +115,7 @@ Listen Sockets
   * ``ticketKeyFile``: str - The path to a file from where TLS tickets keys should be loaded, to support RFC 5077. These keys should be rotated often and never written to persistent storage to preserve forward secrecy. The default is to generate a random key. The OpenSSL provider supports several tickets keys to be able to decrypt existing sessions after the rotation, while the GnuTLS provider only supports one key.
   * ``ticketsKeysRotationDelay``: int - Set the delay before the TLS tickets key is rotated, in seconds. Default is 43200 (12h).
   * ``sessionTickets``: bool - Whether session resumption via session tickets is enabled. Default is true, meaning tickets are enabled.
+  * ``numberOfStoredSessions``: int - The maximum number of sessions kept in memory at the same time. At this time this is only supported by the OpenSSL provider, as stored sessions are not supported with the GnuTLS one. Default is 20480. Setting this value to 0 disables stored session entirely.
 
 .. function:: setLocal(address[, options])
 

diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index 234c19fc74928e9bcf878c6cf8d09b0ad95cca08..4293aa70aab4e67400bcf1baa445d776603331af 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -386,8 +386,6 @@ public:
       throw std::runtime_error("Error creating TLS context on " + fe.d_addr.toStringWithPort());
     }
 
-    /* use the internal built-in cache to store sessions */
-    SSL_CTX_set_session_cache_mode(d_tlsCtx.get(), SSL_SESS_CACHE_SERVER);
     /* use our own ticket keys handler so we can rotate them */
     SSL_CTX_set_tlsext_ticket_key_cb(d_tlsCtx.get(), &OpenSSLTLSIOCtx::ticketKeyCb);
     SSL_CTX_set_ex_data(d_tlsCtx.get(), s_ticketsKeyIndex, this);
@@ -395,6 +393,15 @@ public:
 #if defined(SSL_CTX_set_ecdh_auto)
     SSL_CTX_set_ecdh_auto(d_tlsCtx.get(), 1);
 #endif
+    if (fe.d_maxStoredSessions == 0) {
+      /* disable stored sessions entirely */
+      SSL_CTX_set_session_cache_mode(d_tlsCtx.get(), SSL_SESS_CACHE_OFF);
+    }
+    else {
+      /* use the internal built-in cache to store sessions */
+      SSL_CTX_set_session_cache_mode(d_tlsCtx.get(), SSL_SESS_CACHE_SERVER);
+      SSL_CTX_sess_set_cache_size(d_tlsCtx.get(), fe.d_maxStoredSessions);
+    }
 
     for (const auto& pair : fe.d_certKeyPairs) {
       if (SSL_CTX_use_certificate_chain_file(d_tlsCtx.get(), pair.first.c_str()) != 1) {

diff --git a/pdns/dnsdistdist/tcpiohandler.hh b/pdns/dnsdistdist/tcpiohandler.hh
index b276994e27ad83a7849edcdff30947e103f1411a..ce48a44f9fbf2d8e13a821dba176701076e6ba4a 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.hh
+++ b/pdns/dnsdistdist/tcpiohandler.hh
@@ -135,6 +135,7 @@ public:
   std::string d_interface;
   std::string d_ticketKeyFile;
 
+  size_t d_maxStoredSessions{20480};
   time_t d_ticketsKeyRotationDelay{43200};
   int d_tcpFastOpenQueueSize{0};
   uint8_t d_numberOfTicketsKeys{5};