dnsdist: Add a 'preferServerCiphers' option for DoH and DoT

It used to be that the servers had a much better configuration than
the clients, but nowadays we better rely on the clients, as they
know whether they have hardware support for a specific algorithm
which might save battery life or improve latency by a large margin.

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index 04c08ca21c37789578e55e41cb3b8f5a0e501121..aab566555f897e8dfffa384764875f719f781fbe 100644 (file)
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -1772,6 +1772,10 @@ void setupLuaConfig(bool client)
         frontend->d_enableTickets = boost::get<bool>((*vars)["sessionTickets"]);
       }
 
+      if (vars->count("preferServerCiphers")) {
+        frontend->d_preferServerCiphers = boost::get<bool>((*vars)["preferServerCiphers"]);
+      }
+
       if (vars->count("numberOfStoredSessions")) {
         auto value = boost::get<int>((*vars)["numberOfStoredSessions"]);
         if (value < 0) {
@@ -1969,6 +1973,10 @@ void setupLuaConfig(bool client)
             frontend->d_enableTickets = boost::get<bool>((*vars)["sessionTickets"]);
           }
 
+          if (vars->count("preferServerCiphers")) {
+            frontend->d_preferServerCiphers = boost::get<bool>((*vars)["preferServerCiphers"]);
+          }
+
           if (vars->count("numberOfStoredSessions")) {
             auto value = boost::get<int>((*vars)["numberOfStoredSessions"]);
             if (value < 0) {

diff --git a/pdns/dnsdistdist/docs/reference/config.rst b/pdns/dnsdistdist/docs/reference/config.rst
index 844e7f7e9e9d6c50c844a740aac2316baac9cc52..31b05535a0c5f89fcca1a418486424dc7ab7f13b 100644 (file)
--- a/pdns/dnsdistdist/docs/reference/config.rst
+++ b/pdns/dnsdistdist/docs/reference/config.rst
@@ -135,6 +135,7 @@ Listen Sockets
   * ``ticketsKeysRotationDelay``: int - Set the delay before the TLS tickets key is rotated, in seconds. Default is 43200 (12h).
   * ``sessionTickets``: bool - Whether session resumption via session tickets is enabled. Default is true, meaning tickets are enabled.
   * ``numberOfStoredSessions``: int - The maximum number of sessions kept in memory at the same time. Default is 20480. Setting this value to 0 disables stored session entirely.
+  * ``preferServerCiphers``: bool - Whether to prefer the order of ciphers set by the server instead of the one set by the client. Default is false, meaning that the order of the client is used.
 
 .. function:: addTLSLocal(address, certFile(s), keyFile(s) [, options])
 
@@ -145,7 +146,7 @@ Listen Sockets
   .. versionchanged:: 1.3.3
     ``numberOfStoredSessions`` option added.
   .. versionchanged:: 1.4.0
-    ``ciphersTLS13``, ``minTLSVersion`` and ``ocspResponses`` options added.
+    ``ciphersTLS13``, ``minTLSVersion``, ``ocspResponses`` and ``preferServerCiphers`` options added.
 
   Listen on the specified address and TCP port for incoming DNS over TLS connections, presenting the specified X.509 certificate.
 
@@ -171,6 +172,7 @@ Listen Sockets
   * ``numberOfStoredSessions``: int - The maximum number of sessions kept in memory at the same time. At this time this is only supported by the OpenSSL provider, as stored sessions are not supported with the GnuTLS one. Default is 20480. Setting this value to 0 disables stored session entirely.
   * ``ocspResponses``: list - List of files containing OCSP responses, in the same order than the certificates and keys, that will be used to provide OCSP stapling responses.
   * ``minTLSVersion``: str - Minimum version of the TLS protocol to support. Possible values are 'tls1.0', 'tls1.1', 'tls1.2' and 'tls1.3'. Default is to require at least TLS 1.0. Note that this value is ignored when the GnuTLS provider is in use, and the ``ciphers`` option should be set accordingly instead. For example, 'NORMAL:!VERS-TLS1.0:!VERS-TLS1.1' will disable TLS 1.0 and 1.1.
+  * ``preferServerCiphers``: bool - Whether to prefer the order of ciphers set by the server instead of the one set by the client. Default is false, meaning that the order of the client is used.
 
 .. function:: setLocal(address[, options])
 

diff --git a/pdns/dnsdistdist/doh.cc b/pdns/dnsdistdist/doh.cc
index 6a065dee5ddaa3417165ad620be08847e51f823b..2f3cd457ecca72cef8300262c072b2e12454dfc3 100644 (file)
--- a/pdns/dnsdistdist/doh.cc
+++ b/pdns/dnsdistdist/doh.cc
@@ -927,8 +927,7 @@ static std::unique_ptr<SSL_CTX, void(*)(SSL_CTX*)> getTLSContext(DOHFrontend& df
     SSL_OP_NO_COMPRESSION |
     SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION |
     SSL_OP_SINGLE_DH_USE |
-    SSL_OP_SINGLE_ECDH_USE |
-    SSL_OP_CIPHER_SERVER_PREFERENCE;
+    SSL_OP_SINGLE_ECDH_USE;
 
   if (!df.d_enableTickets || df.d_numberOfTicketsKeys == 0) {
     sslOptions |= SSL_OP_NO_TICKET;
@@ -939,6 +938,10 @@ static std::unique_ptr<SSL_CTX, void(*)(SSL_CTX*)> getTLSContext(DOHFrontend& df
     libssl_set_ticket_key_callback_data(ctx.get(), &df);
   }
 
+  if (df.d_preferServerCiphers) {
+    sslOptions |= SSL_OP_CIPHER_SERVER_PREFERENCE;
+  }
+
   SSL_CTX_set_options(ctx.get(), sslOptions);
   if (!libssl_set_min_tls_version(ctx, df.d_minTLSVersion)) {
     throw std::runtime_error("Failed to set the minimum version to '" + libssl_tls_version_to_string(df.d_minTLSVersion) + "' for DoH listener");

diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index 4eaf0a924d57f68670333a7e5c9e931934dc734f..b3cf999cede10e7033636be0ef83ece42c4b5cee 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -232,8 +232,7 @@ public:
       SSL_OP_NO_COMPRESSION |
       SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION |
       SSL_OP_SINGLE_DH_USE |
-      SSL_OP_SINGLE_ECDH_USE |
-      SSL_OP_CIPHER_SERVER_PREFERENCE;
+      SSL_OP_SINGLE_ECDH_USE;
 
     registerOpenSSLUser();
 
@@ -252,6 +251,10 @@ public:
       libssl_set_ticket_key_callback_data(d_tlsCtx.get(), this);
     }
 
+    if (fe.d_preferServerCiphers) {
+      sslOptions |= SSL_OP_CIPHER_SERVER_PREFERENCE;
+    }
+
     SSL_CTX_set_options(d_tlsCtx.get(), sslOptions);
     if (!libssl_set_min_tls_version(d_tlsCtx, fe.d_minTLSVersion)) {
       throw std::runtime_error("Failed to set the minimum version to '" + libssl_tls_version_to_string(fe.d_minTLSVersion) + "' for ths TLS context on " + fe.d_addr.toStringWithPort());

diff --git a/pdns/doh.hh b/pdns/doh.hh
index 41e6003293710bc4822b779896f7cca83631bc17..896312e75a89abdb01f623a0ddd5d5ce84d6fa7c 100644 (file)
--- a/pdns/doh.hh
+++ b/pdns/doh.hh
@@ -64,6 +64,7 @@ struct DOHFrontend
   size_t d_maxStoredSessions{20480};
   uint8_t d_numberOfTicketsKeys{5};
   bool d_enableTickets{true};
+  bool d_preferServerCiphers{false};
 
   std::atomic<uint64_t> d_httpconnects;   // number of TCP/IP connections established
   std::atomic<uint64_t> d_tls10queries;   // valid DNS queries received via TLSv1.0

diff --git a/pdns/tcpiohandler.hh b/pdns/tcpiohandler.hh
index 00daa2428001aded5d2e3fe728105694db139548..6fc8a37a5edf2ac4bc5fed3865845b5f63e317e8 100644 (file)
--- a/pdns/tcpiohandler.hh
+++ b/pdns/tcpiohandler.hh
@@ -154,6 +154,7 @@ public:
   LibsslTLSVersion d_minTLSVersion{LibsslTLSVersion::TLS10};
 
   bool d_enableTickets{true};
+  bool d_preferServerCiphers{false};
 
 private:
   std::shared_ptr<TLSCtx> d_ctx{nullptr};