From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Wed, 17 Apr 2019 10:33:19 +0000 (+0200)
Subject: dnsdist: Add 'ciphersTLS13' for DoT
X-Git-Tag: dnsdist-1.4.0-alpha2~6^2~10
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9e67ac679bc9c3d14429cfde39c6b45cb82cc799;p=pdns

dnsdist: Add 'ciphersTLS13' for DoT
---

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index 03129695e..0e1954ce0 100644
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -1788,6 +1788,10 @@ void setupLuaConfig(bool client)
             frontend->d_ciphers = boost::get<const string>((*vars)["ciphers"]);
           }
 
+          if (vars->count("ciphersTLS13")) {
+            frontend->d_ciphers13 = boost::get<const string>((*vars)["ciphersTLS13"]);
+          }
+
           if (vars->count("ticketKeyFile")) {
             frontend->d_ticketKeyFile = boost::get<const string>((*vars)["ticketKeyFile"]);
           }
diff --git a/pdns/dnsdistdist/docs/reference/config.rst b/pdns/dnsdistdist/docs/reference/config.rst
index 38d57556f..9db8c9e0d 100644
--- a/pdns/dnsdistdist/docs/reference/config.rst
+++ b/pdns/dnsdistdist/docs/reference/config.rst
@@ -131,6 +131,8 @@ Listen Sockets
     ``sessionTickets`` option added.
   .. versionchanged:: 1.3.3
     ``numberOfStoredSessions`` option added.
+  .. versionchanged:: 1.4.0
+    ``ciphersTLS13`` option added.
 
   Listen on the specified address and TCP port for incoming DNS over TLS connections, presenting the specified X.509 certificate.
 
@@ -147,7 +149,8 @@ Listen Sockets
   * ``interface=""``: str - Set the network interface to use.
   * ``cpus={}``: table - Set the CPU affinity for this listener thread, asking the scheduler to run it on a single CPU id, or a set of CPU ids. This parameter is only available if the OS provides the pthread_setaffinity_np() function.
   * ``provider``: str - The TLS library to use between GnuTLS and OpenSSL, if they were available and enabled at compilation time.
-  * ``ciphers``: str - The TLS ciphers to use. The exact format depends on the provider used.
+  * ``ciphers``: str - The TLS ciphers to use. The exact format depends on the provider used. When the OpenSSL provder is used, ciphers for TLS 1.3 must be specified via ``ciphersTLS13``.
+  * ``ciphersTLS13``: str - The ciphers to use for TLS 1.3, when the OpenSSL provider is used. When the GnuTLS provider is used, ``ciphers`` applies regardless of the TLS protocol and this setting is not used.
   * ``numberOfTicketsKeys``: int - The maximum number of tickets keys to keep in memory at the same time, if the provider supports it (GnuTLS doesn't, OpenSSL does). Only one key is marked as active and used to encrypt new tickets while the remaining ones can still be used to decrypt existing tickets after a rotation. Default to 5.
   * ``ticketKeyFile``: str - The path to a file from where TLS tickets keys should be loaded, to support RFC 5077. These keys should be rotated often and never written to persistent storage to preserve forward secrecy. The default is to generate a random key. The OpenSSL provider supports several tickets keys to be able to decrypt existing sessions after the rotation, while the GnuTLS provider only supports one key.
   * ``ticketsKeysRotationDelay``: int - Set the delay before the TLS tickets key is rotated, in seconds. Default is 43200 (12h).
diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index 8d9a8e1bd..6e77c7840 100644
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -435,6 +435,15 @@ public:
       }
     }
 
+#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
+    if (!fe.d_ciphers13.empty()) {
+      if (SSL_CTX_set_ciphersuites(d_tlsCtx.get(), fe.d_ciphers13.c_str()) != 1) {
+        ERR_print_errors_fp(stderr);
+        throw std::runtime_error("Error setting the TLS 1.3 cipher list to '" + fe.d_ciphers13 + "' for the TLS context on " + fe.d_addr.toStringWithPort());
+      }
+    }
+#endif /* HAVE_SSL_CTX_SET_CIPHERSUITES */
+
     try {
       if (fe.d_ticketKeyFile.empty()) {
         handleTicketsKeyRotation(time(nullptr));
diff --git a/pdns/tcpiohandler.hh b/pdns/tcpiohandler.hh
index 5c2c90a05..ec31ecff8 100644
--- a/pdns/tcpiohandler.hh
+++ b/pdns/tcpiohandler.hh
@@ -140,6 +140,7 @@ public:
   std::vector<std::pair<std::string, std::string>> d_certKeyPairs;
   ComboAddress d_addr;
   std::string d_ciphers;
+  std::string d_ciphers13;
   std::string d_provider;
   std::string d_ticketKeyFile;