dnsdist: Really disable TLS tickets for TLS 1.3 when asked

diff --git a/pdns/dnsdistdist/doh.cc b/pdns/dnsdistdist/doh.cc
index 2f3cd457ecca72cef8300262c072b2e12454dfc3..e2480e078b4e1f8a7e4fe3cbe507837c5f06dbc6 100644 (file)
--- a/pdns/dnsdistdist/doh.cc
+++ b/pdns/dnsdistdist/doh.cc
@@ -930,7 +930,13 @@ static std::unique_ptr<SSL_CTX, void(*)(SSL_CTX*)> getTLSContext(DOHFrontend& df
     SSL_OP_SINGLE_ECDH_USE;
 
   if (!df.d_enableTickets || df.d_numberOfTicketsKeys == 0) {
+    /* for TLS 1.3 this means no stateless tickets, but stateful tickets might still be issued,
+       which is something we don't want. */
     sslOptions |= SSL_OP_NO_TICKET;
+    /* really disable all tickets */
+#ifdef HAVE_SSL_CTX_SET_NUM_TICKETS
+    SSL_CTX_set_num_tickets(ctx.get(), 0);
+#endif /* HAVE_SSL_CTX_SET_NUM_TICKETS */
   }
   else {
     df.d_ticketKeys = std::unique_ptr<OpenSSLTLSTicketKeysRing>(new OpenSSLTLSTicketKeysRing(df.d_numberOfTicketsKeys));

diff --git a/pdns/dnsdistdist/m4/dnsdist_with_libssl.m4 b/pdns/dnsdistdist/m4/dnsdist_with_libssl.m4
index 730b33c7fba366db994ec40c60a3a95883831b7c..ca8885ce8a4638e2ecb3fcfbdf49956e7c8bdf1e 100644 (file)
--- a/pdns/dnsdistdist/m4/dnsdist_with_libssl.m4
+++ b/pdns/dnsdistdist/m4/dnsdist_with_libssl.m4
@@ -17,7 +17,7 @@ AC_DEFUN([DNSDIST_WITH_LIBSSL], [
         save_LIBS=$LIBS
         CFLAGS="$LIBSSL_CFLAGS $CFLAGS"
         LIBS="$LIBSSL_LIBS -lcrypto $LIBS"
-        AC_CHECK_FUNCS([SSL_CTX_set_ciphersuites OCSP_basic_sign])
+        AC_CHECK_FUNCS([SSL_CTX_set_ciphersuites OCSP_basic_sign SSL_CTX_set_num_tickets])
         CFLAGS=$save_CFLAGS
         LIBS=$save_LIBS
 

diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index b3cf999cede10e7033636be0ef83ece42c4b5cee..40d41698ed7bfe65297f3ef2b9a0829f9fdb89a3 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -243,7 +243,13 @@ public:
     }
 
     if (!fe.d_enableTickets || fe.d_numberOfTicketsKeys == 0) {
+      /* for TLS 1.3 this means no stateless tickets, but stateful tickets might still be issued,
+         which is something we don't want. */
       sslOptions |= SSL_OP_NO_TICKET;
+      /* really disable all tickets */
+#ifdef HAVE_SSL_CTX_SET_NUM_TICKETS
+      SSL_CTX_set_num_tickets(d_tlsCtx.get(), 0);
+#endif /* HAVE_SSL_CTX_SET_NUM_TICKETS */
     }
     else {
       /* use our own ticket keys handler so we can rotate them */