]> git.ipfire.org Git - thirdparty/bind9.git/commit
Use the TLS context cache for client-side contexts (XoT)
authorArtem Boldariev <artem@boldariev.com>
Thu, 23 Dec 2021 14:08:41 +0000 (16:08 +0200)
committerArtem Boldariev <artem@boldariev.com>
Wed, 29 Dec 2021 08:25:15 +0000 (10:25 +0200)
commit64f7c5566214a5fe9b6fac63f53e741b20cbbda0
tree3d921dbfe2577b6fcd97dafabd72780f8559845e
parent5b7d4341fe19be0f1dce3e575383860ab64bde3b
Use the TLS context cache for client-side contexts (XoT)

This commit enables client-side TLS contexts re-use for zone transfers
over TLS. That, in turn, makes it possible to use the internal session
cache associated with the contexts, allowing the TLS connections to be
established faster and requiring fewer resources by not going through
the full TLS handshake procedure.

Previously that would recreate the context on every connection, making
TLS session resumption impossible.

Also, this change lays down a foundation for Strict TLS (when the
client validates a server certificate), as the TLS context cache can
be extended to store additional data required for validation (like
intermediates CA chain).
bin/named/include/named/server.h
bin/named/server.c
bin/named/transportconf.c
lib/dns/include/dns/transport.h
lib/dns/include/dns/xfrin.h
lib/dns/include/dns/zone.h
lib/dns/transport.c
lib/dns/xfrin.c
lib/dns/zone.c