Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dnsdist: Add OCSP stapling (from files) for DoT and DoH #8141

Merged
merged 3 commits into from Aug 9, 2019

Conversation

@rgacogne
Copy link
Member

commented Jul 29, 2019

Short description

The OCSP responses are loaded from files on startup, and reloaded when the reloadAllCertificates() command is issued.

Fixes #7812.

Checklist

I have:

  • read the CONTRIBUTING.md document
  • compiled this code
  • tested this code
  • included documentation (including possible behaviour changes)
  • documented the code
  • added or modified regression test(s)
  • added or modified unit test(s)

@rgacogne rgacogne added this to the dnsdist-1.4.0 milestone Jul 29, 2019

dnsdist: Add OCSP stapling (from files) for DoT and DoH
The OCSP responses are loaded from files on startup, and reloaded
when the reloadAllCertificates() command is issued.

@rgacogne rgacogne force-pushed the rgacogne:dnsdist-ocsp branch from 50d1873 to be3183e Aug 1, 2019

@chbruyand
Copy link
Member

left a comment

LGTM although I'm not an openssl API expert. I'm just wondering how hard it would be to add a basic unit test ?

Show resolved Hide resolved pdns/dnsdistdist/tcpiohandler.cc Outdated
@rgacogne

This comment has been minimized.

Copy link
Member Author

commented Aug 6, 2019

Thanks for the review!

I'm just wondering how hard it would be to add a basic unit test ?

The issue I encountered was that I could not find any simple way to generate an OCSP response for a certificate using the OpenSSL tools. I did see a (complicated) way to set up an OCSP server responding to queries so I guess we could do that and use the corresponding client to get a response, but that sounded horribly complicated and brittle.
I did all my testing using OCSP responses from Let's Encrypt for valid certificates.

rgacogne added some commits Aug 7, 2019

@rgacogne

This comment has been minimized.

Copy link
Member Author

commented Aug 8, 2019

Now with regression tests for DoH and DoT OCSP Stapling!
I have to write a bit of code involving undocumented OpenSSL APIs but I hope it will be worth it :-)

@rgacogne rgacogne merged commit 4106c52 into PowerDNS:master Aug 9, 2019

26 of 27 checks passed

LGTM analysis: JavaScript No code changes detected
Details
LGTM analysis: C/C++ No new or fixed alerts
Details
LGTM analysis: Python No new or fixed alerts
Details
ci/circleci: build-auth Your tests passed on CircleCI!
Details
ci/circleci: build-auth-docs Your tests passed on CircleCI!
Details
ci/circleci: build-dnsdist Your tests passed on CircleCI!
Details
ci/circleci: build-dnsdist-docs Your tests passed on CircleCI!
Details
ci/circleci: build-recursor Your tests passed on CircleCI!
Details
ci/circleci: build-recursor-docs Your tests passed on CircleCI!
Details
ci/circleci: test-auth-algorithms Your tests passed on CircleCI!
Details
ci/circleci: test-auth-api Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-bind Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-gmysql Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-gpgsql Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-gsqlite3 Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-ldap Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-lmdb Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-mydns Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-odbc-mssql Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-odbc-sqlite3 Your tests passed on CircleCI!
Details
ci/circleci: test-auth-regress-tinydns Your tests passed on CircleCI!
Details
ci/circleci: test-dnsdist-regression Your tests passed on CircleCI!
Details
ci/circleci: test-ixfrdist-regression Your tests passed on CircleCI!
Details
ci/circleci: test-recursor-api Your tests passed on CircleCI!
Details
ci/circleci: test-recursor-bulk Your tests passed on CircleCI!
Details
ci/circleci: test-recursor-regression Your tests passed on CircleCI!
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

@rgacogne rgacogne deleted the rgacogne:dnsdist-ocsp branch Aug 9, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.