Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dnsdist: Add OCSP stapling (from files) for DoT and DoH #8141

Merged
merged 3 commits into from Aug 9, 2019

Conversation

@rgacogne
Copy link
Member

@rgacogne rgacogne commented Jul 29, 2019

Short description

The OCSP responses are loaded from files on startup, and reloaded when the reloadAllCertificates() command is issued.

Fixes #7812.

Checklist

I have:

  • read the CONTRIBUTING.md document
  • compiled this code
  • tested this code
  • included documentation (including possible behaviour changes)
  • documented the code
  • added or modified regression test(s)
  • added or modified unit test(s)
The OCSP responses are loaded from files on startup, and reloaded
when the reloadAllCertificates() command is issued.
Copy link
Member

@chbruyand chbruyand left a comment

LGTM although I'm not an openssl API expert. I'm just wondering how hard it would be to add a basic unit test ?

Loading

pdns/dnsdistdist/tcpiohandler.cc Outdated Show resolved Hide resolved
Loading
@rgacogne
Copy link
Member Author

@rgacogne rgacogne commented Aug 6, 2019

Thanks for the review!

I'm just wondering how hard it would be to add a basic unit test ?

The issue I encountered was that I could not find any simple way to generate an OCSP response for a certificate using the OpenSSL tools. I did see a (complicated) way to set up an OCSP server responding to queries so I guess we could do that and use the corresponding client to get a response, but that sounded horribly complicated and brittle.
I did all my testing using OCSP responses from Let's Encrypt for valid certificates.

Loading

@rgacogne
Copy link
Member Author

@rgacogne rgacogne commented Aug 8, 2019

Now with regression tests for DoH and DoT OCSP Stapling!
I have to write a bit of code involving undocumented OpenSSL APIs but I hope it will be worth it :-)

Loading

@rgacogne rgacogne merged commit 4106c52 into PowerDNS:master Aug 9, 2019
27 checks passed
Loading
@rgacogne rgacogne deleted the dnsdist-ocsp branch Aug 9, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

2 participants