Node: Restore TLS sessions where possible about serverless-dns HOT 5 CLOSED

Current deployment supports both TLS v1.2 & v1.3.
Session resumption (via session tickets) already works when the client uses TLS v1.2 (Enter Q to quit):

openssl s_client -connect 213.188.218.85:853 -reconnect -servername max.rethinkdns.com \
-tls1_2 | grep -E "^(New|Reused)"

Session Resumption is working with TLS v1.3 too (Enter Q to quit):

openssl s_client -connect 213.188.218.85:853 -servername max.rethinkdns.com -tls1_3 \
-sess_out /tmp/sess.pem | grep -E "^(New|Reused)"
openssl s_client -connect 213.188.218.85:853 -servername max.rethinkdns.com -tls1_3 \
-sess_in /tmp/sess.pem | grep -E "^(New|Reused)"

Session Resumption on TLS v1.2

Using Session Tickets

• NodeJS: ✔️ Works
  • Session tickets are sent during handshake and reconnecting resumes session.
• Deno: ✔️ Works

Using Session IDs

Not explored

Session Resumption on TLS v1.3

• Spec: https://www.rfc-editor.org/rfc/rfc8446#section-2.2
• Sessions are not established until full handshake is complete.

Using Session Tickets (PSK)

• NodeJS ✔️ (Verified from server side too)
  • Works while testing (Enter Q to quit):

     openssl s_client -connect dns.rethinkdns.localhost:10000 -sess_out /tmp/sess.pem \
     | grep -E "^(New|Reused)"
     openssl s_client -connect dns.rethinkdns.localhost:10000 -sess_in /tmp/sess.pem \
     | grep -E "^(New|Reused)"
    

  • Two (different) session tickets are sent post handshake.
  • ❓ Unsupported? nodejs/node#39691
• Deno: ✔️
  • Works while testing (Enter Q to quit):

     openssl s_client -connect dns.rethinkdns.localhost:10000 -sess_out /tmp/sess.pem \
     | grep -E "^(New|Reused)"
     openssl s_client -connect dns.rethinkdns.localhost:10000 -sess_in /tmp/sess.pem \
     | grep -E "^(New|Reused)"
    

  • One session ticket is sent post handshake.
  • ❓ No documentation found.
• Unable to test properly due to openssl s_client bug: openssl/openssl#10714

Using Session IDs

Implementation problems...

0-RTT on TLS v1.3

• NodeJS 💀
  • nodejs/node#28931

from serverless-dns.

So, nothing to do?

from serverless-dns.

@amithm7 This is done, I guess. Commit?

from serverless-dns.

This is built-in to tls lib of nodejs. There is a debug log here to test :

from serverless-dns.

session resumption was recently removed due to memory reqs: abf20c8

instead, tls (client) tickets are now valid for 7d: 20425bf and generated from the same seed across the entire fleet 0dcf5cf

from serverless-dns.