Add TLS session resumption support on .NET 8.0+#214
Draft
sylwiaszunejko wants to merge 7 commits into
Draft
Conversation
2b19a6a to
96b210c
Compare
- Add net8.0 to Cassandra.csproj TargetFrameworks alongside netstandard2.0 - Update LangVersion to 'latest' in both Cassandra and test projects - Fix NETCOREAPP regex to match multi-digit .NET versions (net8, net9, net10+) - Suppress SYSLIB0051, SYSLIB0012, SYSLIB0039, CA1416 warnings for net8.0+ - Reference Cassandra net8.0 TFM for net8/net9+ test builds, netstandard2.0 otherwise
- Return '.NET 8.0+' string when built with NET8_0_OR_GREATER define
- Add EnableSessionResumption bool property (defaults to true) - Add SetEnableSessionResumption fluent setter method - Add unit tests for default value, setter, and fluent return
- Cache SslClientAuthenticationOptions per server name (NET8_0_OR_GREATER) - Reuse same instance per host to enable .NET TLS session ticket resumption - Set AllowTlsResume from SSLOptions.EnableSessionResumption - No-op placeholder on netstandard2.0 - Add unit tests for caching, AllowTlsResume, revocation mode, and callbacks
- Add TlsSessionTicketCache property to Configuration - Create cache instance only when SslOptions is configured
…T 8.0+ - Pass TlsSessionTicketCache from Configuration to TcpSocket via Connection - On NET8_0_OR_GREATER use AuthenticateAsClientAsync(SslClientAuthenticationOptions) - Retrieve cached options from TlsSessionTicketCache for session ticket reuse - Keep existing SslStream.AuthenticateAsClientAsync path for netstandard2.0
- Join split else/if into single else-if to satisfy dotnet format rules
96b210c to
0d57845
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds TLS session resumption (session ticket reuse) for connections to Scylla/Cassandra nodes when running on .NET 8.0 or later. Subsequent TLS connections to the same host reuse previously negotiated session parameters.
On older runtimes (netstandard2.0), behavior is unchanged.
Motivation
Each new TLS connection currently performs a full handshake. For clusters with many nodes or frequent connection churn, this adds latency. .NET 8.0 introduced
SslClientAuthenticationOptions.AllowTlsResume, which enables the runtime to cache and reuse TLS session tickets — but only when the sameSslClientAuthenticationOptionsinstance is reused across connections to the same host.Changes
Project configuration
net8.0as a target framework alongsidenetstandard2.0(multi-targeting)LangVersiontolatestfor modern C# featuresSYSLIB0051,SYSLIB0012,SYSLIB0039,CA1416warnings for net8.0 buildsPlatformHelper
.NET 8.0+inGetTargetFramework()when built withNET8_0_OR_GREATERSSLOptions
EnableSessionResumptionproperty (defaults totrue)SetEnableSessionResumption(bool)fluent setterTlsSessionTicketCache (new class)
SslClientAuthenticationOptionskeyed by server nameAllowTlsResumebased onSSLOptions.EnableSessionResumptionAllowTlsResume, revocation mode, and callback propagationConfiguration
TlsSessionTicketCacheproperty, initialized when SSL is configuredTcpSocket / Connection
TlsSessionTicketCachefromConfigurationthroughConnectiontoTcpSocketNET8_0_OR_GREATER, useAuthenticateAsClientAsync(SslClientAuthenticationOptions)with cached optionsAuthenticateAsClientAsync(string, ...)path for netstandard2.0Usage
TLS session resumption is enabled by default when using .NET 8.0+. No configuration changes are needed.
To disable it:
Fixes: https://scylladb.atlassian.net/browse/DRIVER-171