feat: add TLS session caching support #657
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Adds cassandra.tls module with: - TLSSessionCache abstract base class defining the caching interface - DefaultTLSSessionCache with LRU eviction, TTL expiration, and periodic cleanup - TLSSessionCacheOptions for configuring cache parameters TLS session caching enables faster reconnections by reusing negotiated TLS sessions, reducing handshake latency for both TLS 1.2 (session IDs/tickets) and TLS 1.3 (session tickets).
Add tls_session_cache_key property to EndPoint, SniEndPoint, and UnixSocketEndPoint classes to provide appropriate cache keys for TLS session caching: - EndPoint: (address, port) - SniEndPoint: (address, port, server_name) to prevent cache collisions when multiple SNI endpoints use the same proxy - UnixSocketEndPoint: (path,) since Unix sockets have no port
Add TLS session caching support to the Connection class: - Add tls_session_cache parameter to Connection.__init__ - Apply cached sessions during wrap_socket() for session resumption - Store sessions after successful connection in _connect_socket() - Support both TLS 1.2 and TLS 1.3 session resumption Sessions are only cached after successful connections to avoid caching sessions from failed connection attempts.
Add TLS session caching configuration options to the Cluster class: - tls_session_cache_enabled: toggle caching on/off (default: True) - tls_session_cache_size: max cached sessions (default: 100) - tls_session_cache_ttl: session TTL in seconds (default: 3600) - tls_session_cache_options: advanced config via TLSSessionCacheOptions or custom TLSSessionCache implementation The cache is automatically created when SSL is enabled and passed to connections via the connection factory.
Implement TLS session caching for the eventlet reactor using PyOpenSSL's session API: - Apply cached session via set_session() before handshake - Store session via get_session() after successful handshake - Log session reuse for debugging
Implement TLS session caching for the Twisted reactor using PyOpenSSL's session API via the _SSLCreator class: - Pass tls_session_cache to _SSLCreator - Apply cached session in clientConnectionForTLS() - Store session in info_callback() after successful handshake - Log session reuse for debugging
dkropachev
force-pushed
the
dk/support-tls-tickets-fixes
branch
2 times, most recently
from
cbbde06 to
5430bb7
Compare
dkropachev
changed the title
7 tasks
Add comprehensive unit tests for DefaultTLSSessionCache: - Basic get/set operations - Multiple endpoints with separate cache entries - TTL expiration - LRU eviction when cache is full - cache_by_host_only mode - Thread safety under concurrent access - Periodic cleanup of expired sessions - Clear operations
Add tests verifying the tls_session_cache_key property for each endpoint type: - DefaultEndPoint returns (address, port) - SniEndPoint includes server_name to prevent cache collisions - UnixSocketEndPoint returns just the path
Add tests for TLS session caching in the eventlet reactor: - Cached session is applied via set_session() - Session is stored after successful handshake - Session reuse is detected and logged - Behavior without cache configured
Add tests for TLS session caching in the Twisted reactor: - Cached session is applied in clientConnectionForTLS() - Session is stored in info_callback() after handshake - Session reuse is detected and logged - _SSLCreator properly receives and uses tls_session_cache
Add integration tests that verify TLS session caching works end-to-end with a real Scylla/Cassandra cluster: - Session caching enabled by default with SSL - Session reuse on reconnection - Cache disabled when tls_session_cache_enabled=False - Custom cache options via TLSSessionCacheOptions
Document the TLS session caching feature in the security guide: - Overview of session resumption benefits - Configuration options (enabled, size, ttl, options) - Advanced configuration with TLSSessionCacheOptions - Custom cache implementation example - Notes on TLS 1.2 vs TLS 1.3 behavior
dkropachev
force-pushed
the
dk/support-tls-tickets-fixes
branch
from
5430bb7 to
6a84e73
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds TLS session caching support to the Python driver, enabling faster reconnections by reusing negotiated TLS sessions. This reduces handshake latency for both TLS 1.2 (session IDs/tickets) and TLS 1.3 (session tickets).
Fixes: #426
Changes
Core Implementation:
cassandra.tlsmodule withTLSSessionCacheabstract base class andDefaultTLSSessionCacheimplementation featuring LRU eviction, TTL expiration, and periodic cleanuptls_session_cache_keyproperty to endpoint classes (EndPoint,SniEndPoint,UnixSocketEndPoint) for proper cache key generationConnectionclass - apply cached sessions duringwrap_socket()and store sessions after successful connectionsCluster Configuration:
tls_session_cache_enabled: toggle caching on/off (default:True)tls_session_cache_size: max cached sessions (default:100)tls_session_cache_ttl: session TTL in seconds (default:3600)tls_session_cache_options: advanced config viaTLSSessionCacheOptionsor customTLSSessionCacheimplementationReactor Support:
_SSLCreatorclassTesting
DefaultTLSSessionCache(TTL, LRU eviction, thread safety, cleanup)tls_session_cache_keypropertiesDocumentation
Pre-review checklist
./docs/source/.Fixes:annotations to PR description.