upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-23 16:20:26 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- patch from Doug Hogan for SSL_OP_NO_SSLvx options.

Browse source 
git-svn-id: file:///svn/unbound/trunk@3525 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2015-10-29 08:32:58 +00:00
parent 2f8f3cca82
commit 1ebcdeac38
4 changed files with 19 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
daemon/remote.c
View file

@ -208,12 +208,14 @@ daemon_remote_create(struct config_file* cfg)
return NULL; return NULL;
} }
/* no SSLv2, SSLv3 because has defects */ /* no SSLv2, SSLv3 because has defects */
if(!(SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)){ if((SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
!= SSL_OP_NO_SSLv2){
log_crypto_err("could not set SSL_OP_NO_SSLv2"); log_crypto_err("could not set SSL_OP_NO_SSLv2");
daemon_remote_delete(rc); daemon_remote_delete(rc);
return NULL; return NULL;
} }
if(!(SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)){ if((SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
!= SSL_OP_NO_SSLv3){
log_crypto_err("could not set SSL_OP_NO_SSLv3"); log_crypto_err("could not set SSL_OP_NO_SSLv3");
daemon_remote_delete(rc); daemon_remote_delete(rc);
return NULL; return NULL;

3
doc/Changelog
View file

@ -1,3 +1,6 @@
29 October 2015: Wouter
- patch from Doug Hogan for SSL_OP_NO_SSLvx options.
28 October 2015: Wouter 28 October 2015: Wouter
- Fix checklock testcode for linux threads on exit. - Fix checklock testcode for linux threads on exit.

6
smallapp/unbound-control.c
View file

@ -156,10 +156,12 @@ setup_ctx(struct config_file* cfg)
ctx = SSL_CTX_new(SSLv23_client_method()); ctx = SSL_CTX_new(SSLv23_client_method());
if(!ctx) if(!ctx)
ssl_err("could not allocate SSL_CTX pointer"); ssl_err("could not allocate SSL_CTX pointer");
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)) if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
!= SSL_OP_NO_SSLv2)
ssl_err("could not set SSL_OP_NO_SSLv2"); ssl_err("could not set SSL_OP_NO_SSLv2");
if(cfg->remote_control_use_cert) { if(cfg->remote_control_use_cert) {
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)) if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
!= SSL_OP_NO_SSLv3)
ssl_err("could not set SSL_OP_NO_SSLv3"); ssl_err("could not set SSL_OP_NO_SSLv3");
if(!SSL_CTX_use_certificate_chain_file(ctx,c_cert) || if(!SSL_CTX_use_certificate_chain_file(ctx,c_cert) ||
!SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM) !SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM)

12
util/net_help.c
View file

@ -619,12 +619,14 @@ void* listen_sslctx_create(char* key, char* pem, char* verifypem)
return NULL; return NULL;
} }
/* no SSLv2, SSLv3 because has defects */ /* no SSLv2, SSLv3 because has defects */
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)){ if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
!= SSL_OP_NO_SSLv2){
log_crypto_err("could not set SSL_OP_NO_SSLv2"); log_crypto_err("could not set SSL_OP_NO_SSLv2");
SSL_CTX_free(ctx); SSL_CTX_free(ctx);
return NULL; return NULL;
} }
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)){ if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
!= SSL_OP_NO_SSLv3){
log_crypto_err("could not set SSL_OP_NO_SSLv3"); log_crypto_err("could not set SSL_OP_NO_SSLv3");
SSL_CTX_free(ctx); SSL_CTX_free(ctx);
return NULL; return NULL;
@ -690,12 +692,14 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem)
log_crypto_err("could not allocate SSL_CTX pointer"); log_crypto_err("could not allocate SSL_CTX pointer");
return NULL; return NULL;
} }
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)) { if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
!= SSL_OP_NO_SSLv2) {
log_crypto_err("could not set SSL_OP_NO_SSLv2"); log_crypto_err("could not set SSL_OP_NO_SSLv2");
SSL_CTX_free(ctx); SSL_CTX_free(ctx);
return NULL; return NULL;
} }
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)) { if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)
!= SSL_OP_NO_SSLv3) {
log_crypto_err("could not set SSL_OP_NO_SSLv3"); log_crypto_err("could not set SSL_OP_NO_SSLv3");
SSL_CTX_free(ctx); SSL_CTX_free(ctx);
return NULL; return NULL;