upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Disabled use of SSLv3 in remote-control and ssl-upstream.

Browse source 
git-svn-id: file:///svn/unbound/trunk@3248 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2014-10-27 09:26:48 +00:00
parent e26cce4ae7
commit 7084c20f88
5 changed files with 23 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
daemon/remote.c
View file

@ -154,12 +154,17 @@ daemon_remote_create(struct config_file* cfg)
free(rc); free(rc);
return NULL; return NULL;
} }
/* no SSLv2 because has defects */ /* no SSLv2, SSLv3 because has defects */
if(!(SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)){ if(!(SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)){
log_crypto_err("could not set SSL_OP_NO_SSLv2"); log_crypto_err("could not set SSL_OP_NO_SSLv2");
daemon_remote_delete(rc); daemon_remote_delete(rc);
return NULL; return NULL;
} }
if(!(SSL_CTX_set_options(rc->ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)){
log_crypto_err("could not set SSL_OP_NO_SSLv3");
daemon_remote_delete(rc);
return NULL;
}
s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1); s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
s_key = fname_after_chroot(cfg->server_key_file, cfg, 1); s_key = fname_after_chroot(cfg->server_key_file, cfg, 1);
if(!s_cert || !s_key) { if(!s_cert || !s_key) {

3
doc/Changelog
View file

@ -1,3 +1,6 @@
27 October 2014: Wouter
- Disabled use of SSLv3 in remote-control and ssl-upstream.
16 October 2014: Wouter 16 October 2014: Wouter
- Documented dns64 configuration in unbound.conf man page. - Documented dns64 configuration in unbound.conf man page.

2
smallapp/unbound-control.c
View file

@ -149,6 +149,8 @@ setup_ctx(struct config_file* cfg)
ssl_err("could not allocate SSL_CTX pointer"); ssl_err("could not allocate SSL_CTX pointer");
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)) if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2))
ssl_err("could not set SSL_OP_NO_SSLv2"); ssl_err("could not set SSL_OP_NO_SSLv2");
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3))
ssl_err("could not set SSL_OP_NO_SSLv3");
if(!SSL_CTX_use_certificate_file(ctx,c_cert,SSL_FILETYPE_PEM) || if(!SSL_CTX_use_certificate_file(ctx,c_cert,SSL_FILETYPE_PEM) ||
!SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM) !SSL_CTX_use_PrivateKey_file(ctx,c_key,SSL_FILETYPE_PEM)
|| !SSL_CTX_check_private_key(ctx)) || !SSL_CTX_check_private_key(ctx))

1
testcode/petal.c
View file

@ -235,6 +235,7 @@ setup_ctx(char* key, char* cert)
SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method()); SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method());
if(!ctx) print_exit("out of memory"); if(!ctx) print_exit("out of memory");
(void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); (void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
(void)SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3);
if(!SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM)) if(!SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM))
print_exit("cannot read cert"); print_exit("cannot read cert");
if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM)) if(!SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM))

12
util/net_help.c
View file

@ -613,12 +613,17 @@ void* listen_sslctx_create(char* key, char* pem, char* verifypem)
log_crypto_err("could not SSL_CTX_new"); log_crypto_err("could not SSL_CTX_new");
return NULL; return NULL;
} }
/* no SSLv2 because has defects */ /* no SSLv2, SSLv3 because has defects */
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)){ if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)){
log_crypto_err("could not set SSL_OP_NO_SSLv2"); log_crypto_err("could not set SSL_OP_NO_SSLv2");
SSL_CTX_free(ctx); SSL_CTX_free(ctx);
return NULL; return NULL;
} }
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)){
log_crypto_err("could not set SSL_OP_NO_SSLv3");
SSL_CTX_free(ctx);
return NULL;
}
if(!SSL_CTX_use_certificate_file(ctx, pem, SSL_FILETYPE_PEM)) { if(!SSL_CTX_use_certificate_file(ctx, pem, SSL_FILETYPE_PEM)) {
log_err("error for cert file: %s", pem); log_err("error for cert file: %s", pem);
log_crypto_err("error in SSL_CTX use_certificate_file"); log_crypto_err("error in SSL_CTX use_certificate_file");
@ -668,6 +673,11 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem)
SSL_CTX_free(ctx); SSL_CTX_free(ctx);
return NULL; return NULL;
} }
if(!(SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3)) {
log_crypto_err("could not set SSL_OP_NO_SSLv3");
SSL_CTX_free(ctx);
return NULL;
}
if(key && key[0]) { if(key && key[0]) {
if(!SSL_CTX_use_certificate_file(ctx, pem, SSL_FILETYPE_PEM)) { if(!SSL_CTX_use_certificate_file(ctx, pem, SSL_FILETYPE_PEM)) {
log_err("error in client certificate %s", pem); log_err("error in client certificate %s", pem);