upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-01-31 10:49:27 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option

Browse source 
to ignore the unexpected eof while reading in openssl >= 3.
This commit is contained in:
George Thessalonikefs 2023-03-17 14:39:37 +01:00
parent a97d7175a6
commit d7e7761141
2 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
doc/Changelog
View file

@ -1,3 +1,7 @@
17 March 2023: George
- Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option
to ignore the unexpected eof while reading in openssl >= 3.
16 March 2023: Wouter
- Fix ssl.h include brackets, instead of quotes.

21
util/net_help.c
View file

@ -1005,6 +1005,16 @@ listen_sslctx_setup(void* ctxt)
log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list");
}
#endif
#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
/* ignore errors when peers do not send the mandatory close_notify
* alert on shutdown.
* Relevant for openssl >= 3 */
if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
return 0;
}
#endif
if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) &
SSL_OP_CIPHER_SERVER_PREFERENCE) !=
@ -1233,6 +1243,17 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert)
SSL_CTX_free(ctx);
return 0;
}
#endif
#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
/* ignore errors when peers do not send the mandatory close_notify
* alert on shutdown.
* Relevant for openssl >= 3 */
if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
SSL_CTX_free(ctx);
return 0;
}
#endif
if(key && key[0]) {
if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {