Created attachment 201810 [details] unbound patch The code change to support host validation on OpenSSL 1.0.2 was done in outside_network.c but the checks in daemon/remote.c, iterator/iter_fwd.c, and iterator/iter_hints.c were not fixed. As such, attempting to validate hosts with Unbound 1.9.0 still fails with OpenSSL 1.0.2. Specifically, on FreeBSD 11.2 it does not function: unbound: [45843:0] error: no name verification functionality in ssl library, ignored name for 9.9.9.9@853#blah.example.com The attached patch fixes the checks so it works as intended. I have tested the patch on FreeBSD 11.2 and pfSense 2.4.5 snapshots and it works. The logs indicate successes and failures of validation as expected when testing various scenarios. Obtained from: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5 https://github.com/pfsense/FreeBSD-ports/commit/af2c493a0dfa99e2afc6e3f9236aad10021d6b39
Created attachment 201867 [details] Improved patch to fix problem Proposed fix is fine. Changed patch to make it work with ports
A commit references this bug: Author: garga Date: Mon Feb 11 13:58:09 UTC 2019 New revision: 492694 URL: https://svnweb.freebsd.org/changeset/ports/492694 Log: dns/unbound: Import patch to fix hostname verification with OpenSSL 1.0.2 PR: 235571 Approved by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer) Obtained from: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5 https://github.com/pfsense/FreeBSD-ports/commit/af2c493a0dfa99e2afc6e3f9236aad10021d6b39 Sponsored by: Rubicon Communications, LLC (Netgate) Changes: head/dns/unbound/Makefile head/dns/unbound/files/patch-daemon_remote.c head/dns/unbound/files/patch-iterator_iter__fwd.c head/dns/unbound/files/patch-iterator_iter__hints.c