Bug 235571

Summary: [patch] dns/unbound: Fix DNS over TLS host validation w/OpenSSL 1.0.2
Product: Ports & Packages Reporter: Renato Botelho <garga>
Component: Individual Port(s)Assignee: Renato Botelho <garga>
Status: Closed FIXED    
Severity: Affects Some People CC: jaap
Priority: --- Flags: bugzilla: maintainer-feedback? (jaap)
Version: Latest   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
unbound patch
none
Improved patch to fix problem jaap: maintainer-approval+

Description Renato Botelho freebsd_committer 2019-02-07 10:56:48 UTC
Created attachment 201810 [details]
unbound patch

The code change to support host validation on OpenSSL 1.0.2 was done in outside_network.c but the checks in daemon/remote.c, iterator/iter_fwd.c, and iterator/iter_hints.c were not fixed. As such, attempting to validate hosts with Unbound 1.9.0 still fails with OpenSSL 1.0.2. Specifically, on FreeBSD 11.2 it does not function:

unbound: [45843:0] error: no name verification functionality in ssl library, ignored name for 9.9.9.9@853#blah.example.com

The attached patch fixes the checks so it works as intended. I have tested the patch on FreeBSD 11.2 and pfSense 2.4.5 snapshots and it works. The logs indicate successes and failures of validation as expected when testing various scenarios.

Obtained from: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5
               https://github.com/pfsense/FreeBSD-ports/commit/af2c493a0dfa99e2afc6e3f9236aad10021d6b39
Comment 1 Jaap Akkerhuis 2019-02-09 13:26:13 UTC
Created attachment 201867 [details]
Improved patch to fix problem

Proposed fix is fine.

Changed patch to make it work with ports
Comment 2 commit-hook freebsd_committer 2019-02-11 13:58:40 UTC
A commit references this bug:

Author: garga
Date: Mon Feb 11 13:58:09 UTC 2019
New revision: 492694
URL: https://svnweb.freebsd.org/changeset/ports/492694

Log:
  dns/unbound: Import patch to fix hostname verification with OpenSSL 1.0.2

  PR:		235571
  Approved by:	Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
  Obtained from:	https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5
  		https://github.com/pfsense/FreeBSD-ports/commit/af2c493a0dfa99e2afc6e3f9236aad10021d6b39
  Sponsored by:	Rubicon Communications, LLC (Netgate)

Changes:
  head/dns/unbound/Makefile
  head/dns/unbound/files/patch-daemon_remote.c
  head/dns/unbound/files/patch-iterator_iter__fwd.c
  head/dns/unbound/files/patch-iterator_iter__hints.c