Bug 235571 - [patch] dns/unbound: Fix DNS over TLS host validation w/OpenSSL 1.0.2
Summary: [patch] dns/unbound: Fix DNS over TLS host validation w/OpenSSL 1.0.2
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Renato Botelho
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-02-07 10:56 UTC by Renato Botelho
Modified: 2019-02-11 13:59 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (jaap)


Attachments
unbound patch (2.11 KB, patch)
2019-02-07 10:56 UTC, Renato Botelho
no flags Details | Diff
Improved patch to fix problem (3.28 KB, patch)
2019-02-09 13:26 UTC, Jaap Akkerhuis
jaap: maintainer-approval+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Renato Botelho freebsd_committer 2019-02-07 10:56:48 UTC
Created attachment 201810 [details]
unbound patch

The code change to support host validation on OpenSSL 1.0.2 was done in outside_network.c but the checks in daemon/remote.c, iterator/iter_fwd.c, and iterator/iter_hints.c were not fixed. As such, attempting to validate hosts with Unbound 1.9.0 still fails with OpenSSL 1.0.2. Specifically, on FreeBSD 11.2 it does not function:

unbound: [45843:0] error: no name verification functionality in ssl library, ignored name for 9.9.9.9@853#blah.example.com

The attached patch fixes the checks so it works as intended. I have tested the patch on FreeBSD 11.2 and pfSense 2.4.5 snapshots and it works. The logs indicate successes and failures of validation as expected when testing various scenarios.

Obtained from: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5
               https://github.com/pfsense/FreeBSD-ports/commit/af2c493a0dfa99e2afc6e3f9236aad10021d6b39
Comment 1 Jaap Akkerhuis 2019-02-09 13:26:13 UTC
Created attachment 201867 [details]
Improved patch to fix problem

Proposed fix is fine.

Changed patch to make it work with ports
Comment 2 commit-hook freebsd_committer 2019-02-11 13:58:40 UTC
A commit references this bug:

Author: garga
Date: Mon Feb 11 13:58:09 UTC 2019
New revision: 492694
URL: https://svnweb.freebsd.org/changeset/ports/492694

Log:
  dns/unbound: Import patch to fix hostname verification with OpenSSL 1.0.2

  PR:		235571
  Approved by:	Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
  Obtained from:	https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5
  		https://github.com/pfsense/FreeBSD-ports/commit/af2c493a0dfa99e2afc6e3f9236aad10021d6b39
  Sponsored by:	Rubicon Communications, LLC (Netgate)

Changes:
  head/dns/unbound/Makefile
  head/dns/unbound/files/patch-daemon_remote.c
  head/dns/unbound/files/patch-iterator_iter__fwd.c
  head/dns/unbound/files/patch-iterator_iter__hints.c