- Fix that control-use-cert: no works for 127.0.0.1 to disable certs.

git-svn-id: file:///svn/unbound/tags/release-1.7.3rc2@4740 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/daemon/remote.c b/daemon/remote.c
index a4ac2fea068009bb21a13e5f1ea1d8886df7eccd..dcf98afbc950b0545f76c4b21c61ede1f774490b 100644 (file)
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -208,7 +208,7 @@ daemon_remote_create(struct config_file* cfg)
                rc->ctx = NULL;
                return rc;
        }
-       if(options_remote_is_address(cfg)) {
+       if(options_remote_is_address(cfg) && cfg->control_use_cert) {
                if(!remote_setup_ctx(rc, cfg)) {
                        daemon_remote_delete(rc);
                        return NULL;
@@ -218,7 +218,8 @@ daemon_remote_create(struct config_file* cfg)
                struct config_strlist* p;
                rc->ctx = NULL;
                rc->use_cert = 0;
-               for(p = cfg->control_ifs.first; p; p = p->next) {
+               if(!options_remote_is_address(cfg))
+                 for(p = cfg->control_ifs.first; p; p = p->next) {
                        if(p->str && p->str[0] != '/')
                                log_warn("control-interface %s is not using TLS, but plain transfer, because first control-interface in config file is a local socket (starts with a /).", p->str);
                }
@@ -2207,9 +2208,12 @@ do_status(RES* ssl, struct worker* worker)
        uptime = (time_t)time(NULL) - (time_t)worker->daemon->time_boot.tv_sec;
        if(!ssl_printf(ssl, "uptime: " ARG_LL "d seconds\n", (long long)uptime))
                return;
-       if(!ssl_printf(ssl, "options:%s%s\n" , 
+       if(!ssl_printf(ssl, "options:%s%s%s%s\n" , 
                (worker->daemon->reuseport?" reuseport":""),
-               (worker->daemon->rc->accept_list?(worker->daemon->rc->use_cert?" control(ssl)":" control(namedpipe)"):"")))
+               (worker->daemon->rc->accept_list?" control":""),
+               (worker->daemon->rc->accept_list && worker->daemon->rc->use_cert?"(ssl)":""),
+               (worker->daemon->rc->accept_list && worker->daemon->cfg->control_ifs.first && worker->daemon->cfg->control_ifs.first->str && worker->daemon->cfg->control_ifs.first->str[0] == '/'?"(namedpipe)":"")
+               ))
                return;
        if(!ssl_printf(ssl, "unbound (pid %d) is running...\n",
                (int)getpid()))

diff --git a/doc/Changelog b/doc/Changelog
index 36adb3b74fc6dc02348c308a829286c2b9b5575f..723b0cbc4b0bb21494d34935fc0e145a29dd6ece 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+18 June 2018: Wouter
+       - Fix that control-use-cert: no works for 127.0.0.1 to disable certs.
+
 15 June 2018: Wouter
        - tag for 1.7.3rc1.
 

diff --git a/doc/example.conf.in b/doc/example.conf.in
index d82c8e28e00ef5d9167a90d7b2fdcf5bf3c071ea..55a088951a34c530ec4b4fca235ef101a5d337ba 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -784,6 +784,10 @@ remote-control:
        # port number for remote control operations.
        # control-port: 8953
 
+       # for localhost, you can disable use of TLS by setting this to "no"
+       # For local sockets this option is ignored, and TLS is not used.
+       # control-use-cert: "yes"
+
        # unbound server key file.
        # server-key-file: "@UNBOUND_RUN_DIR@/unbound_server.key"
 

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 48f40b7ca8dcdcb807d9c083f7cb5355001316d3..c0ef1ab9127e9c670a12ed53f1ffe64b513db6f4 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1384,6 +1384,11 @@ default is 8953.
 If you change this and permissions have been dropped, you must restart
 the server for the change to take effect.
 .TP 5
+.B control\-use\-cert: \fI<yes or no>
+For localhost control-interface you can disable the use of TLS by setting
+this option to "no", default is "yes".  For local sockets, TLS is disabled
+and the value of this option is ignored.
+.TP 5
 .B server\-key\-file: \fI<private key file>
 Path to the server private key, by default unbound_server.key.
 This file is generated by the \fIunbound\-control\-setup\fR utility.

diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 3d97de5d3997b1087931c0c19f9a693bb06fb6f5..8da4d4319f15a41fb93beb30c8a4ceafd316e9fd 100644 (file)
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -451,7 +451,7 @@ setup_ctx(struct config_file* cfg)
        char* s_cert=NULL, *c_key=NULL, *c_cert=NULL;
        SSL_CTX* ctx;
 
-       if(!options_remote_is_address(cfg))
+       if(!(options_remote_is_address(cfg) && cfg->control_use_cert))
                return NULL;
        s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
        c_key = fname_after_chroot(cfg->control_key_file, cfg, 1);

diff --git a/util/config_file.c b/util/config_file.c
index 0f5bb6217297ffb62acca08ce1d2a020f302a335..b06176053c6016734b1a92a8a1c616ad2c7384a6 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -247,6 +247,7 @@ config_create(void)
        cfg->control_ifs.first = NULL;
        cfg->control_ifs.last = NULL;
        cfg->control_port = UNBOUND_CONTROL_PORT;
+       cfg->control_use_cert = 1;
        cfg->minimal_responses = 0;
        cfg->rrset_roundrobin = 0;
        cfg->max_udp_size = 4096;

diff --git a/util/config_file.h b/util/config_file.h
index 0cd0cdd73d69c6629b1b956c7eba8a4a716fc69e..4206eb9a2a5120e6873ddd019b7e3f1f5cb2cfe7 100644 (file)
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -383,6 +383,8 @@ struct config_file {
        int remote_control_enable;
        /** the interfaces the remote control should listen on */
        struct config_strlist_head control_ifs;
+       /** if the use-cert option is set */
+       int control_use_cert;
        /** port number for the control port */
        int control_port;
        /** private key file for server */

diff --git a/util/configparser.c b/util/configparser.c
index facddca10434e7f7b6fe98ff4c16cafd58859d7d..7e4002cd825425afccd1007826632fb830fdd841 100644 (file)
--- a/util/configparser.c
+++ b/util/configparser.c
@@ -5082,7 +5082,7 @@ yyreduce:
 #line 2295 "./util/configparser.y" /* yacc.c:1646  */
     {
                OUTYY(("P(control_use_cert:%s)\n", (yyvsp[0].str)));
-               /* ignored */
+               cfg_parser->cfg->control_use_cert = (strcmp((yyvsp[0].str), "yes")==0);
                free((yyvsp[0].str));
        }
 #line 5089 "util/configparser.c" /* yacc.c:1646  */

diff --git a/util/configparser.y b/util/configparser.y
index 7a5b06899853834fbea689155dc6e6673a07998d..e34665aded0c401138ec8f80ab24c8ccb55bad5d 100644 (file)
--- a/util/configparser.y
+++ b/util/configparser.y
@@ -2294,7 +2294,7 @@ rc_control_interface: VAR_CONTROL_INTERFACE STRING_ARG
 rc_control_use_cert: VAR_CONTROL_USE_CERT STRING_ARG
        {
                OUTYY(("P(control_use_cert:%s)\n", $2));
-               /* ignored */
+               cfg_parser->cfg->control_use_cert = (strcmp($2, "yes")==0);
                free($2);
        }
        ;