- Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3

  tls_choose_sigalg routine does not allow the ciphers for the pipe,
  so use TLSv1.2.

git-svn-id: file:///svn/unbound/trunk@4606 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/daemon/remote.c b/daemon/remote.c
index 3477340ff5782a13f3514398b4d6e97ad05138ea..58cdde1e2cc03c95282c46f614bdf80c83be4eb1 100644 (file)
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -236,10 +236,15 @@ daemon_remote_create(struct config_file* cfg)
 
        if (cfg->remote_control_use_cert == 0) {
                /* No certificates are requested */
+#if defined(SSL_OP_NO_TLSv1_3)
+               /* in openssl 1.1.1, negotiation code for tls 1.3 does
+                * not allow the unauthenticated aNULL and eNULL ciphers */
+               SSL_CTX_set_options(rc->ctx, SSL_OP_NO_TLSv1_3);
+#endif
 #ifdef HAVE_SSL_CTX_SET_SECURITY_LEVEL
                SSL_CTX_set_security_level(rc->ctx, 0);
 #endif
-               if(!SSL_CTX_set_cipher_list(rc->ctx, "aNULL, eNULL")) {
+               if(!SSL_CTX_set_cipher_list(rc->ctx, "aNULL:eNULL")) {
                        log_crypto_err("Failed to set aNULL cipher list");
                        daemon_remote_delete(rc);
                        return NULL;

diff --git a/doc/Changelog b/doc/Changelog
index 8fd4428b625f57ac6fc3e5ab7dc862e4bd2d63dd..3c3bfe6133bd94903c67dce44210f4d809cf7a5d 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,6 +2,9 @@
        - Combine write of tcp length and tcp query for dns over tls.
        - nitpick fixes in example.conf.
        - Fix above stub queries for type NS and useless delegation point.
+       - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3
+         tls_choose_sigalg routine does not allow the ciphers for the pipe,
+         so use TLSv1.2.
 
 3 April 2018: Wouter
        - Fix #4043: make test fails due to v6 presentation issue in macOS.

diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 086afa8dddeb11678e44a9ae859f0a5448e37846..fa1e3f6b982868587679ad95d54e68a936dbb593 100644 (file)
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -476,10 +476,15 @@ setup_ctx(struct config_file* cfg)
                free(c_cert);
        } else {
                /* Use ciphers that don't require authentication  */
+#if defined(SSL_OP_NO_TLSv1_3)
+               /* in openssl 1.1.1, negotiation code for tls 1.3 does
+                * not allow the unauthenticated aNULL and eNULL ciphers */
+               SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_3);
+#endif
 #ifdef HAVE_SSL_CTX_SET_SECURITY_LEVEL
                SSL_CTX_set_security_level(ctx, 0);
 #endif
-               if(!SSL_CTX_set_cipher_list(ctx, "aNULL, eNULL"))
+               if(!SSL_CTX_set_cipher_list(ctx, "aNULL:eNULL"))
                        ssl_err("Error setting NULL cipher!");
        }
        return ctx;