From: Remi Gacogne Date: Mon, 30 Jun 2025 13:57:10 +0000 (+0200) Subject: dnsdist: Error if backend certificate validation is enabled without a subject name X-Git-Tag: dnsdist-2.0.0-rc1~9^2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c94b8e80cd4871a96b8be87bc28cca59617b6ae8;p=thirdparty%2Fpdns.git dnsdist: Error if backend certificate validation is enabled without a subject name We can only validate if a proper subject name or subject address is passed, and we do not want to silently disable validation, so let's refuse to start. Signed-off-by: Remi Gacogne (cherry picked from commit 8a9142058f82e0fd70b428ddc50848f00a59d2c4) --- diff --git a/pdns/dnsdistdist/dnsdist-configuration-yaml.cc b/pdns/dnsdistdist/dnsdist-configuration-yaml.cc index e2010a71ab..3b219a90fa 100644 --- a/pdns/dnsdistdist/dnsdist-configuration-yaml.cc +++ b/pdns/dnsdistdist/dnsdist-configuration-yaml.cc @@ -468,6 +468,9 @@ static std::shared_ptr createBackendFromConfiguration(const dns errlog("Error creating new server: downstream subject_address value must be a valid IP address"); } } + if (backendConfig.d_tlsParams.d_validateCertificates && backendConfig.d_tlsSubjectName.empty()) { + throw std::runtime_error("Certificate validation has been requested for backend " + std::string(config.address) + " but neither 'subject_name' nor 'subject_address' are set"); + } } if (protocol == "dot") { diff --git a/pdns/dnsdistdist/dnsdist-lua.cc b/pdns/dnsdistdist/dnsdist-lua.cc index 653bf78ec7..f678fc0ba8 100644 --- a/pdns/dnsdistdist/dnsdist-lua.cc +++ b/pdns/dnsdistdist/dnsdist-lua.cc @@ -545,6 +545,10 @@ static void setupLuaConfig(LuaContext& luaCtx, bool client, bool configCheck) } tlsCtx = getTLSContext(config.d_tlsParams); + + if (config.d_tlsParams.d_validateCertificates && config.d_tlsSubjectName.empty()) { + throw std::runtime_error("Certificate validation has been requested (see 'validateCertificates') for backend " + serverAddressStr + " but neither 'subjectName' nor 'subjectAddress' are set"); + } } try { diff --git a/regression-tests.dnsdist/test_HealthChecks.py b/regression-tests.dnsdist/test_HealthChecks.py index 1c1557f214..819eb4dcd3 100644 --- a/regression-tests.dnsdist/test_HealthChecks.py +++ b/regression-tests.dnsdist/test_HealthChecks.py @@ -247,10 +247,10 @@ class TestLazyHealthChecks(HealthCheckTest): newServer{address="127.0.0.1:%s", healthCheckMode='lazy', checkInterval=1, lazyHealthCheckFailedInterval=1, lazyHealthCheckThreshold=10, lazyHealthCheckSampleSize=100, lazyHealthCheckMinSampleCount=10, lazyHealthCheckMode='TimeoutOrServFail', pool=''} - newServer{address="127.0.0.1:%s", tls='openssl', caStore='ca.pem', healthCheckMode='lazy', checkInterval=1, lazyHealthCheckFailedInterval=1, lazyHealthCheckThreshold=10, lazyHealthCheckSampleSize=100, lazyHealthCheckMinSampleCount=10, lazyHealthCheckMode='TimeoutOrServFail', pool='dot'} + newServer{address="127.0.0.1:%s", tls='openssl', caStore='ca.pem', subjectAddr='127.0.0.1', healthCheckMode='lazy', checkInterval=1, lazyHealthCheckFailedInterval=1, lazyHealthCheckThreshold=10, lazyHealthCheckSampleSize=100, lazyHealthCheckMinSampleCount=10, lazyHealthCheckMode='TimeoutOrServFail', pool='dot'} addAction('dot.lazy.test.powerdns.com.', PoolAction('dot')) - newServer{address="127.0.0.1:%s", tls='openssl', dohPath='/dns-query', caStore='ca.pem', healthCheckMode='lazy', checkInterval=1, lazyHealthCheckFailedInterval=1, lazyHealthCheckThreshold=10, lazyHealthCheckSampleSize=100, lazyHealthCheckMinSampleCount=10, lazyHealthCheckMode='TimeoutOrServFail', pool='doh'} + newServer{address="127.0.0.1:%s", tls='openssl', dohPath='/dns-query', caStore='ca.pem', subjectAddr='127.0.0.1', healthCheckMode='lazy', checkInterval=1, lazyHealthCheckFailedInterval=1, lazyHealthCheckThreshold=10, lazyHealthCheckSampleSize=100, lazyHealthCheckMinSampleCount=10, lazyHealthCheckMode='TimeoutOrServFail', pool='doh'} addAction('doh.lazy.test.powerdns.com.', PoolAction('doh')) """ _verboseMode = True