From 8099e686909ac129a87b8bcb6248b00f8ffd1220 Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Thu, 18 Nov 2021 11:56:33 +0100 Subject: [PATCH] dnsdist: Warn that GnuTLS 3.7.x leaks memory when validating certs In some configurations that we can't detect (PKCS11 support enabled, with a default PKCS11 trust store), GnuTLS from 3.7.0 to at least 3.7.2 leaks memory when validating a server certificate. The issue has been reported to GnuTLS and acknowledged, but there is no available fix yet. --- pdns/tcpiohandler.cc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pdns/tcpiohandler.cc b/pdns/tcpiohandler.cc index 6068c1bc84..b655eb0f6d 100644 --- a/pdns/tcpiohandler.cc +++ b/pdns/tcpiohandler.cc @@ -1539,6 +1539,9 @@ public: if (params.d_validateCertificates) { if (params.d_caStore.empty()) { +#if GNUTLS_VERSION_NUMBER >= 0x030700 + std::cerr<<"Warning: GnuTLS >= 3.7.0 has a known memory leak when validating server certificates in some configurations (PKCS11 support enabled, and a default PKCS11 trust store), please consider using the OpenSSL provider for outgoing connections instead, or explicitely setting a CA store"<= 0x030700 */ rc = gnutls_certificate_set_x509_system_trust(d_creds.get()); if (rc < 0) { throw std::runtime_error("Error adding the system's default trusted CAs: " + std::string(gnutls_strerror(rc))); -- 2.47.2