- Fixes for the patch, and man page entry.

git-svn-id: file:///svn/unbound/trunk@5055 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/daemon/unbound.c b/daemon/unbound.c
index d5a591e0b11ecc9bd58c2265dc640c7dbb7c701d..193bb123155059a0a817be6d4c9b093b675eca2e 100644 (file)
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -433,13 +433,13 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
                        fatal_exit("could not set up listen SSL_CTX");
                if(cfg->tls_ciphers && cfg->tls_ciphers[0]) {
                        if (!SSL_CTX_set_cipher_list(daemon->listen_sslctx, cfg->tls_ciphers)) {
-                               fatal_exit("faild to set tls-cipher %s",cfg->tls_ciphers);
+                               fatal_exit("failed to set tls-cipher %s", cfg->tls_ciphers);
                        }
                }
 #if OPENSSL_VERSION_NUMBER >= 0x1010101
                if(cfg->tls_ciphersuites && cfg->tls_ciphersuites[0]) {
                        if (!SSL_CTX_set_ciphersuites(daemon->listen_sslctx, cfg->tls_ciphersuites)) {
-                               fatal_exit("faild to set tls-ciphersuites %s",cfg->tls_ciphersuites);
+                               fatal_exit("failed to set tls-ciphersuites %s", cfg->tls_ciphersuites);
                        }
                }
 #endif

diff --git a/doc/Changelog b/doc/Changelog
index d078610353798cd05b86e8af95a9321a12c9848c..7f2b6dc95056397ca5d6d50d0276092833d5c4f8 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,7 @@
 23 January 2018: Wouter
        - Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites
          options for unbound.conf.
+       - Fixes for the patch, and man page entry.
 
 22 January 2018: Wouter
        - Fix space calculation for tcp req buffer size.

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 1ff4c2de2ae7fa6a03ec8118d537db2d0482eabe..d23292725a6524a226a8b0e647b736f4b0df30f1 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -504,6 +504,14 @@ List portnumbers as tls\-additional\-port, and when interfaces are defined,
 eg. with the @port suffix, as this port number, they provide dns over TLS
 service.  Can list multiple, each on a new statement.
 .TP
+.B tls\-ciphers: \fI<string with cipher list>
+Set the list of ciphers to allow when serving TLS.  Use "" for defaults,
+and that is the default.
+.TP
+.B tls\-ciphersuites: \fI<string with ciphersuites list>
+Set the list of ciphersuites to allow when serving TLS.  This is for newer
+TLS 1.3 connections.  Use "" for defaults, and that is the default.
+.TP
 .B use\-systemd: \fI<yes or no>
 Enable or disable systemd socket activation.
 Default is no.

diff --git a/util/config_file.c b/util/config_file.c
index e49bc8f00209411003c700828c085d22e88fd281..30d53727379f10ad532f72a4d96074c92fd0959a 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -487,8 +487,8 @@ int config_set_option(struct config_file* cfg, const char* opt,
        else S_STRLIST("additional-tls-port:", tls_additional_port)
        else S_STRLIST("tls-additional-ports:", tls_additional_port)
        else S_STRLIST("tls-additional-port:", tls_additional_port)
-       else S_STR("tls_ciphers:", tls_ciphers)
-       else S_STR("tls_ciphersuites:", tls_ciphersuites)
+       else S_STR("tls-ciphers:", tls_ciphers)
+       else S_STR("tls-ciphersuites:", tls_ciphersuites)
        else S_YNO("interface-automatic:", if_automatic)
        else S_YNO("use-systemd:", use_systemd)
        else S_YNO("do-daemonize:", do_daemonize)
@@ -1362,6 +1362,8 @@ config_delete(struct config_file* cfg)
        free(cfg->ssl_service_pem);
        free(cfg->tls_cert_bundle);
        config_delstrlist(cfg->tls_additional_port);
+       free(cfg->tls_ciphers);
+       free(cfg->tls_ciphersuites);
        free(cfg->log_identity);
        config_del_strarray(cfg->ifs, cfg->num_ifs);
        config_del_strarray(cfg->out_ifs, cfg->num_out_ifs);

diff --git a/util/config_file.h b/util/config_file.h
index 3a8efce8d01d8cb0de0e7cbd9a34a0f22220ab9f..f61fff269ad355256006be825f8af5215f2a390d 100644 (file)
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -120,9 +120,9 @@ struct config_file {
        int tls_win_cert;
        /** additional tls ports */
        struct config_strlist* tls_additional_port;
-       /** TLS chiper **/
+       /** TLS ciphers */
        char* tls_ciphers;
-       /** TLS chipersuites (TLSv1.3) **/
+       /** TLS chipersuites (TLSv1.3) */
        char* tls_ciphersuites;
 
        /** outgoing port range number of ports (per thread) */