- unbound-host initializes ssl (for potential DNS-over-TLS usage

  inside libunbound).

git-svn-id: file:///svn/unbound/trunk@4690 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/Makefile.in b/Makefile.in
index 1b1503632e82446de440b035f37d079c4ac3fabf..f104fdb9b2d80f0803f9c8f4dc6a68f33d20b1cb 100644 (file)
--- a/Makefile.in
+++ b/Makefile.in
@@ -327,7 +327,7 @@ unbound-control$(EXEEXT):   $(CONTROL_OBJ_LINK) libunbound.la
        $(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
 
 unbound-host$(EXEEXT): $(HOST_OBJ_LINK) libunbound.la
-       $(LINK) -o $@ $(HOST_OBJ_LINK) -L. -L.libs -lunbound $(LIBS)
+       $(LINK) -o $@ $(HOST_OBJ_LINK) -L. -L.libs -lunbound $(SSLLIB) $(LIBS)
 
 unbound-anchor$(EXEEXT):       $(UBANCHOR_OBJ_LINK) libunbound.la
        $(LINK) -o $@ $(UBANCHOR_OBJ_LINK) -L. -L.libs -lunbound -lexpat $(SSLLIB) $(LIBS)

diff --git a/doc/Changelog b/doc/Changelog
index 30a077e05602ccbd0217b242ca9c923fb2dc0e29..e46e7aad626e0ff1beee334644e190599099879b 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,8 @@
 24 May 2018: Wouter
        - Fix that libunbound can do DNS-over-TLS, when configured.
        - Fix that windows unbound service can use DNS-over-TLS.
+       - unbound-host initializes ssl (for potential DNS-over-TLS usage
+         inside libunbound).
 
 23 May 2018: Wouter
        - Use accept4 to speed up incoming TCP (and TLS) connections,

diff --git a/smallapp/unbound-host.c b/smallapp/unbound-host.c
index 93b5e48700117a0eb35fa317f4d444d98f42be31..cd1ffe3351d2696f367a6d5eeddf4233ad61468e 100644 (file)
--- a/smallapp/unbound-host.c
+++ b/smallapp/unbound-host.c
@@ -66,6 +66,14 @@
 /* nss3 */
 #include "nss.h"
 #endif
+#ifdef HAVE_SSL
+#ifdef HAVE_OPENSSL_SSL_H
+#include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#endif /* HAVE_SSL */
 
 /** verbosity for unbound-host app */
 static int verb = 0;
@@ -487,6 +495,26 @@ int main(int argc, char* argv[])
        if(argc != 1)
                usage();
 
+#ifdef HAVE_SSL
+#ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
+       ERR_load_crypto_strings();
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
+       ERR_load_SSL_strings();
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
+       OpenSSL_add_all_algorithms();
+#else
+       OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
+               | OPENSSL_INIT_ADD_ALL_DIGESTS
+               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
+       (void)SSL_library_init();
+#else
+       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+#endif
+#endif /* HAVE_SSL */
 #ifdef HAVE_NSS
         if(NSS_NoDB_Init(".") != SECSuccess) {
                fprintf(stderr, "could not init NSS\n");