From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 1 Jul 2025 10:26:57 +0000 (+0200)
Subject: Merge pull request #15754 from rgacogne/ddist-warn-on-backend-certificate-validation... 
X-Git-Tag: rec-5.3.0-alpha2~21
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bcdb36bbb1493231c1aad897bc7dabafe779af1d;p=thirdparty%2Fpdns.git

Merge pull request #15754 from rgacogne/ddist-warn-on-backend-certificate-validation-without-subject-name

dnsdist: Error if backend certificate validation is enabled without a subject name
---

bcdb36bbb1493231c1aad897bc7dabafe779af1d
diff --cc pdns/dnsdistdist/dnsdist-configuration-yaml.cc
index f8017f4311,0f1ebd5a85..53a72c27d1
--- a/pdns/dnsdistdist/dnsdist-configuration-yaml.cc
+++ b/pdns/dnsdistdist/dnsdist-configuration-yaml.cc
@@@ -450,18 -448,8 +450,19 @@@ static std::shared_ptr<DownstreamState
    const auto& tlsConf = config.tls;
    auto protocol = boost::to_lower_copy(std::string(config.protocol));
    if (protocol == "dot" || protocol == "doh") {
 +#if !defined(HAVE_DNS_OVER_TLS)
 +    if (protocol == "dot") {
 +      throw std::runtime_error("Backend " + std::string(config.address) + " is configured to use DNS over TLS but DoT support is not available");
 +    }
 +#endif /* HAVE_DNS_OVER_TLS */
 +#if !defined(HAVE_DNS_OVER_HTTPS)
 +    if (protocol == "doh") {
 +      throw std::runtime_error("Backend " + std::string(config.address) + " is configured to use DNS over HTTPS but DoH support is not available");
 +    }
 +#endif /* HAVE_DNS_OVER_HTTPS */
 +
      backendConfig.d_tlsParams.d_provider = std::string(tlsConf.provider);
+     boost::algorithm::to_lower(backendConfig.d_tlsParams.d_provider);
      backendConfig.d_tlsParams.d_ciphers = std::string(tlsConf.ciphers);
      backendConfig.d_tlsParams.d_ciphers13 = std::string(tlsConf.ciphers_tls_13);
      backendConfig.d_tlsParams.d_caStore = std::string(tlsConf.ca_store);