]> git.ipfire.org Git - thirdparty/systemd.git/commit
projects / thirdparty / systemd.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: feda6f3) | patch
resolved: honour per-link DNSOverTLS=yes for certificate verification
authorLuca Boccassi <luca.boccassi@gmail.com>
Fri, 24 Apr 2026 21:03:17 +0000 (22:03 +0100)
committerLennart Poettering <lennart@poettering.net>
Wed, 8 Jul 2026 15:29:03 +0000 (17:29 +0200)
commit052ff5fb5d57e498c92dc3a0f187486a889bfeff
treee89e844536808a5c18d08da90edf5e006cdc8211tree | snapshot
parentfeda6f31d8cd69e1e677a331fd76b857a1bde800commit | diff
resolved: honour per-link DNSOverTLS=yes for certificate verification

dnstls_stream_connect_tls() reads the manager-wide dns_over_tls_mode
field directly, so when the global mode was 'no' or 'opportunistic' but
a link was configured with strict DNSOverTLS=yes, the DoT connection
was established without SSL_VERIFY_PEER or hostname/IP checks.
Use dns_server_get_dns_over_tls_mode() which honours the per-link
override.
src/resolve/resolved-dnstls.c diff | blob | blame | history
test/units/TEST-75-RESOLVED.sh diff | blob | blame | history
Unnamed repository; edit this file 'description' to name the repository.