]> git.ipfire.org Git - thirdparty/bind9.git/commit
Add "protocols" options to the "tls" clause
authorArtem Boldariev <artem@boldariev.com>
Mon, 13 Sep 2021 12:39:36 +0000 (15:39 +0300)
committerArtem Boldariev <artem@boldariev.com>
Fri, 1 Oct 2021 12:50:43 +0000 (15:50 +0300)
commit992f81577011b89fecf67d8672fb4e9743a79487
tree9dd79b64caa5eafcfeb9c9209b9e8d67ea0e3689
parent9e039986cd066f0e26560bc4182e5725fc2131db
Add "protocols" options to the "tls" clause

This commit adds the ability to specify allowed TLS protocols versions
within the "tls" clause. If an unsupported TLS protocol version is
specified in a file, the configuration file will not pass
verification.

Also, this commit adds strict checks for "tls" clauses verification,
in particular:

- it ensures that loading configuration files containing duplicated
"tls" clauses is not allowed;

- it ensures that loading configuration files containing "tls" clauses
missing "cert-file" or "key-file" is not allowed;

- it ensures that loading configuration files containing "tls" clauses
named as "ephemeral" or "none" is not allowed.
21 files changed:
bin/named/named.conf.rst
bin/named/server.c
bin/tests/system/checkconf/bad-dot-badprotocol.conf [new file with mode: 0644]
bin/tests/system/checkconf/bad-dot-duplicatetls.conf [new file with mode: 0644]
bin/tests/system/checkconf/bad-dot-ephemeral.conf [new file with mode: 0644]
bin/tests/system/checkconf/bad-dot-nocert.conf [new file with mode: 0644]
bin/tests/system/checkconf/bad-dot-nokey.conf [new file with mode: 0644]
bin/tests/system/checkconf/bad-dot-none.conf [new file with mode: 0644]
bin/tests/system/checkconf/good-doh-tlsopts.conf [new file with mode: 0644]
bin/tests/system/checkconf/good-dot-tlsopts.conf [new file with mode: 0644]
doc/arm/reference.rst
doc/man/named.conf.5in
doc/misc/options
doc/misc/options.active
doc/misc/tls.grammar.rst
lib/bind9/check.c
lib/isc/include/isc/tls.h
lib/isc/tls.c
lib/isccfg/namedconf.c
lib/ns/include/ns/listenlist.h
lib/ns/listenlist.c