- Fix local privilege escalation on Windows. Thanks to Hao Huang

  for the report. The OpenSSL init calls are set to not load
  the openssl.cnf file when compiled for Windows.

diff --git a/daemon/daemon.c b/daemon/daemon.c
index 72cd0dc82439f59e8bbf23c9d60348ae98f280eb..5ee12e0dbb1c584396ce8e5e912c9504ad29a75e 100644 (file)
--- a/daemon/daemon.c
+++ b/daemon/daemon.c
@@ -235,7 +235,11 @@ daemon_init(void)
 #  else
        OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                | OPENSSL_INIT_ADD_ALL_DIGESTS
-               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#    endif
+               , NULL);
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
        /* grab the COMP method ptr because openssl leaks it */
@@ -244,7 +248,11 @@ daemon_init(void)
 #  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
        (void)SSL_library_init();
 #  else
-       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#    endif
+               , NULL);
 #  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
        if(!ub_openssl_lock_init())

diff --git a/dnstap/unbound-dnstap-socket.c b/dnstap/unbound-dnstap-socket.c
index c0d344cbbaf431811e98bca6a827ce47ff2358b2..ac1fcfab4458442ea50e8fbaeca37566c051420a 100644 (file)
--- a/dnstap/unbound-dnstap-socket.c
+++ b/dnstap/unbound-dnstap-socket.c
@@ -1561,12 +1561,20 @@ int main(int argc, char** argv)
 #else
                OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                        | OPENSSL_INIT_ADD_ALL_DIGESTS
-                       | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+                       | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+                       | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+                       , NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
                (void)SSL_library_init();
 #else
-               (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+               (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+                       | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+                       , NULL);
 #endif
 #endif /* HAVE_SSL */
        }

diff --git a/doc/Changelog b/doc/Changelog
index 06e40c8d698713caab9502fbb3a15711d9e437b2..19292cc5d1d04279e621bf33d894fb4579d0b02d 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+4 February 2026: Wouter
+       - Fix local privilege escalation on Windows. Thanks to Hao Huang
+         for the report. The OpenSSL init calls are set to not load
+         the openssl.cnf file when compiled for Windows.
+
 3 February 2026: Yorgos
        - Eagerly remove .skip mark files in between mini_tdir.sh runs in case
          there has been a change on the environment.

diff --git a/smallapp/unbound-anchor.c b/smallapp/unbound-anchor.c
index 16f26206719a08fac80c6706c8efe3d25646108b..fac8676d17698d5ce9347bbc5dab03ed29307238 100644 (file)
--- a/smallapp/unbound-anchor.c
+++ b/smallapp/unbound-anchor.c
@@ -2430,12 +2430,20 @@ int main(int argc, char* argv[])
 #else
        OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                | OPENSSL_INIT_ADD_ALL_DIGESTS
-               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
        (void)SSL_library_init();
 #else
-       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 
        if(dolist) do_list_builtin();

diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index bb1d5237edcf84452733bb10c26389c8140b8c11..71e955bec3671271bd49ca7c1bc8595a96d71f71 100644 (file)
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -1052,12 +1052,20 @@ int main(int argc, char* argv[])
 #else
        OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                | OPENSSL_INIT_ADD_ALL_DIGESTS
-               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
        (void)SSL_library_init();
 #else
-       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 
        if(!RAND_status()) {

diff --git a/smallapp/unbound-host.c b/smallapp/unbound-host.c
index edca6b9a37324bc6bfb7484133e616a32edfcec8..dbccf96742b6add69e3be7e998c345d46c6f12c4 100644 (file)
--- a/smallapp/unbound-host.c
+++ b/smallapp/unbound-host.c
@@ -521,12 +521,20 @@ int main(int argc, char* argv[])
 #else
        OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                | OPENSSL_INIT_ADD_ALL_DIGESTS
-               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
        (void)SSL_library_init();
 #else
-       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 #endif /* HAVE_SSL */
 #ifdef HAVE_NSS

diff --git a/testcode/asynclook.c b/testcode/asynclook.c
index fffd14ed598a62b8bf25b3853da01e895cc9796d..74fb9d13e69467c51364357aa476760c97df185a 100644 (file)
--- a/testcode/asynclook.c
+++ b/testcode/asynclook.c
@@ -488,12 +488,20 @@ int main(int argc, char** argv)
 #else
        OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                | OPENSSL_INIT_ADD_ALL_DIGESTS
-               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
        (void)SSL_library_init();
 #else
-       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 #endif /* HAVE_SSL */
 

diff --git a/testcode/dohclient.c b/testcode/dohclient.c
index 5eb523b2e0acc2b6907d14cc1667043334c3ef71..8d8adaf5df34cc7cc3cb7dafd9e418fc067dbda6 100644 (file)
--- a/testcode/dohclient.c
+++ b/testcode/dohclient.c
@@ -642,12 +642,20 @@ int main(int argc, char** argv)
 #else
                OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                        | OPENSSL_INIT_ADD_ALL_DIGESTS
-                       | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+                       | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+                       | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+                       , NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
                (void)SSL_library_init();
 #else
-               (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+               (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+                       | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+                       , NULL);
 #endif
        }
        run(h2_session, port, no_tls, argc, argv);

diff --git a/testcode/petal.c b/testcode/petal.c
index db6b7f77983e2113f794ad4165475318a330ad13..d7d7e07ccb331536da2ff90172859ad2af586e02 100644 (file)
--- a/testcode/petal.c
+++ b/testcode/petal.c
@@ -675,12 +675,20 @@ int main(int argc, char* argv[])
 #else
        OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                | OPENSSL_INIT_ADD_ALL_DIGESTS
-               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+               | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
        (void)SSL_library_init();
 #else
-       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+       (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+               | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+               , NULL);
 #endif
 
        do_service(addr, port, key, cert);

diff --git a/testcode/streamtcp.c b/testcode/streamtcp.c
index 60122c4ddfd1d5763876f0516bb1e6ef96c01d89..ce9e4cbe3f00a5012817773305dce1507889bb7b 100644 (file)
--- a/testcode/streamtcp.c
+++ b/testcode/streamtcp.c
@@ -652,12 +652,20 @@ int main(int argc, char** argv)
 #else
                OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
                        | OPENSSL_INIT_ADD_ALL_DIGESTS
-                       | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+                       | OPENSSL_INIT_LOAD_CRYPTO_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+                       | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+                       , NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
                (void)SSL_library_init();
 #else
-               (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+               (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
+#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
+                       | OPENSSL_INIT_NO_LOAD_CONFIG
+#  endif
+                       , NULL);
 #endif
        }
        send_em(svr, pp2_client, udp, usessl, noanswer, onarrival, delay, argc, argv);