- Create the quic SSL listening context only when needed.

diff --git a/daemon/unbound.c b/daemon/unbound.c
index feea431809916c5f9e3b55b8d7eb0af43caf0da8..8de7eb0a590f6dcc462059ffd772cb0f393415a5 100644 (file)
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -505,9 +505,11 @@ setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
                }
 #endif
 #ifdef HAVE_NGTCP2
-               if(!(daemon->listen_quic_sslctx = quic_sslctx_create(
-                       cfg->ssl_service_key, cfg->ssl_service_pem, NULL))) {
-                       fatal_exit("could not set up quic SSL_CTX");
+               if(cfg_has_quic(cfg)) {
+                       if(!(daemon->listen_quic_sslctx = quic_sslctx_create(
+                               cfg->ssl_service_key, cfg->ssl_service_pem, NULL))) {
+                               fatal_exit("could not set up quic SSL_CTX");
+                       }
                }
 #endif /* HAVE_NGTCP2 */
        }

diff --git a/doc/Changelog b/doc/Changelog
index 050304516fb0e12733757fd4ae815ed4a491b05a..e7d8803aafc35b3cfe8cb304f015e5ddf1738f06 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,7 @@
 20 January 2025: Yorgos
        - Merge #1222: Unique DoT and DoH SSL contexts to allow for different
          ALPN.
+       - Create the quic SSL listening context only when needed.
 
 15 January 2025: Yorgos
        - Merge #1221: Consider auth zones when checking for forwarders.

diff --git a/util/config_file.c b/util/config_file.c
index dbe1b70814cae40f802a8d8065def1a75499f062..b1f0d874157b61fc3d1c336ffb71171575a66462 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -2866,3 +2866,22 @@ if_is_quic(const char* ifname, const char* port, int quic_port)
        return 0;
 #endif
 }
+
+/** see if config contains quic turned on */
+int
+cfg_has_quic(struct config_file* cfg)
+{
+#ifndef HAVE_NGTCP2
+       (void)cfg;
+       return 0;
+#else
+       int i;
+       char portbuf[32];
+       snprintf(portbuf, sizeof(portbuf), "%d", cfg->port);
+       for(i = 0; i<cfg->num_ifs; i++) {
+               if(if_is_quic(cfg->ifs[i], portbuf, cfg->quic_port))
+                       return 1;
+       }
+       return 0;
+#endif
+}

diff --git a/util/config_file.h b/util/config_file.h
index 07e539f0657142b88d03091f3bb46b6d3c5c6f7b..6f808b9605931715b9c1b716ee77a65b1ad998d4 100644 (file)
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -1419,6 +1419,13 @@ int if_is_dnscrypt(const char* ifname, const char* port, int dnscrypt_port);
 /** see if interface is quic, its port number == the quic port number */
 int if_is_quic(const char* ifname, const char* port, int quic_port);
 
+/**
+ * Return true if the config contains settings that enable quic.
+ * @param cfg: config information.
+ * @return true if quic ports are used for server.
+ */
+int cfg_has_quic(struct config_file* cfg);
+
 #ifdef USE_LINUX_IP_LOCAL_PORT_RANGE
 #define LINUX_IP_LOCAL_PORT_RANGE_PATH "/proc/sys/net/ipv4/ip_local_port_range"
 #endif