upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-02-27 03:51:16 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Disable unused 'tls' clause options: 'ca-file' and 'hostname'

Browse source 
This commit disables the unused 'tls' clause options. For these some
backing code exists, but their values are not really used anywhere,
nor there are sufficient syntax tests for them.

These options are only disabled temporarily, until TLS certificate
verification gets implemented.
This commit is contained in:
Artem Boldariev 2021-11-29 10:45:35 +02:00
parent 2fc4239ccb
commit 78b73d0865
9 changed files with 19 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
bin/named/named.conf.rst
View file

@ -561,11 +561,9 @@ TLS
::
tls string {
ca-file quoted_string;
cert-file quoted_string;
ciphers string;
dhparam-file quoted_string;
hostname quoted_string;
key-file quoted_string;
prefer-server-ciphers boolean;
protocols { string; ... };

12
bin/named/transportconf.c
View file

@ -71,10 +71,16 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
dns_transport_set_keyfile);
parse_transport_option(doh, transport, "cert-file",
dns_transport_set_certfile);
#if 0
/*
* The following two options need to remain unavailable until
* TLS certificate verification gets implemented.
*/
parse_transport_option(doh, transport, "ca-file",
dns_transport_set_cafile);
parse_transport_option(doh, transport, "hostname",
dns_transport_set_hostname);
#endif
}
return (ISC_R_SUCCESS);
@ -115,10 +121,16 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
dns_transport_set_keyfile);
parse_transport_option(tls, transport, "cert-file",
dns_transport_set_certfile);
#if 0
/*
* The following two options need to remain unavailable until
* TLS certificate verification gets implemented.
*/
parse_transport_option(tls, transport, "ca-file",
dns_transport_set_cafile);
parse_transport_option(tls, transport, "hostname",
dns_transport_set_hostname);
#endif
}
return (ISC_R_SUCCESS);

1
bin/tests/system/checkconf/good-dot-doh-tls-nokeycert.conf
View file

@ -12,5 +12,4 @@
# In some cases a "tls" statement may omit key-file and cert-file.
tls local-tls {
protocols {TLSv1.2;};
hostname "fqdn.example.com";
};

8
doc/arm/reference.rst
View file

@ -293,7 +293,7 @@ The following statements are supported:
Declares communication channels to get access to ``named`` statistics.
``tls``
Specifies configuration information for a TLS connection, including a ``key-file``, ``cert-file``, ``ca-file``, ``dhparam-file``, ``hostname``, ``ciphers``, ``protocols``, ``prefer-server-ciphers``, and ``session-tickets``.
Specifies configuration information for a TLS connection, including a ``key-file``, ``cert-file``, ``dhparam-file``, ``ciphers``, ``protocols``, ``prefer-server-ciphers``, and ``session-tickets``.
``http``
Specifies configuration information for an HTTP connection, including ``endponts``, ``listener-clients`` and ``streams-per-connection``.
@ -4756,9 +4756,6 @@ The following options can be specified in a ``tls`` statement:
Path to a file containing the TLS certificate to be used for
the connection.
``ca-file``
Path to a file containing trusted TLS certificates.
``dhparam-file``
Path to a file containing Diffie-Hellman parameters,
which is needed to enable the cipher suites depending on the
@ -4766,9 +4763,6 @@ The following options can be specified in a ``tls`` statement:
specified is essential for enabling perfect forward secrecy capable
ciphers in TLSv1.2.
``hostname``
The hostname associated with the certificate.
``protocols``
Allowed versions of the TLS protocol. TLS version 1.2 and higher are
supported, depending on the cryptographic library in use. Multiple

2
doc/man/named.conf.5in
View file

@ -652,11 +652,9 @@ statistics\-channels {
.nf
.ft C
tls string {
ca\-file quoted_string;
cert\-file quoted_string;
ciphers string;
dhparam\-file quoted_string;
hostname quoted_string;
key\-file quoted_string;
prefer\-server\-ciphers boolean;
protocols { string; ... };

2
doc/misc/options
View file

@ -457,11 +457,9 @@ statistics-channels {
}; // may occur multiple times
tls <string> {
ca-file <quoted_string>;
cert-file <quoted_string>;
ciphers <string>;
dhparam-file <quoted_string>;
hostname <quoted_string>;
key-file <quoted_string>;
prefer-server-ciphers <boolean>;
protocols { <string>; ... };

2
doc/misc/options.active
View file

@ -454,11 +454,9 @@ statistics-channels {
}; // may occur multiple times
tls <string> {
ca-file <quoted_string>;
cert-file <quoted_string>;
ciphers <string>;
dhparam-file <quoted_string>;
hostname <quoted_string>;
key-file <quoted_string>;
prefer-server-ciphers <boolean>;
protocols { <string>; ... };

2
doc/misc/tls.grammar.rst
View file

@ -1,11 +1,9 @@
::
tls <string> {
ca-file <quoted_string>;
cert-file <quoted_string>;
ciphers <string>;
dhparam-file <quoted_string>;
hostname <quoted_string>;
key-file <quoted_string>;
prefer-server-ciphers <boolean>;
protocols { <string>; ... };

6
lib/isccfg/namedconf.c
View file

@ -3886,8 +3886,14 @@ static cfg_type_t cfg_type_tlsprotos = { "tls_protocols",
static cfg_clausedef_t tls_clauses[] = {
{ "key-file", &cfg_type_qstring, 0 },
{ "cert-file", &cfg_type_qstring, 0 },
#if 0
/*
* The following two options need to remain unavailable until TLS
* certificate verification gets implemented.
*/
{ "ca-file", &cfg_type_qstring, 0 },
{ "hostname", &cfg_type_qstring, 0 },
#endif
{ "dhparam-file", &cfg_type_qstring, 0 },
{ "protocols", &cfg_type_tlsprotos, 0 },
{ "ciphers", &cfg_type_astring, 0 },