Commit Graph

507 Commits

Author SHA1 Message Date
Willem Toorop d7099f6e30 Deal with DoT servers that take long to connect to
(because they might be under attack)
2020-02-21 14:17:00 +01:00
Willem Toorop 4fdf3a8b2a Stuff that came out of valgrind on FreeBSD 12 2019-12-20 11:09:24 +00:00
Jim Hague ea09baf376 Fix Windows build failure when libunbound is present. 2019-10-29 17:42:21 +00:00
Jim Hague 87177cc103 Add a Windows implementation of getdns_context_set_resolvconf().
Have it return GETDNS_RETURN_NOT_IMPLEMENTED. This function is listed in the shared library exports, and it's part of the official API, so we need it.
2019-10-18 19:04:17 +01:00
Jim Hague 5db0d03b13 Enable building on Windows with Visual Studio.
The change mostly consists of removing or replacing non-standard (usually POSIX) header includes.

Guards for replacements for inet_ntop(), inet_pton() and gettimeofday() are updated; the first two are macros on Windows, so the guards are changed to HAVE_DECL. gettimeofday() is present on MinGW builds but not Visual Studio, so that has a function check.
2019-10-15 10:09:17 +01:00
Vladislav Grishenko 416c55734b Optimize local addresses enumeration with old uClibc
uClibc 0.9.30rc1 - 0.9.32rc5 has bug - getaddrinfo() does not accept numeric
service without any hints. As the related side effect, hint struct with
ai_socktype == 0 (unspec) and ai_protocol == 0 (unpsec) gives the same
EAI_SERVICE error instead of same address with different proto enumebration.
For more details please refer https://bugs.busybox.net/show_bug.cgi?id=3841 and
https://git.uclibc.org/uClibc/commit/?id=bc3be18145e4d57e7268506f123c0f0f373a15e2

Since 0.9.3x uClibc versions are still not somewhat unique in embedded (issue
https://github.com/getdnsapi/stubby/issues/124 as example) and non-zero
ai_socktype allows to avoid address dups for each supported UDP/TCP/etc proto,
seems worth to have it specified, as a minor memory allocation optimization at
least.

SOCK_DGRAM vs SOCK_STREAM choice doesn't really matter here, both are actually
used for DNS and both are non-zero, no difference is expected on *nix. So
SOCK_DGRAM selected due original comment only.
2019-04-25 03:31:56 +05:00
Havard Eidnes c68f5a7a8d Fix various build warnings uncovered on NetBSD w/pkgsrc.
The isxxxx() and toxxxx() functions have a limited well-defined
input value range, namely that of "unsigned char" plus EOF.  Cast
args accordingly.

Bring strncasecmp() into scope by including <strings.h>.
2019-01-28 11:24:10 +01:00
Jim Hague 3fe0c94357 Merge branch 'develop' into feature/abstract-tls 2019-01-14 19:09:20 +00:00
Willem Toorop bbe7dff257 No TLS1.3 ciphers in cipher_list only when ...
SSL_set_ciphersuites in OpenSSL API.
2018-12-31 16:13:20 +01:00
Bruno Pagani 1962c03b79
context: remove TLS13 cipher from cipher_list
TLS 1.3 ciphers have to be set in ciphersuites instead.
2018-12-23 11:31:27 +00:00
Willem Toorop 232f655663 trust_anchor_backoff_time also when appdata dir is not writable 2018-12-14 13:42:43 +01:00
Willem Toorop eecc18703a Issue found with static analysis 2018-12-13 15:24:27 +01:00
Willem Toorop 41f4940072 Log messages about trust anchor fetching and installing 2018-12-13 14:23:32 +01:00
Willem Toorop 91a3a3db36 More specific return codes, more logging 2018-12-12 16:12:07 +01:00
Jim Hague ff7ffc246c Rename TLS Interface DANE init to pinset init. That's what it's actually used for. 2018-12-11 12:46:05 +00:00
Jim Hague fee864c25c Implement setting cipher/curve lists.
Set the priority string to a concatenation of the connection cipher and curve strings, falling back to the context ones if the connection value isn't specified. Also get context.c to specify NULL for default context list and the opportunistic list for the connection, moving these library-specific quantities into the specific implementation.
2018-12-07 16:55:17 +00:00
Willem Toorop bb99321e57 More constness for issue #410 2018-12-07 16:34:03 +01:00
Willem Toorop 8a7226baee Move from debugging to logging for
- upstream_stats & stub system
2018-12-07 14:02:17 +01:00
Willem Toorop a1692359f3 RFE #408: Retry fetching of TA after backoff time 2018-12-03 12:27:31 +01:00
Willem Toorop c1f51815ba RFE #408: "dnssec" extension requiring DNSSEC
When this extension is set, GETDNS_DNSSEC_INDETERMINATE status will no
longer be returned.
2018-11-30 14:20:12 +01:00
Willem Toorop e3b007a43a Issue #410: Document ownership with getdns_context_get_api_information()
+ const for extensions and namespaces
TODO: Look at other cases that are not const for no good reason.

Thanks Stefan Bühler
2018-11-27 16:59:47 +01:00
Jim Hague c101a7a021 Abstract context DANE initialisation. 2018-11-27 15:41:23 +00:00
Jim Hague 5e390a4b23 Revise all TLS interfaces to pass in GetDNS memory functions where necessary.
This means we can remove OpenSSL_free() calls from request-internal.c and util-internal.c.
2018-11-27 14:41:46 +00:00
Willem Toorop b90ba236ae tls_ciphersuites, tls_cipher_list, tls_curve_list,
tls_min_version & tls_max_version settings must cause
	failure when not supported by the TLS library.  Not during
	configure time, but during connection setup so it doesn't
	hamper alternative transports.
2018-11-22 11:37:28 +01:00
Willem Toorop 1904ee7318 Enhancement getdnsapi/stubby#56 & getdnsapi/stubby#130
Configurable TLS version
2018-11-21 15:02:28 +01:00
Willem Toorop 6a5e96d4e1 tls_ciphersuites + bugfix in strdup2!! 2018-11-20 16:13:57 +01:00
Jim Hague 52421be5f4 Correct error checking result of _getdns_tls_context_set_ca(). 2018-11-20 15:12:10 +00:00
Jim Hague 5d353d9efb To aid proof-of-concept work, insist on OpenSSL 1.1.1 or later.
Remove ssl_dane as now surplus to requirements.
2018-11-16 17:58:29 +00:00
Jim Hague d9fdd4c10d Abstracting TLS; let's start with context only.
Change data types in context.h and fix up context.c. Do minimal fixups to stub.c.
2018-11-15 11:01:13 +00:00
wtoorop 7fe45a7012
Merge pull request #396 from saradickinson/bugfix/windows_certs
Temporary fix for https://github.com/getdnsapi/stubby/issues/87. Dete…
2018-05-11 11:51:33 +01:00
Willem Toorop 98b1ff624a Memory loss with empty string bindata's 2018-05-11 11:23:19 +02:00
Willem Toorop 7331717990 Fix for Fallback to current (working) directory (for appdata_dir). 2018-05-04 15:30:27 +02:00
Willem Toorop 99bfe4a287 Fallback to current (working) directory (for appdata_dir).
To improve integration with system and service managers like systemd
See also getdnsapi/stubby#106
2018-05-04 10:40:49 +02:00
Willem Toorop 1b5b0ca799 Force trailing '\0' with string config settings
Because even though it is added when parsing from JSON, it will be lost when the bindata is copied into a dict with getdns_dict_set_bindata.
2018-04-23 15:11:20 +02:00
saradickinson ced112ca74 Temporary fix for https://github.com/getdnsapi/stubby/issues/87. Detect and ignore duplicate certs in the root store. 2018-04-05 18:35:07 +01:00
Willem Toorop 8a2fc5f5a9 max_udp_backoff should not be public
At least, not with this point release
2018-03-05 12:42:27 +01:00
Robert Groenenberg a0fb2c8424 Limit back_off value to avoid very long retry interval 2018-03-05 12:01:52 +01:00
Willem Toorop 223e85bc02 Merge branch 'features/tls_curves_list' into release/1.4.0 2018-02-12 16:04:49 +01:00
Willem Toorop 401aa2e3b8 Specify the supported curves with TLS 2018-02-12 15:40:17 +01:00
Willem Toorop 7af885396f Merge branch 'release/1.4.0' into release/1.4.0-merge-PR-377 2018-02-08 11:46:28 +01:00
Willem Toorop 87fec7f9b4 Merge branch 'feature/monitor-tool' into release/1.4.0 2018-02-07 17:11:28 +01:00
Willem Toorop 7d4ccabc7f Merge branch 'bugfix/opportunistic_fallabck' into release/1.4.0-merge-PR-377 2018-02-07 17:00:25 +01:00
Willem Toorop c28a293c9f "Pinset validation failure" error when it occurred 2018-02-07 14:38:31 +01:00
Sara Dickinson 7e3439efbc Improve handling of opportunistic back-off. If other transports are working, don’t forcibly promote failed upstreams just wait for the re-try timer.
Clean up logs.
2018-01-24 13:13:14 +00:00
Jim Hague 3666d994a7 Add 'keepalive' test and supporting changes to getdns library.
Checking for server support for keepalive means we need to know if the server did send a keepalive option to the client. This information is not currently exposed in getdns, so add a flag 'server_keepalive_received' to call_reporting. This is 0 if not received, 1 if received. If received, the actual timeout is in 'idle timeout in ms', though watch out for the overflow alternative.
2018-01-17 15:17:20 +00:00
Willem Toorop 7c5bdd5431 Use danessl submodule when OpenSSL version between 1.0.0 and 1.1.0 2018-01-10 12:47:14 +01:00
Willem Toorop 540735a956 Check pins with DANE functions when available 2018-01-04 15:58:09 +01:00
Willem Toorop 0ef910b9ee read_buf's may remain on canceled tcp requests 2017-12-21 14:53:54 +01:00
Willem Toorop 97cc67d026 s/CApath/tls_ca_path/g s/CAfile/tls_ca_file/g 2017-12-21 13:08:01 +01:00
Willem Toorop ae38a29a50 Upstream specific tls_cipher_list's 2017-12-21 12:30:15 +01:00