Package: release.debian.org
Severity: normal
Tags: bookworm
User: release.debian....@packages.debian.org
Usertags: pu
X-Debbugs-Cc: unbo...@packages.debian.org
Control: affects -1 + src:unbound
[ Reason ]
There's a mode of operation of the server (which is becoming
more common with time) which makes it to loop endlessly and
to become useless, and to flood system log. This happens with
libssl3 (which we have in bookworm).
This release has a single bugfix for #1038243 from upstream.
Unstable/testing has a next upstream release already, where
this fix is included.
[ Tests ]
I did a local test of the installed package and observe the
issue is now fixed.
[ Checklist ]
[*] *all* changes are documented in the d/changelog
[*] I reviewed all changes and I approve them
[*] attach debdiff against the package in (old)stable
[*] the issue is verified as fixed in unstable
diff -Nru unbound-1.17.1/debian/changelog unbound-1.17.1/debian/changelog
--- unbound-1.17.1/debian/changelog 2023-04-09 15:59:14.000000000 +0300
+++ unbound-1.17.1/debian/changelog 2023-09-25 18:45:40.000000000 +0300
@@ -1,3 +1,11 @@
+unbound (1.17.1-2+deb12u1) bookworm; urgency=medium
+
+ * fix-812-fix-846-by-using-the-SSL_OP_IGNORE_UNEXPECTE.patch from upstream
+ to fix error log flooding when using DNS over TLS with openssl 3.0.
+ Closes: #1038243
+
+ -- Michael Tokarev <m...@tls.msk.ru> Mon, 25 Sep 2023 18:45:40 +0300
+
unbound (1.17.1-2) unstable; urgency=medium
* unbound-helper: return 0 explicitly in a few places
diff -Nru
unbound-1.17.1/debian/patches/fix-812-fix-846-by-using-the-SSL_OP_IGNORE_UNEXPECTE.patch
unbound-1.17.1/debian/patches/fix-812-fix-846-by-using-the-SSL_OP_IGNORE_UNEXPECTE.patch
---
unbound-1.17.1/debian/patches/fix-812-fix-846-by-using-the-SSL_OP_IGNORE_UNEXPECTE.patch
1970-01-01 03:00:00.000000000 +0300
+++
unbound-1.17.1/debian/patches/fix-812-fix-846-by-using-the-SSL_OP_IGNORE_UNEXPECTE.patch
2023-09-25 18:45:40.000000000 +0300
@@ -0,0 +1,68 @@
+From: George Thessalonikefs <geo...@nlnetlabs.nl>
+Date: Fri, 17 Mar 2023 14:39:37 +0100
+Subject: Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option
+ to ignore the unexpected eof while reading in openssl >= 3.
+Origin: upstream,
https://github.com/NLnetLabs/unbound/commit/d7e776114114c16816570e48ab3a27eedc401a0e
+Forwarded: not needed
+Bug: https://github.com/NLnetLabs/unbound/issues/812
+Bug-Debian: https://bugs.debian.org/1038243
+
+---
+ doc/Changelog | 4 ++++
+ util/net_help.c | 21 +++++++++++++++++++++
+ 2 files changed, 25 insertions(+)
+
+#diff --git a/doc/Changelog b/doc/Changelog
+#index 62d2b4c84..25b63ce76 100644
+#--- a/doc/Changelog
+#+++ b/doc/Changelog
+#@@ -1,3 +1,7 @@
+#+17 March 2023: George
+#+ - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option
+#+ to ignore the unexpected eof while reading in openssl >= 3.
+#+
+# 16 March 2023: Wouter
+# - Fix ssl.h include brackets, instead of quotes.
+#
+diff --git a/util/net_help.c b/util/net_help.c
+index 54fad6986..de2d771bd 100644
+--- a/util/net_help.c
++++ b/util/net_help.c
+@@ -1005,6 +1005,16 @@ listen_sslctx_setup(void* ctxt)
+ log_crypto_err("could not set cipher list with
SSL_CTX_set_cipher_list");
+ }
+ #endif
++#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
++ /* ignore errors when peers do not send the mandatory close_notify
++ * alert on shutdown.
++ * Relevant for openssl >= 3 */
++ if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
++ SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
++ log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
++ return 0;
++ }
++#endif
+
+ if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) &
+ SSL_OP_CIPHER_SERVER_PREFERENCE) !=
+@@ -1233,6 +1243,17 @@ void* connect_sslctx_create(char* key, char* pem, char*
verifypem, int wincert)
+ SSL_CTX_free(ctx);
+ return 0;
+ }
++#endif
++#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF)
++ /* ignore errors when peers do not send the mandatory close_notify
++ * alert on shutdown.
++ * Relevant for openssl >= 3 */
++ if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) &
++ SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) {
++ log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF");
++ SSL_CTX_free(ctx);
++ return 0;
++ }
+ #endif
+ if(key && key[0]) {
+ if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) {
+--
+2.39.2
+
diff -Nru unbound-1.17.1/debian/patches/series
unbound-1.17.1/debian/patches/series
--- unbound-1.17.1/debian/patches/series 2022-08-12 13:04:20.000000000
+0300
+++ unbound-1.17.1/debian/patches/series 2023-09-17 09:17:32.000000000
+0300
@@ -1,3 +1,4 @@
unbound-control-setup-check-openssl.patch
do-not-chown-control-socket.patch
do-not-look-at-pidfile.patch
+fix-812-fix-846-by-using-the-SSL_OP_IGNORE_UNEXPECTE.patch
