SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

resolved: honour per-link DNSOverTLS=yes for certificate verification

Browse Source 
dnstls_stream_connect_tls() reads the manager-wide dns_over_tls_mode
field directly, so when the global mode was 'no' or 'opportunistic' but
a link was configured with strict DNSOverTLS=yes, the DoT connection
was established without SSL_VERIFY_PEER or hostname/IP checks.
Use dns_server_get_dns_over_tls_mode() which honours the per-link
override.
This commit is contained in:
Luca Boccassi
2026-07-08 17:29:03 +02:00
committed by Lennart Poettering
parent feda6f31d8
commit 052ff5fb5d
2 changed files with 109 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/resolve/resolved-dnstls.c
+1 -1
View File
@@ -101,7 +101,7 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) {
return openssl_to_errno(sym_ERR_get_error());
sym_SSL_set_bio(s, TAKE_PTR(rb), TAKE_PTR(wb));
if (server->manager->dns_over_tls_mode == DNS_OVER_TLS_YES) {
if (dns_server_get_dns_over_tls_mode(server) == DNS_OVER_TLS_YES) {
X509_VERIFY_PARAM *v;
sym_SSL_set_verify(s, SSL_VERIFY_PEER, NULL);