no unbound-control without certificates?

Unbound
1

Hello,

after update from 1.5.9 to 1.5.10 "unbound-control reload" no longer work:

the relevant unbound.conf section:
     remote-control:
       control-enable: yes
       control-interface: /path/to/unbound-control.socket
       control-use-cert: no

# ls -la /path/to/unbound-control.socket
srw-rw---- 1 unbound unbound 0 Nov 3 14:24 /path/to/unbound-control.socket

# unbound-control reload
error: SSL handshake failed
140666240513792:error:141640B5:SSL routines:tls_construct_client_hello:no ciphers available:ssl/statem/statem_clnt.c:815:

Andreas

2

Hi Andreas,

Unbound sets SSL_CTX_set_cipher_list(rc->ctx, "aNULL") in
daemon/remote.c, you can get the list of aNULL ciphers(1) with
$ openssl ciphers aNULL
For me that is a long list of ciphers.

I do not really know what the correct list is to set here. It seems
reasonable that authentication has already been handled by dh and unix
socket.

Best regards, Wouter

3

Hi Andreas,

Are you using OpenSSL 1.1? Apparently it introduced security levels and
by default doesn't allow aNULL ciphers. I just commited a version to our
repository that sets the security level to 0 for the remote control ssl
context when control-use-cert is no.

Regards,
-- Ralph

4

Ralph Dolmans via Unbound-users:

Hi Andreas,

Are you using OpenSSL 1.1? Apparently it introduced security levels and
by default doesn't allow aNULL ciphers. I just commited a version to our
repository that sets the security level to 0 for the remote control ssl
context when control-use-cert is no.

Hello Ralph,

without testing I would say that's the key!
Just looked into the openssl-1.1.x source and found rare documentation.
I'll apply your solution an report...

Andreas

5

Ralph Dolmans via Unbound-users:

Are you using OpenSSL 1.1? Apparently it introduced security levels and
by default doesn't allow aNULL ciphers. I just commited a version to our
repository that sets the security level to 0 for the remote control ssl
context when control-use-cert is no.

confirmed.
for reference I attache my minimalistic, not portable patch...

Andreas

(attachments)

unbound-1.5.10+openssl-1.1.0.patch (1.19 KB)