We want to use crypto-policy provided configuration always in our
builds. Allow changing the default of tls-use-system-policy-versions at
build time by a simple configure parameter.
* Do not initialize quic_table unless it is enabled
Fedora in FIPS mode might fail to initialize ngtcp2 library, because
some ciphers desired are not available.
Make it possible to skip initialization by setting explicitly quic_port
to 0. Unless we have some listeners for port 853 configured, skip its
initialization as well.
Related: https://pagure.io/freeipa/issue/9877
* Fix typo in logged function name
Recent openssl genrsa does not use umask for generated keys. There is no
strong reason why every member of unbound group should be able read
server key. But control key would be quite useful to be group readable
and to allow control access to whole group. Allowing access to control
by group membership, not via sudo.
Python since 3.12 prints warning about Py_NoSiteFlag is deprecated. It
seems that variable is not needed since Python 3.8, since it sets in
such cases directly config.site_import variable few moments later.
Move using deprecated variable to versions before that flag in config
could be used only.
This should fix warning like:
pythonmod/pythonmod.c: In function 'pythonmod_init':
pythonmod/pythonmod.c:359:7: warning: 'Py_NoSiteFlag' is deprecated [-Wdeprecated-declarations]
359 | Py_NoSiteFlag = 1;
| ^~~~~~~~~~~~~
In file included from /usr/include/python3.12/Python.h:48,
from pythonmod/pythonmod.c:54:
/usr/include/python3.12/cpython/pydebug.h:14:37: note: declared here
14 | Py_DEPRECATED(3.12) PyAPI_DATA(int) Py_NoSiteFlag;
| ^~~~~~~~~~~~~
https://docs.python.org/3/c-api/init.html#c.Py_NoSiteFlag
Use vanilla m4 files with known source. Prepared for possible removal at
build time if the system already has autoconf-archive source present.
Switch to AX_PKG_SWIG macro for versioned or unversioned swig detection.
Addition to commit a8739bad76, which
updated only address specified in code. But addresses provided in
example configuration were not updated, I think they should be updated
too.
OpenSSL has a way to load default file. That file might contain usable
certificates to verify common connections. Allow similar trust as on
windows and leave it on openssl package to provide sane defaults.
Also provide use-system-cert alias, because it is not windows specific
anymore.
Both crypto functions are not allowed by FIPS 140-3. Use openssl 3.0
function to check FIPS mode presence and use it to make those algorithms
unsupported.
RHEL9/CentOS 9 would fail in default crypto policy. If call to openssl
returns invalid digest then report the name insecure. If all tested
signatures return the same issue, then make the reply insecure.
Change mode first when configuring remote control unix socket. Some
security systems might strip capability of changing other user's system
even to process with effective uid 0. That is done on Fedora by SELinux
policy and systemd for example. SELinux audit then shows errors, because
unbound tries modifying permissions of not own file. Fix just by mode
change as first step, make it owned by unbound:unbound user as the last
step only.
Related: rhbz#1905441
