pfSense

devel should pick it up naturally here in a week or two when the 2018Q3 branch comes in. FreeBSD ports tree HEAD/master is at unbound 1.7.3.

Unbound 1.7.3 is in current 2.4.4 snapshots, so this can be added now.

if you guys want this before pfsense 2.5, you only need to compile unbound against openssl 1.1, the system binary can still be an older openssl, which many freebsd configurations actually run like this by using openssl from ports, so basically compiling against a newer openssl from ports whilst still having an older base openssl, now I know pfsense doesnt use freebsd ports, but the basic principle still applies that the unbound pfsense package can be compiled statically against its own openssl 1.1. libraries.

We have gone down the road of having multiple OpenSSL instances on the firewall before and it was a pain to maintain, have everything use the correct paths, make sure everything was linked against the expected version, and so on. It also confused users to have two different sets of OpenSSL binaries on the system that behaved differently. We'll stick to what's in the FreeBSD base system. When we move to a FreeBSD 12 base, we'll get OpenSSL 1.1.x automatically.

Unbound 1.9.0 added support for verifying hosts on OpenSSL 1.0.2, but it still doesn't seem to work. Unbound 1.9.0 is in 2.4.5 snapshots, and I still get the same failure.

Feb  6 11:38:46 jack unbound: [45843:0] error: no name verification functionality in ssl library, ignored name for 9.9.9.9@853#blah.example.com

Looking in the source it's failing a check with this:

#ifndef HAVE_SSL_SET1_HOST
            if(auth_name)
              log_err("no name verification functionality in " 
                "ssl library, ignored name for %s", todo);
#endif

There are a couple other checks as well that were not updated.

I patched the checks and it works as expected in a test, I pushed the patches to our ports repo for further testing. I sent the patch to Unbound at https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5

The next build that includes unbound 1.9.0_1 and the changes referenced on this issue will be ready for testing. Using a patched copy compiled locally, it works. It complains about invalid hosts and notes success of valid hosts:

Deliberately bad/mismatched hostname, fails as expected.

    forward-addr: 149.112.112.112@853#somethingwrong.com

Feb  6 13:59:26 jack unbound: [40033:0] error: ssl handshake failed crypto error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Feb  6 13:59:26 jack unbound: [40033:0] notice: ssl handshake failed ip4 149.112.112.112 port 853 (len 16)

Valid hostname is verified and works:

    forward-addr: 9.9.9.9@853#dns.quad9.net

Feb  6 13:59:38 jack unbound: [40033:0] debug: peer certificate:          Issuer: C=US, O=DigiCert Inc, CN=DigiCert ECC Secure Server CA         Validity             Not Before: Sep 20 00:00:00 2018 GMT             Not After : Sep 24 12:00:00 2020 GMT         Subject: C=US, ST=California, L=Berkeley, O=Quad9, CN=*.quad9.net         X509v3 extensions:             X509v3 Authority Key Identifier:                  keyid:A3:9D:E6:1F:F9:DA:39:4F:C0:6E:E8:91:CB:95:A5:DA:31:E2:0A:9F              X509v3 Subject Key Identifier:                  7F:A9:12:A5:D7:C6:8B:48:02:C7:3D:2A:45:6E:40:1E:40:60:F4:97             X509v3 Subject Alternative Name:                  DNS:*.quad9.net, DNS:quad9.net, IP Address:9.9.9.9, IP Address:9.9.9.10, IP Address:9.9.9.11, IP Address:9.9.9.12, IP Address:9.9.9.13, IP Address:9.9.9.14, IP Address:9.9.9.15, IP Address:149.112.112.9, IP Address:149.112.112.10, IP Address:149.112.112.11, IP Address:149.112.112.12, IP Address:149.112.112.13, IP Address:149.112.112.14, IP Address:149.112.112
Feb  6 13:59:38 jack unbound: [40033:0] debug: SSL connection authenticated ip4 9.9.9.9 port 853 (len 16)

Similar results here. Mismatched FQDN for the server results in a certificate verify error for unbound:
Apr 29 04:48:10 unbound 57201 [57201:0] error: ssl handshake failed crypto error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Apr 29 04:48:10 unbound 57201 [57201:0] notice: ssl handshake failed 9.9.9.9 port 853

2.4.4-p3:

May 13 19:39:24 unbound 82673:1 error: no name verification functionality in ssl library, ignored name for 149.112.112.112@853#dns.xyzzy.com