Unbound accept client initiated renegotiation

[yegle]

pip3 install sslyze
sslyze --reneg $HOSTNAME:853

Result:

$ sslyze example.com:853 --reneg



 AVAILABLE PLUGINS
 -----------------

  CompressionPlugin
  RobotPlugin
  CertificateInfoPlugin
  FallbackScsvPlugin
  SessionRenegotiationPlugin
  SessionResumptionPlugin
  HttpHeadersPlugin
  EarlyDataPlugin
  OpenSslCipherSuitesPlugin
  OpenSslCcsInjectionPlugin
  HeartbleedPlugin



 CHECKING HOST(S) AVAILABILITY
 -----------------------------

   example.com:853                       => XXXXX




 SCAN RESULTS FOR example.com:XXXXX
 ----------------------------------------------------------------------------

 * Session Renegotiation:
       Client-initiated Renegotiation:    VULNERABLE - Server honors client-initiated renegotiations
       Secure Renegotiation:              OK - Supported


 SCAN COMPLETED IN 0.18 S
 ------------------------

[wcawijngaards]

Thanks for the check! The code did not have the SSL_OP_NO_RENEGOTIATION set on the context. The option requires an up to date version of openssl, but then I set it on all the SSL contexts.

[wcawijngaards]

I also fixed this in NSD, by the way. NLnetLabs/nsd@68742ad

[yegle]

Confirm fixed (at least sslyze no longer report the issue).

Any chance to release a new version with this included since this has the potential of being used to do DoS?