Re: NSD 4.2.0rc1 pre-release available

Wouter Wijngaards <[email protected]> Tue, 11 Jun 2019 15:25:11 +0200
Newsgroups	gmane.network.dns.nsd.general
Message-ID	<[email protected]>
Hi Andreas,

Fixed the ctx create code and the cipher selection you suggested (for
the next release).  Thanks for the suggestions, it is good to harden the
remote control connection too.

Best regards, Wouter

On 6/7/19 9:29 AM, A. Schulze wrote:
> 
> Am 06.06.19 um 11:29 schrieb Wouter Wijngaards:
>> NSD 4.2.0rc1 release candidate is available:
>> https://www.nlnetlabs.nl/downloads/nsd/nsd-4.2.0rc1.tar.gz
> 
>> - Patch to add support for tls service on a specified tls port,
>>   from Sara Dickinson (Sinodun).
> cool, the patch works here since March
> 
>> - TLS OCSP stapling support, enabled with tls-service-ocsp: filename,
>>   patch from Andreas Schulze.
> OCSP-Data are valid for a much shorter time then certificates.
> For this reason I renew OCSP-data daily.
> 
> Currently this mean, I restart nsd once a day.
> 
> At the long tail it would be helpful if updated certificates,
> private keys and ocsp-data would only require a reload.
> 
> 
>> - Disable TLS1.0, TLS1.1 and weak ciphers, enable
>>   CIPHER_SERVER_PREFERENCE, patch from Andreas Schulze.
> there is TLS setup code in
>   - server.c ~lines 1660...1270, server_tls_ctx_create()
>   - remote.c ~lines  250...300, remote_setup_ctx
> 
> the code for the same problem exists twice but only in server.c the
> "hardening" happen.
> Is this not implemented in remote.c to not break existing remote control
> installations?
> 
> Also I've a problem with the cipher selection
> "CHACHA20+ECDH:AESGCM+ECDH:!SHA:!AESCCM"
> ( server.c, line 1709 ) I suggested months ago:
> 
> It's redundant, prefer CHACHA20-POLY1305 over AESGCM and is not as
> readable as it could be.
> -> new Suggestion: SSL_CTX_set_cipher_list(ctx,
> "ECDHE+AESGCM:ECDHE+CHACHA20")
> 
> 
> Andreas
> 
> 
> _______________________________________________
> nsd-users mailing list
> [email protected]
> https://open.nlnetlabs.nl/mailman/listinfo/nsd-users

_______________________________________________
nsd-users mailing list
[email protected]
https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
signature.asc (application/pgp-signature, 833 B)