Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle

**Describe the bug**
I were playing with unbound and DNS over TLS. I wanted to check it does something, so I have configured unbound to provide TLS service. Then I made configuration for unbound-host to specify remotes.

**To reproduce**
Steps to reproduce the behavior:
1. provide TLS service on local unbound.
2. create local.conf with following contents:
```
server:
	# tls-cert-bundle: "/etc/unbound/unbound_server.pem"

forward-zone:
	name: "."
	forward-addr: 10.0.1.103@853
	forward-tls-upstream: yes
```
3. ``unbound-host -C local.conf unbound.net``
```
Host unbound.net not found: 2(SERVFAIL).
Host unbound.net not found: 2(SERVFAIL).
Host unbound.net not found: 2(SERVFAIL).
```
4. check record pcap.

It seems this sends query just over TCP, but without proper TLS encapsulation. Queried name is visible in wireshark dump.

**Expected behavior**
It should always encrypt the query. It it is requested to do so but it cannot, it should emit error or at least warning. Nothing is emitted this way.

**System:**
 - Unbound version: 1.13.1
 - OS: Red Hat Enterprise Linux release 9.1 Beta (Plow)
 - `unbound -V` output:
```
Version 1.13.1

Configure line: --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --with-pythonmodule --with-pyunbound PYTHON=/usr/bin/python3 --enable-dnstap --with-libnghttp2 --with-libevent --with-pthreads --with-ssl --disable-rpath --disable-static --enable-relro-now --enable-pie --enable-subnet --enable-ipsecmod --with-conf-file=/etc/unbound/unbound.conf --with-pidfile=/run/unbound/unbound.pid --enable-sha2 --disable-gost --enable-ecdsa --with-rootkey-file=/var/lib/unbound/root.key --enable-linux-ip-local-port-range --disable-sha1
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.1 14 Dec 2021
Linked modules: dns64 python ipsecmod subnetcache respip validator iterator

BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues
```

**Additional information**
It would be cool if I could build-in default value for tls-cert-bundle pointing to distribution specific trust anchor storage. I guess it would be great default value and would be useful not only for unbound, which has a common config path. But tools like unbound-host have no default path to put that in.

Would PR specifying default value for TLS bundle be acceptable?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle #676

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle #676

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions