Add back DNS over TLS host verification code. Fixes #8602

Requires Unbound 1.9.0_1 from pfsense/freebsd-ports, which fixes a bug
in Unbound 1.9.0 which did not fully implement OpenSSL 1.0.2 host
validation support. See https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5

(cherry picked from commit 7e8bfed216304b37342a0800eb35ef7c29546f5d)

2 files changed, 51 insertions, 2 deletions

diff --git a/src/usr/local/www/services_unbound_domainoverride_edit.php b/src/usr/local/www/services_unbound_domainoverride_edit.php
index b5429a6..b3e6957 100644
--- a/src/usr/local/www/services_unbound_domainoverride_edit.php
+++ b/src/usr/local/www/services_unbound_domainoverride_edit.php
@@ -42,6 +42,7 @@ if (isset($id) && $a_domainOverrides[$id]) {
 	$pconfig['domain'] = $a_domainOverrides[$id]['domain'];
 	$pconfig['ip'] = $a_domainOverrides[$id]['ip'];
 	$pconfig['descr'] = $a_domainOverrides[$id]['descr'];
+	$pconfig['tls_hostname'] = $a_domainOverrides[$id]['tls_hostname'];
 	$pconfig['forward_tls_upstream'] = isset($a_domainOverrides[$id]['forward_tls_upstream']);
 }
 
@@ -80,11 +81,16 @@ if ($_POST['save']) {
 		}
 	}
 
+	if (!empty($_POST['tls_hostname']) && !is_hostname($_POST['tls_hostname'])) {
+		$input_errors[] = gettext("The supplied TLS hostname is not valid.");
+	}
+
 	if (!$input_errors) {
 		$doment = array();
 		$doment['domain'] = $_POST['domain'];
 		$doment['ip'] = $_POST['ip'];
 		$doment['descr'] = $_POST['descr'];
+		$doment['tls_hostname'] = $_POST['tls_hostname'];
 		$doment['forward_tls_upstream'] = isset($_POST['forward_tls_upstream']);
 
 		if (isset($id) && $a_domainOverrides[$id]) {
@@ -137,6 +143,13 @@ $section->addInput(new Form_Checkbox(
 ))->setHelp('When set, queries to %1$sall DNS servers for this domain%2$s will be sent using SSL/TLS on the default port of 853.', '<b>', '</b>');
 
 $section->addInput(new Form_Input(
+	'tls_hostname',
+	'TLS Hostname',
+	'text',
+	$pconfig['tls_hostname']
+))->setHelp('An optional TLS hostname used to verify the server certificate when performing TLS Queries.');
+
+$section->addInput(new Form_Input(
 	'descr',
 	'Description',
 	'text',
diff --git a/src/usr/local/www/system.php b/src/usr/local/www/system.php
index d1cab7d..5337ca8 100644
--- a/src/usr/local/www/system.php
+++ b/src/usr/local/www/system.php
@@ -52,6 +52,14 @@ if (!isset($config['system']['language'])) {
 	$config['system']['language'] = $g['language'];
 }
 
+$dnshost_counter = 1;
+
+while (isset($config["system"]["dns{$dnshost_counter}host"])) {
+	$pconfig_dnshost_counter = $dnshost_counter - 1;
+	$pconfig["dnshost{$pconfig_dnshost_counter}"] = $config["system"]["dns{$dnshost_counter}host"];
+	$dnshost_counter++;
+}
+
 $dnsgw_counter = 1;
 
 while (isset($config["system"]["dns{$dnsgw_counter}gw"])) {
@@ -184,11 +192,15 @@ if ($_POST) {
 
 	while (isset($_POST[$dnsname])) {
 		$dnsgwname = "dnsgw{$dnscounter}";
+		$dnshostname = "dnshost{$dnscounter}";
 		$dnslist[] = $_POST[$dnsname];
 
 		if (($_POST[$dnsname] && !is_ipaddr($_POST[$dnsname]))) {
 			$input_errors[] = sprintf(gettext("A valid IP address must be specified for DNS server %s."), $dnscounter+1);
 		} else {
+			if (!empty($_POST[$dnshostname]) && !is_hostname($_POST[$dnshostname])) {
+				$input_errors[] = sprintf(gettext('The hostname provided for DNS server "%1$s" is not valid.'), $_POST[$dnsname]);
+			}
 			if (($_POST[$dnsgwname] <> "") && ($_POST[$dnsgwname] <> "none")) {
 				// A real gateway has been selected.
 				if (is_ipaddr($_POST[$dnsname])) {
@@ -350,22 +362,29 @@ if ($_POST) {
 		while (isset($_POST[$dnsname])) {
 			// The $_POST array key of the corresponding gateway (starts from 0)
 			$dnsgwname = "dnsgw{$dnscounter}";
-			// The numbering of DNS GW entries in the config starts from 1
+			$dnshostname = "dnshost{$dnscounter}";
+			// The numbering of DNS GW/host entries in the config starts from 1
 			$dnsgwconfigcounter = $dnscounter + 1;
+			$dnshostconfigcounter = $dnscounter + 1;
 			// So this is the array key of the DNS GW entry in $config['system']
 			$dnsgwconfigname = "dns{$dnsgwconfigcounter}gw";
+			$dnshostconfigname = "dns{$dnshostconfigcounter}host";
 
 			$olddnsgwname = $config['system'][$dnsgwconfigname];
+			$olddnshostname = $config['system'][$dnshostconfigname];
 
 			if ($ignore_posted_dnsgw[$dnsgwname]) {
 				$thisdnsgwname = "none";
 			} else {
 				$thisdnsgwname = $pconfig[$dnsgwname];
 			}
+			$thisdnshostname = $pconfig[$dnshostname];
 
 			// "Blank" out the settings for this index, then we set them below using the "outdnscounter" index.
 			$config['system'][$dnsgwconfigname] = "none";
 			$pconfig[$dnsgwname] = "none";
+			$config['system'][$dnshostconfigname] = "";
+			$pconfig[$dnshostname] = "";
 			$pconfig[$dnsname] = "";
 
 			if ($_POST[$dnsname]) {
@@ -377,19 +396,28 @@ if ($_POST) {
 				$outdnsname = "dns{$outdnscounter}";
 				// The $pconfig array key of the corresponding gateway (starts from 0)
 				$outdnsgwname = "dnsgw{$outdnscounter}";
-				// The numbering of DNS GW entries in the config starts from 1
+				// The $pconfig array key of the corresponding hostname (starts from 0)
+				$outdnshostname = "dnshost{$outdnscounter}";
+
+				// The numbering of DNS GW/host entries in the config starts from 1
 				$outdnsgwconfigcounter = $outdnscounter + 1;
+				$outdnshostconfigcounter = $outdnscounter + 1;
 				// So this is the array key of the output DNS GW entry in $config['system']
 				$outdnsgwconfigname = "dns{$outdnsgwconfigcounter}gw";
+				$outdnshostconfigname = "dns{$outdnshostconfigcounter}host";
 
 				$pconfig[$outdnsname] = $_POST[$dnsname];
 				if ($_POST[$dnsgwname]) {
 					$config['system'][$outdnsgwconfigname] = $thisdnsgwname;
 					$pconfig[$outdnsgwname] = $thisdnsgwname;
+					$config['system'][$outdnshostconfigname] = $thisdnshostname;
+					$pconfig[$outdnshostname] = $thisdnshostname;
 				} else {
 					// Note: when no DNS GW name is chosen, the entry is set to "none", so actually this case never happens.
 					unset($config['system'][$outdnsgwconfigname]);
 					$pconfig[$outdnsgwname] = "";
+					unset($config['system'][$outdnshostconfigname]);
+					$pconfig[$outdnshostname] = "";
 				}
 				$outdnscounter++;
 			}
@@ -485,6 +513,7 @@ $dnsserver_count = count($pconfig['dnsserver']);
 $dnsserver_num = 0;
 $dnsserver_help = gettext("Address") . '<br/>' . gettext("Enter IP addresses to be used by the system for DNS resolution.") . " " .
 	gettext("These are also used for the DHCP service, DNS Forwarder and DNS Resolver when it has DNS Query Forwarding enabled.");
+$dnshost_help = gettext("Hostname") . '<br/>' . gettext("Enter the DNS Server Hostname for TLS Verification in the DNS Resolver (optional).");
 $dnsgw_help = gettext("Gateway") . '<br/>'. gettext("Optionally select the gateway for each DNS server.") . " " .
 	gettext("When using multiple WAN connections there should be at least one unique DNS server per gateway.");
 
@@ -506,6 +535,13 @@ foreach ($pconfig['dnsserver'] as $dnsserver) {
 		$dnsserver
 	))->setHelp(($is_last_dnsserver) ? $dnsserver_help:null);
 
+	$group->add(new Form_Input(
+		'dnshost' . $dnsserver_num,
+		'DNS Hostname',
+		'text',
+		$pconfig['dnshost' . $dnsserver_num]
+	))->setHelp(($is_last_dnsserver) ? $dnshost_help:null);
+
 	if ($multiwan)	{
 		$options = array('none' => 'none');