diff options
| author | Kinsey Moore <kmoore@digium.com> | 2013-03-15 12:53:03 +0000 |
|---|---|---|
| committer | Kinsey Moore <kmoore@digium.com> | 2013-03-15 12:53:03 +0000 |
| commit | ad5f3a5759a6e86e364811198432dcc7597f6109 (patch) | |
| tree | 5a5415e74d28c7b64af35964795e9e18d5b14b72 /channels | |
| parent | cacc356bbe211d04a9fea57b6433e0ffa52369df (diff) | |
tcptls: Prevent unsupported options from being set
AMI, HTTP, and chan_sip all support TLS in some way, but none of them
support all the options that Asterisk's TLS core is capable of
interpreting. This prevents consumers of the TLS/SSL layer from setting
TLS/SSL options that they do not support.
This also gets tlsverifyclient closer to a working state by requesting
the client certificate when tlsverifyclient is set. Currently, there is
no consumer of main/tcptls.c in Asterisk that supports this feature and
so it can not be properly tested.
Review: https://reviewboard.asterisk.org/r/2370/
Reported-by: John Bigelow
Patch-by: Kinsey Moore
(closes issue AST-1093)
........
Merged revisions 383165 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 383166 from http://svn.asterisk.org/svn/asterisk/branches/11
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@383167 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'channels')
| -rw-r--r-- | channels/chan_sip.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index f3a260a27..631c1db5d 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -31646,8 +31646,11 @@ static int reload_config(enum channelreloadreason reason) continue; } - /* handle tls conf */ - if (!ast_tls_read_conf(&default_tls_cfg, &sip_tls_desc, v->name, v->value)) { + /* handle tls conf, don't allow setting of tlsverifyclient as it isn't supported by chan_sip */ + if (!strcasecmp(v->name, "tlsverifyclient")) { + ast_log(LOG_WARNING, "Ignoring unsupported option 'tlsverifyclient'\n"); + continue; + } else if (!ast_tls_read_conf(&default_tls_cfg, &sip_tls_desc, v->name, v->value)) { continue; } |