diff options
| author | Kinsey Moore <kmoore@digium.com> | 2013-03-15 12:53:03 +0000 |
|---|---|---|
| committer | Kinsey Moore <kmoore@digium.com> | 2013-03-15 12:53:03 +0000 |
| commit | ad5f3a5759a6e86e364811198432dcc7597f6109 (patch) | |
| tree | 5a5415e74d28c7b64af35964795e9e18d5b14b72 /main/tcptls.c | |
| parent | cacc356bbe211d04a9fea57b6433e0ffa52369df (diff) | |
tcptls: Prevent unsupported options from being set
AMI, HTTP, and chan_sip all support TLS in some way, but none of them
support all the options that Asterisk's TLS core is capable of
interpreting. This prevents consumers of the TLS/SSL layer from setting
TLS/SSL options that they do not support.
This also gets tlsverifyclient closer to a working state by requesting
the client certificate when tlsverifyclient is set. Currently, there is
no consumer of main/tcptls.c in Asterisk that supports this feature and
so it can not be properly tested.
Review: https://reviewboard.asterisk.org/r/2370/
Reported-by: John Bigelow
Patch-by: Kinsey Moore
(closes issue AST-1093)
........
Merged revisions 383165 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 383166 from http://svn.asterisk.org/svn/asterisk/branches/11
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@383167 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'main/tcptls.c')
| -rw-r--r-- | main/tcptls.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/main/tcptls.c b/main/tcptls.c index dffba1dcd..2b4842638 100644 --- a/main/tcptls.c +++ b/main/tcptls.c @@ -373,6 +373,11 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client) cfg->enabled = 0; return 0; } + + SSL_CTX_set_verify(cfg->ssl_ctx, + ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE, + NULL); + if (!ast_strlen_zero(cfg->certfile)) { char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile; if (SSL_CTX_use_certificate_file(cfg->ssl_ctx, cfg->certfile, SSL_FILETYPE_PEM) == 0) { |