diff options
author | Kinsey Moore <kmoore@digium.com> | 2013-03-15 12:53:03 +0000 |
---|---|---|
committer | Kinsey Moore <kmoore@digium.com> | 2013-03-15 12:53:03 +0000 |
commit | ad5f3a5759a6e86e364811198432dcc7597f6109 (patch) | |
tree | 5a5415e74d28c7b64af35964795e9e18d5b14b72 /main | |
parent | cacc356bbe211d04a9fea57b6433e0ffa52369df (diff) |
tcptls: Prevent unsupported options from being set
AMI, HTTP, and chan_sip all support TLS in some way, but none of them
support all the options that Asterisk's TLS core is capable of
interpreting. This prevents consumers of the TLS/SSL layer from setting
TLS/SSL options that they do not support.
This also gets tlsverifyclient closer to a working state by requesting
the client certificate when tlsverifyclient is set. Currently, there is
no consumer of main/tcptls.c in Asterisk that supports this feature and
so it can not be properly tested.
Review: https://reviewboard.asterisk.org/r/2370/
Reported-by: John Bigelow
Patch-by: Kinsey Moore
(closes issue AST-1093)
........
Merged revisions 383165 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 383166 from http://svn.asterisk.org/svn/asterisk/branches/11
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@383167 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'main')
-rw-r--r-- | main/http.c | 13 | ||||
-rw-r--r-- | main/manager.c | 10 | ||||
-rw-r--r-- | main/tcptls.c | 5 |
3 files changed, 25 insertions, 3 deletions
diff --git a/main/http.c b/main/http.c index fc2931290..73fb8bc92 100644 --- a/main/http.c +++ b/main/http.c @@ -1060,8 +1060,17 @@ static int __ast_http_load(int reload) v = ast_variable_browse(cfg, "general"); for (; v; v = v->next) { - /* handle tls conf */ - if (!ast_tls_read_conf(&http_tls_cfg, &https_desc, v->name, v->value)) { + /* read tls config options while preventing unsupported options from being set */ + if (strcasecmp(v->name, "tlscafile") + && strcasecmp(v->name, "tlscapath") + && strcasecmp(v->name, "tlscadir") + && strcasecmp(v->name, "tlsverifyclient") + && strcasecmp(v->name, "tlsdontverifyserver") + && strcasecmp(v->name, "tlsclientmethod") + && strcasecmp(v->name, "sslclientmethod") + && strcasecmp(v->name, "tlscipher") + && strcasecmp(v->name, "sslcipher") + && !ast_tls_read_conf(&http_tls_cfg, &https_desc, v->name, v->value)) { continue; } diff --git a/main/manager.c b/main/manager.c index 10a3a3397..d5d5ccc26 100644 --- a/main/manager.c +++ b/main/manager.c @@ -7795,7 +7795,15 @@ static int __init_manager(int reload, int by_external_config) for (var = ast_variable_browse(cfg, "general"); var; var = var->next) { val = var->value; - if (!ast_tls_read_conf(&ami_tls_cfg, &amis_desc, var->name, val)) { + /* read tls config options while preventing unsupported options from being set */ + if (strcasecmp(var->name, "tlscafile") + && strcasecmp(var->name, "tlscapath") + && strcasecmp(var->name, "tlscadir") + && strcasecmp(var->name, "tlsverifyclient") + && strcasecmp(var->name, "tlsdontverifyserver") + && strcasecmp(var->name, "tlsclientmethod") + && strcasecmp(var->name, "sslclientmethod") + && !ast_tls_read_conf(&ami_tls_cfg, &amis_desc, var->name, val)) { continue; } diff --git a/main/tcptls.c b/main/tcptls.c index dffba1dcd..2b4842638 100644 --- a/main/tcptls.c +++ b/main/tcptls.c @@ -373,6 +373,11 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client) cfg->enabled = 0; return 0; } + + SSL_CTX_set_verify(cfg->ssl_ctx, + ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE, + NULL); + if (!ast_strlen_zero(cfg->certfile)) { char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile; if (SSL_CTX_use_certificate_file(cfg->ssl_ctx, cfg->certfile, SSL_FILETYPE_PEM) == 0) { |