diff options
| -rw-r--r-- | channels/chan_sip.c | 7 | ||||
| -rw-r--r-- | main/http.c | 13 | ||||
| -rw-r--r-- | main/manager.c | 10 | ||||
| -rw-r--r-- | main/tcptls.c | 5 |
4 files changed, 30 insertions, 5 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index f3a260a27..631c1db5d 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -31646,8 +31646,11 @@ static int reload_config(enum channelreloadreason reason) continue; } - /* handle tls conf */ - if (!ast_tls_read_conf(&default_tls_cfg, &sip_tls_desc, v->name, v->value)) { + /* handle tls conf, don't allow setting of tlsverifyclient as it isn't supported by chan_sip */ + if (!strcasecmp(v->name, "tlsverifyclient")) { + ast_log(LOG_WARNING, "Ignoring unsupported option 'tlsverifyclient'\n"); + continue; + } else if (!ast_tls_read_conf(&default_tls_cfg, &sip_tls_desc, v->name, v->value)) { continue; } diff --git a/main/http.c b/main/http.c index fc2931290..73fb8bc92 100644 --- a/main/http.c +++ b/main/http.c @@ -1060,8 +1060,17 @@ static int __ast_http_load(int reload) v = ast_variable_browse(cfg, "general"); for (; v; v = v->next) { - /* handle tls conf */ - if (!ast_tls_read_conf(&http_tls_cfg, &https_desc, v->name, v->value)) { + /* read tls config options while preventing unsupported options from being set */ + if (strcasecmp(v->name, "tlscafile") + && strcasecmp(v->name, "tlscapath") + && strcasecmp(v->name, "tlscadir") + && strcasecmp(v->name, "tlsverifyclient") + && strcasecmp(v->name, "tlsdontverifyserver") + && strcasecmp(v->name, "tlsclientmethod") + && strcasecmp(v->name, "sslclientmethod") + && strcasecmp(v->name, "tlscipher") + && strcasecmp(v->name, "sslcipher") + && !ast_tls_read_conf(&http_tls_cfg, &https_desc, v->name, v->value)) { continue; } diff --git a/main/manager.c b/main/manager.c index 10a3a3397..d5d5ccc26 100644 --- a/main/manager.c +++ b/main/manager.c @@ -7795,7 +7795,15 @@ static int __init_manager(int reload, int by_external_config) for (var = ast_variable_browse(cfg, "general"); var; var = var->next) { val = var->value; - if (!ast_tls_read_conf(&ami_tls_cfg, &amis_desc, var->name, val)) { + /* read tls config options while preventing unsupported options from being set */ + if (strcasecmp(var->name, "tlscafile") + && strcasecmp(var->name, "tlscapath") + && strcasecmp(var->name, "tlscadir") + && strcasecmp(var->name, "tlsverifyclient") + && strcasecmp(var->name, "tlsdontverifyserver") + && strcasecmp(var->name, "tlsclientmethod") + && strcasecmp(var->name, "sslclientmethod") + && !ast_tls_read_conf(&ami_tls_cfg, &amis_desc, var->name, val)) { continue; } diff --git a/main/tcptls.c b/main/tcptls.c index dffba1dcd..2b4842638 100644 --- a/main/tcptls.c +++ b/main/tcptls.c @@ -373,6 +373,11 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client) cfg->enabled = 0; return 0; } + + SSL_CTX_set_verify(cfg->ssl_ctx, + ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE, + NULL); + if (!ast_strlen_zero(cfg->certfile)) { char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile; if (SSL_CTX_use_certificate_file(cfg->ssl_ctx, cfg->certfile, SSL_FILETYPE_PEM) == 0) { |