From 06d3f22a5f024613b692b6113eec1ca3122a2592 Mon Sep 17 00:00:00 2001 From: Nanang Izzuddin Date: Mon, 16 Jan 2012 05:05:47 +0000 Subject: Close #1014: - Added configurable ciphers setting in SIP TLS transport and pjsua app. - Added API pj_ssl_cipher_is_supported(). git-svn-id: http://svn.pjsip.org/repos/pjproject/branches/1.x@3942 74dad513-b988-da41-8d7b-12977e46ad98 --- pjsip/include/pjsip/sip_transport_tls.h | 24 ++++++++++++++++++++---- pjsip/src/pjsip/sip_transport_tls.c | 5 ++++- 2 files changed, 24 insertions(+), 5 deletions(-) (limited to 'pjsip') diff --git a/pjsip/include/pjsip/sip_transport_tls.h b/pjsip/include/pjsip/sip_transport_tls.h index f9426412..241b063b 100644 --- a/pjsip/include/pjsip/sip_transport_tls.h +++ b/pjsip/include/pjsip/sip_transport_tls.h @@ -26,6 +26,7 @@ */ #include +#include #include #include #include @@ -106,10 +107,19 @@ typedef struct pjsip_tls_setting int method; /** - * TLS cipher list string in OpenSSL format. If empty, then default - * cipher list of the backend will be used. + * Number of ciphers contained in the specified cipher preference. + * If this is set to zero, then default cipher list of the backend + * will be used. + * + * Default: 0 (zero). + */ + unsigned ciphers_num; + + /** + * Ciphers and order preference. The #pj_ssl_cipher_get_availables() + * can be used to check the available ciphers supported by backend. */ - pj_str_t ciphers; + pj_ssl_cipher *ciphers; /** * Optionally specify the server name instance to be contacted when @@ -246,7 +256,13 @@ PJ_INLINE(void) pjsip_tls_setting_copy(pj_pool_t *pool, pj_strdup_with_null(pool, &dst->cert_file, &src->cert_file); pj_strdup_with_null(pool, &dst->privkey_file, &src->privkey_file); pj_strdup_with_null(pool, &dst->password, &src->password); - pj_strdup_with_null(pool, &dst->ciphers, &src->ciphers); + if (src->ciphers_num) { + unsigned i; + dst->ciphers = (pj_ssl_cipher*) pj_pool_calloc(pool, src->ciphers_num, + sizeof(pj_ssl_cipher)); + for (i=0; iciphers_num; ++i) + dst->ciphers[i] = src->ciphers[i]; + } } diff --git a/pjsip/src/pjsip/sip_transport_tls.c b/pjsip/src/pjsip/sip_transport_tls.c index face6b88..bae3ffd1 100644 --- a/pjsip/src/pjsip/sip_transport_tls.c +++ b/pjsip/src/pjsip/sip_transport_tls.c @@ -293,6 +293,8 @@ PJ_DEF(pj_status_t) pjsip_tls_transport_start (pjsip_endpoint *endpt, ssock_param.send_buffer_size = PJSIP_MAX_PKT_LEN; if (ssock_param.read_buffer_size < PJSIP_MAX_PKT_LEN) ssock_param.read_buffer_size = PJSIP_MAX_PKT_LEN; + ssock_param.ciphers_num = listener->tls_setting.ciphers_num; + ssock_param.ciphers = listener->tls_setting.ciphers; ssock_param.qos_type = listener->tls_setting.qos_type; ssock_param.qos_ignore_error = listener->tls_setting.qos_ignore_error; pj_memcpy(&ssock_param.qos_params, &listener->tls_setting.qos_params, @@ -862,7 +864,6 @@ static pj_status_t lis_create_transport(pjsip_tpfactory *factory, ssock_param.cb.on_data_sent = &on_data_sent; ssock_param.async_cnt = 1; ssock_param.ioqueue = pjsip_endpt_get_ioqueue(listener->endpt); - PJ_TODO(synchronize_tls_cipher_type_with_ssl_sock_cipher_type); ssock_param.server_name = remote_name; ssock_param.timeout = listener->tls_setting.timeout; ssock_param.user_data = NULL; /* pending, must be set later */ @@ -872,6 +873,8 @@ static pj_status_t lis_create_transport(pjsip_tpfactory *factory, ssock_param.send_buffer_size = PJSIP_MAX_PKT_LEN; if (ssock_param.read_buffer_size < PJSIP_MAX_PKT_LEN) ssock_param.read_buffer_size = PJSIP_MAX_PKT_LEN; + ssock_param.ciphers_num = listener->tls_setting.ciphers_num; + ssock_param.ciphers = listener->tls_setting.ciphers; ssock_param.qos_type = listener->tls_setting.qos_type; ssock_param.qos_ignore_error = listener->tls_setting.qos_ignore_error; pj_memcpy(&ssock_param.qos_params, &listener->tls_setting.qos_params, -- cgit v1.2.3