tcptls: Prevent unsupported options from being set

AMI, HTTP, and chan_sip all support TLS in some way, but none of them
support all the options that Asterisk's TLS core is capable of
interpreting. This prevents consumers of the TLS/SSL layer from setting
TLS/SSL options that they do not support.

This also gets tlsverifyclient closer to a working state by requesting
the client certificate when tlsverifyclient is set. Currently, there is
no consumer of main/tcptls.c in Asterisk that supports this feature and
so it can not be properly tested.

Review: https://reviewboard.asterisk.org/r/2370/
Reported-by: John Bigelow
Patch-by: Kinsey Moore
(closes issue AST-1093)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@383165 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 9aa286e44c48f81673f30d03990b8cb9fb0489c4..74feb6695c06eb1a480e1a66e57dda65636ad07d 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -28882,8 +28882,11 @@ static int reload_config(enum channelreloadreason reason)
                if (!ast_jb_read_conf(&global_jbconf, v->name, v->value))
                        continue;
 
-               /* handle tls conf */
-               if (!ast_tls_read_conf(&default_tls_cfg, &sip_tls_desc, v->name, v->value)) {
+               /* handle tls conf, don't allow setting of tlsverifyclient as it isn't supported by chan_sip */
+               if (!strcasecmp(v->name, "tlsverifyclient")) {
+                       ast_log(LOG_WARNING, "Ignoring unsupported option 'tlsverifyclient'\n");
+                       continue;
+               } else if (!ast_tls_read_conf(&default_tls_cfg, &sip_tls_desc, v->name, v->value)) {
                        continue;
                }
 

diff --git a/main/http.c b/main/http.c
index 991260f75a838777a28b44d0d379e3d7aa96fe80..1b5f2b6962b6f7fe0f51a5cbd648fee60cec352a 100644 (file)
--- a/main/http.c
+++ b/main/http.c
@@ -1076,8 +1076,17 @@ static int __ast_http_load(int reload)
                v = ast_variable_browse(cfg, "general");
                for (; v; v = v->next) {
 
-                       /* handle tls conf */
-                       if (!ast_tls_read_conf(&http_tls_cfg, &https_desc, v->name, v->value)) {
+                       /* read tls config options while preventing unsupported options from being set */
+                       if (strcasecmp(v->name, "tlscafile")
+                               && strcasecmp(v->name, "tlscapath")
+                               && strcasecmp(v->name, "tlscadir")
+                               && strcasecmp(v->name, "tlsverifyclient")
+                               && strcasecmp(v->name, "tlsdontverifyserver")
+                               && strcasecmp(v->name, "tlsclientmethod")
+                               && strcasecmp(v->name, "sslclientmethod")
+                               && strcasecmp(v->name, "tlscipher")
+                               && strcasecmp(v->name, "sslcipher")
+                               && !ast_tls_read_conf(&http_tls_cfg, &https_desc, v->name, v->value)) {
                                continue;
                        }
 

diff --git a/main/manager.c b/main/manager.c
index 1696d5ec5c1ab4ee416c58f1b9134d4a97183125..6fa956b8a6a5559c63494a111da4ef60d8f65a65 100644 (file)
--- a/main/manager.c
+++ b/main/manager.c
@@ -6893,7 +6893,15 @@ static int __init_manager(int reload)
        for (var = ast_variable_browse(cfg, "general"); var; var = var->next) {
                val = var->value;
 
-               if (!ast_tls_read_conf(&ami_tls_cfg, &amis_desc, var->name, val)) {
+               /* read tls config options while preventing unsupported options from being set */
+               if (strcasecmp(var->name, "tlscafile")
+                       && strcasecmp(var->name, "tlscapath")
+                       && strcasecmp(var->name, "tlscadir")
+                       && strcasecmp(var->name, "tlsverifyclient")
+                       && strcasecmp(var->name, "tlsdontverifyserver")
+                       && strcasecmp(var->name, "tlsclientmethod")
+                       && strcasecmp(var->name, "sslclientmethod")
+                       && !ast_tls_read_conf(&ami_tls_cfg, &amis_desc, var->name, val)) {
                        continue;
                }
 

diff --git a/main/tcptls.c b/main/tcptls.c
index df4e7ad5ea13a84178a1465069ec751932e27301..c25f63fceb4593df5dbddecaa393124e36451520 100644 (file)
--- a/main/tcptls.c
+++ b/main/tcptls.c
@@ -364,6 +364,11 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client)
                cfg->enabled = 0;
                return 0;
        }
+
+       SSL_CTX_set_verify(cfg->ssl_ctx,
+               ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE,
+               NULL);
+
        if (!ast_strlen_zero(cfg->certfile)) {
                char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile;
                if (SSL_CTX_use_certificate_file(cfg->ssl_ctx, cfg->certfile, SSL_FILETYPE_PEM) == 0) {