kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-19 03:07:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

tcptls.c: Add peer hostname and port to some error messages

Browse Source 
Where possble, hostname and port has been added to error
messages, mostly on the server side.

ASTERISK-26006
Reported by: Oleksandr Natalenko

Change-Id: Iff4f897277bc36ce8c5b493b71d0a4a7b74e62f0
This commit is contained in:
George Joseph
2019-06-27 14:04:27 -06:00
parent 2f29c375c1
commit c2ffb004aa
1 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
main/tcptls.c
View File

@@ -128,7 +128,8 @@ static void *handle_tcptls_connection(void *data)
* this seems like a good general policy. * this seems like a good general policy.
*/ */
if (ast_thread_inhibit_escalations()) { if (ast_thread_inhibit_escalations()) {
ast_log(LOG_ERROR, "Failed to inhibit privilege escalations; killing connection\n"); ast_log(LOG_ERROR, "Failed to inhibit privilege escalations; killing connection from peer '%s'\n",
ast_sockaddr_stringify(&tcptls_session->remote_address));
ast_tcptls_close_session_file(tcptls_session); ast_tcptls_close_session_file(tcptls_session);
ao2_ref(tcptls_session, -1); ao2_ref(tcptls_session, -1);
return NULL; return NULL;
@@ -141,7 +142,8 @@ static void *handle_tcptls_connection(void *data)
* the individual protocol handlers, but this seems like a good start. * the individual protocol handlers, but this seems like a good start.
*/ */
if (ast_thread_user_interface_set(1)) { if (ast_thread_user_interface_set(1)) {
ast_log(LOG_ERROR, "Failed to set user interface status; killing connection\n"); ast_log(LOG_ERROR, "Failed to set user interface status; killing connection from peer '%s'\n",
ast_sockaddr_stringify(&tcptls_session->remote_address));
ast_tcptls_close_session_file(tcptls_session); ast_tcptls_close_session_file(tcptls_session);
ao2_ref(tcptls_session, -1); ao2_ref(tcptls_session, -1);
return NULL; return NULL;
@@ -150,6 +152,11 @@ static void *handle_tcptls_connection(void *data)
if (tcptls_session->parent->tls_cfg) { if (tcptls_session->parent->tls_cfg) {
#ifdef DO_SSL #ifdef DO_SSL
if (ast_iostream_start_tls(&tcptls_session->stream, tcptls_session->parent->tls_cfg->ssl_ctx, tcptls_session->client) < 0) { if (ast_iostream_start_tls(&tcptls_session->stream, tcptls_session->parent->tls_cfg->ssl_ctx, tcptls_session->client) < 0) {
SSL *ssl = ast_iostream_get_ssl(tcptls_session->stream);
if (ssl) {
ast_log(LOG_ERROR, "Unable to set up ssl connection with peer '%s'\n",
ast_sockaddr_stringify(&tcptls_session->remote_address));
}
ast_tcptls_close_session_file(tcptls_session); ast_tcptls_close_session_file(tcptls_session);
ao2_ref(tcptls_session, -1); ao2_ref(tcptls_session, -1);
return NULL; return NULL;
@@ -162,7 +169,8 @@ static void *handle_tcptls_connection(void *data)
long res; long res;
peer = SSL_get_peer_certificate(ssl); peer = SSL_get_peer_certificate(ssl);
if (!peer) { if (!peer) {
ast_log(LOG_ERROR, "No peer SSL certificate to verify\n"); ast_log(LOG_ERROR, "No SSL certificate to verify from peer '%s'\n",
ast_sockaddr_stringify(&tcptls_session->remote_address));
ast_tcptls_close_session_file(tcptls_session); ast_tcptls_close_session_file(tcptls_session);
ao2_ref(tcptls_session, -1); ao2_ref(tcptls_session, -1);
return NULL; return NULL;
@@ -170,7 +178,9 @@ static void *handle_tcptls_connection(void *data)
res = SSL_get_verify_result(ssl); res = SSL_get_verify_result(ssl);
if (res != X509_V_OK) { if (res != X509_V_OK) {
ast_log(LOG_ERROR, "Certificate did not verify: %s\n", X509_verify_cert_error_string(res)); ast_log(LOG_ERROR, "Certificate from peer '%s' did not verify: %s\n",
ast_sockaddr_stringify(&tcptls_session->remote_address),
X509_verify_cert_error_string(res));
X509_free(peer); X509_free(peer);
ast_tcptls_close_session_file(tcptls_session); ast_tcptls_close_session_file(tcptls_session);
ao2_ref(tcptls_session, -1); ao2_ref(tcptls_session, -1);
@@ -220,7 +230,8 @@ static void *handle_tcptls_connection(void *data)
} }
if (!found) { if (!found) {
ast_log(LOG_ERROR, "Certificate common name did not match (%s)\n", tcptls_session->parent->hostname); ast_log(LOG_ERROR, "Certificate common name from peer '%s' did not match (%s)\n",
ast_sockaddr_stringify(&tcptls_session->remote_address), tcptls_session->parent->hostname);
X509_free(peer); X509_free(peer);
ast_tcptls_close_session_file(tcptls_session); ast_tcptls_close_session_file(tcptls_session);
ao2_ref(tcptls_session, -1); ao2_ref(tcptls_session, -1);
@@ -307,7 +318,8 @@ void *ast_tcptls_server_root(void *data)
/* This thread is now the only place that controls the single ref to tcptls_session */ /* This thread is now the only place that controls the single ref to tcptls_session */
if (ast_pthread_create_detached_background(&launched, NULL, handle_tcptls_connection, tcptls_session)) { if (ast_pthread_create_detached_background(&launched, NULL, handle_tcptls_connection, tcptls_session)) {
ast_log(LOG_ERROR, "TCP/TLS unable to launch helper thread: %s\n", ast_log(LOG_ERROR, "TCP/TLS unable to launch helper thread for peer '%s': %s\n",
ast_sockaddr_stringify(&tcptls_session->remote_address),
strerror(errno)); strerror(errno));
ao2_ref(tcptls_session, -1); ao2_ref(tcptls_session, -1);
} }