kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Allow setting TLS cipher suites through Sofia-SIP API 

Previously there was no way to override the hard-coded cipher suite
specification of "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH".

This commit does leave in place the hardcoded cipher spec for WebRTC
of "HIGH:!DSS:!aNULL@STRENGTH".
This commit is contained in:
Travis Cross 2014-02-06 03:08:33 +00:00
parent 195e959d61
commit 25c65d52c5
5 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libs/sofia-sip/libsofia-sip-ua/tport/sofia-sip/tport_tag.h
View File

@ -180,6 +180,12 @@ TPORT_DLL extern tag_typedef_t tptag_certificate;
TPORT_DLL extern tag_typedef_t tptag_certificate_ref; TPORT_DLL extern tag_typedef_t tptag_certificate_ref;
#define TPTAG_CERTIFICATE_REF(x) tptag_certificate_ref, tag_str_vr(&(x)) #define TPTAG_CERTIFICATE_REF(x) tptag_certificate_ref, tag_str_vr(&(x))
TPORT_DLL extern tag_typedef_t tptag_tls_ciphers;
#define TPTAG_TLS_CIPHERS(x) tptag_tls_ciphers, tag_str_v((x))
TPORT_DLL extern tag_typedef_t tptag_tls_ciphers_ref;
#define TPTAG_TLS_CIPHERS_REF(x) tptag_tls_ciphers_ref, tag_str_vr(&(x))
enum tport_tls_version { enum tport_tls_version {
TPTLS_VERSION_SSLv2 = (1 << 0), TPTLS_VERSION_SSLv2 = (1 << 0),
TPTLS_VERSION_SSLv3 = (1 << 1), TPTLS_VERSION_SSLv3 = (1 << 1),

8
libs/sofia-sip/libsofia-sip-ua/tport/tport_tag.c
View File

@ -270,6 +270,14 @@ tag_typedef_t tptag_certificate = STRTAG_TYPEDEF(certificate);
*/ */
tag_typedef_t tptag_compartment = PTRTAG_TYPEDEF(compartment); tag_typedef_t tptag_compartment = PTRTAG_TYPEDEF(compartment);
/**@def TPTAG_TLS_CIPHERS(x)
*
* Sets the supported TLS cipher suites.
*
* Use with tport_tbind(), nua_create(), nta_agent_create(),
* nta_agent_add_tport(), nth_engine_create(), or initial nth_site_create().
*/
tag_typedef_t tptag_tls_ciphers = STRTAG_TYPEDEF(tls_ciphers);
/**@def TPTAG_TLS_VERSION(x) /**@def TPTAG_TLS_VERSION(x)
* *

4
libs/sofia-sip/libsofia-sip-ua/tport/tport_tls.c
View File

@ -202,7 +202,7 @@ void tls_set_default(tls_issues_t *i)
i->key = i->key ? i->key : i->cert; i->key = i->key ? i->key : i->cert;
i->randFile = i->randFile ? i->randFile : "tls_seed.dat"; i->randFile = i->randFile ? i->randFile : "tls_seed.dat";
i->CAfile = i->CAfile ? i->CAfile : "cafile.pem"; i->CAfile = i->CAfile ? i->CAfile : "cafile.pem";
i->cipher = i->cipher ? i->cipher : "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"; i->ciphers = i->ciphers ? i->ciphers : "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH";
/* Default SIP cipher */ /* Default SIP cipher */
/* "RSA-WITH-AES-128-CBC-SHA"; */ /* "RSA-WITH-AES-128-CBC-SHA"; */
/* RFC-2543-compatibility ciphersuite */ /* RFC-2543-compatibility ciphersuite */
@ -381,7 +381,7 @@ int tls_init_context(tls_t *tls, tls_issues_t const *ti)
SSL_CTX_set_verify_depth(tls->ctx, ti->verify_depth); SSL_CTX_set_verify_depth(tls->ctx, ti->verify_depth);
SSL_CTX_set_verify(tls->ctx, verify, tls_verify_cb); SSL_CTX_set_verify(tls->ctx, verify, tls_verify_cb);
if (!SSL_CTX_set_cipher_list(tls->ctx, ti->cipher)) { if (!SSL_CTX_set_cipher_list(tls->ctx, ti->ciphers)) {
SU_DEBUG_1(("%s: error setting cipher list\n", "tls_init_context")); SU_DEBUG_1(("%s: error setting cipher list\n", "tls_init_context"));
tls_log_errors(3, "tls_init_context", 0); tls_log_errors(3, "tls_init_context", 0);
errno = EIO; errno = EIO;

2
libs/sofia-sip/libsofia-sip-ua/tport/tport_tls.h
View File

@ -60,7 +60,7 @@ typedef struct tls_issues_s {
char *randFile; /* Seed file for the PRNG (default: tls_seed.dat) */ char *randFile; /* Seed file for the PRNG (default: tls_seed.dat) */
char *CAfile; /* PEM file of CA's */ char *CAfile; /* PEM file of CA's */
char *CApath; /* PEM file path of CA's */ char *CApath; /* PEM file path of CA's */
char *cipher; /* Should be one of the above defined ciphers * char *ciphers; /* Should be one of the above defined ciphers *
* or NULL (default: "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH * or NULL (default: "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH
*/ */
int version; /* For tls1, version is 1. When ssl3/ssl2 is int version; /* For tls1, version is 1. When ssl3/ssl2 is

3
libs/sofia-sip/libsofia-sip-ua/tport/tport_type_tls.c
View File

@ -180,6 +180,7 @@ static int tport_tls_init_master(tport_primary_t *pri,
char *homedir; char *homedir;
char *tbf = NULL; char *tbf = NULL;
char const *path = NULL; char const *path = NULL;
char const *tls_ciphers = NULL;
unsigned tls_version = 1; unsigned tls_version = 1;
unsigned tls_timeout = 300; unsigned tls_timeout = 300;
unsigned tls_verify = 0; unsigned tls_verify = 0;
@ -198,6 +199,7 @@ static int tport_tls_init_master(tport_primary_t *pri,
tl_gets(tags, tl_gets(tags,
TPTAG_CERTIFICATE_REF(path), TPTAG_CERTIFICATE_REF(path),
TPTAG_TLS_CIPHERS_REF(tls_ciphers),
TPTAG_TLS_VERSION_REF(tls_version), TPTAG_TLS_VERSION_REF(tls_version),
TPTAG_TLS_TIMEOUT_REF(tls_timeout), TPTAG_TLS_TIMEOUT_REF(tls_timeout),
TPTAG_TLS_VERIFY_PEER_REF(tls_verify), TPTAG_TLS_VERIFY_PEER_REF(tls_verify),
@ -225,6 +227,7 @@ static int tport_tls_init_master(tport_primary_t *pri,
ti.passphrase = su_strdup(autohome, passphrase); ti.passphrase = su_strdup(autohome, passphrase);
ti.cert = ti.key; ti.cert = ti.key;
ti.CAfile = su_sprintf(autohome, "%s/%s", path, "cafile.pem"); ti.CAfile = su_sprintf(autohome, "%s/%s", path, "cafile.pem");
if (tls_ciphers) ti.ciphers = su_strdup(autohome, tls_ciphers);
ti.version = tls_version; ti.version = tls_version;
ti.timeout = tls_timeout; ti.timeout = tls_timeout;
ti.CApath = su_strdup(autohome, path); ti.CApath = su_strdup(autohome, path);