Skip to content

tls_mgm: fix require_cert and verify_cert enforcement for virtual domains #4115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ipoddubny wants to merge 1 commit into from
+39 −24
Closed

tls_mgm: fix require_cert and verify_cert enforcement for virtual domains #4115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions modules/tls_openssl/openssl_config.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -326,13 +326,18 @@ int openssl_reg_sni_cb(tls_sni_cb_f cb)

int openssl_switch_ssl_ctx(struct tls_domain *dom, void *ssl_ctx)
{
int verify_mode = 0;

SSL_set_SSL_CTX((SSL *)ssl_ctx, (SSL_CTX *)dom->ctx);

if (!SSL_set_ex_data((SSL *)ssl_ctx, SSL_EX_DOM_IDX, dom)) {
LM_ERR("Failed to store tls_domain pointer in SSL struct\n");
return -1;
}

get_ssl_ctx_verify_mode(dom, &verify_mode);
SSL_set_verify((SSL *)ssl_ctx, verify_mode, NULL); /* NULL = use the previously defined callback */

return 0;
}

Expand Down
58 changes: 34 additions & 24 deletions modules/tls_wolfssl/wolfssl_config.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,34 @@ int tls_get_method(str *method_str,
return 0;
}

static void get_ssl_ctx_verify_mode(struct tls_domain *d, int *verify_mode)
{
if (d->flags & DOM_FLAG_SRV) {
if (d->verify_cert ) {
*verify_mode = SSL_VERIFY_PEER;
if (d->require_client_cert ) {
LM_INFO("client verification activated. Client "
"certificates are mandatory.\n");
*verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
} else {
LM_INFO("client verification activated. Client "
"certificates are NOT mandatory.\n");
}
} else {
*verify_mode = SSL_VERIFY_NONE;
LM_INFO("client verification NOT activated. Weaker security.\n");
}
} else {
if (d->verify_cert ) {
*verify_mode = SSL_VERIFY_PEER;
LM_INFO("server verification activated.\n");
} else {
*verify_mode = SSL_VERIFY_NONE;
LM_INFO("server verification NOT activated. Weaker security.\n");
}
}
}

static int verify_callback(int pre_verify_ok, WOLFSSL_X509_STORE_CTX *ctx) {
char buf[256];
WOLFSSL_X509 *cert;
Expand Down Expand Up @@ -194,13 +222,18 @@ int _wolfssl_reg_sni_cb(tls_sni_cb_f cb)

int _wolfssl_switch_ssl_ctx(struct tls_domain *dom, void *ssl_ctx)
{
int verify_mode = 0;

wolfSSL_set_SSL_CTX((WOLFSSL *)ssl_ctx, dom->ctx);

if (!wolfSSL_set_ex_data((WOLFSSL *)ssl_ctx, SSL_EX_DOM_IDX, dom)) {
LM_ERR("Failed to store tls_domain pointer in SSL struct\n");
return -1;
}

get_ssl_ctx_verify_mode(dom, &verify_mode);
wolfSSL_set_verify((WOLFSSL *)ssl_ctx, verify_mode, verify_callback);

return 0;
}

Expand Down Expand Up @@ -494,30 +527,7 @@ int _wolfssl_init_tls_dom(struct tls_domain *d, int init_flags)
wolfSSL_CTX_set_servername_arg(d->ctx, d);
}

if (d->flags & DOM_FLAG_SRV) {
if (d->verify_cert ) {
verify_mode = SSL_VERIFY_PEER;
if (d->require_client_cert ) {
LM_INFO("client verification activated. Client "
"certificates are mandatory.\n");
verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
} else {
LM_INFO("client verification activated. Client "
"certificates are NOT mandatory.\n");
}
} else {
verify_mode = SSL_VERIFY_NONE;
LM_INFO("client verification NOT activated. Weaker security.\n");
}
} else {
if (d->verify_cert ) {
verify_mode = SSL_VERIFY_PEER;
LM_INFO("server verification activated.\n");
} else {
verify_mode = SSL_VERIFY_NONE;
LM_INFO("server verification NOT activated. Weaker security.\n");
}
}
get_ssl_ctx_verify_mode(d, &verify_mode);

wolfSSL_CTX_set_verify(d->ctx, verify_mode, verify_callback);
wolfSSL_CTX_set_verify_depth(d->ctx, VERIFY_DEPTH_S);
Expand Down