2008-01-18 22:04:33 +00:00
|
|
|
/*
|
|
|
|
* Asterisk -- An open source telephony toolkit.
|
|
|
|
*
|
|
|
|
* Copyright (C) 2007 - 2008, Digium, Inc.
|
|
|
|
*
|
|
|
|
* Luigi Rizzo (TCP and TLS server code)
|
|
|
|
* Brett Bryant <brettbryant@gmail.com> (updated for client support)
|
|
|
|
*
|
|
|
|
* See http://www.asterisk.org for more information about
|
|
|
|
* the Asterisk project. Please do not directly contact
|
|
|
|
* any of the maintainers of this project for assistance;
|
|
|
|
* the project provides a web site, mailing lists and IRC
|
|
|
|
* channels for your use.
|
|
|
|
*
|
|
|
|
* This program is free software, distributed under the terms of
|
|
|
|
* the GNU General Public License Version 2. See the LICENSE file
|
|
|
|
* at the top of the source tree.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*!
|
|
|
|
* \file
|
|
|
|
* \brief Code to support TCP and TLS server/client
|
|
|
|
*
|
|
|
|
* \author Luigi Rizzo
|
|
|
|
* \author Brett Bryant <brettbryant@gmail.com>
|
|
|
|
*/
|
|
|
|
|
2012-06-15 16:20:16 +00:00
|
|
|
/*** MODULEINFO
|
|
|
|
<support_level>core</support_level>
|
|
|
|
***/
|
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
#include "asterisk.h"
|
|
|
|
|
git migration: Refactor the ASTERISK_FILE_VERSION macro
Git does not support the ability to replace a token with a version
string during check-in. While it does have support for replacing a
token on clone, this is somewhat sub-optimal: the token is replaced
with the object hash, which is not particularly easy for human
consumption. What's more, in practice, the source file version was often
not terribly useful. Generally, when triaging bugs, the overall version
of Asterisk is far more useful than an individual SVN version of a file. As a
result, this patch removes Asterisk's support for showing source file
versions.
Specifically, it does the following:
* Rename ASTERISK_FILE_VERSION macro to ASTERISK_REGISTER_FILE, and
remove passing the version in with the macro. Other facilities
than 'core show file version' make use of the file names, such as
setting a debug level only on a specific file. As such, the act of
registering source files with the Asterisk core still has use. The
macro rename now reflects the new macro purpose.
* main/asterisk:
- Refactor the file_version structure to reflect that it no longer
tracks a version field.
- Remove the "core show file version" CLI command. Without the file
version, it is no longer useful.
- Remove the ast_file_version_find function. The file version is no
longer tracked.
- Rename ast_register_file_version/ast_unregister_file_version to
ast_register_file/ast_unregister_file, respectively.
* main/manager: Remove value from the Version key of the ModuleCheck
Action. The actual key itself has not been removed, as doing so would
absolutely constitute a backwards incompatible change. However, since
the file version is no longer tracked, there is no need to attempt to
include it in the Version key.
* UPGRADE: Add notes for:
- Modification to the ModuleCheck AMI Action
- Removal of the "core show file version" CLI command
Change-Id: I6cf0ff280e1668bf4957dc21f32a5ff43444a40e
2015-04-12 02:38:22 +00:00
|
|
|
ASTERISK_REGISTER_FILE()
|
2008-01-18 22:04:33 +00:00
|
|
|
|
|
|
|
#ifdef HAVE_FCNTL_H
|
|
|
|
#include <fcntl.h>
|
|
|
|
#endif
|
|
|
|
|
2010-03-20 12:03:07 +00:00
|
|
|
#include <signal.h>
|
2008-01-18 22:04:33 +00:00
|
|
|
|
|
|
|
#include "asterisk/compat.h"
|
|
|
|
#include "asterisk/tcptls.h"
|
|
|
|
#include "asterisk/http.h"
|
|
|
|
#include "asterisk/utils.h"
|
|
|
|
#include "asterisk/strings.h"
|
|
|
|
#include "asterisk/options.h"
|
|
|
|
#include "asterisk/manager.h"
|
2008-10-19 19:11:28 +00:00
|
|
|
#include "asterisk/astobj2.h"
|
2013-12-16 19:11:51 +00:00
|
|
|
#include "asterisk/pbx.h"
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
/*! ao2 object used for the FILE stream fopencookie()/funopen() cookie. */
|
|
|
|
struct ast_tcptls_stream {
|
|
|
|
/*! SSL state if not NULL */
|
|
|
|
SSL *ssl;
|
|
|
|
/*!
|
|
|
|
* \brief Start time from when an I/O sequence must complete
|
|
|
|
* by struct ast_tcptls_stream.timeout.
|
|
|
|
*
|
|
|
|
* \note If struct ast_tcptls_stream.start.tv_sec is zero then
|
|
|
|
* start time is the current I/O request.
|
|
|
|
*/
|
|
|
|
struct timeval start;
|
|
|
|
/*!
|
|
|
|
* \brief The socket returned by accept().
|
|
|
|
*
|
|
|
|
* \note Set to -1 if the stream is closed.
|
|
|
|
*/
|
|
|
|
int fd;
|
|
|
|
/*!
|
|
|
|
* \brief Timeout in ms relative to struct ast_tcptls_stream.start
|
|
|
|
* to wait for an event on struct ast_tcptls_stream.fd.
|
|
|
|
*
|
|
|
|
* \note Set to -1 to disable timeout.
|
|
|
|
* \note The socket needs to be set to non-blocking for the timeout
|
|
|
|
* feature to work correctly.
|
|
|
|
*/
|
|
|
|
int timeout;
|
2014-06-13 05:16:34 +00:00
|
|
|
/*! TRUE if stream can exclusively wait for fd input. */
|
|
|
|
int exclusive_input;
|
2014-06-12 17:00:08 +00:00
|
|
|
};
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
void ast_tcptls_stream_set_timeout_disable(struct ast_tcptls_stream *stream)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
2014-06-12 17:00:08 +00:00
|
|
|
ast_assert(stream != NULL);
|
|
|
|
|
|
|
|
stream->timeout = -1;
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
void ast_tcptls_stream_set_timeout_inactivity(struct ast_tcptls_stream *stream, int timeout)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
2014-06-12 17:00:08 +00:00
|
|
|
ast_assert(stream != NULL);
|
2011-11-06 09:51:09 +00:00
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
stream->start.tv_sec = 0;
|
|
|
|
stream->timeout = timeout;
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
void ast_tcptls_stream_set_timeout_sequence(struct ast_tcptls_stream *stream, struct timeval start, int timeout)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
2014-06-12 17:00:08 +00:00
|
|
|
ast_assert(stream != NULL);
|
2012-09-14 19:53:43 +00:00
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
stream->start = start;
|
|
|
|
stream->timeout = timeout;
|
|
|
|
}
|
|
|
|
|
2014-06-13 05:16:34 +00:00
|
|
|
void ast_tcptls_stream_set_exclusive_input(struct ast_tcptls_stream *stream, int exclusive_input)
|
|
|
|
{
|
|
|
|
ast_assert(stream != NULL);
|
|
|
|
|
|
|
|
stream->exclusive_input = exclusive_input;
|
|
|
|
}
|
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
/*!
|
|
|
|
* \internal
|
|
|
|
* \brief fopencookie()/funopen() stream read function.
|
|
|
|
*
|
|
|
|
* \param cookie Stream control data.
|
|
|
|
* \param buf Where to put read data.
|
|
|
|
* \param size Size of the buffer.
|
|
|
|
*
|
|
|
|
* \retval number of bytes put into buf.
|
|
|
|
* \retval 0 on end of file.
|
|
|
|
* \retval -1 on error.
|
|
|
|
*/
|
|
|
|
static HOOK_T tcptls_stream_read(void *cookie, char *buf, LEN_T size)
|
|
|
|
{
|
|
|
|
struct ast_tcptls_stream *stream = cookie;
|
|
|
|
struct timeval start;
|
|
|
|
int ms;
|
|
|
|
int res;
|
|
|
|
|
|
|
|
if (!size) {
|
|
|
|
/* You asked for no data you got no data. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!stream || stream->fd == -1) {
|
|
|
|
errno = EBADF;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (stream->start.tv_sec) {
|
|
|
|
start = stream->start;
|
|
|
|
} else {
|
|
|
|
start = ast_tvnow();
|
|
|
|
}
|
|
|
|
|
|
|
|
#if defined(DO_SSL)
|
|
|
|
if (stream->ssl) {
|
|
|
|
for (;;) {
|
|
|
|
res = SSL_read(stream->ssl, buf, size);
|
|
|
|
if (0 < res) {
|
|
|
|
/* We read some payload data. */
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
switch (SSL_get_error(stream->ssl, res)) {
|
|
|
|
case SSL_ERROR_ZERO_RETURN:
|
|
|
|
/* Report EOF for a shutdown */
|
|
|
|
ast_debug(1, "TLS clean shutdown alert reading data\n");
|
|
|
|
return 0;
|
|
|
|
case SSL_ERROR_WANT_READ:
|
2014-06-13 05:16:34 +00:00
|
|
|
if (!stream->exclusive_input) {
|
|
|
|
/* We cannot wait for data now. */
|
|
|
|
errno = EAGAIN;
|
|
|
|
return -1;
|
|
|
|
}
|
2014-06-12 17:00:08 +00:00
|
|
|
while ((ms = ast_remaining_ms(start, stream->timeout))) {
|
|
|
|
res = ast_wait_for_input(stream->fd, ms);
|
|
|
|
if (0 < res) {
|
|
|
|
/* Socket is ready to be read. */
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (res < 0) {
|
|
|
|
if (errno == EINTR || errno == EAGAIN) {
|
|
|
|
/* Try again. */
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
ast_debug(1, "TLS socket error waiting for read data: %s\n",
|
|
|
|
strerror(errno));
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case SSL_ERROR_WANT_WRITE:
|
|
|
|
while ((ms = ast_remaining_ms(start, stream->timeout))) {
|
|
|
|
res = ast_wait_for_output(stream->fd, ms);
|
|
|
|
if (0 < res) {
|
|
|
|
/* Socket is ready to be written. */
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (res < 0) {
|
|
|
|
if (errno == EINTR || errno == EAGAIN) {
|
|
|
|
/* Try again. */
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
ast_debug(1, "TLS socket error waiting for write space: %s\n",
|
|
|
|
strerror(errno));
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
/* Report EOF for an undecoded SSL or transport error. */
|
|
|
|
ast_debug(1, "TLS transport or SSL error reading data\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (!ms) {
|
|
|
|
/* Report EOF for a timeout */
|
|
|
|
ast_debug(1, "TLS timeout reading data\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif /* defined(DO_SSL) */
|
|
|
|
|
|
|
|
for (;;) {
|
|
|
|
res = read(stream->fd, buf, size);
|
2014-06-13 05:16:34 +00:00
|
|
|
if (0 <= res || !stream->exclusive_input) {
|
|
|
|
/* Got data or we cannot wait for it. */
|
2014-06-12 17:00:08 +00:00
|
|
|
return res;
|
2011-11-30 22:03:02 +00:00
|
|
|
}
|
2014-06-12 17:00:08 +00:00
|
|
|
if (errno != EINTR && errno != EAGAIN) {
|
|
|
|
/* Not a retryable error. */
|
|
|
|
ast_debug(1, "TCP socket error reading data: %s\n",
|
|
|
|
strerror(errno));
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
ms = ast_remaining_ms(start, stream->timeout);
|
|
|
|
if (!ms) {
|
|
|
|
/* Report EOF for a timeout */
|
|
|
|
ast_debug(1, "TCP timeout reading data\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
ast_wait_for_input(stream->fd, ms);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*!
|
|
|
|
* \internal
|
|
|
|
* \brief fopencookie()/funopen() stream write function.
|
|
|
|
*
|
|
|
|
* \param cookie Stream control data.
|
|
|
|
* \param buf Where to get data to write.
|
|
|
|
* \param size Size of the buffer.
|
|
|
|
*
|
|
|
|
* \retval number of bytes written from buf.
|
|
|
|
* \retval -1 on error.
|
|
|
|
*/
|
|
|
|
static HOOK_T tcptls_stream_write(void *cookie, const char *buf, LEN_T size)
|
|
|
|
{
|
|
|
|
struct ast_tcptls_stream *stream = cookie;
|
|
|
|
struct timeval start;
|
|
|
|
int ms;
|
|
|
|
int res;
|
|
|
|
int written;
|
|
|
|
int remaining;
|
|
|
|
|
|
|
|
if (!size) {
|
|
|
|
/* You asked to write no data you wrote no data. */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!stream || stream->fd == -1) {
|
|
|
|
errno = EBADF;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (stream->start.tv_sec) {
|
|
|
|
start = stream->start;
|
|
|
|
} else {
|
|
|
|
start = ast_tvnow();
|
|
|
|
}
|
2012-09-14 19:53:43 +00:00
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
#if defined(DO_SSL)
|
|
|
|
if (stream->ssl) {
|
|
|
|
written = 0;
|
|
|
|
remaining = size;
|
|
|
|
for (;;) {
|
|
|
|
res = SSL_write(stream->ssl, buf + written, remaining);
|
|
|
|
if (res == remaining) {
|
|
|
|
/* Everything was written. */
|
|
|
|
return size;
|
|
|
|
}
|
|
|
|
if (0 < res) {
|
|
|
|
/* Successfully wrote part of the buffer. Try to write the rest. */
|
|
|
|
written += res;
|
|
|
|
remaining -= res;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
switch (SSL_get_error(stream->ssl, res)) {
|
|
|
|
case SSL_ERROR_ZERO_RETURN:
|
|
|
|
ast_debug(1, "TLS clean shutdown alert writing data\n");
|
|
|
|
if (written) {
|
|
|
|
/* Report partial write. */
|
|
|
|
return written;
|
|
|
|
}
|
|
|
|
errno = EBADF;
|
|
|
|
return -1;
|
|
|
|
case SSL_ERROR_WANT_READ:
|
|
|
|
ms = ast_remaining_ms(start, stream->timeout);
|
|
|
|
if (!ms) {
|
|
|
|
/* Report partial write. */
|
|
|
|
ast_debug(1, "TLS timeout writing data (want read)\n");
|
|
|
|
return written;
|
|
|
|
}
|
|
|
|
ast_wait_for_input(stream->fd, ms);
|
|
|
|
break;
|
|
|
|
case SSL_ERROR_WANT_WRITE:
|
|
|
|
ms = ast_remaining_ms(start, stream->timeout);
|
|
|
|
if (!ms) {
|
|
|
|
/* Report partial write. */
|
|
|
|
ast_debug(1, "TLS timeout writing data (want write)\n");
|
|
|
|
return written;
|
|
|
|
}
|
|
|
|
ast_wait_for_output(stream->fd, ms);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
/* Undecoded SSL or transport error. */
|
|
|
|
ast_debug(1, "TLS transport or SSL error writing data\n");
|
|
|
|
if (written) {
|
|
|
|
/* Report partial write. */
|
|
|
|
return written;
|
|
|
|
}
|
|
|
|
errno = EBADF;
|
|
|
|
return -1;
|
|
|
|
}
|
2012-09-14 19:53:43 +00:00
|
|
|
}
|
2014-06-12 17:00:08 +00:00
|
|
|
}
|
|
|
|
#endif /* defined(DO_SSL) */
|
2012-09-14 19:53:43 +00:00
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
written = 0;
|
|
|
|
remaining = size;
|
|
|
|
for (;;) {
|
|
|
|
res = write(stream->fd, buf + written, remaining);
|
|
|
|
if (res == remaining) {
|
|
|
|
/* Yay everything was written. */
|
|
|
|
return size;
|
|
|
|
}
|
|
|
|
if (0 < res) {
|
|
|
|
/* Successfully wrote part of the buffer. Try to write the rest. */
|
|
|
|
written += res;
|
|
|
|
remaining -= res;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
if (errno != EINTR && errno != EAGAIN) {
|
|
|
|
/* Not a retryable error. */
|
|
|
|
ast_debug(1, "TCP socket error writing: %s\n", strerror(errno));
|
|
|
|
if (written) {
|
|
|
|
return written;
|
|
|
|
}
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
ms = ast_remaining_ms(start, stream->timeout);
|
|
|
|
if (!ms) {
|
|
|
|
/* Report partial write. */
|
|
|
|
ast_debug(1, "TCP timeout writing data\n");
|
|
|
|
return written;
|
|
|
|
}
|
|
|
|
ast_wait_for_output(stream->fd, ms);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*!
|
|
|
|
* \internal
|
|
|
|
* \brief fopencookie()/funopen() stream close function.
|
|
|
|
*
|
|
|
|
* \param cookie Stream control data.
|
|
|
|
*
|
|
|
|
* \retval 0 on success.
|
|
|
|
* \retval -1 on error.
|
|
|
|
*/
|
|
|
|
static int tcptls_stream_close(void *cookie)
|
|
|
|
{
|
|
|
|
struct ast_tcptls_stream *stream = cookie;
|
|
|
|
|
|
|
|
if (!stream) {
|
|
|
|
errno = EBADF;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (stream->fd != -1) {
|
|
|
|
#if defined(DO_SSL)
|
|
|
|
if (stream->ssl) {
|
|
|
|
int res;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* According to the TLS standard, it is acceptable for an
|
|
|
|
* application to only send its shutdown alert and then
|
|
|
|
* close the underlying connection without waiting for
|
|
|
|
* the peer's response (this way resources can be saved,
|
|
|
|
* as the process can already terminate or serve another
|
|
|
|
* connection).
|
|
|
|
*/
|
|
|
|
res = SSL_shutdown(stream->ssl);
|
|
|
|
if (res < 0) {
|
|
|
|
ast_log(LOG_ERROR, "SSL_shutdown() failed: %d\n",
|
|
|
|
SSL_get_error(stream->ssl, res));
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!stream->ssl->server) {
|
|
|
|
/* For client threads, ensure that the error stack is cleared */
|
2015-05-05 16:35:16 +00:00
|
|
|
#if OPENSSL_VERSION_NUMBER >= 0x10000000L
|
|
|
|
ERR_remove_thread_state(NULL);
|
|
|
|
#else
|
2014-06-12 17:00:08 +00:00
|
|
|
ERR_remove_state(0);
|
2015-05-05 16:35:16 +00:00
|
|
|
#endif /* OPENSSL_VERSION_NUMBER >= 0x10000000L */
|
2014-06-12 17:00:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
SSL_free(stream->ssl);
|
|
|
|
stream->ssl = NULL;
|
|
|
|
}
|
|
|
|
#endif /* defined(DO_SSL) */
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Issuing shutdown() is necessary here to avoid a race
|
|
|
|
* condition where the last data written may not appear
|
|
|
|
* in the TCP stream. See ASTERISK-23548
|
|
|
|
*/
|
|
|
|
shutdown(stream->fd, SHUT_RDWR);
|
|
|
|
if (close(stream->fd)) {
|
2011-11-30 22:03:02 +00:00
|
|
|
ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
|
|
|
|
}
|
2014-06-12 17:00:08 +00:00
|
|
|
stream->fd = -1;
|
2011-11-30 22:03:02 +00:00
|
|
|
}
|
2014-06-12 17:00:08 +00:00
|
|
|
ao2_t_ref(stream, -1, "Closed tcptls stream cookie");
|
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2014-06-12 17:00:08 +00:00
|
|
|
|
|
|
|
/*!
|
|
|
|
* \internal
|
|
|
|
* \brief fopencookie()/funopen() stream destructor function.
|
|
|
|
*
|
|
|
|
* \param cookie Stream control data.
|
|
|
|
*
|
|
|
|
* \return Nothing
|
|
|
|
*/
|
|
|
|
static void tcptls_stream_dtor(void *cookie)
|
|
|
|
{
|
2014-08-11 09:55:13 +00:00
|
|
|
#ifdef AST_DEVMODE
|
|
|
|
/* Since the ast_assert below is the only one using stream,
|
|
|
|
* and ast_assert is only available with AST_DEVMODE, we
|
|
|
|
* put this in a conditional to avoid compiler warnings. */
|
2014-06-12 17:00:08 +00:00
|
|
|
struct ast_tcptls_stream *stream = cookie;
|
2014-08-11 09:55:13 +00:00
|
|
|
#endif
|
2014-06-12 17:00:08 +00:00
|
|
|
|
|
|
|
ast_assert(stream->fd == -1);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*!
|
|
|
|
* \internal
|
|
|
|
* \brief fopencookie()/funopen() stream allocation function.
|
|
|
|
*
|
|
|
|
* \retval stream_cookie on success.
|
|
|
|
* \retval NULL on error.
|
|
|
|
*/
|
|
|
|
static struct ast_tcptls_stream *tcptls_stream_alloc(void)
|
|
|
|
{
|
|
|
|
struct ast_tcptls_stream *stream;
|
|
|
|
|
|
|
|
stream = ao2_alloc_options(sizeof(*stream), tcptls_stream_dtor,
|
|
|
|
AO2_ALLOC_OPT_LOCK_NOLOCK);
|
|
|
|
if (stream) {
|
|
|
|
stream->fd = -1;
|
|
|
|
stream->timeout = -1;
|
|
|
|
}
|
|
|
|
return stream;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*!
|
|
|
|
* \internal
|
|
|
|
* \brief Open a custom FILE stream for tcptls.
|
|
|
|
*
|
|
|
|
* \param stream Stream cookie control data.
|
|
|
|
* \param ssl SSL state if not NULL.
|
|
|
|
* \param fd Socket file descriptor.
|
|
|
|
* \param timeout ms to wait for an event on fd. -1 if timeout disabled.
|
|
|
|
*
|
|
|
|
* \retval fp on success.
|
|
|
|
* \retval NULL on error.
|
|
|
|
*/
|
|
|
|
static FILE *tcptls_stream_fopen(struct ast_tcptls_stream *stream, SSL *ssl, int fd, int timeout)
|
|
|
|
{
|
|
|
|
FILE *fp;
|
|
|
|
|
|
|
|
#if defined(HAVE_FOPENCOOKIE) /* the glibc/linux interface */
|
|
|
|
static const cookie_io_functions_t cookie_funcs = {
|
|
|
|
tcptls_stream_read,
|
|
|
|
tcptls_stream_write,
|
|
|
|
NULL,
|
|
|
|
tcptls_stream_close
|
|
|
|
};
|
|
|
|
#endif /* defined(HAVE_FOPENCOOKIE) */
|
|
|
|
|
|
|
|
if (fd == -1) {
|
|
|
|
/* Socket not open. */
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
stream->ssl = ssl;
|
|
|
|
stream->fd = fd;
|
|
|
|
stream->timeout = timeout;
|
|
|
|
ao2_t_ref(stream, +1, "Opening tcptls stream cookie");
|
|
|
|
|
|
|
|
#if defined(HAVE_FUNOPEN) /* the BSD interface */
|
|
|
|
fp = funopen(stream, tcptls_stream_read, tcptls_stream_write, NULL,
|
|
|
|
tcptls_stream_close);
|
|
|
|
#elif defined(HAVE_FOPENCOOKIE) /* the glibc/linux interface */
|
|
|
|
fp = fopencookie(stream, "w+", cookie_funcs);
|
|
|
|
#else
|
|
|
|
/* could add other methods here */
|
|
|
|
ast_debug(2, "No stream FILE methods attempted!\n");
|
|
|
|
fp = NULL;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
if (!fp) {
|
|
|
|
stream->fd = -1;
|
|
|
|
ao2_t_ref(stream, -1, "Failed to open tcptls stream cookie");
|
|
|
|
}
|
|
|
|
return fp;
|
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2008-12-12 18:45:03 +00:00
|
|
|
HOOK_T ast_tcptls_server_read(struct ast_tcptls_session_instance *tcptls_session, void *buf, size_t count)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
2014-06-12 17:00:08 +00:00
|
|
|
if (!tcptls_session->stream_cookie || tcptls_session->stream_cookie->fd == -1) {
|
|
|
|
ast_log(LOG_ERROR, "TCP/TLS read called on invalid stream.\n");
|
2008-06-17 21:46:57 +00:00
|
|
|
errno = EIO;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
return tcptls_stream_read(tcptls_session->stream_cookie, buf, count);
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
|
|
|
|
2008-12-13 08:36:35 +00:00
|
|
|
HOOK_T ast_tcptls_server_write(struct ast_tcptls_session_instance *tcptls_session, const void *buf, size_t count)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
2014-06-12 17:00:08 +00:00
|
|
|
if (!tcptls_session->stream_cookie || tcptls_session->stream_cookie->fd == -1) {
|
|
|
|
ast_log(LOG_ERROR, "TCP/TLS write called on invalid stream.\n");
|
2008-06-17 21:46:57 +00:00
|
|
|
errno = EIO;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
return tcptls_stream_write(tcptls_session->stream_cookie, buf, count);
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
|
|
|
|
2012-10-12 16:31:01 +00:00
|
|
|
static void session_instance_destructor(void *obj)
|
|
|
|
{
|
|
|
|
struct ast_tcptls_session_instance *i = obj;
|
2014-06-12 17:00:08 +00:00
|
|
|
|
|
|
|
if (i->stream_cookie) {
|
|
|
|
ao2_t_ref(i->stream_cookie, -1, "Destroying tcptls session instance");
|
|
|
|
i->stream_cookie = NULL;
|
|
|
|
}
|
2012-10-12 16:31:01 +00:00
|
|
|
ast_free(i->overflow_buf);
|
2014-07-03 17:16:55 +00:00
|
|
|
ao2_cleanup(i->private_data);
|
2012-10-12 16:31:01 +00:00
|
|
|
}
|
|
|
|
|
2015-05-14 22:12:41 +00:00
|
|
|
#ifdef DO_SSL
|
|
|
|
static int check_tcptls_cert_name(ASN1_STRING *cert_str, const char *hostname, const char *desc)
|
|
|
|
{
|
|
|
|
unsigned char *str;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
ret = ASN1_STRING_to_UTF8(&str, cert_str);
|
|
|
|
if (ret < 0 || !str) {
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (strlen((char *) str) != ret) {
|
|
|
|
ast_log(LOG_WARNING, "Invalid certificate %s length (contains NULL bytes?)\n", desc);
|
|
|
|
|
|
|
|
ret = -1;
|
|
|
|
} else if (!strcasecmp(hostname, (char *) str)) {
|
|
|
|
ret = 0;
|
|
|
|
} else {
|
|
|
|
ret = -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
ast_debug(3, "SSL %s compare s1='%s' s2='%s'\n", desc, hostname, str);
|
|
|
|
OPENSSL_free(str);
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2008-10-19 19:11:28 +00:00
|
|
|
/*! \brief
|
|
|
|
* creates a FILE * from the fd passed by the accept thread.
|
|
|
|
* This operation is potentially expensive (certificate verification),
|
|
|
|
* so we do it in the child thread context.
|
2009-09-24 20:37:20 +00:00
|
|
|
*
|
|
|
|
* \note must decrement ref count before returning NULL on error
|
2008-10-19 19:11:28 +00:00
|
|
|
*/
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
static void *handle_tcptls_connection(void *data)
|
2008-10-19 19:11:28 +00:00
|
|
|
{
|
2008-12-12 18:45:03 +00:00
|
|
|
struct ast_tcptls_session_instance *tcptls_session = data;
|
2008-10-19 19:11:28 +00:00
|
|
|
#ifdef DO_SSL
|
2008-12-12 18:45:03 +00:00
|
|
|
int (*ssl_setup)(SSL *) = (tcptls_session->client) ? SSL_connect : SSL_accept;
|
2008-10-19 19:11:28 +00:00
|
|
|
int ret;
|
|
|
|
char err[256];
|
|
|
|
#endif
|
|
|
|
|
2013-12-16 19:11:51 +00:00
|
|
|
/* TCP/TLS connections are associated with external protocols, and
|
|
|
|
* should not be allowed to execute 'dangerous' functions. This may
|
|
|
|
* need to be pushed down into the individual protocol handlers, but
|
|
|
|
* this seems like a good general policy.
|
|
|
|
*/
|
|
|
|
if (ast_thread_inhibit_escalations()) {
|
|
|
|
ast_log(LOG_ERROR, "Failed to inhibit privilege escalations; killing connection\n");
|
2014-01-26 23:04:46 +00:00
|
|
|
ast_tcptls_close_session_file(tcptls_session);
|
|
|
|
ao2_ref(tcptls_session, -1);
|
2013-12-16 19:11:51 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2014-06-12 17:00:08 +00:00
|
|
|
tcptls_session->stream_cookie = tcptls_stream_alloc();
|
|
|
|
if (!tcptls_session->stream_cookie) {
|
|
|
|
ast_tcptls_close_session_file(tcptls_session);
|
|
|
|
ao2_ref(tcptls_session, -1);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2008-10-19 19:11:28 +00:00
|
|
|
/*
|
|
|
|
* open a FILE * as appropriate.
|
|
|
|
*/
|
2009-02-04 18:48:06 +00:00
|
|
|
if (!tcptls_session->parent->tls_cfg) {
|
2014-06-12 17:00:08 +00:00
|
|
|
tcptls_session->f = tcptls_stream_fopen(tcptls_session->stream_cookie, NULL,
|
|
|
|
tcptls_session->fd, -1);
|
|
|
|
if (tcptls_session->f) {
|
|
|
|
if (setvbuf(tcptls_session->f, NULL, _IONBF, 0)) {
|
2011-11-30 22:03:02 +00:00
|
|
|
ast_tcptls_close_session_file(tcptls_session);
|
2011-03-16 19:51:55 +00:00
|
|
|
}
|
|
|
|
}
|
2009-02-04 18:48:06 +00:00
|
|
|
}
|
2008-10-19 19:11:28 +00:00
|
|
|
#ifdef DO_SSL
|
2008-12-12 18:45:03 +00:00
|
|
|
else if ( (tcptls_session->ssl = SSL_new(tcptls_session->parent->tls_cfg->ssl_ctx)) ) {
|
|
|
|
SSL_set_fd(tcptls_session->ssl, tcptls_session->fd);
|
|
|
|
if ((ret = ssl_setup(tcptls_session->ssl)) <= 0) {
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "Problem setting up ssl connection: %s\n", ERR_error_string(ERR_get_error(), err));
|
2014-06-12 17:00:08 +00:00
|
|
|
} else if ((tcptls_session->f = tcptls_stream_fopen(tcptls_session->stream_cookie,
|
|
|
|
tcptls_session->ssl, tcptls_session->fd, -1))) {
|
2008-12-12 18:45:03 +00:00
|
|
|
if ((tcptls_session->client && !ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_DONT_VERIFY_SERVER))
|
|
|
|
|| (!tcptls_session->client && ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_VERIFY_CLIENT))) {
|
2008-10-19 19:11:28 +00:00
|
|
|
X509 *peer;
|
|
|
|
long res;
|
2008-12-12 18:45:03 +00:00
|
|
|
peer = SSL_get_peer_certificate(tcptls_session->ssl);
|
2011-11-06 09:51:09 +00:00
|
|
|
if (!peer) {
|
2012-10-17 19:01:27 +00:00
|
|
|
ast_log(LOG_ERROR, "No peer SSL certificate to verify\n");
|
|
|
|
ast_tcptls_close_session_file(tcptls_session);
|
|
|
|
ao2_ref(tcptls_session, -1);
|
|
|
|
return NULL;
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2012-10-17 19:01:27 +00:00
|
|
|
|
2008-12-12 18:45:03 +00:00
|
|
|
res = SSL_get_verify_result(tcptls_session->ssl);
|
2011-11-06 09:51:09 +00:00
|
|
|
if (res != X509_V_OK) {
|
2008-10-19 19:11:28 +00:00
|
|
|
ast_log(LOG_ERROR, "Certificate did not verify: %s\n", X509_verify_cert_error_string(res));
|
2012-10-17 19:01:27 +00:00
|
|
|
X509_free(peer);
|
|
|
|
ast_tcptls_close_session_file(tcptls_session);
|
|
|
|
ao2_ref(tcptls_session, -1);
|
|
|
|
return NULL;
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-12-12 18:45:03 +00:00
|
|
|
if (!ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_IGNORE_COMMON_NAME)) {
|
2008-10-19 19:11:28 +00:00
|
|
|
ASN1_STRING *str;
|
|
|
|
X509_NAME *name = X509_get_subject_name(peer);
|
2015-05-14 22:12:41 +00:00
|
|
|
STACK_OF(GENERAL_NAME) *alt_names;
|
2008-10-19 19:11:28 +00:00
|
|
|
int pos = -1;
|
|
|
|
int found = 0;
|
2009-04-29 21:13:43 +00:00
|
|
|
|
2008-10-19 19:11:28 +00:00
|
|
|
for (;;) {
|
|
|
|
/* Walk the certificate to check all available "Common Name" */
|
|
|
|
/* XXX Probably should do a gethostbyname on the hostname and compare that as well */
|
|
|
|
pos = X509_NAME_get_index_by_NID(name, NID_commonName, pos);
|
2011-11-06 09:51:09 +00:00
|
|
|
if (pos < 0) {
|
2008-10-19 19:11:28 +00:00
|
|
|
break;
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2015-05-14 22:12:41 +00:00
|
|
|
|
2008-10-19 19:11:28 +00:00
|
|
|
str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, pos));
|
2015-05-14 22:12:41 +00:00
|
|
|
if (!check_tcptls_cert_name(str, tcptls_session->parent->hostname, "common name")) {
|
|
|
|
found = 1;
|
|
|
|
break;
|
2015-04-08 16:49:18 +00:00
|
|
|
}
|
2015-05-14 22:12:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (!found) {
|
|
|
|
alt_names = X509_get_ext_d2i(peer, NID_subject_alt_name, NULL, NULL);
|
|
|
|
if (alt_names != NULL) {
|
|
|
|
int alt_names_count = sk_GENERAL_NAME_num(alt_names);
|
2015-04-08 16:49:18 +00:00
|
|
|
|
2015-05-14 22:12:41 +00:00
|
|
|
for (pos = 0; pos < alt_names_count; pos++) {
|
|
|
|
const GENERAL_NAME *alt_name = sk_GENERAL_NAME_value(alt_names, pos);
|
|
|
|
|
|
|
|
if (alt_name->type != GEN_DNS) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!check_tcptls_cert_name(alt_name->d.dNSName, tcptls_session->parent->hostname, "alt name")) {
|
|
|
|
found = 1;
|
|
|
|
break;
|
|
|
|
}
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2015-05-14 22:12:41 +00:00
|
|
|
|
|
|
|
sk_GENERAL_NAME_pop_free(alt_names, GENERAL_NAME_free);
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-10-19 19:11:28 +00:00
|
|
|
}
|
2015-05-14 22:12:41 +00:00
|
|
|
|
2008-10-19 19:11:28 +00:00
|
|
|
if (!found) {
|
2008-12-12 18:45:03 +00:00
|
|
|
ast_log(LOG_ERROR, "Certificate common name did not match (%s)\n", tcptls_session->parent->hostname);
|
2012-10-17 19:01:27 +00:00
|
|
|
X509_free(peer);
|
2011-11-30 22:03:02 +00:00
|
|
|
ast_tcptls_close_session_file(tcptls_session);
|
2009-09-24 20:37:20 +00:00
|
|
|
ao2_ref(tcptls_session, -1);
|
2008-10-19 19:11:28 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
}
|
2012-10-17 19:01:27 +00:00
|
|
|
X509_free(peer);
|
2008-10-19 19:11:28 +00:00
|
|
|
}
|
|
|
|
}
|
2011-11-06 09:51:09 +00:00
|
|
|
if (!tcptls_session->f) { /* no success opening descriptor stacking */
|
2008-12-12 18:45:03 +00:00
|
|
|
SSL_free(tcptls_session->ssl);
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2011-11-30 22:03:02 +00:00
|
|
|
}
|
2008-10-19 19:11:28 +00:00
|
|
|
#endif /* DO_SSL */
|
|
|
|
|
2008-12-12 18:45:03 +00:00
|
|
|
if (!tcptls_session->f) {
|
2011-11-30 22:03:02 +00:00
|
|
|
ast_tcptls_close_session_file(tcptls_session);
|
2008-10-19 19:11:28 +00:00
|
|
|
ast_log(LOG_WARNING, "FILE * open failed!\n");
|
2010-02-16 20:54:48 +00:00
|
|
|
#ifndef DO_SSL
|
|
|
|
if (tcptls_session->parent->tls_cfg) {
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "Attempted a TLS connection without OpenSSL support. This will not work!\n");
|
2010-02-16 20:54:48 +00:00
|
|
|
}
|
|
|
|
#endif
|
2008-12-12 18:45:03 +00:00
|
|
|
ao2_ref(tcptls_session, -1);
|
2008-10-19 19:11:28 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2012-05-31 18:39:30 +00:00
|
|
|
if (tcptls_session->parent->worker_fn) {
|
2008-12-12 18:45:03 +00:00
|
|
|
return tcptls_session->parent->worker_fn(tcptls_session);
|
2011-11-06 09:51:09 +00:00
|
|
|
} else {
|
2008-12-12 18:45:03 +00:00
|
|
|
return tcptls_session;
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-10-19 19:11:28 +00:00
|
|
|
}
|
|
|
|
|
2008-03-04 22:23:21 +00:00
|
|
|
void *ast_tcptls_server_root(void *data)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
2008-10-19 19:11:28 +00:00
|
|
|
struct ast_tcptls_session_args *desc = data;
|
2008-01-18 22:04:33 +00:00
|
|
|
int fd;
|
2010-07-08 22:08:07 +00:00
|
|
|
struct ast_sockaddr addr;
|
2008-12-12 18:45:03 +00:00
|
|
|
struct ast_tcptls_session_instance *tcptls_session;
|
2008-01-18 22:04:33 +00:00
|
|
|
pthread_t launched;
|
2009-04-29 21:13:43 +00:00
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
for (;;) {
|
|
|
|
int i, flags;
|
|
|
|
|
2011-11-06 09:51:09 +00:00
|
|
|
if (desc->periodic_fn) {
|
2008-01-18 22:04:33 +00:00
|
|
|
desc->periodic_fn(desc);
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
i = ast_wait_for_input(desc->accept_fd, desc->poll_timeout);
|
2011-11-06 09:51:09 +00:00
|
|
|
if (i <= 0) {
|
2008-01-18 22:04:33 +00:00
|
|
|
continue;
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2010-07-08 22:08:07 +00:00
|
|
|
fd = ast_accept(desc->accept_fd, &addr);
|
2008-01-18 22:04:33 +00:00
|
|
|
if (fd < 0) {
|
2015-01-27 22:58:44 +00:00
|
|
|
if ((errno != EAGAIN) && (errno != EWOULDBLOCK) && (errno != EINTR) && (errno != ECONNABORTED)) {
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "Accept failed: %s\n", strerror(errno));
|
2015-01-27 22:58:44 +00:00
|
|
|
break;
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
continue;
|
|
|
|
}
|
2012-10-12 16:31:01 +00:00
|
|
|
tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor);
|
2008-12-12 18:45:03 +00:00
|
|
|
if (!tcptls_session) {
|
2008-01-18 22:04:33 +00:00
|
|
|
ast_log(LOG_WARNING, "No memory for new session: %s\n", strerror(errno));
|
2011-11-30 22:03:02 +00:00
|
|
|
if (close(fd)) {
|
|
|
|
ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
|
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
continue;
|
|
|
|
}
|
2008-06-17 21:46:57 +00:00
|
|
|
|
2012-10-12 16:31:01 +00:00
|
|
|
tcptls_session->overflow_buf = ast_str_create(128);
|
2008-01-18 22:04:33 +00:00
|
|
|
flags = fcntl(fd, F_GETFL);
|
|
|
|
fcntl(fd, F_SETFL, flags & ~O_NONBLOCK);
|
2008-12-12 18:45:03 +00:00
|
|
|
tcptls_session->fd = fd;
|
|
|
|
tcptls_session->parent = desc;
|
2010-07-08 22:08:07 +00:00
|
|
|
ast_sockaddr_copy(&tcptls_session->remote_address, &addr);
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2008-12-12 18:45:03 +00:00
|
|
|
tcptls_session->client = 0;
|
2009-04-29 21:13:43 +00:00
|
|
|
|
2009-09-24 20:37:20 +00:00
|
|
|
/* This thread is now the only place that controls the single ref to tcptls_session */
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
if (ast_pthread_create_detached_background(&launched, NULL, handle_tcptls_connection, tcptls_session)) {
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "Unable to launch helper thread: %s\n", strerror(errno));
|
2011-11-30 22:03:02 +00:00
|
|
|
ast_tcptls_close_session_file(tcptls_session);
|
2008-12-12 18:45:03 +00:00
|
|
|
ao2_ref(tcptls_session, -1);
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2015-06-02 16:35:39 +00:00
|
|
|
#ifdef DO_SSL
|
2015-05-10 14:55:24 +00:00
|
|
|
static void __ssl_setup_certs(struct ast_tls_config *cfg, const size_t cert_file_len, const char *key_type_extension, const char *key_type)
|
|
|
|
{
|
|
|
|
char *cert_file = ast_strdupa(cfg->certfile);
|
|
|
|
|
|
|
|
memcpy(cert_file + cert_file_len - 8, key_type_extension, 5);
|
|
|
|
if (access(cert_file, F_OK) == 0) {
|
|
|
|
if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cert_file) == 0) {
|
|
|
|
ast_log(LOG_WARNING, "TLS/SSL error loading public %s key (certificate) from <%s>.\n", key_type, cert_file);
|
|
|
|
} else if (SSL_CTX_use_PrivateKey_file(cfg->ssl_ctx, cert_file, SSL_FILETYPE_PEM) == 0) {
|
|
|
|
ast_log(LOG_WARNING, "TLS/SSL error loading private %s key from <%s>.\n", key_type, cert_file);
|
|
|
|
} else if (SSL_CTX_check_private_key(cfg->ssl_ctx) == 0) {
|
|
|
|
ast_log(LOG_WARNING, "TLS/SSL error matching private %s key and certificate in <%s>.\n", key_type, cert_file);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2015-06-02 16:35:39 +00:00
|
|
|
#endif
|
2015-05-10 14:55:24 +00:00
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
static int __ssl_setup(struct ast_tls_config *cfg, int client)
|
|
|
|
{
|
|
|
|
#ifndef DO_SSL
|
|
|
|
cfg->enabled = 0;
|
|
|
|
return 0;
|
|
|
|
#else
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
int disable_ssl = 0;
|
2016-02-03 18:05:20 +00:00
|
|
|
long ssl_opts = 0;
|
|
|
|
|
2011-11-06 09:51:09 +00:00
|
|
|
if (!cfg->enabled) {
|
2008-01-18 22:04:33 +00:00
|
|
|
return 0;
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2012-05-18 17:24:57 +00:00
|
|
|
/* Get rid of an old SSL_CTX since we're about to
|
|
|
|
* allocate a new one
|
|
|
|
*/
|
|
|
|
if (cfg->ssl_ctx) {
|
|
|
|
SSL_CTX_free(cfg->ssl_ctx);
|
|
|
|
cfg->ssl_ctx = NULL;
|
|
|
|
}
|
|
|
|
|
2009-04-29 21:13:43 +00:00
|
|
|
if (client) {
|
2011-04-19 15:42:32 +00:00
|
|
|
#ifndef OPENSSL_NO_SSL2
|
2009-04-29 21:13:43 +00:00
|
|
|
if (ast_test_flag(&cfg->flags, AST_SSL_SSLV2_CLIENT)) {
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
ast_log(LOG_WARNING, "Usage of SSLv2 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
|
2009-04-29 21:13:43 +00:00
|
|
|
cfg->ssl_ctx = SSL_CTX_new(SSLv2_client_method());
|
2011-04-19 15:42:32 +00:00
|
|
|
} else
|
|
|
|
#endif
|
2015-02-19 15:28:56 +00:00
|
|
|
#ifndef OPENSSL_NO_SSL3_METHOD
|
2011-04-19 15:42:32 +00:00
|
|
|
if (ast_test_flag(&cfg->flags, AST_SSL_SSLV3_CLIENT)) {
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
ast_log(LOG_WARNING, "Usage of SSLv3 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
|
2009-04-29 21:13:43 +00:00
|
|
|
cfg->ssl_ctx = SSL_CTX_new(SSLv3_client_method());
|
2015-02-19 15:28:56 +00:00
|
|
|
} else
|
|
|
|
#endif
|
|
|
|
if (ast_test_flag(&cfg->flags, AST_SSL_TLSV1_CLIENT)) {
|
2009-04-29 21:13:43 +00:00
|
|
|
cfg->ssl_ctx = SSL_CTX_new(TLSv1_client_method());
|
|
|
|
} else {
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
disable_ssl = 1;
|
2009-04-29 21:13:43 +00:00
|
|
|
cfg->ssl_ctx = SSL_CTX_new(SSLv23_client_method());
|
|
|
|
}
|
|
|
|
} else {
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
disable_ssl = 1;
|
2009-04-29 21:13:43 +00:00
|
|
|
cfg->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!cfg->ssl_ctx) {
|
2008-01-22 08:58:46 +00:00
|
|
|
ast_debug(1, "Sorry, SSL_CTX_new call returned null...\n");
|
2008-01-18 22:04:33 +00:00
|
|
|
cfg->enabled = 0;
|
|
|
|
return 0;
|
|
|
|
}
|
2013-03-15 12:53:03 +00:00
|
|
|
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
/* Due to the POODLE vulnerability, completely disable
|
|
|
|
* SSLv2 and SSLv3 if we are not explicitly told to use
|
|
|
|
* them. SSLv23_*_method supports TLSv1+.
|
|
|
|
*/
|
|
|
|
if (disable_ssl) {
|
2016-02-03 18:05:20 +00:00
|
|
|
ssl_opts |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ast_test_flag(&cfg->flags, AST_SSL_SERVER_CIPHER_ORDER)) {
|
|
|
|
ssl_opts |= SSL_OP_CIPHER_SERVER_PREFERENCE;
|
|
|
|
}
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
|
2016-02-03 18:05:20 +00:00
|
|
|
if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV1)) {
|
|
|
|
ssl_opts |= SSL_OP_NO_TLSv1;
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
}
|
2016-02-04 22:17:55 +00:00
|
|
|
#if defined(HAVE_SSL_OP_NO_TLSV1_1) && defined(HAVE_SSL_OP_NO_TLSV1_2)
|
2016-02-03 18:05:20 +00:00
|
|
|
if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV11)) {
|
|
|
|
ssl_opts |= SSL_OP_NO_TLSv1_1;
|
|
|
|
}
|
|
|
|
if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV12)) {
|
|
|
|
ssl_opts |= SSL_OP_NO_TLSv1_2;
|
|
|
|
}
|
2016-02-04 22:17:55 +00:00
|
|
|
#else
|
|
|
|
ast_log(LOG_WARNING, "Your version of OpenSSL leaves you potentially vulnerable "
|
|
|
|
"to the SSL BEAST attack. Please upgrade to OpenSSL 1.0.1 or later\n");
|
|
|
|
#endif
|
2016-02-03 18:05:20 +00:00
|
|
|
|
|
|
|
SSL_CTX_set_options(cfg->ssl_ctx, ssl_opts);
|
AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
will default to the OpenSSL SSLv23_method. This method allows for all
ecnryption methods, including SSLv2/SSLv3. A MITM can exploit this by
forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
and explicitly disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.
Review: https://reviewboard.asterisk.org/r/4096/
ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
AST-2014-011-11.diff uploaded by mjordan (License 6283)
........
Merged revisions 425987 from http://svn.asterisk.org/svn/asterisk/branches/12
........
Merged revisions 425991 from http://svn.asterisk.org/svn/asterisk/branches/13
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@426003 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-10-20 14:20:15 +00:00
|
|
|
|
2013-03-15 12:53:03 +00:00
|
|
|
SSL_CTX_set_verify(cfg->ssl_ctx,
|
|
|
|
ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE,
|
|
|
|
NULL);
|
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
if (!ast_strlen_zero(cfg->certfile)) {
|
2009-04-24 21:22:31 +00:00
|
|
|
char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile;
|
2014-02-04 18:16:09 +00:00
|
|
|
if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cfg->certfile) == 0) {
|
2008-01-18 22:04:33 +00:00
|
|
|
if (!client) {
|
|
|
|
/* Clients don't need a certificate, but if its setup we can use it */
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "TLS/SSL error loading cert file. <%s>\n", cfg->certfile);
|
2009-04-24 21:22:31 +00:00
|
|
|
cfg->enabled = 0;
|
2012-05-18 17:24:57 +00:00
|
|
|
SSL_CTX_free(cfg->ssl_ctx);
|
|
|
|
cfg->ssl_ctx = NULL;
|
2009-04-24 21:22:31 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if ((SSL_CTX_use_PrivateKey_file(cfg->ssl_ctx, tmpprivate, SSL_FILETYPE_PEM) == 0) || (SSL_CTX_check_private_key(cfg->ssl_ctx) == 0 )) {
|
|
|
|
if (!client) {
|
|
|
|
/* Clients don't need a private key, but if its setup we can use it */
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "TLS/SSL error loading private key file. <%s>\n", tmpprivate);
|
2008-01-18 22:04:33 +00:00
|
|
|
cfg->enabled = 0;
|
2012-05-18 17:24:57 +00:00
|
|
|
SSL_CTX_free(cfg->ssl_ctx);
|
|
|
|
cfg->ssl_ctx = NULL;
|
2008-01-18 22:04:33 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
2015-05-10 14:55:24 +00:00
|
|
|
if (!client) {
|
|
|
|
size_t certfile_len = strlen(cfg->certfile);
|
|
|
|
|
|
|
|
/* expects a file name which contains _rsa. like asterisk_rsa.pem
|
|
|
|
* ignores any 3-character file-extension like .pem, .cer, .crt
|
|
|
|
*/
|
|
|
|
if (certfile_len >= 8 && !strncmp(cfg->certfile + certfile_len - 8, "_rsa.", 5)) {
|
|
|
|
__ssl_setup_certs(cfg, certfile_len, "_ecc.", "ECC");
|
|
|
|
__ssl_setup_certs(cfg, certfile_len, "_dsa.", "DSA");
|
|
|
|
}
|
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
|
|
|
if (!ast_strlen_zero(cfg->cipher)) {
|
|
|
|
if (SSL_CTX_set_cipher_list(cfg->ssl_ctx, cfg->cipher) == 0 ) {
|
|
|
|
if (!client) {
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "TLS/SSL cipher error <%s>\n", cfg->cipher);
|
2008-01-18 22:04:33 +00:00
|
|
|
cfg->enabled = 0;
|
2012-05-18 17:24:57 +00:00
|
|
|
SSL_CTX_free(cfg->ssl_ctx);
|
|
|
|
cfg->ssl_ctx = NULL;
|
2008-01-18 22:04:33 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!ast_strlen_zero(cfg->cafile) || !ast_strlen_zero(cfg->capath)) {
|
2011-11-06 09:51:09 +00:00
|
|
|
if (SSL_CTX_load_verify_locations(cfg->ssl_ctx, S_OR(cfg->cafile, NULL), S_OR(cfg->capath,NULL)) == 0) {
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "TLS/SSL CA file(%s)/path(%s) error\n", cfg->cafile, cfg->capath);
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
|
|
|
|
2014-07-03 16:55:44 +00:00
|
|
|
#ifdef HAVE_OPENSSL_EC
|
|
|
|
|
2014-07-03 12:10:17 +00:00
|
|
|
if (!ast_strlen_zero(cfg->pvtfile)) {
|
|
|
|
BIO *bio = BIO_new_file(cfg->pvtfile, "r");
|
|
|
|
if (bio != NULL) {
|
|
|
|
DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
|
|
|
|
if (dh != NULL) {
|
|
|
|
if (SSL_CTX_set_tmp_dh(cfg->ssl_ctx, dh)) {
|
|
|
|
long options = SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE;
|
|
|
|
options = SSL_CTX_set_options(cfg->ssl_ctx, options);
|
|
|
|
ast_verb(2, "TLS/SSL DH initialized, PFS cipher-suites enabled\n");
|
|
|
|
}
|
|
|
|
DH_free(dh);
|
|
|
|
}
|
|
|
|
BIO_free(bio);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#ifndef SSL_CTRL_SET_ECDH_AUTO
|
|
|
|
#define SSL_CTRL_SET_ECDH_AUTO 94
|
|
|
|
#endif
|
|
|
|
/* SSL_CTX_set_ecdh_auto(cfg->ssl_ctx, on); requires OpenSSL 1.0.2 which wraps: */
|
|
|
|
if (SSL_CTX_ctrl(cfg->ssl_ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL)) {
|
|
|
|
ast_verb(2, "TLS/SSL ECDH initialized (automatic), faster PFS ciphers enabled\n");
|
|
|
|
} else {
|
|
|
|
/* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
|
|
|
|
EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
|
|
|
|
if (ecdh != NULL) {
|
|
|
|
if (SSL_CTX_set_tmp_ecdh(cfg->ssl_ctx, ecdh)) {
|
|
|
|
ast_verb(2, "TLS/SSL ECDH initialized (secp256r1), faster PFS cipher-suites enabled\n");
|
|
|
|
}
|
|
|
|
EC_KEY_free(ecdh);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-07-03 16:55:44 +00:00
|
|
|
#endif /* #ifdef HAVE_OPENSSL_EC */
|
|
|
|
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_verb(2, "TLS/SSL certificate ok\n"); /* We should log which one that is ok. This message doesn't really make sense in production use */
|
2008-01-18 22:04:33 +00:00
|
|
|
return 1;
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2008-03-04 22:23:21 +00:00
|
|
|
int ast_ssl_setup(struct ast_tls_config *cfg)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
|
|
|
return __ssl_setup(cfg, 0);
|
|
|
|
}
|
|
|
|
|
2012-05-18 17:24:57 +00:00
|
|
|
void ast_ssl_teardown(struct ast_tls_config *cfg)
|
|
|
|
{
|
2012-05-23 20:30:21 +00:00
|
|
|
#ifdef DO_SSL
|
2012-05-18 17:24:57 +00:00
|
|
|
if (cfg->ssl_ctx) {
|
|
|
|
SSL_CTX_free(cfg->ssl_ctx);
|
|
|
|
cfg->ssl_ctx = NULL;
|
|
|
|
}
|
2012-05-23 20:30:21 +00:00
|
|
|
#endif
|
2012-05-18 17:24:57 +00:00
|
|
|
}
|
|
|
|
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
struct ast_tcptls_session_instance *ast_tcptls_client_start(struct ast_tcptls_session_instance *tcptls_session)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
struct ast_tcptls_session_args *desc;
|
2008-01-18 22:04:33 +00:00
|
|
|
int flags;
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
|
|
|
|
if (!(desc = tcptls_session->parent)) {
|
|
|
|
goto client_start_error;
|
|
|
|
}
|
|
|
|
|
2010-07-08 22:08:07 +00:00
|
|
|
if (ast_connect(desc->accept_fd, &desc->remote_address)) {
|
|
|
|
ast_log(LOG_ERROR, "Unable to connect %s to %s: %s\n",
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
desc->name,
|
2010-07-08 22:08:07 +00:00
|
|
|
ast_sockaddr_stringify(&desc->remote_address),
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
strerror(errno));
|
|
|
|
goto client_start_error;
|
|
|
|
}
|
|
|
|
|
|
|
|
flags = fcntl(desc->accept_fd, F_GETFL);
|
|
|
|
fcntl(desc->accept_fd, F_SETFL, flags & ~O_NONBLOCK);
|
|
|
|
|
|
|
|
if (desc->tls_cfg) {
|
|
|
|
desc->tls_cfg->enabled = 1;
|
|
|
|
__ssl_setup(desc->tls_cfg, 1);
|
|
|
|
}
|
|
|
|
|
|
|
|
return handle_tcptls_connection(tcptls_session);
|
|
|
|
|
|
|
|
client_start_error:
|
Resolve FORWARD_NULL static analysis warnings
This resolves core findings from ASTERISK-19650 numbers 0-2, 6, 7, 9-11, 14-20,
22-24, 28, 30-32, 34-36, 42-56, 82-84, 87, 89-90, 93-102, 104, 105, 109-111,
and 115. Finding numbers 26, 33, and 29 were already resolved. Those skipped
were either extended/deprecated or in areas of code that shouldn't be
disturbed.
(Closes issue ASTERISK-19650)
........
Merged revisions 366167 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 366168 from http://svn.asterisk.org/svn/asterisk/branches/10
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@366169 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-05-10 20:56:09 +00:00
|
|
|
if (desc) {
|
|
|
|
close(desc->accept_fd);
|
|
|
|
desc->accept_fd = -1;
|
|
|
|
}
|
2012-05-31 18:39:30 +00:00
|
|
|
ao2_ref(tcptls_session, -1);
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
return NULL;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
struct ast_tcptls_session_instance *ast_tcptls_client_create(struct ast_tcptls_session_args *desc)
|
|
|
|
{
|
2008-10-19 19:11:28 +00:00
|
|
|
int x = 1;
|
2008-12-12 18:45:03 +00:00
|
|
|
struct ast_tcptls_session_instance *tcptls_session = NULL;
|
2008-01-18 22:04:33 +00:00
|
|
|
|
|
|
|
/* Do nothing if nothing has changed */
|
2010-07-08 22:08:07 +00:00
|
|
|
if (!ast_sockaddr_cmp(&desc->old_address, &desc->remote_address)) {
|
2008-01-22 08:58:46 +00:00
|
|
|
ast_debug(1, "Nothing changed in %s\n", desc->name);
|
2008-01-18 22:04:33 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2011-05-20 21:40:19 +00:00
|
|
|
/* If we return early, there is no connection */
|
|
|
|
ast_sockaddr_setnull(&desc->old_address);
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2011-11-06 09:51:09 +00:00
|
|
|
if (desc->accept_fd != -1) {
|
2008-01-18 22:04:33 +00:00
|
|
|
close(desc->accept_fd);
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2010-07-08 22:08:07 +00:00
|
|
|
desc->accept_fd = socket(ast_sockaddr_is_ipv6(&desc->remote_address) ?
|
|
|
|
AF_INET6 : AF_INET, SOCK_STREAM, IPPROTO_TCP);
|
2008-01-18 22:04:33 +00:00
|
|
|
if (desc->accept_fd < 0) {
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n",
|
2008-01-18 22:04:33 +00:00
|
|
|
desc->name, strerror(errno));
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2008-10-19 19:11:28 +00:00
|
|
|
/* if a local address was specified, bind to it so the connection will
|
|
|
|
originate from the desired address */
|
2010-07-08 22:08:07 +00:00
|
|
|
if (!ast_sockaddr_isnull(&desc->local_address)) {
|
2008-10-19 19:11:28 +00:00
|
|
|
setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
|
2010-07-08 22:08:07 +00:00
|
|
|
if (ast_bind(desc->accept_fd, &desc->local_address)) {
|
|
|
|
ast_log(LOG_ERROR, "Unable to bind %s to %s: %s\n",
|
|
|
|
desc->name,
|
|
|
|
ast_sockaddr_stringify(&desc->local_address),
|
2008-10-19 19:11:28 +00:00
|
|
|
strerror(errno));
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2012-10-12 16:31:01 +00:00
|
|
|
if (!(tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor))) {
|
2008-01-18 22:04:33 +00:00
|
|
|
goto error;
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2012-10-12 16:31:01 +00:00
|
|
|
tcptls_session->overflow_buf = ast_str_create(128);
|
SIP TCP/TLS: move client connection setup/write into tcp helper thread, various related locking/memory fixes.
What this patch fixes
1.Moves sip TCP/TLS connection setup into the TCP helper thread:
Connection setup takes awhile and before this it was being
done while holding the monitor lock.
2.Moves TCP/TLS writing to the TCP helper thread: Through the
use of a packet queue and an alert pipe, the TCP helper thread
can now be woken up to write data as well as read data.
3.Locking error: sip_xmit returned an XMIT_ERROR without giving
up the tcptls_session lock. This lock has been completely removed
from sip_xmit and placed in the new sip_tcptls_write() function.
4.Memory leak: When creating a tcptls_client the tls_cfg was alloced
but never freed unless the tcptls_session failed to start. Now the
session_args for a sip client are an ao2 object which frees the
tls_cfg on destruction.
5.Pointer to stack variable: During sip_prepare_socket the creation
of a client's ast_tcptls_session_args was done on the stack and
stored as a pointer in the newly created tcptls_session. Depending
on the events that followed, there was a slight possibility that
pointer could have been accessed after the stack returned. Given
the new changes, it is always accessed after the stack returns
which is why I found it.
Notable code changes
1.I broke tcptls.c's ast_tcptls_client_start() function into two
functions. One for creating and allocating the new tcptls_session,
and a separate one for starting and handling the new connection.
This allowed me to create the tcptls_session, launch the helper
thread, and then establish the connection within the helper thread.
2.Writes to a tcptls_session are now done within the helper thread.
This is done by using an alert pipe to wake up the thread if new
data needs to be sent. The thread's sip_threadinfo object contains
the alert pipe as well as the packet queue.
3.Since the threadinfo object contains the alert pipe, it must now be
accessed outside of the helper thread for every write (queuing of a
packet). For easy lookup, I moved the threadinfo objects from a
linked list to an ao2_container.
(closes issue #13136)
Reported by: pabelanger
Tested by: dvossel, whys
(closes issue #15894)
Reported by: dvossel
Tested by: dvossel
Review: https://reviewboard.asterisk.org/r/380/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22 19:55:51 +00:00
|
|
|
tcptls_session->client = 1;
|
2008-12-12 18:45:03 +00:00
|
|
|
tcptls_session->fd = desc->accept_fd;
|
|
|
|
tcptls_session->parent = desc;
|
|
|
|
tcptls_session->parent->worker_fn = NULL;
|
2010-07-08 22:08:07 +00:00
|
|
|
ast_sockaddr_copy(&tcptls_session->remote_address,
|
|
|
|
&desc->remote_address);
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2011-05-20 21:40:19 +00:00
|
|
|
/* Set current info */
|
|
|
|
ast_sockaddr_copy(&desc->old_address, &desc->remote_address);
|
2008-12-12 18:45:03 +00:00
|
|
|
return tcptls_session;
|
2008-01-18 22:04:33 +00:00
|
|
|
|
|
|
|
error:
|
|
|
|
close(desc->accept_fd);
|
|
|
|
desc->accept_fd = -1;
|
2011-11-06 09:51:09 +00:00
|
|
|
if (tcptls_session) {
|
2008-12-12 18:45:03 +00:00
|
|
|
ao2_ref(tcptls_session, -1);
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2008-10-19 19:11:28 +00:00
|
|
|
void ast_tcptls_server_start(struct ast_tcptls_session_args *desc)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
|
|
|
int flags;
|
|
|
|
int x = 1;
|
2009-04-29 21:13:43 +00:00
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
/* Do nothing if nothing has changed */
|
2010-07-08 22:08:07 +00:00
|
|
|
if (!ast_sockaddr_cmp(&desc->old_address, &desc->local_address)) {
|
2008-01-22 08:58:46 +00:00
|
|
|
ast_debug(1, "Nothing changed in %s\n", desc->name);
|
2008-01-18 22:04:33 +00:00
|
|
|
return;
|
|
|
|
}
|
2009-04-29 21:13:43 +00:00
|
|
|
|
2011-05-20 21:40:19 +00:00
|
|
|
/* If we return early, there is no one listening */
|
|
|
|
ast_sockaddr_setnull(&desc->old_address);
|
2009-04-29 21:13:43 +00:00
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
/* Shutdown a running server if there is one */
|
|
|
|
if (desc->master != AST_PTHREADT_NULL) {
|
|
|
|
pthread_cancel(desc->master);
|
|
|
|
pthread_kill(desc->master, SIGURG);
|
|
|
|
pthread_join(desc->master, NULL);
|
|
|
|
}
|
2009-04-29 21:13:43 +00:00
|
|
|
|
2011-11-06 09:51:09 +00:00
|
|
|
if (desc->accept_fd != -1) {
|
2008-01-18 22:04:33 +00:00
|
|
|
close(desc->accept_fd);
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
|
|
|
|
/* If there's no new server, stop here */
|
2010-07-08 22:08:07 +00:00
|
|
|
if (ast_sockaddr_isnull(&desc->local_address)) {
|
2008-10-13 15:49:01 +00:00
|
|
|
ast_debug(2, "Server disabled: %s\n", desc->name);
|
2008-01-18 22:04:33 +00:00
|
|
|
return;
|
2008-10-13 15:49:01 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
|
2010-07-08 22:08:07 +00:00
|
|
|
desc->accept_fd = socket(ast_sockaddr_is_ipv6(&desc->local_address) ?
|
|
|
|
AF_INET6 : AF_INET, SOCK_STREAM, 0);
|
2008-01-18 22:04:33 +00:00
|
|
|
if (desc->accept_fd < 0) {
|
2008-10-13 15:49:01 +00:00
|
|
|
ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n", desc->name, strerror(errno));
|
2008-01-18 22:04:33 +00:00
|
|
|
return;
|
|
|
|
}
|
2009-04-29 21:13:43 +00:00
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
|
2010-07-08 22:08:07 +00:00
|
|
|
if (ast_bind(desc->accept_fd, &desc->local_address)) {
|
|
|
|
ast_log(LOG_ERROR, "Unable to bind %s to %s: %s\n",
|
2008-01-18 22:04:33 +00:00
|
|
|
desc->name,
|
2010-07-08 22:08:07 +00:00
|
|
|
ast_sockaddr_stringify(&desc->local_address),
|
2008-01-18 22:04:33 +00:00
|
|
|
strerror(errno));
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
if (listen(desc->accept_fd, 10)) {
|
2008-01-22 08:58:46 +00:00
|
|
|
ast_log(LOG_ERROR, "Unable to listen for %s!\n", desc->name);
|
2008-01-18 22:04:33 +00:00
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
flags = fcntl(desc->accept_fd, F_GETFL);
|
|
|
|
fcntl(desc->accept_fd, F_SETFL, flags | O_NONBLOCK);
|
|
|
|
if (ast_pthread_create_background(&desc->master, NULL, desc->accept_fn, desc)) {
|
2010-07-08 22:08:07 +00:00
|
|
|
ast_log(LOG_ERROR, "Unable to launch thread for %s on %s: %s\n",
|
2008-01-18 22:04:33 +00:00
|
|
|
desc->name,
|
2010-07-08 22:08:07 +00:00
|
|
|
ast_sockaddr_stringify(&desc->local_address),
|
2008-01-18 22:04:33 +00:00
|
|
|
strerror(errno));
|
|
|
|
goto error;
|
|
|
|
}
|
2011-05-20 21:40:19 +00:00
|
|
|
|
|
|
|
/* Set current info */
|
|
|
|
ast_sockaddr_copy(&desc->old_address, &desc->local_address);
|
|
|
|
|
2008-01-18 22:04:33 +00:00
|
|
|
return;
|
|
|
|
|
|
|
|
error:
|
|
|
|
close(desc->accept_fd);
|
|
|
|
desc->accept_fd = -1;
|
|
|
|
}
|
|
|
|
|
2011-11-30 22:03:02 +00:00
|
|
|
void ast_tcptls_close_session_file(struct ast_tcptls_session_instance *tcptls_session)
|
|
|
|
{
|
|
|
|
if (tcptls_session->f) {
|
2014-03-28 16:18:56 +00:00
|
|
|
fflush(tcptls_session->f);
|
2011-11-30 22:03:02 +00:00
|
|
|
if (fclose(tcptls_session->f)) {
|
|
|
|
ast_log(LOG_ERROR, "fclose() failed: %s\n", strerror(errno));
|
|
|
|
}
|
|
|
|
tcptls_session->f = NULL;
|
|
|
|
tcptls_session->fd = -1;
|
|
|
|
} else if (tcptls_session->fd != -1) {
|
2014-06-12 17:00:08 +00:00
|
|
|
/*
|
|
|
|
* Issuing shutdown() is necessary here to avoid a race
|
|
|
|
* condition where the last data written may not appear
|
|
|
|
* in the TCP stream. See ASTERISK-23548
|
|
|
|
*/
|
2014-03-28 16:18:56 +00:00
|
|
|
shutdown(tcptls_session->fd, SHUT_RDWR);
|
2011-11-30 22:03:02 +00:00
|
|
|
if (close(tcptls_session->fd)) {
|
|
|
|
ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
|
|
|
|
}
|
|
|
|
tcptls_session->fd = -1;
|
|
|
|
} else {
|
|
|
|
ast_log(LOG_ERROR, "ast_tcptls_close_session_file invoked on session instance without file or file descriptor\n");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-10-19 19:11:28 +00:00
|
|
|
void ast_tcptls_server_stop(struct ast_tcptls_session_args *desc)
|
2008-01-18 22:04:33 +00:00
|
|
|
{
|
|
|
|
if (desc->master != AST_PTHREADT_NULL) {
|
|
|
|
pthread_cancel(desc->master);
|
|
|
|
pthread_kill(desc->master, SIGURG);
|
|
|
|
pthread_join(desc->master, NULL);
|
2011-05-23 16:28:14 +00:00
|
|
|
desc->master = AST_PTHREADT_NULL;
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
2011-11-06 09:51:09 +00:00
|
|
|
if (desc->accept_fd != -1) {
|
2008-01-18 22:04:33 +00:00
|
|
|
close(desc->accept_fd);
|
2011-11-06 09:51:09 +00:00
|
|
|
}
|
2008-01-18 22:04:33 +00:00
|
|
|
desc->accept_fd = -1;
|
2008-10-13 15:49:01 +00:00
|
|
|
ast_debug(2, "Stopped server :: %s\n", desc->name);
|
2008-01-18 22:04:33 +00:00
|
|
|
}
|
2009-04-29 14:39:48 +00:00
|
|
|
|
|
|
|
int ast_tls_read_conf(struct ast_tls_config *tls_cfg, struct ast_tcptls_session_args *tls_desc, const char *varname, const char *value)
|
|
|
|
{
|
|
|
|
if (!strcasecmp(varname, "tlsenable") || !strcasecmp(varname, "sslenable")) {
|
|
|
|
tls_cfg->enabled = ast_true(value) ? 1 : 0;
|
2009-04-29 21:13:43 +00:00
|
|
|
} else if (!strcasecmp(varname, "tlscertfile") || !strcasecmp(varname, "sslcert") || !strcasecmp(varname, "tlscert")) {
|
2009-04-29 14:39:48 +00:00
|
|
|
ast_free(tls_cfg->certfile);
|
|
|
|
tls_cfg->certfile = ast_strdup(value);
|
|
|
|
} else if (!strcasecmp(varname, "tlsprivatekey") || !strcasecmp(varname, "sslprivatekey")) {
|
|
|
|
ast_free(tls_cfg->pvtfile);
|
|
|
|
tls_cfg->pvtfile = ast_strdup(value);
|
|
|
|
} else if (!strcasecmp(varname, "tlscipher") || !strcasecmp(varname, "sslcipher")) {
|
|
|
|
ast_free(tls_cfg->cipher);
|
|
|
|
tls_cfg->cipher = ast_strdup(value);
|
|
|
|
} else if (!strcasecmp(varname, "tlscafile")) {
|
|
|
|
ast_free(tls_cfg->cafile);
|
|
|
|
tls_cfg->cafile = ast_strdup(value);
|
2011-01-31 22:26:06 +00:00
|
|
|
} else if (!strcasecmp(varname, "tlscapath") || !strcasecmp(varname, "tlscadir")) {
|
2009-04-29 14:39:48 +00:00
|
|
|
ast_free(tls_cfg->capath);
|
|
|
|
tls_cfg->capath = ast_strdup(value);
|
|
|
|
} else if (!strcasecmp(varname, "tlsverifyclient")) {
|
|
|
|
ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_VERIFY_CLIENT);
|
|
|
|
} else if (!strcasecmp(varname, "tlsdontverifyserver")) {
|
|
|
|
ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DONT_VERIFY_SERVER);
|
|
|
|
} else if (!strcasecmp(varname, "tlsbindaddr") || !strcasecmp(varname, "sslbindaddr")) {
|
2010-07-08 22:08:07 +00:00
|
|
|
if (ast_parse_arg(value, PARSE_ADDR, &tls_desc->local_address))
|
2014-04-27 19:29:27 +00:00
|
|
|
ast_log(LOG_ERROR, "Invalid %s '%s'\n", varname, value);
|
2009-04-29 21:13:43 +00:00
|
|
|
} else if (!strcasecmp(varname, "tlsclientmethod") || !strcasecmp(varname, "sslclientmethod")) {
|
|
|
|
if (!strcasecmp(value, "tlsv1")) {
|
|
|
|
ast_set_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
|
|
|
|
ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
|
|
|
|
ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
|
|
|
|
} else if (!strcasecmp(value, "sslv3")) {
|
|
|
|
ast_set_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
|
|
|
|
ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
|
|
|
|
ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
|
|
|
|
} else if (!strcasecmp(value, "sslv2")) {
|
|
|
|
ast_set_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
|
|
|
|
ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
|
|
|
|
ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
|
|
|
|
}
|
2016-02-03 18:05:20 +00:00
|
|
|
} else if (!strcasecmp(varname, "tlsservercipherorder")) {
|
|
|
|
ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_SERVER_CIPHER_ORDER);
|
|
|
|
} else if (!strcasecmp(varname, "tlsdisablev1")) {
|
|
|
|
ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV1);
|
|
|
|
} else if (!strcasecmp(varname, "tlsdisablev11")) {
|
|
|
|
ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV11);
|
|
|
|
} else if (!strcasecmp(varname, "tlsdisablev12")) {
|
|
|
|
ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV12);
|
2009-04-29 14:39:48 +00:00
|
|
|
} else {
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|