Fixes to include signal.h
[asterisk/asterisk.git] / main / tcptls.c
1 /*
2  * Asterisk -- An open source telephony toolkit.
3  *
4  * Copyright (C) 2007 - 2008, Digium, Inc.
5  *
6  * Luigi Rizzo (TCP and TLS server code)
7  * Brett Bryant <brettbryant@gmail.com> (updated for client support)
8  *
9  * See http://www.asterisk.org for more information about
10  * the Asterisk project. Please do not directly contact
11  * any of the maintainers of this project for assistance;
12  * the project provides a web site, mailing lists and IRC
13  * channels for your use.
14  *
15  * This program is free software, distributed under the terms of
16  * the GNU General Public License Version 2. See the LICENSE file
17  * at the top of the source tree.
18  */
19
20 /*!
21  * \file
22  * \brief Code to support TCP and TLS server/client
23  *
24  * \author Luigi Rizzo
25  * \author Brett Bryant <brettbryant@gmail.com>
26  */
27
28 /*** MODULEINFO
29         <support_level>core</support_level>
30  ***/
31
32 #include "asterisk.h"
33
34 ASTERISK_REGISTER_FILE()
35
36 #ifdef HAVE_FCNTL_H
37 #include <fcntl.h>
38 #endif
39
40 #include <signal.h>
41
42 #include "asterisk/compat.h"
43 #include "asterisk/tcptls.h"
44 #include "asterisk/http.h"
45 #include "asterisk/utils.h"
46 #include "asterisk/strings.h"
47 #include "asterisk/options.h"
48 #include "asterisk/manager.h"
49 #include "asterisk/astobj2.h"
50 #include "asterisk/pbx.h"
51
52 /*! ao2 object used for the FILE stream fopencookie()/funopen() cookie. */
53 struct ast_tcptls_stream {
54         /*! SSL state if not NULL */
55         SSL *ssl;
56         /*!
57          * \brief Start time from when an I/O sequence must complete
58          * by struct ast_tcptls_stream.timeout.
59          *
60          * \note If struct ast_tcptls_stream.start.tv_sec is zero then
61          * start time is the current I/O request.
62          */
63         struct timeval start;
64         /*!
65          * \brief The socket returned by accept().
66          *
67          * \note Set to -1 if the stream is closed.
68          */
69         int fd;
70         /*!
71          * \brief Timeout in ms relative to struct ast_tcptls_stream.start
72          * to wait for an event on struct ast_tcptls_stream.fd.
73          *
74          * \note Set to -1 to disable timeout.
75          * \note The socket needs to be set to non-blocking for the timeout
76          * feature to work correctly.
77          */
78         int timeout;
79         /*! TRUE if stream can exclusively wait for fd input. */
80         int exclusive_input;
81 };
82
83 void ast_tcptls_stream_set_timeout_disable(struct ast_tcptls_stream *stream)
84 {
85         ast_assert(stream != NULL);
86
87         stream->timeout = -1;
88 }
89
90 void ast_tcptls_stream_set_timeout_inactivity(struct ast_tcptls_stream *stream, int timeout)
91 {
92         ast_assert(stream != NULL);
93
94         stream->start.tv_sec = 0;
95         stream->timeout = timeout;
96 }
97
98 void ast_tcptls_stream_set_timeout_sequence(struct ast_tcptls_stream *stream, struct timeval start, int timeout)
99 {
100         ast_assert(stream != NULL);
101
102         stream->start = start;
103         stream->timeout = timeout;
104 }
105
106 void ast_tcptls_stream_set_exclusive_input(struct ast_tcptls_stream *stream, int exclusive_input)
107 {
108         ast_assert(stream != NULL);
109
110         stream->exclusive_input = exclusive_input;
111 }
112
113 /*!
114  * \internal
115  * \brief fopencookie()/funopen() stream read function.
116  *
117  * \param cookie Stream control data.
118  * \param buf Where to put read data.
119  * \param size Size of the buffer.
120  *
121  * \retval number of bytes put into buf.
122  * \retval 0 on end of file.
123  * \retval -1 on error.
124  */
125 static HOOK_T tcptls_stream_read(void *cookie, char *buf, LEN_T size)
126 {
127         struct ast_tcptls_stream *stream = cookie;
128         struct timeval start;
129         int ms;
130         int res;
131
132         if (!size) {
133                 /* You asked for no data you got no data. */
134                 return 0;
135         }
136
137         if (!stream || stream->fd == -1) {
138                 errno = EBADF;
139                 return -1;
140         }
141
142         if (stream->start.tv_sec) {
143                 start = stream->start;
144         } else {
145                 start = ast_tvnow();
146         }
147
148 #if defined(DO_SSL)
149         if (stream->ssl) {
150                 for (;;) {
151                         res = SSL_read(stream->ssl, buf, size);
152                         if (0 < res) {
153                                 /* We read some payload data. */
154                                 return res;
155                         }
156                         switch (SSL_get_error(stream->ssl, res)) {
157                         case SSL_ERROR_ZERO_RETURN:
158                                 /* Report EOF for a shutdown */
159                                 ast_debug(1, "TLS clean shutdown alert reading data\n");
160                                 return 0;
161                         case SSL_ERROR_WANT_READ:
162                                 if (!stream->exclusive_input) {
163                                         /* We cannot wait for data now. */
164                                         errno = EAGAIN;
165                                         return -1;
166                                 }
167                                 while ((ms = ast_remaining_ms(start, stream->timeout))) {
168                                         res = ast_wait_for_input(stream->fd, ms);
169                                         if (0 < res) {
170                                                 /* Socket is ready to be read. */
171                                                 break;
172                                         }
173                                         if (res < 0) {
174                                                 if (errno == EINTR || errno == EAGAIN) {
175                                                         /* Try again. */
176                                                         continue;
177                                                 }
178                                                 ast_debug(1, "TLS socket error waiting for read data: %s\n",
179                                                         strerror(errno));
180                                                 return -1;
181                                         }
182                                 }
183                                 break;
184                         case SSL_ERROR_WANT_WRITE:
185                                 while ((ms = ast_remaining_ms(start, stream->timeout))) {
186                                         res = ast_wait_for_output(stream->fd, ms);
187                                         if (0 < res) {
188                                                 /* Socket is ready to be written. */
189                                                 break;
190                                         }
191                                         if (res < 0) {
192                                                 if (errno == EINTR || errno == EAGAIN) {
193                                                         /* Try again. */
194                                                         continue;
195                                                 }
196                                                 ast_debug(1, "TLS socket error waiting for write space: %s\n",
197                                                         strerror(errno));
198                                                 return -1;
199                                         }
200                                 }
201                                 break;
202                         default:
203                                 /* Report EOF for an undecoded SSL or transport error. */
204                                 ast_debug(1, "TLS transport or SSL error reading data\n");
205                                 return 0;
206                         }
207                         if (!ms) {
208                                 /* Report EOF for a timeout */
209                                 ast_debug(1, "TLS timeout reading data\n");
210                                 return 0;
211                         }
212                 }
213         }
214 #endif  /* defined(DO_SSL) */
215
216         for (;;) {
217                 res = read(stream->fd, buf, size);
218                 if (0 <= res || !stream->exclusive_input) {
219                         /* Got data or we cannot wait for it. */
220                         return res;
221                 }
222                 if (errno != EINTR && errno != EAGAIN) {
223                         /* Not a retryable error. */
224                         ast_debug(1, "TCP socket error reading data: %s\n",
225                                 strerror(errno));
226                         return -1;
227                 }
228                 ms = ast_remaining_ms(start, stream->timeout);
229                 if (!ms) {
230                         /* Report EOF for a timeout */
231                         ast_debug(1, "TCP timeout reading data\n");
232                         return 0;
233                 }
234                 ast_wait_for_input(stream->fd, ms);
235         }
236 }
237
238 /*!
239  * \internal
240  * \brief fopencookie()/funopen() stream write function.
241  *
242  * \param cookie Stream control data.
243  * \param buf Where to get data to write.
244  * \param size Size of the buffer.
245  *
246  * \retval number of bytes written from buf.
247  * \retval -1 on error.
248  */
249 static HOOK_T tcptls_stream_write(void *cookie, const char *buf, LEN_T size)
250 {
251         struct ast_tcptls_stream *stream = cookie;
252         struct timeval start;
253         int ms;
254         int res;
255         int written;
256         int remaining;
257
258         if (!size) {
259                 /* You asked to write no data you wrote no data. */
260                 return 0;
261         }
262
263         if (!stream || stream->fd == -1) {
264                 errno = EBADF;
265                 return -1;
266         }
267
268         if (stream->start.tv_sec) {
269                 start = stream->start;
270         } else {
271                 start = ast_tvnow();
272         }
273
274 #if defined(DO_SSL)
275         if (stream->ssl) {
276                 written = 0;
277                 remaining = size;
278                 for (;;) {
279                         res = SSL_write(stream->ssl, buf + written, remaining);
280                         if (res == remaining) {
281                                 /* Everything was written. */
282                                 return size;
283                         }
284                         if (0 < res) {
285                                 /* Successfully wrote part of the buffer.  Try to write the rest. */
286                                 written += res;
287                                 remaining -= res;
288                                 continue;
289                         }
290                         switch (SSL_get_error(stream->ssl, res)) {
291                         case SSL_ERROR_ZERO_RETURN:
292                                 ast_debug(1, "TLS clean shutdown alert writing data\n");
293                                 if (written) {
294                                         /* Report partial write. */
295                                         return written;
296                                 }
297                                 errno = EBADF;
298                                 return -1;
299                         case SSL_ERROR_WANT_READ:
300                                 ms = ast_remaining_ms(start, stream->timeout);
301                                 if (!ms) {
302                                         /* Report partial write. */
303                                         ast_debug(1, "TLS timeout writing data (want read)\n");
304                                         return written;
305                                 }
306                                 ast_wait_for_input(stream->fd, ms);
307                                 break;
308                         case SSL_ERROR_WANT_WRITE:
309                                 ms = ast_remaining_ms(start, stream->timeout);
310                                 if (!ms) {
311                                         /* Report partial write. */
312                                         ast_debug(1, "TLS timeout writing data (want write)\n");
313                                         return written;
314                                 }
315                                 ast_wait_for_output(stream->fd, ms);
316                                 break;
317                         default:
318                                 /* Undecoded SSL or transport error. */
319                                 ast_debug(1, "TLS transport or SSL error writing data\n");
320                                 if (written) {
321                                         /* Report partial write. */
322                                         return written;
323                                 }
324                                 errno = EBADF;
325                                 return -1;
326                         }
327                 }
328         }
329 #endif  /* defined(DO_SSL) */
330
331         written = 0;
332         remaining = size;
333         for (;;) {
334                 res = write(stream->fd, buf + written, remaining);
335                 if (res == remaining) {
336                         /* Yay everything was written. */
337                         return size;
338                 }
339                 if (0 < res) {
340                         /* Successfully wrote part of the buffer.  Try to write the rest. */
341                         written += res;
342                         remaining -= res;
343                         continue;
344                 }
345                 if (errno != EINTR && errno != EAGAIN) {
346                         /* Not a retryable error. */
347                         ast_debug(1, "TCP socket error writing: %s\n", strerror(errno));
348                         if (written) {
349                                 return written;
350                         }
351                         return -1;
352                 }
353                 ms = ast_remaining_ms(start, stream->timeout);
354                 if (!ms) {
355                         /* Report partial write. */
356                         ast_debug(1, "TCP timeout writing data\n");
357                         return written;
358                 }
359                 ast_wait_for_output(stream->fd, ms);
360         }
361 }
362
363 /*!
364  * \internal
365  * \brief fopencookie()/funopen() stream close function.
366  *
367  * \param cookie Stream control data.
368  *
369  * \retval 0 on success.
370  * \retval -1 on error.
371  */
372 static int tcptls_stream_close(void *cookie)
373 {
374         struct ast_tcptls_stream *stream = cookie;
375
376         if (!stream) {
377                 errno = EBADF;
378                 return -1;
379         }
380
381         if (stream->fd != -1) {
382 #if defined(DO_SSL)
383                 if (stream->ssl) {
384                         int res;
385
386                         /*
387                          * According to the TLS standard, it is acceptable for an
388                          * application to only send its shutdown alert and then
389                          * close the underlying connection without waiting for
390                          * the peer's response (this way resources can be saved,
391                          * as the process can already terminate or serve another
392                          * connection).
393                          */
394                         res = SSL_shutdown(stream->ssl);
395                         if (res < 0) {
396                                 ast_log(LOG_ERROR, "SSL_shutdown() failed: %d\n",
397                                         SSL_get_error(stream->ssl, res));
398                         }
399
400                         if (!stream->ssl->server) {
401                                 /* For client threads, ensure that the error stack is cleared */
402 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
403                                 ERR_remove_thread_state(NULL);
404 #else
405                                 ERR_remove_state(0);
406 #endif  /* OPENSSL_VERSION_NUMBER >= 0x10000000L */
407                         }
408
409                         SSL_free(stream->ssl);
410                         stream->ssl = NULL;
411                 }
412 #endif  /* defined(DO_SSL) */
413
414                 /*
415                  * Issuing shutdown() is necessary here to avoid a race
416                  * condition where the last data written may not appear
417                  * in the TCP stream.  See ASTERISK-23548
418                  */
419                 shutdown(stream->fd, SHUT_RDWR);
420                 if (close(stream->fd)) {
421                         ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
422                 }
423                 stream->fd = -1;
424         }
425         ao2_t_ref(stream, -1, "Closed tcptls stream cookie");
426
427         return 0;
428 }
429
430 /*!
431  * \internal
432  * \brief fopencookie()/funopen() stream destructor function.
433  *
434  * \param cookie Stream control data.
435  *
436  * \return Nothing
437  */
438 static void tcptls_stream_dtor(void *cookie)
439 {
440 #ifdef AST_DEVMODE
441         /* Since the ast_assert below is the only one using stream,
442          * and ast_assert is only available with AST_DEVMODE, we
443          * put this in a conditional to avoid compiler warnings. */
444         struct ast_tcptls_stream *stream = cookie;
445 #endif
446
447         ast_assert(stream->fd == -1);
448 }
449
450 /*!
451  * \internal
452  * \brief fopencookie()/funopen() stream allocation function.
453  *
454  * \retval stream_cookie on success.
455  * \retval NULL on error.
456  */
457 static struct ast_tcptls_stream *tcptls_stream_alloc(void)
458 {
459         struct ast_tcptls_stream *stream;
460
461         stream = ao2_alloc_options(sizeof(*stream), tcptls_stream_dtor,
462                 AO2_ALLOC_OPT_LOCK_NOLOCK);
463         if (stream) {
464                 stream->fd = -1;
465                 stream->timeout = -1;
466         }
467         return stream;
468 }
469
470 /*!
471  * \internal
472  * \brief Open a custom FILE stream for tcptls.
473  *
474  * \param stream Stream cookie control data.
475  * \param ssl SSL state if not NULL.
476  * \param fd Socket file descriptor.
477  * \param timeout ms to wait for an event on fd. -1 if timeout disabled.
478  *
479  * \retval fp on success.
480  * \retval NULL on error.
481  */
482 static FILE *tcptls_stream_fopen(struct ast_tcptls_stream *stream, SSL *ssl, int fd, int timeout)
483 {
484         FILE *fp;
485
486 #if defined(HAVE_FOPENCOOKIE)   /* the glibc/linux interface */
487         static const cookie_io_functions_t cookie_funcs = {
488                 tcptls_stream_read,
489                 tcptls_stream_write,
490                 NULL,
491                 tcptls_stream_close
492         };
493 #endif  /* defined(HAVE_FOPENCOOKIE) */
494
495         if (fd == -1) {
496                 /* Socket not open. */
497                 return NULL;
498         }
499
500         stream->ssl = ssl;
501         stream->fd = fd;
502         stream->timeout = timeout;
503         ao2_t_ref(stream, +1, "Opening tcptls stream cookie");
504
505 #if defined(HAVE_FUNOPEN)       /* the BSD interface */
506         fp = funopen(stream, tcptls_stream_read, tcptls_stream_write, NULL,
507                 tcptls_stream_close);
508 #elif defined(HAVE_FOPENCOOKIE) /* the glibc/linux interface */
509         fp = fopencookie(stream, "w+", cookie_funcs);
510 #else
511         /* could add other methods here */
512         ast_debug(2, "No stream FILE methods attempted!\n");
513         fp = NULL;
514 #endif
515
516         if (!fp) {
517                 stream->fd = -1;
518                 ao2_t_ref(stream, -1, "Failed to open tcptls stream cookie");
519         }
520         return fp;
521 }
522
523 HOOK_T ast_tcptls_server_read(struct ast_tcptls_session_instance *tcptls_session, void *buf, size_t count)
524 {
525         if (!tcptls_session->stream_cookie || tcptls_session->stream_cookie->fd == -1) {
526                 ast_log(LOG_ERROR, "TCP/TLS read called on invalid stream.\n");
527                 errno = EIO;
528                 return -1;
529         }
530
531         return tcptls_stream_read(tcptls_session->stream_cookie, buf, count);
532 }
533
534 HOOK_T ast_tcptls_server_write(struct ast_tcptls_session_instance *tcptls_session, const void *buf, size_t count)
535 {
536         if (!tcptls_session->stream_cookie || tcptls_session->stream_cookie->fd == -1) {
537                 ast_log(LOG_ERROR, "TCP/TLS write called on invalid stream.\n");
538                 errno = EIO;
539                 return -1;
540         }
541
542         return tcptls_stream_write(tcptls_session->stream_cookie, buf, count);
543 }
544
545 static void session_instance_destructor(void *obj)
546 {
547         struct ast_tcptls_session_instance *i = obj;
548
549         if (i->stream_cookie) {
550                 ao2_t_ref(i->stream_cookie, -1, "Destroying tcptls session instance");
551                 i->stream_cookie = NULL;
552         }
553         ast_free(i->overflow_buf);
554         ao2_cleanup(i->private_data);
555 }
556
557 #ifdef DO_SSL
558 static int check_tcptls_cert_name(ASN1_STRING *cert_str, const char *hostname, const char *desc)
559 {
560         unsigned char *str;
561         int ret;
562
563         ret = ASN1_STRING_to_UTF8(&str, cert_str);
564         if (ret < 0 || !str) {
565                 return -1;
566         }
567
568         if (strlen((char *) str) != ret) {
569                 ast_log(LOG_WARNING, "Invalid certificate %s length (contains NULL bytes?)\n", desc);
570
571                 ret = -1;
572         } else if (!strcasecmp(hostname, (char *) str)) {
573                 ret = 0;
574         } else {
575                 ret = -1;
576         }
577
578         ast_debug(3, "SSL %s compare s1='%s' s2='%s'\n", desc, hostname, str);
579         OPENSSL_free(str);
580
581         return ret;
582 }
583 #endif
584
585 /*! \brief
586 * creates a FILE * from the fd passed by the accept thread.
587 * This operation is potentially expensive (certificate verification),
588 * so we do it in the child thread context.
589 *
590 * \note must decrement ref count before returning NULL on error
591 */
592 static void *handle_tcptls_connection(void *data)
593 {
594         struct ast_tcptls_session_instance *tcptls_session = data;
595 #ifdef DO_SSL
596         int (*ssl_setup)(SSL *) = (tcptls_session->client) ? SSL_connect : SSL_accept;
597         int ret;
598         char err[256];
599 #endif
600
601         /* TCP/TLS connections are associated with external protocols, and
602          * should not be allowed to execute 'dangerous' functions. This may
603          * need to be pushed down into the individual protocol handlers, but
604          * this seems like a good general policy.
605          */
606         if (ast_thread_inhibit_escalations()) {
607                 ast_log(LOG_ERROR, "Failed to inhibit privilege escalations; killing connection\n");
608                 ast_tcptls_close_session_file(tcptls_session);
609                 ao2_ref(tcptls_session, -1);
610                 return NULL;
611         }
612
613         tcptls_session->stream_cookie = tcptls_stream_alloc();
614         if (!tcptls_session->stream_cookie) {
615                 ast_tcptls_close_session_file(tcptls_session);
616                 ao2_ref(tcptls_session, -1);
617                 return NULL;
618         }
619
620         /*
621         * open a FILE * as appropriate.
622         */
623         if (!tcptls_session->parent->tls_cfg) {
624                 tcptls_session->f = tcptls_stream_fopen(tcptls_session->stream_cookie, NULL,
625                         tcptls_session->fd, -1);
626                 if (tcptls_session->f) {
627                         if (setvbuf(tcptls_session->f, NULL, _IONBF, 0)) {
628                                 ast_tcptls_close_session_file(tcptls_session);
629                         }
630                 }
631         }
632 #ifdef DO_SSL
633         else if ( (tcptls_session->ssl = SSL_new(tcptls_session->parent->tls_cfg->ssl_ctx)) ) {
634                 SSL_set_fd(tcptls_session->ssl, tcptls_session->fd);
635                 if ((ret = ssl_setup(tcptls_session->ssl)) <= 0) {
636                         ast_log(LOG_ERROR, "Problem setting up ssl connection: %s\n", ERR_error_string(ERR_get_error(), err));
637                 } else if ((tcptls_session->f = tcptls_stream_fopen(tcptls_session->stream_cookie,
638                         tcptls_session->ssl, tcptls_session->fd, -1))) {
639                         if ((tcptls_session->client && !ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_DONT_VERIFY_SERVER))
640                                 || (!tcptls_session->client && ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_VERIFY_CLIENT))) {
641                                 X509 *peer;
642                                 long res;
643                                 peer = SSL_get_peer_certificate(tcptls_session->ssl);
644                                 if (!peer) {
645                                         ast_log(LOG_ERROR, "No peer SSL certificate to verify\n");
646                                         ast_tcptls_close_session_file(tcptls_session);
647                                         ao2_ref(tcptls_session, -1);
648                                         return NULL;
649                                 }
650
651                                 res = SSL_get_verify_result(tcptls_session->ssl);
652                                 if (res != X509_V_OK) {
653                                         ast_log(LOG_ERROR, "Certificate did not verify: %s\n", X509_verify_cert_error_string(res));
654                                         X509_free(peer);
655                                         ast_tcptls_close_session_file(tcptls_session);
656                                         ao2_ref(tcptls_session, -1);
657                                         return NULL;
658                                 }
659                                 if (!ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_IGNORE_COMMON_NAME)) {
660                                         ASN1_STRING *str;
661                                         X509_NAME *name = X509_get_subject_name(peer);
662                                         STACK_OF(GENERAL_NAME) *alt_names;
663                                         int pos = -1;
664                                         int found = 0;
665
666                                         for (;;) {
667                                                 /* Walk the certificate to check all available "Common Name" */
668                                                 /* XXX Probably should do a gethostbyname on the hostname and compare that as well */
669                                                 pos = X509_NAME_get_index_by_NID(name, NID_commonName, pos);
670                                                 if (pos < 0) {
671                                                         break;
672                                                 }
673
674                                                 str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, pos));
675                                                 if (!check_tcptls_cert_name(str, tcptls_session->parent->hostname, "common name")) {
676                                                         found = 1;
677                                                         break;
678                                                 }
679                                         }
680
681                                         if (!found) {
682                                                 alt_names = X509_get_ext_d2i(peer, NID_subject_alt_name, NULL, NULL);
683                                                 if (alt_names != NULL) {
684                                                         int alt_names_count = sk_GENERAL_NAME_num(alt_names);
685
686                                                         for (pos = 0; pos < alt_names_count; pos++) {
687                                                                 const GENERAL_NAME *alt_name = sk_GENERAL_NAME_value(alt_names, pos);
688
689                                                                 if (alt_name->type != GEN_DNS) {
690                                                                         continue;
691                                                                 }
692
693                                                                 if (!check_tcptls_cert_name(alt_name->d.dNSName, tcptls_session->parent->hostname, "alt name")) {
694                                                                         found = 1;
695                                                                         break;
696                                                                 }
697                                                         }
698
699                                                         sk_GENERAL_NAME_pop_free(alt_names, GENERAL_NAME_free);
700                                                 }
701                                         }
702
703                                         if (!found) {
704                                                 ast_log(LOG_ERROR, "Certificate common name did not match (%s)\n", tcptls_session->parent->hostname);
705                                                 X509_free(peer);
706                                                 ast_tcptls_close_session_file(tcptls_session);
707                                                 ao2_ref(tcptls_session, -1);
708                                                 return NULL;
709                                         }
710                                 }
711                                 X509_free(peer);
712                         }
713                 }
714                 if (!tcptls_session->f) {       /* no success opening descriptor stacking */
715                         SSL_free(tcptls_session->ssl);
716                 }
717         }
718 #endif /* DO_SSL */
719
720         if (!tcptls_session->f) {
721                 ast_tcptls_close_session_file(tcptls_session);
722                 ast_log(LOG_WARNING, "FILE * open failed!\n");
723 #ifndef DO_SSL
724                 if (tcptls_session->parent->tls_cfg) {
725                         ast_log(LOG_ERROR, "Attempted a TLS connection without OpenSSL support. This will not work!\n");
726                 }
727 #endif
728                 ao2_ref(tcptls_session, -1);
729                 return NULL;
730         }
731
732         if (tcptls_session->parent->worker_fn) {
733                 return tcptls_session->parent->worker_fn(tcptls_session);
734         } else {
735                 return tcptls_session;
736         }
737 }
738
739 void *ast_tcptls_server_root(void *data)
740 {
741         struct ast_tcptls_session_args *desc = data;
742         int fd;
743         struct ast_sockaddr addr;
744         struct ast_tcptls_session_instance *tcptls_session;
745         pthread_t launched;
746
747         for (;;) {
748                 int i, flags;
749
750                 if (desc->periodic_fn) {
751                         desc->periodic_fn(desc);
752                 }
753                 i = ast_wait_for_input(desc->accept_fd, desc->poll_timeout);
754                 if (i <= 0) {
755                         continue;
756                 }
757                 fd = ast_accept(desc->accept_fd, &addr);
758                 if (fd < 0) {
759                         if ((errno != EAGAIN) && (errno != EWOULDBLOCK) && (errno != EINTR) && (errno != ECONNABORTED)) {
760                                 ast_log(LOG_ERROR, "Accept failed: %s\n", strerror(errno));
761                                 break;
762                         }
763                         continue;
764                 }
765                 tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor);
766                 if (!tcptls_session) {
767                         ast_log(LOG_WARNING, "No memory for new session: %s\n", strerror(errno));
768                         if (close(fd)) {
769                                 ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
770                         }
771                         continue;
772                 }
773
774                 tcptls_session->overflow_buf = ast_str_create(128);
775                 flags = fcntl(fd, F_GETFL);
776                 fcntl(fd, F_SETFL, flags & ~O_NONBLOCK);
777                 tcptls_session->fd = fd;
778                 tcptls_session->parent = desc;
779                 ast_sockaddr_copy(&tcptls_session->remote_address, &addr);
780
781                 tcptls_session->client = 0;
782
783                 /* This thread is now the only place that controls the single ref to tcptls_session */
784                 if (ast_pthread_create_detached_background(&launched, NULL, handle_tcptls_connection, tcptls_session)) {
785                         ast_log(LOG_ERROR, "Unable to launch helper thread: %s\n", strerror(errno));
786                         ast_tcptls_close_session_file(tcptls_session);
787                         ao2_ref(tcptls_session, -1);
788                 }
789         }
790         return NULL;
791 }
792
793 #ifdef DO_SSL
794 static void __ssl_setup_certs(struct ast_tls_config *cfg, const size_t cert_file_len, const char *key_type_extension, const char *key_type)
795 {
796         char *cert_file = ast_strdupa(cfg->certfile);
797
798         memcpy(cert_file + cert_file_len - 8, key_type_extension, 5);
799         if (access(cert_file, F_OK) == 0) {
800                 if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cert_file) == 0) {
801                         ast_log(LOG_WARNING, "TLS/SSL error loading public %s key (certificate) from <%s>.\n", key_type, cert_file);
802                 } else if (SSL_CTX_use_PrivateKey_file(cfg->ssl_ctx, cert_file, SSL_FILETYPE_PEM) == 0) {
803                         ast_log(LOG_WARNING, "TLS/SSL error loading private %s key from <%s>.\n", key_type, cert_file);
804                 } else if (SSL_CTX_check_private_key(cfg->ssl_ctx) == 0) {
805                         ast_log(LOG_WARNING, "TLS/SSL error matching private %s key and certificate in <%s>.\n", key_type, cert_file);
806                 }
807         }
808 }
809 #endif
810
811 static int __ssl_setup(struct ast_tls_config *cfg, int client)
812 {
813 #ifndef DO_SSL
814         cfg->enabled = 0;
815         return 0;
816 #else
817         int disable_ssl = 0;
818         long ssl_opts = 0;
819
820         if (!cfg->enabled) {
821                 return 0;
822         }
823
824         /* Get rid of an old SSL_CTX since we're about to
825          * allocate a new one
826          */
827         if (cfg->ssl_ctx) {
828                 SSL_CTX_free(cfg->ssl_ctx);
829                 cfg->ssl_ctx = NULL;
830         }
831
832         if (client) {
833 #ifndef OPENSSL_NO_SSL2
834                 if (ast_test_flag(&cfg->flags, AST_SSL_SSLV2_CLIENT)) {
835                         ast_log(LOG_WARNING, "Usage of SSLv2 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
836                         cfg->ssl_ctx = SSL_CTX_new(SSLv2_client_method());
837                 } else
838 #endif
839 #ifndef OPENSSL_NO_SSL3_METHOD
840                 if (ast_test_flag(&cfg->flags, AST_SSL_SSLV3_CLIENT)) {
841                         ast_log(LOG_WARNING, "Usage of SSLv3 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
842                         cfg->ssl_ctx = SSL_CTX_new(SSLv3_client_method());
843                 } else
844 #endif
845                 if (ast_test_flag(&cfg->flags, AST_SSL_TLSV1_CLIENT)) {
846                         cfg->ssl_ctx = SSL_CTX_new(TLSv1_client_method());
847                 } else {
848                         disable_ssl = 1;
849                         cfg->ssl_ctx = SSL_CTX_new(SSLv23_client_method());
850                 }
851         } else {
852                 disable_ssl = 1;
853                 cfg->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
854         }
855
856         if (!cfg->ssl_ctx) {
857                 ast_debug(1, "Sorry, SSL_CTX_new call returned null...\n");
858                 cfg->enabled = 0;
859                 return 0;
860         }
861
862         /* Due to the POODLE vulnerability, completely disable
863          * SSLv2 and SSLv3 if we are not explicitly told to use
864          * them. SSLv23_*_method supports TLSv1+.
865          */
866         if (disable_ssl) {
867                 ssl_opts |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
868         }
869
870         if (ast_test_flag(&cfg->flags, AST_SSL_SERVER_CIPHER_ORDER)) {
871                 ssl_opts |= SSL_OP_CIPHER_SERVER_PREFERENCE;
872         }
873
874         if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV1)) {
875                 ssl_opts |= SSL_OP_NO_TLSv1;
876         }
877 #if defined(HAVE_SSL_OP_NO_TLSV1_1) && defined(HAVE_SSL_OP_NO_TLSV1_2)
878         if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV11)) {
879                 ssl_opts |= SSL_OP_NO_TLSv1_1;
880         }
881         if (ast_test_flag(&cfg->flags, AST_SSL_DISABLE_TLSV12)) {
882                 ssl_opts |= SSL_OP_NO_TLSv1_2;
883         }
884 #else
885         ast_log(LOG_WARNING, "Your version of OpenSSL leaves you potentially vulnerable "
886                         "to the SSL BEAST attack. Please upgrade to OpenSSL 1.0.1 or later\n");
887 #endif
888
889         SSL_CTX_set_options(cfg->ssl_ctx, ssl_opts);
890
891         SSL_CTX_set_verify(cfg->ssl_ctx,
892                 ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE,
893                 NULL);
894
895         if (!ast_strlen_zero(cfg->certfile)) {
896                 char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile;
897                 if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cfg->certfile) == 0) {
898                         if (!client) {
899                                 /* Clients don't need a certificate, but if its setup we can use it */
900                                 ast_log(LOG_ERROR, "TLS/SSL error loading cert file. <%s>\n", cfg->certfile);
901                                 cfg->enabled = 0;
902                                 SSL_CTX_free(cfg->ssl_ctx);
903                                 cfg->ssl_ctx = NULL;
904                                 return 0;
905                         }
906                 }
907                 if ((SSL_CTX_use_PrivateKey_file(cfg->ssl_ctx, tmpprivate, SSL_FILETYPE_PEM) == 0) || (SSL_CTX_check_private_key(cfg->ssl_ctx) == 0 )) {
908                         if (!client) {
909                                 /* Clients don't need a private key, but if its setup we can use it */
910                                 ast_log(LOG_ERROR, "TLS/SSL error loading private key file. <%s>\n", tmpprivate);
911                                 cfg->enabled = 0;
912                                 SSL_CTX_free(cfg->ssl_ctx);
913                                 cfg->ssl_ctx = NULL;
914                                 return 0;
915                         }
916                 }
917                 if (!client) {
918                         size_t certfile_len = strlen(cfg->certfile);
919
920                         /* expects a file name which contains _rsa. like asterisk_rsa.pem
921                          * ignores any 3-character file-extension like .pem, .cer, .crt
922                          */
923                         if (certfile_len >= 8 && !strncmp(cfg->certfile + certfile_len - 8, "_rsa.", 5)) {
924                                 __ssl_setup_certs(cfg, certfile_len, "_ecc.", "ECC");
925                                 __ssl_setup_certs(cfg, certfile_len, "_dsa.", "DSA");
926                         }
927                 }
928         }
929         if (!ast_strlen_zero(cfg->cipher)) {
930                 if (SSL_CTX_set_cipher_list(cfg->ssl_ctx, cfg->cipher) == 0 ) {
931                         if (!client) {
932                                 ast_log(LOG_ERROR, "TLS/SSL cipher error <%s>\n", cfg->cipher);
933                                 cfg->enabled = 0;
934                                 SSL_CTX_free(cfg->ssl_ctx);
935                                 cfg->ssl_ctx = NULL;
936                                 return 0;
937                         }
938                 }
939         }
940         if (!ast_strlen_zero(cfg->cafile) || !ast_strlen_zero(cfg->capath)) {
941                 if (SSL_CTX_load_verify_locations(cfg->ssl_ctx, S_OR(cfg->cafile, NULL), S_OR(cfg->capath,NULL)) == 0) {
942                         ast_log(LOG_ERROR, "TLS/SSL CA file(%s)/path(%s) error\n", cfg->cafile, cfg->capath);
943                 }
944         }
945
946 #ifdef HAVE_OPENSSL_EC
947
948         if (!ast_strlen_zero(cfg->pvtfile)) {
949                 BIO *bio = BIO_new_file(cfg->pvtfile, "r");
950                 if (bio != NULL) {
951                         DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
952                         if (dh != NULL) {
953                                 if (SSL_CTX_set_tmp_dh(cfg->ssl_ctx, dh)) {
954                                         long options = SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE;
955                                         options = SSL_CTX_set_options(cfg->ssl_ctx, options);
956                                         ast_verb(2, "TLS/SSL DH initialized, PFS cipher-suites enabled\n");
957                                 }
958                                 DH_free(dh);
959                         }
960                         BIO_free(bio);
961                 }
962         }
963         #ifndef SSL_CTRL_SET_ECDH_AUTO
964                 #define SSL_CTRL_SET_ECDH_AUTO 94
965         #endif
966         /* SSL_CTX_set_ecdh_auto(cfg->ssl_ctx, on); requires OpenSSL 1.0.2 which wraps: */
967         if (SSL_CTX_ctrl(cfg->ssl_ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL)) {
968                 ast_verb(2, "TLS/SSL ECDH initialized (automatic), faster PFS ciphers enabled\n");
969         } else {
970                 /* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
971                 EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
972                 if (ecdh != NULL) {
973                         if (SSL_CTX_set_tmp_ecdh(cfg->ssl_ctx, ecdh)) {
974                                 ast_verb(2, "TLS/SSL ECDH initialized (secp256r1), faster PFS cipher-suites enabled\n");
975                         }
976                         EC_KEY_free(ecdh);
977                 }
978         }
979
980 #endif /* #ifdef HAVE_OPENSSL_EC */
981
982         ast_verb(2, "TLS/SSL certificate ok\n");        /* We should log which one that is ok. This message doesn't really make sense in production use */
983         return 1;
984 #endif
985 }
986
987 int ast_ssl_setup(struct ast_tls_config *cfg)
988 {
989         return __ssl_setup(cfg, 0);
990 }
991
992 void ast_ssl_teardown(struct ast_tls_config *cfg)
993 {
994 #ifdef DO_SSL
995         if (cfg->ssl_ctx) {
996                 SSL_CTX_free(cfg->ssl_ctx);
997                 cfg->ssl_ctx = NULL;
998         }
999 #endif
1000 }
1001
1002 struct ast_tcptls_session_instance *ast_tcptls_client_start(struct ast_tcptls_session_instance *tcptls_session)
1003 {
1004         struct ast_tcptls_session_args *desc;
1005         int flags;
1006
1007         if (!(desc = tcptls_session->parent)) {
1008                 goto client_start_error;
1009         }
1010
1011         if (ast_connect(desc->accept_fd, &desc->remote_address)) {
1012                 ast_log(LOG_ERROR, "Unable to connect %s to %s: %s\n",
1013                         desc->name,
1014                         ast_sockaddr_stringify(&desc->remote_address),
1015                         strerror(errno));
1016                 goto client_start_error;
1017         }
1018
1019         flags = fcntl(desc->accept_fd, F_GETFL);
1020         fcntl(desc->accept_fd, F_SETFL, flags & ~O_NONBLOCK);
1021
1022         if (desc->tls_cfg) {
1023                 desc->tls_cfg->enabled = 1;
1024                 __ssl_setup(desc->tls_cfg, 1);
1025         }
1026
1027         return handle_tcptls_connection(tcptls_session);
1028
1029 client_start_error:
1030         if (desc) {
1031                 close(desc->accept_fd);
1032                 desc->accept_fd = -1;
1033         }
1034         ao2_ref(tcptls_session, -1);
1035         return NULL;
1036
1037 }
1038
1039 struct ast_tcptls_session_instance *ast_tcptls_client_create(struct ast_tcptls_session_args *desc)
1040 {
1041         int x = 1;
1042         struct ast_tcptls_session_instance *tcptls_session = NULL;
1043
1044         /* Do nothing if nothing has changed */
1045         if (!ast_sockaddr_cmp(&desc->old_address, &desc->remote_address)) {
1046                 ast_debug(1, "Nothing changed in %s\n", desc->name);
1047                 return NULL;
1048         }
1049
1050         /* If we return early, there is no connection */
1051         ast_sockaddr_setnull(&desc->old_address);
1052
1053         if (desc->accept_fd != -1) {
1054                 close(desc->accept_fd);
1055         }
1056
1057         desc->accept_fd = socket(ast_sockaddr_is_ipv6(&desc->remote_address) ?
1058                                  AF_INET6 : AF_INET, SOCK_STREAM, IPPROTO_TCP);
1059         if (desc->accept_fd < 0) {
1060                 ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n",
1061                         desc->name, strerror(errno));
1062                 return NULL;
1063         }
1064
1065         /* if a local address was specified, bind to it so the connection will
1066            originate from the desired address */
1067         if (!ast_sockaddr_isnull(&desc->local_address)) {
1068                 setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
1069                 if (ast_bind(desc->accept_fd, &desc->local_address)) {
1070                         ast_log(LOG_ERROR, "Unable to bind %s to %s: %s\n",
1071                                 desc->name,
1072                                 ast_sockaddr_stringify(&desc->local_address),
1073                                 strerror(errno));
1074                         goto error;
1075                 }
1076         }
1077
1078         if (!(tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor))) {
1079                 goto error;
1080         }
1081
1082         tcptls_session->overflow_buf = ast_str_create(128);
1083         tcptls_session->client = 1;
1084         tcptls_session->fd = desc->accept_fd;
1085         tcptls_session->parent = desc;
1086         tcptls_session->parent->worker_fn = NULL;
1087         ast_sockaddr_copy(&tcptls_session->remote_address,
1088                           &desc->remote_address);
1089
1090         /* Set current info */
1091         ast_sockaddr_copy(&desc->old_address, &desc->remote_address);
1092         return tcptls_session;
1093
1094 error:
1095         close(desc->accept_fd);
1096         desc->accept_fd = -1;
1097         if (tcptls_session) {
1098                 ao2_ref(tcptls_session, -1);
1099         }
1100         return NULL;
1101 }
1102
1103 void ast_tcptls_server_start(struct ast_tcptls_session_args *desc)
1104 {
1105         int flags;
1106         int x = 1;
1107
1108         /* Do nothing if nothing has changed */
1109         if (!ast_sockaddr_cmp(&desc->old_address, &desc->local_address)) {
1110                 ast_debug(1, "Nothing changed in %s\n", desc->name);
1111                 return;
1112         }
1113
1114         /* If we return early, there is no one listening */
1115         ast_sockaddr_setnull(&desc->old_address);
1116
1117         /* Shutdown a running server if there is one */
1118         if (desc->master != AST_PTHREADT_NULL) {
1119                 pthread_cancel(desc->master);
1120                 pthread_kill(desc->master, SIGURG);
1121                 pthread_join(desc->master, NULL);
1122         }
1123
1124         if (desc->accept_fd != -1) {
1125                 close(desc->accept_fd);
1126         }
1127
1128         /* If there's no new server, stop here */
1129         if (ast_sockaddr_isnull(&desc->local_address)) {
1130                 ast_debug(2, "Server disabled:  %s\n", desc->name);
1131                 return;
1132         }
1133
1134         desc->accept_fd = socket(ast_sockaddr_is_ipv6(&desc->local_address) ?
1135                                  AF_INET6 : AF_INET, SOCK_STREAM, 0);
1136         if (desc->accept_fd < 0) {
1137                 ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n", desc->name, strerror(errno));
1138                 return;
1139         }
1140
1141         setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
1142         if (ast_bind(desc->accept_fd, &desc->local_address)) {
1143                 ast_log(LOG_ERROR, "Unable to bind %s to %s: %s\n",
1144                         desc->name,
1145                         ast_sockaddr_stringify(&desc->local_address),
1146                         strerror(errno));
1147                 goto error;
1148         }
1149         if (listen(desc->accept_fd, 10)) {
1150                 ast_log(LOG_ERROR, "Unable to listen for %s!\n", desc->name);
1151                 goto error;
1152         }
1153         flags = fcntl(desc->accept_fd, F_GETFL);
1154         fcntl(desc->accept_fd, F_SETFL, flags | O_NONBLOCK);
1155         if (ast_pthread_create_background(&desc->master, NULL, desc->accept_fn, desc)) {
1156                 ast_log(LOG_ERROR, "Unable to launch thread for %s on %s: %s\n",
1157                         desc->name,
1158                         ast_sockaddr_stringify(&desc->local_address),
1159                         strerror(errno));
1160                 goto error;
1161         }
1162
1163         /* Set current info */
1164         ast_sockaddr_copy(&desc->old_address, &desc->local_address);
1165
1166         return;
1167
1168 error:
1169         close(desc->accept_fd);
1170         desc->accept_fd = -1;
1171 }
1172
1173 void ast_tcptls_close_session_file(struct ast_tcptls_session_instance *tcptls_session)
1174 {
1175         if (tcptls_session->f) {
1176                 fflush(tcptls_session->f);
1177                 if (fclose(tcptls_session->f)) {
1178                         ast_log(LOG_ERROR, "fclose() failed: %s\n", strerror(errno));
1179                 }
1180                 tcptls_session->f = NULL;
1181                 tcptls_session->fd = -1;
1182         } else if (tcptls_session->fd != -1) {
1183                 /*
1184                  * Issuing shutdown() is necessary here to avoid a race
1185                  * condition where the last data written may not appear
1186                  * in the TCP stream.  See ASTERISK-23548
1187                  */
1188                 shutdown(tcptls_session->fd, SHUT_RDWR);
1189                 if (close(tcptls_session->fd)) {
1190                         ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
1191                 }
1192                 tcptls_session->fd = -1;
1193         } else {
1194                 ast_log(LOG_ERROR, "ast_tcptls_close_session_file invoked on session instance without file or file descriptor\n");
1195         }
1196 }
1197
1198 void ast_tcptls_server_stop(struct ast_tcptls_session_args *desc)
1199 {
1200         if (desc->master != AST_PTHREADT_NULL) {
1201                 pthread_cancel(desc->master);
1202                 pthread_kill(desc->master, SIGURG);
1203                 pthread_join(desc->master, NULL);
1204                 desc->master = AST_PTHREADT_NULL;
1205         }
1206         if (desc->accept_fd != -1) {
1207                 close(desc->accept_fd);
1208         }
1209         desc->accept_fd = -1;
1210         ast_debug(2, "Stopped server :: %s\n", desc->name);
1211 }
1212
1213 int ast_tls_read_conf(struct ast_tls_config *tls_cfg, struct ast_tcptls_session_args *tls_desc, const char *varname, const char *value)
1214 {
1215         if (!strcasecmp(varname, "tlsenable") || !strcasecmp(varname, "sslenable")) {
1216                 tls_cfg->enabled = ast_true(value) ? 1 : 0;
1217         } else if (!strcasecmp(varname, "tlscertfile") || !strcasecmp(varname, "sslcert") || !strcasecmp(varname, "tlscert")) {
1218                 ast_free(tls_cfg->certfile);
1219                 tls_cfg->certfile = ast_strdup(value);
1220         } else if (!strcasecmp(varname, "tlsprivatekey") || !strcasecmp(varname, "sslprivatekey")) {
1221                 ast_free(tls_cfg->pvtfile);
1222                 tls_cfg->pvtfile = ast_strdup(value);
1223         } else if (!strcasecmp(varname, "tlscipher") || !strcasecmp(varname, "sslcipher")) {
1224                 ast_free(tls_cfg->cipher);
1225                 tls_cfg->cipher = ast_strdup(value);
1226         } else if (!strcasecmp(varname, "tlscafile")) {
1227                 ast_free(tls_cfg->cafile);
1228                 tls_cfg->cafile = ast_strdup(value);
1229         } else if (!strcasecmp(varname, "tlscapath") || !strcasecmp(varname, "tlscadir")) {
1230                 ast_free(tls_cfg->capath);
1231                 tls_cfg->capath = ast_strdup(value);
1232         } else if (!strcasecmp(varname, "tlsverifyclient")) {
1233                 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_VERIFY_CLIENT);
1234         } else if (!strcasecmp(varname, "tlsdontverifyserver")) {
1235                 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DONT_VERIFY_SERVER);
1236         } else if (!strcasecmp(varname, "tlsbindaddr") || !strcasecmp(varname, "sslbindaddr")) {
1237                 if (ast_parse_arg(value, PARSE_ADDR, &tls_desc->local_address))
1238                         ast_log(LOG_ERROR, "Invalid %s '%s'\n", varname, value);
1239         } else if (!strcasecmp(varname, "tlsclientmethod") || !strcasecmp(varname, "sslclientmethod")) {
1240                 if (!strcasecmp(value, "tlsv1")) {
1241                         ast_set_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1242                         ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
1243                         ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1244                 } else if (!strcasecmp(value, "sslv3")) {
1245                         ast_set_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
1246                         ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1247                         ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1248                 } else if (!strcasecmp(value, "sslv2")) {
1249                         ast_set_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1250                         ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1251                         ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
1252                 }
1253         } else if (!strcasecmp(varname, "tlsservercipherorder")) {
1254                 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_SERVER_CIPHER_ORDER);
1255         } else if (!strcasecmp(varname, "tlsdisablev1")) {
1256                 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV1);
1257         } else if (!strcasecmp(varname, "tlsdisablev11")) {
1258                 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV11);
1259         } else if (!strcasecmp(varname, "tlsdisablev12")) {
1260                 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DISABLE_TLSV12);
1261         } else {
1262                 return -1;
1263         }
1264
1265         return 0;
1266 }