main/tcptls.c

   1 /*
   2  * Asterisk -- An open source telephony toolkit.
   3  *
   4  * Copyright (C) 2007 - 2008, Digium, Inc.
   5  *
   6  * Luigi Rizzo (TCP and TLS server code)
   7  * Brett Bryant <brettbryant@gmail.com> (updated for client support)
   8  *
   9  * See http://www.asterisk.org for more information about
  10  * the Asterisk project. Please do not directly contact
  11  * any of the maintainers of this project for assistance;
  12  * the project provides a web site, mailing lists and IRC
  13  * channels for your use.
  14  *
  15  * This program is free software, distributed under the terms of
  16  * the GNU General Public License Version 2. See the LICENSE file
  17  * at the top of the source tree.
  18  */
  19
  20 /*!
  21  * \file
  22  * \brief Code to support TCP and TLS server/client
  23  *
  24  * \author Luigi Rizzo
  25  * \author Brett Bryant <brettbryant@gmail.com>
  26  */
  27
  28 /*** MODULEINFO
  29         <support_level>core</support_level>
  30  ***/
  31
  32 #include "asterisk.h"
  33
  34 ASTERISK_REGISTER_FILE()
  35
  36 #ifdef HAVE_FCNTL_H
  37 #include <fcntl.h>
  38 #endif
  39
  40 #include <signal.h>
  41 #include <sys/signal.h>
  42
  43 #include "asterisk/compat.h"
  44 #include "asterisk/tcptls.h"
  45 #include "asterisk/http.h"
  46 #include "asterisk/utils.h"
  47 #include "asterisk/strings.h"
  48 #include "asterisk/options.h"
  49 #include "asterisk/manager.h"
  50 #include "asterisk/astobj2.h"
  51 #include "asterisk/pbx.h"
  52
  53 /*! ao2 object used for the FILE stream fopencookie()/funopen() cookie. */
  54 struct ast_tcptls_stream {
  55         /*! SSL state if not NULL */
  56         SSL *ssl;
  57         /*!
  58          * \brief Start time from when an I/O sequence must complete
  59          * by struct ast_tcptls_stream.timeout.
  60          *
  61          * \note If struct ast_tcptls_stream.start.tv_sec is zero then
  62          * start time is the current I/O request.
  63          */
  64         struct timeval start;
  65         /*!
  66          * \brief The socket returned by accept().
  67          *
  68          * \note Set to -1 if the stream is closed.
  69          */
  70         int fd;
  71         /*!
  72          * \brief Timeout in ms relative to struct ast_tcptls_stream.start
  73          * to wait for an event on struct ast_tcptls_stream.fd.
  74          *
  75          * \note Set to -1 to disable timeout.
  76          * \note The socket needs to be set to non-blocking for the timeout
  77          * feature to work correctly.
  78          */
  79         int timeout;
  80         /*! TRUE if stream can exclusively wait for fd input. */
  81         int exclusive_input;
  82 };
  83
  84 void ast_tcptls_stream_set_timeout_disable(struct ast_tcptls_stream *stream)
  85 {
  86         ast_assert(stream != NULL);
  87
  88         stream->timeout = -1;
  89 }
  90
  91 void ast_tcptls_stream_set_timeout_inactivity(struct ast_tcptls_stream *stream, int timeout)
  92 {
  93         ast_assert(stream != NULL);
  94
  95         stream->start.tv_sec = 0;
  96         stream->timeout = timeout;
  97 }
  98
  99 void ast_tcptls_stream_set_timeout_sequence(struct ast_tcptls_stream *stream, struct timeval start, int timeout)
 100 {
 101         ast_assert(stream != NULL);
 102
 103         stream->start = start;
 104         stream->timeout = timeout;
 105 }
 106
 107 void ast_tcptls_stream_set_exclusive_input(struct ast_tcptls_stream *stream, int exclusive_input)
 108 {
 109         ast_assert(stream != NULL);
 110
 111         stream->exclusive_input = exclusive_input;
 112 }
 113
 114 /*!
 115  * \internal
 116  * \brief fopencookie()/funopen() stream read function.
 117  *
 118  * \param cookie Stream control data.
 119  * \param buf Where to put read data.
 120  * \param size Size of the buffer.
 121  *
 122  * \retval number of bytes put into buf.
 123  * \retval 0 on end of file.
 124  * \retval -1 on error.
 125  */
 126 static HOOK_T tcptls_stream_read(void *cookie, char *buf, LEN_T size)
 127 {
 128         struct ast_tcptls_stream *stream = cookie;
 129         struct timeval start;
 130         int ms;
 131         int res;
 132
 133         if (!size) {
 134                 /* You asked for no data you got no data. */
 135                 return 0;
 136         }
 137
 138         if (!stream || stream->fd == -1) {
 139                 errno = EBADF;
 140                 return -1;
 141         }
 142
 143         if (stream->start.tv_sec) {
 144                 start = stream->start;
 145         } else {
 146                 start = ast_tvnow();
 147         }
 148
 149 #if defined(DO_SSL)
 150         if (stream->ssl) {
 151                 for (;;) {
 152                         res = SSL_read(stream->ssl, buf, size);
 153                         if (0 < res) {
 154                                 /* We read some payload data. */
 155                                 return res;
 156                         }
 157                         switch (SSL_get_error(stream->ssl, res)) {
 158                         case SSL_ERROR_ZERO_RETURN:
 159                                 /* Report EOF for a shutdown */
 160                                 ast_debug(1, "TLS clean shutdown alert reading data\n");
 161                                 return 0;
 162                         case SSL_ERROR_WANT_READ:
 163                                 if (!stream->exclusive_input) {
 164                                         /* We cannot wait for data now. */
 165                                         errno = EAGAIN;
 166                                         return -1;
 167                                 }
 168                                 while ((ms = ast_remaining_ms(start, stream->timeout))) {
 169                                         res = ast_wait_for_input(stream->fd, ms);
 170                                         if (0 < res) {
 171                                                 /* Socket is ready to be read. */
 172                                                 break;
 173                                         }
 174                                         if (res < 0) {
 175                                                 if (errno == EINTR || errno == EAGAIN) {
 176                                                         /* Try again. */
 177                                                         continue;
 178                                                 }
 179                                                 ast_debug(1, "TLS socket error waiting for read data: %s\n",
 180                                                         strerror(errno));
 181                                                 return -1;
 182                                         }
 183                                 }
 184                                 break;
 185                         case SSL_ERROR_WANT_WRITE:
 186                                 while ((ms = ast_remaining_ms(start, stream->timeout))) {
 187                                         res = ast_wait_for_output(stream->fd, ms);
 188                                         if (0 < res) {
 189                                                 /* Socket is ready to be written. */
 190                                                 break;
 191                                         }
 192                                         if (res < 0) {
 193                                                 if (errno == EINTR || errno == EAGAIN) {
 194                                                         /* Try again. */
 195                                                         continue;
 196                                                 }
 197                                                 ast_debug(1, "TLS socket error waiting for write space: %s\n",
 198                                                         strerror(errno));
 199                                                 return -1;
 200                                         }
 201                                 }
 202                                 break;
 203                         default:
 204                                 /* Report EOF for an undecoded SSL or transport error. */
 205                                 ast_debug(1, "TLS transport or SSL error reading data\n");
 206                                 return 0;
 207                         }
 208                         if (!ms) {
 209                                 /* Report EOF for a timeout */
 210                                 ast_debug(1, "TLS timeout reading data\n");
 211                                 return 0;
 212                         }
 213                 }
 214         }
 215 #endif  /* defined(DO_SSL) */
 216
 217         for (;;) {
 218                 res = read(stream->fd, buf, size);
 219                 if (0 <= res || !stream->exclusive_input) {
 220                         /* Got data or we cannot wait for it. */
 221                         return res;
 222                 }
 223                 if (errno != EINTR && errno != EAGAIN) {
 224                         /* Not a retryable error. */
 225                         ast_debug(1, "TCP socket error reading data: %s\n",
 226                                 strerror(errno));
 227                         return -1;
 228                 }
 229                 ms = ast_remaining_ms(start, stream->timeout);
 230                 if (!ms) {
 231                         /* Report EOF for a timeout */
 232                         ast_debug(1, "TCP timeout reading data\n");
 233                         return 0;
 234                 }
 235                 ast_wait_for_input(stream->fd, ms);
 236         }
 237 }
 238
 239 /*!
 240  * \internal
 241  * \brief fopencookie()/funopen() stream write function.
 242  *
 243  * \param cookie Stream control data.
 244  * \param buf Where to get data to write.
 245  * \param size Size of the buffer.
 246  *
 247  * \retval number of bytes written from buf.
 248  * \retval -1 on error.
 249  */
 250 static HOOK_T tcptls_stream_write(void *cookie, const char *buf, LEN_T size)
 251 {
 252         struct ast_tcptls_stream *stream = cookie;
 253         struct timeval start;
 254         int ms;
 255         int res;
 256         int written;
 257         int remaining;
 258
 259         if (!size) {
 260                 /* You asked to write no data you wrote no data. */
 261                 return 0;
 262         }
 263
 264         if (!stream || stream->fd == -1) {
 265                 errno = EBADF;
 266                 return -1;
 267         }
 268
 269         if (stream->start.tv_sec) {
 270                 start = stream->start;
 271         } else {
 272                 start = ast_tvnow();
 273         }
 274
 275 #if defined(DO_SSL)
 276         if (stream->ssl) {
 277                 written = 0;
 278                 remaining = size;
 279                 for (;;) {
 280                         res = SSL_write(stream->ssl, buf + written, remaining);
 281                         if (res == remaining) {
 282                                 /* Everything was written. */
 283                                 return size;
 284                         }
 285                         if (0 < res) {
 286                                 /* Successfully wrote part of the buffer.  Try to write the rest. */
 287                                 written += res;
 288                                 remaining -= res;
 289                                 continue;
 290                         }
 291                         switch (SSL_get_error(stream->ssl, res)) {
 292                         case SSL_ERROR_ZERO_RETURN:
 293                                 ast_debug(1, "TLS clean shutdown alert writing data\n");
 294                                 if (written) {
 295                                         /* Report partial write. */
 296                                         return written;
 297                                 }
 298                                 errno = EBADF;
 299                                 return -1;
 300                         case SSL_ERROR_WANT_READ:
 301                                 ms = ast_remaining_ms(start, stream->timeout);
 302                                 if (!ms) {
 303                                         /* Report partial write. */
 304                                         ast_debug(1, "TLS timeout writing data (want read)\n");
 305                                         return written;
 306                                 }
 307                                 ast_wait_for_input(stream->fd, ms);
 308                                 break;
 309                         case SSL_ERROR_WANT_WRITE:
 310                                 ms = ast_remaining_ms(start, stream->timeout);
 311                                 if (!ms) {
 312                                         /* Report partial write. */
 313                                         ast_debug(1, "TLS timeout writing data (want write)\n");
 314                                         return written;
 315                                 }
 316                                 ast_wait_for_output(stream->fd, ms);
 317                                 break;
 318                         default:
 319                                 /* Undecoded SSL or transport error. */
 320                                 ast_debug(1, "TLS transport or SSL error writing data\n");
 321                                 if (written) {
 322                                         /* Report partial write. */
 323                                         return written;
 324                                 }
 325                                 errno = EBADF;
 326                                 return -1;
 327                         }
 328                 }
 329         }
 330 #endif  /* defined(DO_SSL) */
 331
 332         written = 0;
 333         remaining = size;
 334         for (;;) {
 335                 res = write(stream->fd, buf + written, remaining);
 336                 if (res == remaining) {
 337                         /* Yay everything was written. */
 338                         return size;
 339                 }
 340                 if (0 < res) {
 341                         /* Successfully wrote part of the buffer.  Try to write the rest. */
 342                         written += res;
 343                         remaining -= res;
 344                         continue;
 345                 }
 346                 if (errno != EINTR && errno != EAGAIN) {
 347                         /* Not a retryable error. */
 348                         ast_debug(1, "TCP socket error writing: %s\n", strerror(errno));
 349                         if (written) {
 350                                 return written;
 351                         }
 352                         return -1;
 353                 }
 354                 ms = ast_remaining_ms(start, stream->timeout);
 355                 if (!ms) {
 356                         /* Report partial write. */
 357                         ast_debug(1, "TCP timeout writing data\n");
 358                         return written;
 359                 }
 360                 ast_wait_for_output(stream->fd, ms);
 361         }
 362 }
 363
 364 /*!
 365  * \internal
 366  * \brief fopencookie()/funopen() stream close function.
 367  *
 368  * \param cookie Stream control data.
 369  *
 370  * \retval 0 on success.
 371  * \retval -1 on error.
 372  */
 373 static int tcptls_stream_close(void *cookie)
 374 {
 375         struct ast_tcptls_stream *stream = cookie;
 376
 377         if (!stream) {
 378                 errno = EBADF;
 379                 return -1;
 380         }
 381
 382         if (stream->fd != -1) {
 383 #if defined(DO_SSL)
 384                 if (stream->ssl) {
 385                         int res;
 386
 387                         /*
 388                          * According to the TLS standard, it is acceptable for an
 389                          * application to only send its shutdown alert and then
 390                          * close the underlying connection without waiting for
 391                          * the peer's response (this way resources can be saved,
 392                          * as the process can already terminate or serve another
 393                          * connection).
 394                          */
 395                         res = SSL_shutdown(stream->ssl);
 396                         if (res < 0) {
 397                                 ast_log(LOG_ERROR, "SSL_shutdown() failed: %d\n",
 398                                         SSL_get_error(stream->ssl, res));
 399                         }
 400
 401                         if (!stream->ssl->server) {
 402                                 /* For client threads, ensure that the error stack is cleared */
 403 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
 404                                 ERR_remove_thread_state(NULL);
 405 #else
 406                                 ERR_remove_state(0);
 407 #endif  /* OPENSSL_VERSION_NUMBER >= 0x10000000L */
 408                         }
 409
 410                         SSL_free(stream->ssl);
 411                         stream->ssl = NULL;
 412                 }
 413 #endif  /* defined(DO_SSL) */
 414
 415                 /*
 416                  * Issuing shutdown() is necessary here to avoid a race
 417                  * condition where the last data written may not appear
 418                  * in the TCP stream.  See ASTERISK-23548
 419                  */
 420                 shutdown(stream->fd, SHUT_RDWR);
 421                 if (close(stream->fd)) {
 422                         ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
 423                 }
 424                 stream->fd = -1;
 425         }
 426         ao2_t_ref(stream, -1, "Closed tcptls stream cookie");
 427
 428         return 0;
 429 }
 430
 431 /*!
 432  * \internal
 433  * \brief fopencookie()/funopen() stream destructor function.
 434  *
 435  * \param cookie Stream control data.
 436  *
 437  * \return Nothing
 438  */
 439 static void tcptls_stream_dtor(void *cookie)
 440 {
 441 #ifdef AST_DEVMODE
 442         /* Since the ast_assert below is the only one using stream,
 443          * and ast_assert is only available with AST_DEVMODE, we
 444          * put this in a conditional to avoid compiler warnings. */
 445         struct ast_tcptls_stream *stream = cookie;
 446 #endif
 447
 448         ast_assert(stream->fd == -1);
 449 }
 450
 451 /*!
 452  * \internal
 453  * \brief fopencookie()/funopen() stream allocation function.
 454  *
 455  * \retval stream_cookie on success.
 456  * \retval NULL on error.
 457  */
 458 static struct ast_tcptls_stream *tcptls_stream_alloc(void)
 459 {
 460         struct ast_tcptls_stream *stream;
 461
 462         stream = ao2_alloc_options(sizeof(*stream), tcptls_stream_dtor,
 463                 AO2_ALLOC_OPT_LOCK_NOLOCK);
 464         if (stream) {
 465                 stream->fd = -1;
 466                 stream->timeout = -1;
 467         }
 468         return stream;
 469 }
 470
 471 /*!
 472  * \internal
 473  * \brief Open a custom FILE stream for tcptls.
 474  *
 475  * \param stream Stream cookie control data.
 476  * \param ssl SSL state if not NULL.
 477  * \param fd Socket file descriptor.
 478  * \param timeout ms to wait for an event on fd. -1 if timeout disabled.
 479  *
 480  * \retval fp on success.
 481  * \retval NULL on error.
 482  */
 483 static FILE *tcptls_stream_fopen(struct ast_tcptls_stream *stream, SSL *ssl, int fd, int timeout)
 484 {
 485         FILE *fp;
 486
 487 #if defined(HAVE_FOPENCOOKIE)   /* the glibc/linux interface */
 488         static const cookie_io_functions_t cookie_funcs = {
 489                 tcptls_stream_read,
 490                 tcptls_stream_write,
 491                 NULL,
 492                 tcptls_stream_close
 493         };
 494 #endif  /* defined(HAVE_FOPENCOOKIE) */
 495
 496         if (fd == -1) {
 497                 /* Socket not open. */
 498                 return NULL;
 499         }
 500
 501         stream->ssl = ssl;
 502         stream->fd = fd;
 503         stream->timeout = timeout;
 504         ao2_t_ref(stream, +1, "Opening tcptls stream cookie");
 505
 506 #if defined(HAVE_FUNOPEN)       /* the BSD interface */
 507         fp = funopen(stream, tcptls_stream_read, tcptls_stream_write, NULL,
 508                 tcptls_stream_close);
 509 #elif defined(HAVE_FOPENCOOKIE) /* the glibc/linux interface */
 510         fp = fopencookie(stream, "w+", cookie_funcs);
 511 #else
 512         /* could add other methods here */
 513         ast_debug(2, "No stream FILE methods attempted!\n");
 514         fp = NULL;
 515 #endif
 516
 517         if (!fp) {
 518                 stream->fd = -1;
 519                 ao2_t_ref(stream, -1, "Failed to open tcptls stream cookie");
 520         }
 521         return fp;
 522 }
 523
 524 HOOK_T ast_tcptls_server_read(struct ast_tcptls_session_instance *tcptls_session, void *buf, size_t count)
 525 {
 526         if (!tcptls_session->stream_cookie || tcptls_session->stream_cookie->fd == -1) {
 527                 ast_log(LOG_ERROR, "TCP/TLS read called on invalid stream.\n");
 528                 errno = EIO;
 529                 return -1;
 530         }
 531
 532         return tcptls_stream_read(tcptls_session->stream_cookie, buf, count);
 533 }
 534
 535 HOOK_T ast_tcptls_server_write(struct ast_tcptls_session_instance *tcptls_session, const void *buf, size_t count)
 536 {
 537         if (!tcptls_session->stream_cookie || tcptls_session->stream_cookie->fd == -1) {
 538                 ast_log(LOG_ERROR, "TCP/TLS write called on invalid stream.\n");
 539                 errno = EIO;
 540                 return -1;
 541         }
 542
 543         return tcptls_stream_write(tcptls_session->stream_cookie, buf, count);
 544 }
 545
 546 static void session_instance_destructor(void *obj)
 547 {
 548         struct ast_tcptls_session_instance *i = obj;
 549
 550         if (i->stream_cookie) {
 551                 ao2_t_ref(i->stream_cookie, -1, "Destroying tcptls session instance");
 552                 i->stream_cookie = NULL;
 553         }
 554         ast_free(i->overflow_buf);
 555         ao2_cleanup(i->private_data);
 556 }
 557
 558 #ifdef DO_SSL
 559 static int check_tcptls_cert_name(ASN1_STRING *cert_str, const char *hostname, const char *desc)
 560 {
 561         unsigned char *str;
 562         int ret;
 563
 564         ret = ASN1_STRING_to_UTF8(&str, cert_str);
 565         if (ret < 0 || !str) {
 566                 return -1;
 567         }
 568
 569         if (strlen((char *) str) != ret) {
 570                 ast_log(LOG_WARNING, "Invalid certificate %s length (contains NULL bytes?)\n", desc);
 571
 572                 ret = -1;
 573         } else if (!strcasecmp(hostname, (char *) str)) {
 574                 ret = 0;
 575         } else {
 576                 ret = -1;
 577         }
 578
 579         ast_debug(3, "SSL %s compare s1='%s' s2='%s'\n", desc, hostname, str);
 580         OPENSSL_free(str);
 581
 582         return ret;
 583 }
 584 #endif
 585
 586 /*! \brief
 587 * creates a FILE * from the fd passed by the accept thread.
 588 * This operation is potentially expensive (certificate verification),
 589 * so we do it in the child thread context.
 590 *
 591 * \note must decrement ref count before returning NULL on error
 592 */
 593 static void *handle_tcptls_connection(void *data)
 594 {
 595         struct ast_tcptls_session_instance *tcptls_session = data;
 596 #ifdef DO_SSL
 597         int (*ssl_setup)(SSL *) = (tcptls_session->client) ? SSL_connect : SSL_accept;
 598         int ret;
 599         char err[256];
 600 #endif
 601
 602         /* TCP/TLS connections are associated with external protocols, and
 603          * should not be allowed to execute 'dangerous' functions. This may
 604          * need to be pushed down into the individual protocol handlers, but
 605          * this seems like a good general policy.
 606          */
 607         if (ast_thread_inhibit_escalations()) {
 608                 ast_log(LOG_ERROR, "Failed to inhibit privilege escalations; killing connection\n");
 609                 ast_tcptls_close_session_file(tcptls_session);
 610                 ao2_ref(tcptls_session, -1);
 611                 return NULL;
 612         }
 613
 614         tcptls_session->stream_cookie = tcptls_stream_alloc();
 615         if (!tcptls_session->stream_cookie) {
 616                 ast_tcptls_close_session_file(tcptls_session);
 617                 ao2_ref(tcptls_session, -1);
 618                 return NULL;
 619         }
 620
 621         /*
 622         * open a FILE * as appropriate.
 623         */
 624         if (!tcptls_session->parent->tls_cfg) {
 625                 tcptls_session->f = tcptls_stream_fopen(tcptls_session->stream_cookie, NULL,
 626                         tcptls_session->fd, -1);
 627                 if (tcptls_session->f) {
 628                         if (setvbuf(tcptls_session->f, NULL, _IONBF, 0)) {
 629                                 ast_tcptls_close_session_file(tcptls_session);
 630                         }
 631                 }
 632         }
 633 #ifdef DO_SSL
 634         else if ( (tcptls_session->ssl = SSL_new(tcptls_session->parent->tls_cfg->ssl_ctx)) ) {
 635                 SSL_set_fd(tcptls_session->ssl, tcptls_session->fd);
 636                 if ((ret = ssl_setup(tcptls_session->ssl)) <= 0) {
 637                         ast_log(LOG_ERROR, "Problem setting up ssl connection: %s\n", ERR_error_string(ERR_get_error(), err));
 638                 } else if ((tcptls_session->f = tcptls_stream_fopen(tcptls_session->stream_cookie,
 639                         tcptls_session->ssl, tcptls_session->fd, -1))) {
 640                         if ((tcptls_session->client && !ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_DONT_VERIFY_SERVER))
 641                                 || (!tcptls_session->client && ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_VERIFY_CLIENT))) {
 642                                 X509 *peer;
 643                                 long res;
 644                                 peer = SSL_get_peer_certificate(tcptls_session->ssl);
 645                                 if (!peer) {
 646                                         ast_log(LOG_ERROR, "No peer SSL certificate to verify\n");
 647                                         ast_tcptls_close_session_file(tcptls_session);
 648                                         ao2_ref(tcptls_session, -1);
 649                                         return NULL;
 650                                 }
 651
 652                                 res = SSL_get_verify_result(tcptls_session->ssl);
 653                                 if (res != X509_V_OK) {
 654                                         ast_log(LOG_ERROR, "Certificate did not verify: %s\n", X509_verify_cert_error_string(res));
 655                                         X509_free(peer);
 656                                         ast_tcptls_close_session_file(tcptls_session);
 657                                         ao2_ref(tcptls_session, -1);
 658                                         return NULL;
 659                                 }
 660                                 if (!ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_IGNORE_COMMON_NAME)) {
 661                                         ASN1_STRING *str;
 662                                         X509_NAME *name = X509_get_subject_name(peer);
 663                                         STACK_OF(GENERAL_NAME) *alt_names;
 664                                         int pos = -1;
 665                                         int found = 0;
 666
 667                                         for (;;) {
 668                                                 /* Walk the certificate to check all available "Common Name" */
 669                                                 /* XXX Probably should do a gethostbyname on the hostname and compare that as well */
 670                                                 pos = X509_NAME_get_index_by_NID(name, NID_commonName, pos);
 671                                                 if (pos < 0) {
 672                                                         break;
 673                                                 }
 674
 675                                                 str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, pos));
 676                                                 if (!check_tcptls_cert_name(str, tcptls_session->parent->hostname, "common name")) {
 677                                                         found = 1;
 678                                                         break;
 679                                                 }
 680                                         }
 681
 682                                         if (!found) {
 683                                                 alt_names = X509_get_ext_d2i(peer, NID_subject_alt_name, NULL, NULL);
 684                                                 if (alt_names != NULL) {
 685                                                         int alt_names_count = sk_GENERAL_NAME_num(alt_names);
 686
 687                                                         for (pos = 0; pos < alt_names_count; pos++) {
 688                                                                 const GENERAL_NAME *alt_name = sk_GENERAL_NAME_value(alt_names, pos);
 689
 690                                                                 if (alt_name->type != GEN_DNS) {
 691                                                                         continue;
 692                                                                 }
 693
 694                                                                 if (!check_tcptls_cert_name(alt_name->d.dNSName, tcptls_session->parent->hostname, "alt name")) {
 695                                                                         found = 1;
 696                                                                         break;
 697                                                                 }
 698                                                         }
 699
 700                                                         sk_GENERAL_NAME_pop_free(alt_names, GENERAL_NAME_free);
 701                                                 }
 702                                         }
 703
 704                                         if (!found) {
 705                                                 ast_log(LOG_ERROR, "Certificate common name did not match (%s)\n", tcptls_session->parent->hostname);
 706                                                 X509_free(peer);
 707                                                 ast_tcptls_close_session_file(tcptls_session);
 708                                                 ao2_ref(tcptls_session, -1);
 709                                                 return NULL;
 710                                         }
 711                                 }
 712                                 X509_free(peer);
 713                         }
 714                 }
 715                 if (!tcptls_session->f) {       /* no success opening descriptor stacking */
 716                         SSL_free(tcptls_session->ssl);
 717                 }
 718         }
 719 #endif /* DO_SSL */
 720
 721         if (!tcptls_session->f) {
 722                 ast_tcptls_close_session_file(tcptls_session);
 723                 ast_log(LOG_WARNING, "FILE * open failed!\n");
 724 #ifndef DO_SSL
 725                 if (tcptls_session->parent->tls_cfg) {
 726                         ast_log(LOG_ERROR, "Attempted a TLS connection without OpenSSL support. This will not work!\n");
 727                 }
 728 #endif
 729                 ao2_ref(tcptls_session, -1);
 730                 return NULL;
 731         }
 732
 733         if (tcptls_session->parent->worker_fn) {
 734                 return tcptls_session->parent->worker_fn(tcptls_session);
 735         } else {
 736                 return tcptls_session;
 737         }
 738 }
 739
 740 void *ast_tcptls_server_root(void *data)
 741 {
 742         struct ast_tcptls_session_args *desc = data;
 743         int fd;
 744         struct ast_sockaddr addr;
 745         struct ast_tcptls_session_instance *tcptls_session;
 746         pthread_t launched;
 747
 748         for (;;) {
 749                 int i, flags;
 750
 751                 if (desc->periodic_fn) {
 752                         desc->periodic_fn(desc);
 753                 }
 754                 i = ast_wait_for_input(desc->accept_fd, desc->poll_timeout);
 755                 if (i <= 0) {
 756                         continue;
 757                 }
 758                 fd = ast_accept(desc->accept_fd, &addr);
 759                 if (fd < 0) {
 760                         if ((errno != EAGAIN) && (errno != EWOULDBLOCK) && (errno != EINTR) && (errno != ECONNABORTED)) {
 761                                 ast_log(LOG_ERROR, "Accept failed: %s\n", strerror(errno));
 762                                 break;
 763                         }
 764                         continue;
 765                 }
 766                 tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor);
 767                 if (!tcptls_session) {
 768                         ast_log(LOG_WARNING, "No memory for new session: %s\n", strerror(errno));
 769                         if (close(fd)) {
 770                                 ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
 771                         }
 772                         continue;
 773                 }
 774
 775                 tcptls_session->overflow_buf = ast_str_create(128);
 776                 flags = fcntl(fd, F_GETFL);
 777                 fcntl(fd, F_SETFL, flags & ~O_NONBLOCK);
 778                 tcptls_session->fd = fd;
 779                 tcptls_session->parent = desc;
 780                 ast_sockaddr_copy(&tcptls_session->remote_address, &addr);
 781
 782                 tcptls_session->client = 0;
 783
 784                 /* This thread is now the only place that controls the single ref to tcptls_session */
 785                 if (ast_pthread_create_detached_background(&launched, NULL, handle_tcptls_connection, tcptls_session)) {
 786                         ast_log(LOG_ERROR, "Unable to launch helper thread: %s\n", strerror(errno));
 787                         ast_tcptls_close_session_file(tcptls_session);
 788                         ao2_ref(tcptls_session, -1);
 789                 }
 790         }
 791         return NULL;
 792 }
 793
 794 #ifdef DO_SSL
 795 static void __ssl_setup_certs(struct ast_tls_config *cfg, const size_t cert_file_len, const char *key_type_extension, const char *key_type)
 796 {
 797         char *cert_file = ast_strdupa(cfg->certfile);
 798
 799         memcpy(cert_file + cert_file_len - 8, key_type_extension, 5);
 800         if (access(cert_file, F_OK) == 0) {
 801                 if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cert_file) == 0) {
 802                         ast_log(LOG_WARNING, "TLS/SSL error loading public %s key (certificate) from <%s>.\n", key_type, cert_file);
 803                 } else if (SSL_CTX_use_PrivateKey_file(cfg->ssl_ctx, cert_file, SSL_FILETYPE_PEM) == 0) {
 804                         ast_log(LOG_WARNING, "TLS/SSL error loading private %s key from <%s>.\n", key_type, cert_file);
 805                 } else if (SSL_CTX_check_private_key(cfg->ssl_ctx) == 0) {
 806                         ast_log(LOG_WARNING, "TLS/SSL error matching private %s key and certificate in <%s>.\n", key_type, cert_file);
 807                 }
 808         }
 809 }
 810 #endif
 811
 812 static int __ssl_setup(struct ast_tls_config *cfg, int client)
 813 {
 814 #ifndef DO_SSL
 815         cfg->enabled = 0;
 816         return 0;
 817 #else
 818         int disable_ssl = 0;
 819
 820         if (!cfg->enabled) {
 821                 return 0;
 822         }
 823
 824         /* Get rid of an old SSL_CTX since we're about to
 825          * allocate a new one
 826          */
 827         if (cfg->ssl_ctx) {
 828                 SSL_CTX_free(cfg->ssl_ctx);
 829                 cfg->ssl_ctx = NULL;
 830         }
 831
 832         if (client) {
 833 #ifndef OPENSSL_NO_SSL2
 834                 if (ast_test_flag(&cfg->flags, AST_SSL_SSLV2_CLIENT)) {
 835                         ast_log(LOG_WARNING, "Usage of SSLv2 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
 836                         cfg->ssl_ctx = SSL_CTX_new(SSLv2_client_method());
 837                 } else
 838 #endif
 839 #ifndef OPENSSL_NO_SSL3_METHOD
 840                 if (ast_test_flag(&cfg->flags, AST_SSL_SSLV3_CLIENT)) {
 841                         ast_log(LOG_WARNING, "Usage of SSLv3 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
 842                         cfg->ssl_ctx = SSL_CTX_new(SSLv3_client_method());
 843                 } else
 844 #endif
 845                 if (ast_test_flag(&cfg->flags, AST_SSL_TLSV1_CLIENT)) {
 846                         cfg->ssl_ctx = SSL_CTX_new(TLSv1_client_method());
 847                 } else {
 848                         disable_ssl = 1;
 849                         cfg->ssl_ctx = SSL_CTX_new(SSLv23_client_method());
 850                 }
 851         } else {
 852                 disable_ssl = 1;
 853                 cfg->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
 854         }
 855
 856         if (!cfg->ssl_ctx) {
 857                 ast_debug(1, "Sorry, SSL_CTX_new call returned null...\n");
 858                 cfg->enabled = 0;
 859                 return 0;
 860         }
 861
 862         /* Due to the POODLE vulnerability, completely disable
 863          * SSLv2 and SSLv3 if we are not explicitly told to use
 864          * them. SSLv23_*_method supports TLSv1+.
 865          */
 866         if (disable_ssl) {
 867                 long ssl_opts;
 868
 869                 ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
 870                 SSL_CTX_set_options(cfg->ssl_ctx, ssl_opts);
 871         }
 872
 873         SSL_CTX_set_verify(cfg->ssl_ctx,
 874                 ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE,
 875                 NULL);
 876
 877         if (!ast_strlen_zero(cfg->certfile)) {
 878                 char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile;
 879                 if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cfg->certfile) == 0) {
 880                         if (!client) {
 881                                 /* Clients don't need a certificate, but if its setup we can use it */
 882                                 ast_log(LOG_ERROR, "TLS/SSL error loading cert file. <%s>\n", cfg->certfile);
 883                                 cfg->enabled = 0;
 884                                 SSL_CTX_free(cfg->ssl_ctx);
 885                                 cfg->ssl_ctx = NULL;
 886                                 return 0;
 887                         }
 888                 }
 889                 if ((SSL_CTX_use_PrivateKey_file(cfg->ssl_ctx, tmpprivate, SSL_FILETYPE_PEM) == 0) || (SSL_CTX_check_private_key(cfg->ssl_ctx) == 0 )) {
 890                         if (!client) {
 891                                 /* Clients don't need a private key, but if its setup we can use it */
 892                                 ast_log(LOG_ERROR, "TLS/SSL error loading private key file. <%s>\n", tmpprivate);
 893                                 cfg->enabled = 0;
 894                                 SSL_CTX_free(cfg->ssl_ctx);
 895                                 cfg->ssl_ctx = NULL;
 896                                 return 0;
 897                         }
 898                 }
 899                 if (!client) {
 900                         size_t certfile_len = strlen(cfg->certfile);
 901
 902                         /* expects a file name which contains _rsa. like asterisk_rsa.pem
 903                          * ignores any 3-character file-extension like .pem, .cer, .crt
 904                          */
 905                         if (certfile_len >= 8 && !strncmp(cfg->certfile + certfile_len - 8, "_rsa.", 5)) {
 906                                 __ssl_setup_certs(cfg, certfile_len, "_ecc.", "ECC");
 907                                 __ssl_setup_certs(cfg, certfile_len, "_dsa.", "DSA");
 908                         }
 909                 }
 910         }
 911         if (!ast_strlen_zero(cfg->cipher)) {
 912                 if (SSL_CTX_set_cipher_list(cfg->ssl_ctx, cfg->cipher) == 0 ) {
 913                         if (!client) {
 914                                 ast_log(LOG_ERROR, "TLS/SSL cipher error <%s>\n", cfg->cipher);
 915                                 cfg->enabled = 0;
 916                                 SSL_CTX_free(cfg->ssl_ctx);
 917                                 cfg->ssl_ctx = NULL;
 918                                 return 0;
 919                         }
 920                 }
 921         }
 922         if (!ast_strlen_zero(cfg->cafile) || !ast_strlen_zero(cfg->capath)) {
 923                 if (SSL_CTX_load_verify_locations(cfg->ssl_ctx, S_OR(cfg->cafile, NULL), S_OR(cfg->capath,NULL)) == 0) {
 924                         ast_log(LOG_ERROR, "TLS/SSL CA file(%s)/path(%s) error\n", cfg->cafile, cfg->capath);
 925                 }
 926         }
 927
 928 #ifdef HAVE_OPENSSL_EC
 929
 930         if (!ast_strlen_zero(cfg->pvtfile)) {
 931                 BIO *bio = BIO_new_file(cfg->pvtfile, "r");
 932                 if (bio != NULL) {
 933                         DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
 934                         if (dh != NULL) {
 935                                 if (SSL_CTX_set_tmp_dh(cfg->ssl_ctx, dh)) {
 936                                         long options = SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE;
 937                                         options = SSL_CTX_set_options(cfg->ssl_ctx, options);
 938                                         ast_verb(2, "TLS/SSL DH initialized, PFS cipher-suites enabled\n");
 939                                 }
 940                                 DH_free(dh);
 941                         }
 942                         BIO_free(bio);
 943                 }
 944         }
 945         #ifndef SSL_CTRL_SET_ECDH_AUTO
 946                 #define SSL_CTRL_SET_ECDH_AUTO 94
 947         #endif
 948         /* SSL_CTX_set_ecdh_auto(cfg->ssl_ctx, on); requires OpenSSL 1.0.2 which wraps: */
 949         if (SSL_CTX_ctrl(cfg->ssl_ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL)) {
 950                 ast_verb(2, "TLS/SSL ECDH initialized (automatic), faster PFS ciphers enabled\n");
 951         } else {
 952                 /* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
 953                 EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
 954                 if (ecdh != NULL) {
 955                         if (SSL_CTX_set_tmp_ecdh(cfg->ssl_ctx, ecdh)) {
 956                                 ast_verb(2, "TLS/SSL ECDH initialized (secp256r1), faster PFS cipher-suites enabled\n");
 957                         }
 958                         EC_KEY_free(ecdh);
 959                 }
 960         }
 961
 962 #endif /* #ifdef HAVE_OPENSSL_EC */
 963
 964         ast_verb(2, "TLS/SSL certificate ok\n");        /* We should log which one that is ok. This message doesn't really make sense in production use */
 965         return 1;
 966 #endif
 967 }
 968
 969 int ast_ssl_setup(struct ast_tls_config *cfg)
 970 {
 971         return __ssl_setup(cfg, 0);
 972 }
 973
 974 void ast_ssl_teardown(struct ast_tls_config *cfg)
 975 {
 976 #ifdef DO_SSL
 977         if (cfg->ssl_ctx) {
 978                 SSL_CTX_free(cfg->ssl_ctx);
 979                 cfg->ssl_ctx = NULL;
 980         }
 981 #endif
 982 }
 983
 984 struct ast_tcptls_session_instance *ast_tcptls_client_start(struct ast_tcptls_session_instance *tcptls_session)
 985 {
 986         struct ast_tcptls_session_args *desc;
 987         int flags;
 988
 989         if (!(desc = tcptls_session->parent)) {
 990                 goto client_start_error;
 991         }
 992
 993         if (ast_connect(desc->accept_fd, &desc->remote_address)) {
 994                 ast_log(LOG_ERROR, "Unable to connect %s to %s: %s\n",
 995                         desc->name,
 996                         ast_sockaddr_stringify(&desc->remote_address),
 997                         strerror(errno));
 998                 goto client_start_error;
 999         }
1000
1001         flags = fcntl(desc->accept_fd, F_GETFL);
1002         fcntl(desc->accept_fd, F_SETFL, flags & ~O_NONBLOCK);
1003
1004         if (desc->tls_cfg) {
1005                 desc->tls_cfg->enabled = 1;
1006                 __ssl_setup(desc->tls_cfg, 1);
1007         }
1008
1009         return handle_tcptls_connection(tcptls_session);
1010
1011 client_start_error:
1012         if (desc) {
1013                 close(desc->accept_fd);
1014                 desc->accept_fd = -1;
1015         }
1016         ao2_ref(tcptls_session, -1);
1017         return NULL;
1018
1019 }
1020
1021 struct ast_tcptls_session_instance *ast_tcptls_client_create(struct ast_tcptls_session_args *desc)
1022 {
1023         int x = 1;
1024         struct ast_tcptls_session_instance *tcptls_session = NULL;
1025
1026         /* Do nothing if nothing has changed */
1027         if (!ast_sockaddr_cmp(&desc->old_address, &desc->remote_address)) {
1028                 ast_debug(1, "Nothing changed in %s\n", desc->name);
1029                 return NULL;
1030         }
1031
1032         /* If we return early, there is no connection */
1033         ast_sockaddr_setnull(&desc->old_address);
1034
1035         if (desc->accept_fd != -1) {
1036                 close(desc->accept_fd);
1037         }
1038
1039         desc->accept_fd = socket(ast_sockaddr_is_ipv6(&desc->remote_address) ?
1040                                  AF_INET6 : AF_INET, SOCK_STREAM, IPPROTO_TCP);
1041         if (desc->accept_fd < 0) {
1042                 ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n",
1043                         desc->name, strerror(errno));
1044                 return NULL;
1045         }
1046
1047         /* if a local address was specified, bind to it so the connection will
1048            originate from the desired address */
1049         if (!ast_sockaddr_isnull(&desc->local_address)) {
1050                 setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
1051                 if (ast_bind(desc->accept_fd, &desc->local_address)) {
1052                         ast_log(LOG_ERROR, "Unable to bind %s to %s: %s\n",
1053                                 desc->name,
1054                                 ast_sockaddr_stringify(&desc->local_address),
1055                                 strerror(errno));
1056                         goto error;
1057                 }
1058         }
1059
1060         if (!(tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor))) {
1061                 goto error;
1062         }
1063
1064         tcptls_session->overflow_buf = ast_str_create(128);
1065         tcptls_session->client = 1;
1066         tcptls_session->fd = desc->accept_fd;
1067         tcptls_session->parent = desc;
1068         tcptls_session->parent->worker_fn = NULL;
1069         ast_sockaddr_copy(&tcptls_session->remote_address,
1070                           &desc->remote_address);
1071
1072         /* Set current info */
1073         ast_sockaddr_copy(&desc->old_address, &desc->remote_address);
1074         return tcptls_session;
1075
1076 error:
1077         close(desc->accept_fd);
1078         desc->accept_fd = -1;
1079         if (tcptls_session) {
1080                 ao2_ref(tcptls_session, -1);
1081         }
1082         return NULL;
1083 }
1084
1085 void ast_tcptls_server_start(struct ast_tcptls_session_args *desc)
1086 {
1087         int flags;
1088         int x = 1;
1089
1090         /* Do nothing if nothing has changed */
1091         if (!ast_sockaddr_cmp(&desc->old_address, &desc->local_address)) {
1092                 ast_debug(1, "Nothing changed in %s\n", desc->name);
1093                 return;
1094         }
1095
1096         /* If we return early, there is no one listening */
1097         ast_sockaddr_setnull(&desc->old_address);
1098
1099         /* Shutdown a running server if there is one */
1100         if (desc->master != AST_PTHREADT_NULL) {
1101                 pthread_cancel(desc->master);
1102                 pthread_kill(desc->master, SIGURG);
1103                 pthread_join(desc->master, NULL);
1104         }
1105
1106         if (desc->accept_fd != -1) {
1107                 close(desc->accept_fd);
1108         }
1109
1110         /* If there's no new server, stop here */
1111         if (ast_sockaddr_isnull(&desc->local_address)) {
1112                 ast_debug(2, "Server disabled:  %s\n", desc->name);
1113                 return;
1114         }
1115
1116         desc->accept_fd = socket(ast_sockaddr_is_ipv6(&desc->local_address) ?
1117                                  AF_INET6 : AF_INET, SOCK_STREAM, 0);
1118         if (desc->accept_fd < 0) {
1119                 ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n", desc->name, strerror(errno));
1120                 return;
1121         }
1122
1123         setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
1124         if (ast_bind(desc->accept_fd, &desc->local_address)) {
1125                 ast_log(LOG_ERROR, "Unable to bind %s to %s: %s\n",
1126                         desc->name,
1127                         ast_sockaddr_stringify(&desc->local_address),
1128                         strerror(errno));
1129                 goto error;
1130         }
1131         if (listen(desc->accept_fd, 10)) {
1132                 ast_log(LOG_ERROR, "Unable to listen for %s!\n", desc->name);
1133                 goto error;
1134         }
1135         flags = fcntl(desc->accept_fd, F_GETFL);
1136         fcntl(desc->accept_fd, F_SETFL, flags | O_NONBLOCK);
1137         if (ast_pthread_create_background(&desc->master, NULL, desc->accept_fn, desc)) {
1138                 ast_log(LOG_ERROR, "Unable to launch thread for %s on %s: %s\n",
1139                         desc->name,
1140                         ast_sockaddr_stringify(&desc->local_address),
1141                         strerror(errno));
1142                 goto error;
1143         }
1144
1145         /* Set current info */
1146         ast_sockaddr_copy(&desc->old_address, &desc->local_address);
1147
1148         return;
1149
1150 error:
1151         close(desc->accept_fd);
1152         desc->accept_fd = -1;
1153 }
1154
1155 void ast_tcptls_close_session_file(struct ast_tcptls_session_instance *tcptls_session)
1156 {
1157         if (tcptls_session->f) {
1158                 fflush(tcptls_session->f);
1159                 if (fclose(tcptls_session->f)) {
1160                         ast_log(LOG_ERROR, "fclose() failed: %s\n", strerror(errno));
1161                 }
1162                 tcptls_session->f = NULL;
1163                 tcptls_session->fd = -1;
1164         } else if (tcptls_session->fd != -1) {
1165                 /*
1166                  * Issuing shutdown() is necessary here to avoid a race
1167                  * condition where the last data written may not appear
1168                  * in the TCP stream.  See ASTERISK-23548
1169                  */
1170                 shutdown(tcptls_session->fd, SHUT_RDWR);
1171                 if (close(tcptls_session->fd)) {
1172                         ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
1173                 }
1174                 tcptls_session->fd = -1;
1175         } else {
1176                 ast_log(LOG_ERROR, "ast_tcptls_close_session_file invoked on session instance without file or file descriptor\n");
1177         }
1178 }
1179
1180 void ast_tcptls_server_stop(struct ast_tcptls_session_args *desc)
1181 {
1182         if (desc->master != AST_PTHREADT_NULL) {
1183                 pthread_cancel(desc->master);
1184                 pthread_kill(desc->master, SIGURG);
1185                 pthread_join(desc->master, NULL);
1186                 desc->master = AST_PTHREADT_NULL;
1187         }
1188         if (desc->accept_fd != -1) {
1189                 close(desc->accept_fd);
1190         }
1191         desc->accept_fd = -1;
1192         ast_debug(2, "Stopped server :: %s\n", desc->name);
1193 }
1194
1195 int ast_tls_read_conf(struct ast_tls_config *tls_cfg, struct ast_tcptls_session_args *tls_desc, const char *varname, const char *value)
1196 {
1197         if (!strcasecmp(varname, "tlsenable") || !strcasecmp(varname, "sslenable")) {
1198                 tls_cfg->enabled = ast_true(value) ? 1 : 0;
1199         } else if (!strcasecmp(varname, "tlscertfile") || !strcasecmp(varname, "sslcert") || !strcasecmp(varname, "tlscert")) {
1200                 ast_free(tls_cfg->certfile);
1201                 tls_cfg->certfile = ast_strdup(value);
1202         } else if (!strcasecmp(varname, "tlsprivatekey") || !strcasecmp(varname, "sslprivatekey")) {
1203                 ast_free(tls_cfg->pvtfile);
1204                 tls_cfg->pvtfile = ast_strdup(value);
1205         } else if (!strcasecmp(varname, "tlscipher") || !strcasecmp(varname, "sslcipher")) {
1206                 ast_free(tls_cfg->cipher);
1207                 tls_cfg->cipher = ast_strdup(value);
1208         } else if (!strcasecmp(varname, "tlscafile")) {
1209                 ast_free(tls_cfg->cafile);
1210                 tls_cfg->cafile = ast_strdup(value);
1211         } else if (!strcasecmp(varname, "tlscapath") || !strcasecmp(varname, "tlscadir")) {
1212                 ast_free(tls_cfg->capath);
1213                 tls_cfg->capath = ast_strdup(value);
1214         } else if (!strcasecmp(varname, "tlsverifyclient")) {
1215                 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_VERIFY_CLIENT);
1216         } else if (!strcasecmp(varname, "tlsdontverifyserver")) {
1217                 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DONT_VERIFY_SERVER);
1218         } else if (!strcasecmp(varname, "tlsbindaddr") || !strcasecmp(varname, "sslbindaddr")) {
1219                 if (ast_parse_arg(value, PARSE_ADDR, &tls_desc->local_address))
1220                         ast_log(LOG_ERROR, "Invalid %s '%s'\n", varname, value);
1221         } else if (!strcasecmp(varname, "tlsclientmethod") || !strcasecmp(varname, "sslclientmethod")) {
1222                 if (!strcasecmp(value, "tlsv1")) {
1223                         ast_set_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1224                         ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
1225                         ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1226                 } else if (!strcasecmp(value, "sslv3")) {
1227                         ast_set_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
1228                         ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1229                         ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1230                 } else if (!strcasecmp(value, "sslv2")) {
1231                         ast_set_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1232                         ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1233                         ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
1234                 }
1235         } else {
1236                 return -1;
1237         }
1238
1239         return 0;
1240 }