2 * Asterisk -- An open source telephony toolkit.
4 * Copyright (C) 2007 - 2008, Digium, Inc.
6 * Luigi Rizzo (TCP and TLS server code)
7 * Brett Bryant <brettbryant@gmail.com> (updated for client support)
9 * See http://www.asterisk.org for more information about
10 * the Asterisk project. Please do not directly contact
11 * any of the maintainers of this project for assistance;
12 * the project provides a web site, mailing lists and IRC
13 * channels for your use.
15 * This program is free software, distributed under the terms of
16 * the GNU General Public License Version 2. See the LICENSE file
17 * at the top of the source tree.
22 * \brief Code to support TCP and TLS server/client
25 * \author Brett Bryant <brettbryant@gmail.com>
29 <support_level>core</support_level>
34 ASTERISK_REGISTER_FILE()
41 #include <sys/signal.h>
43 #include "asterisk/compat.h"
44 #include "asterisk/tcptls.h"
45 #include "asterisk/http.h"
46 #include "asterisk/utils.h"
47 #include "asterisk/strings.h"
48 #include "asterisk/options.h"
49 #include "asterisk/manager.h"
50 #include "asterisk/astobj2.h"
51 #include "asterisk/pbx.h"
53 /*! ao2 object used for the FILE stream fopencookie()/funopen() cookie. */
54 struct ast_tcptls_stream {
55 /*! SSL state if not NULL */
58 * \brief Start time from when an I/O sequence must complete
59 * by struct ast_tcptls_stream.timeout.
61 * \note If struct ast_tcptls_stream.start.tv_sec is zero then
62 * start time is the current I/O request.
66 * \brief The socket returned by accept().
68 * \note Set to -1 if the stream is closed.
72 * \brief Timeout in ms relative to struct ast_tcptls_stream.start
73 * to wait for an event on struct ast_tcptls_stream.fd.
75 * \note Set to -1 to disable timeout.
76 * \note The socket needs to be set to non-blocking for the timeout
77 * feature to work correctly.
80 /*! TRUE if stream can exclusively wait for fd input. */
84 void ast_tcptls_stream_set_timeout_disable(struct ast_tcptls_stream *stream)
86 ast_assert(stream != NULL);
91 void ast_tcptls_stream_set_timeout_inactivity(struct ast_tcptls_stream *stream, int timeout)
93 ast_assert(stream != NULL);
95 stream->start.tv_sec = 0;
96 stream->timeout = timeout;
99 void ast_tcptls_stream_set_timeout_sequence(struct ast_tcptls_stream *stream, struct timeval start, int timeout)
101 ast_assert(stream != NULL);
103 stream->start = start;
104 stream->timeout = timeout;
107 void ast_tcptls_stream_set_exclusive_input(struct ast_tcptls_stream *stream, int exclusive_input)
109 ast_assert(stream != NULL);
111 stream->exclusive_input = exclusive_input;
116 * \brief fopencookie()/funopen() stream read function.
118 * \param cookie Stream control data.
119 * \param buf Where to put read data.
120 * \param size Size of the buffer.
122 * \retval number of bytes put into buf.
123 * \retval 0 on end of file.
124 * \retval -1 on error.
126 static HOOK_T tcptls_stream_read(void *cookie, char *buf, LEN_T size)
128 struct ast_tcptls_stream *stream = cookie;
129 struct timeval start;
134 /* You asked for no data you got no data. */
138 if (!stream || stream->fd == -1) {
143 if (stream->start.tv_sec) {
144 start = stream->start;
152 res = SSL_read(stream->ssl, buf, size);
154 /* We read some payload data. */
157 switch (SSL_get_error(stream->ssl, res)) {
158 case SSL_ERROR_ZERO_RETURN:
159 /* Report EOF for a shutdown */
160 ast_debug(1, "TLS clean shutdown alert reading data\n");
162 case SSL_ERROR_WANT_READ:
163 if (!stream->exclusive_input) {
164 /* We cannot wait for data now. */
168 while ((ms = ast_remaining_ms(start, stream->timeout))) {
169 res = ast_wait_for_input(stream->fd, ms);
171 /* Socket is ready to be read. */
175 if (errno == EINTR || errno == EAGAIN) {
179 ast_debug(1, "TLS socket error waiting for read data: %s\n",
185 case SSL_ERROR_WANT_WRITE:
186 while ((ms = ast_remaining_ms(start, stream->timeout))) {
187 res = ast_wait_for_output(stream->fd, ms);
189 /* Socket is ready to be written. */
193 if (errno == EINTR || errno == EAGAIN) {
197 ast_debug(1, "TLS socket error waiting for write space: %s\n",
204 /* Report EOF for an undecoded SSL or transport error. */
205 ast_debug(1, "TLS transport or SSL error reading data\n");
209 /* Report EOF for a timeout */
210 ast_debug(1, "TLS timeout reading data\n");
215 #endif /* defined(DO_SSL) */
218 res = read(stream->fd, buf, size);
219 if (0 <= res || !stream->exclusive_input) {
220 /* Got data or we cannot wait for it. */
223 if (errno != EINTR && errno != EAGAIN) {
224 /* Not a retryable error. */
225 ast_debug(1, "TCP socket error reading data: %s\n",
229 ms = ast_remaining_ms(start, stream->timeout);
231 /* Report EOF for a timeout */
232 ast_debug(1, "TCP timeout reading data\n");
235 ast_wait_for_input(stream->fd, ms);
241 * \brief fopencookie()/funopen() stream write function.
243 * \param cookie Stream control data.
244 * \param buf Where to get data to write.
245 * \param size Size of the buffer.
247 * \retval number of bytes written from buf.
248 * \retval -1 on error.
250 static HOOK_T tcptls_stream_write(void *cookie, const char *buf, LEN_T size)
252 struct ast_tcptls_stream *stream = cookie;
253 struct timeval start;
260 /* You asked to write no data you wrote no data. */
264 if (!stream || stream->fd == -1) {
269 if (stream->start.tv_sec) {
270 start = stream->start;
280 res = SSL_write(stream->ssl, buf + written, remaining);
281 if (res == remaining) {
282 /* Everything was written. */
286 /* Successfully wrote part of the buffer. Try to write the rest. */
291 switch (SSL_get_error(stream->ssl, res)) {
292 case SSL_ERROR_ZERO_RETURN:
293 ast_debug(1, "TLS clean shutdown alert writing data\n");
295 /* Report partial write. */
300 case SSL_ERROR_WANT_READ:
301 ms = ast_remaining_ms(start, stream->timeout);
303 /* Report partial write. */
304 ast_debug(1, "TLS timeout writing data (want read)\n");
307 ast_wait_for_input(stream->fd, ms);
309 case SSL_ERROR_WANT_WRITE:
310 ms = ast_remaining_ms(start, stream->timeout);
312 /* Report partial write. */
313 ast_debug(1, "TLS timeout writing data (want write)\n");
316 ast_wait_for_output(stream->fd, ms);
319 /* Undecoded SSL or transport error. */
320 ast_debug(1, "TLS transport or SSL error writing data\n");
322 /* Report partial write. */
330 #endif /* defined(DO_SSL) */
335 res = write(stream->fd, buf + written, remaining);
336 if (res == remaining) {
337 /* Yay everything was written. */
341 /* Successfully wrote part of the buffer. Try to write the rest. */
346 if (errno != EINTR && errno != EAGAIN) {
347 /* Not a retryable error. */
348 ast_debug(1, "TCP socket error writing: %s\n", strerror(errno));
354 ms = ast_remaining_ms(start, stream->timeout);
356 /* Report partial write. */
357 ast_debug(1, "TCP timeout writing data\n");
360 ast_wait_for_output(stream->fd, ms);
366 * \brief fopencookie()/funopen() stream close function.
368 * \param cookie Stream control data.
370 * \retval 0 on success.
371 * \retval -1 on error.
373 static int tcptls_stream_close(void *cookie)
375 struct ast_tcptls_stream *stream = cookie;
382 if (stream->fd != -1) {
388 * According to the TLS standard, it is acceptable for an
389 * application to only send its shutdown alert and then
390 * close the underlying connection without waiting for
391 * the peer's response (this way resources can be saved,
392 * as the process can already terminate or serve another
395 res = SSL_shutdown(stream->ssl);
397 ast_log(LOG_ERROR, "SSL_shutdown() failed: %d\n",
398 SSL_get_error(stream->ssl, res));
401 if (!stream->ssl->server) {
402 /* For client threads, ensure that the error stack is cleared */
403 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
404 ERR_remove_thread_state(NULL);
407 #endif /* OPENSSL_VERSION_NUMBER >= 0x10000000L */
410 SSL_free(stream->ssl);
413 #endif /* defined(DO_SSL) */
416 * Issuing shutdown() is necessary here to avoid a race
417 * condition where the last data written may not appear
418 * in the TCP stream. See ASTERISK-23548
420 shutdown(stream->fd, SHUT_RDWR);
421 if (close(stream->fd)) {
422 ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
426 ao2_t_ref(stream, -1, "Closed tcptls stream cookie");
433 * \brief fopencookie()/funopen() stream destructor function.
435 * \param cookie Stream control data.
439 static void tcptls_stream_dtor(void *cookie)
442 /* Since the ast_assert below is the only one using stream,
443 * and ast_assert is only available with AST_DEVMODE, we
444 * put this in a conditional to avoid compiler warnings. */
445 struct ast_tcptls_stream *stream = cookie;
448 ast_assert(stream->fd == -1);
453 * \brief fopencookie()/funopen() stream allocation function.
455 * \retval stream_cookie on success.
456 * \retval NULL on error.
458 static struct ast_tcptls_stream *tcptls_stream_alloc(void)
460 struct ast_tcptls_stream *stream;
462 stream = ao2_alloc_options(sizeof(*stream), tcptls_stream_dtor,
463 AO2_ALLOC_OPT_LOCK_NOLOCK);
466 stream->timeout = -1;
473 * \brief Open a custom FILE stream for tcptls.
475 * \param stream Stream cookie control data.
476 * \param ssl SSL state if not NULL.
477 * \param fd Socket file descriptor.
478 * \param timeout ms to wait for an event on fd. -1 if timeout disabled.
480 * \retval fp on success.
481 * \retval NULL on error.
483 static FILE *tcptls_stream_fopen(struct ast_tcptls_stream *stream, SSL *ssl, int fd, int timeout)
487 #if defined(HAVE_FOPENCOOKIE) /* the glibc/linux interface */
488 static const cookie_io_functions_t cookie_funcs = {
494 #endif /* defined(HAVE_FOPENCOOKIE) */
497 /* Socket not open. */
503 stream->timeout = timeout;
504 ao2_t_ref(stream, +1, "Opening tcptls stream cookie");
506 #if defined(HAVE_FUNOPEN) /* the BSD interface */
507 fp = funopen(stream, tcptls_stream_read, tcptls_stream_write, NULL,
508 tcptls_stream_close);
509 #elif defined(HAVE_FOPENCOOKIE) /* the glibc/linux interface */
510 fp = fopencookie(stream, "w+", cookie_funcs);
512 /* could add other methods here */
513 ast_debug(2, "No stream FILE methods attempted!\n");
519 ao2_t_ref(stream, -1, "Failed to open tcptls stream cookie");
524 HOOK_T ast_tcptls_server_read(struct ast_tcptls_session_instance *tcptls_session, void *buf, size_t count)
526 if (!tcptls_session->stream_cookie || tcptls_session->stream_cookie->fd == -1) {
527 ast_log(LOG_ERROR, "TCP/TLS read called on invalid stream.\n");
532 return tcptls_stream_read(tcptls_session->stream_cookie, buf, count);
535 HOOK_T ast_tcptls_server_write(struct ast_tcptls_session_instance *tcptls_session, const void *buf, size_t count)
537 if (!tcptls_session->stream_cookie || tcptls_session->stream_cookie->fd == -1) {
538 ast_log(LOG_ERROR, "TCP/TLS write called on invalid stream.\n");
543 return tcptls_stream_write(tcptls_session->stream_cookie, buf, count);
546 static void session_instance_destructor(void *obj)
548 struct ast_tcptls_session_instance *i = obj;
550 if (i->stream_cookie) {
551 ao2_t_ref(i->stream_cookie, -1, "Destroying tcptls session instance");
552 i->stream_cookie = NULL;
554 ast_free(i->overflow_buf);
555 ao2_cleanup(i->private_data);
559 static int check_tcptls_cert_name(ASN1_STRING *cert_str, const char *hostname, const char *desc)
564 ret = ASN1_STRING_to_UTF8(&str, cert_str);
565 if (ret < 0 || !str) {
569 if (strlen((char *) str) != ret) {
570 ast_log(LOG_WARNING, "Invalid certificate %s length (contains NULL bytes?)\n", desc);
573 } else if (!strcasecmp(hostname, (char *) str)) {
579 ast_debug(3, "SSL %s compare s1='%s' s2='%s'\n", desc, hostname, str);
587 * creates a FILE * from the fd passed by the accept thread.
588 * This operation is potentially expensive (certificate verification),
589 * so we do it in the child thread context.
591 * \note must decrement ref count before returning NULL on error
593 static void *handle_tcptls_connection(void *data)
595 struct ast_tcptls_session_instance *tcptls_session = data;
597 int (*ssl_setup)(SSL *) = (tcptls_session->client) ? SSL_connect : SSL_accept;
602 /* TCP/TLS connections are associated with external protocols, and
603 * should not be allowed to execute 'dangerous' functions. This may
604 * need to be pushed down into the individual protocol handlers, but
605 * this seems like a good general policy.
607 if (ast_thread_inhibit_escalations()) {
608 ast_log(LOG_ERROR, "Failed to inhibit privilege escalations; killing connection\n");
609 ast_tcptls_close_session_file(tcptls_session);
610 ao2_ref(tcptls_session, -1);
614 tcptls_session->stream_cookie = tcptls_stream_alloc();
615 if (!tcptls_session->stream_cookie) {
616 ast_tcptls_close_session_file(tcptls_session);
617 ao2_ref(tcptls_session, -1);
622 * open a FILE * as appropriate.
624 if (!tcptls_session->parent->tls_cfg) {
625 tcptls_session->f = tcptls_stream_fopen(tcptls_session->stream_cookie, NULL,
626 tcptls_session->fd, -1);
627 if (tcptls_session->f) {
628 if (setvbuf(tcptls_session->f, NULL, _IONBF, 0)) {
629 ast_tcptls_close_session_file(tcptls_session);
634 else if ( (tcptls_session->ssl = SSL_new(tcptls_session->parent->tls_cfg->ssl_ctx)) ) {
635 SSL_set_fd(tcptls_session->ssl, tcptls_session->fd);
636 if ((ret = ssl_setup(tcptls_session->ssl)) <= 0) {
637 ast_log(LOG_ERROR, "Problem setting up ssl connection: %s\n", ERR_error_string(ERR_get_error(), err));
638 } else if ((tcptls_session->f = tcptls_stream_fopen(tcptls_session->stream_cookie,
639 tcptls_session->ssl, tcptls_session->fd, -1))) {
640 if ((tcptls_session->client && !ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_DONT_VERIFY_SERVER))
641 || (!tcptls_session->client && ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_VERIFY_CLIENT))) {
644 peer = SSL_get_peer_certificate(tcptls_session->ssl);
646 ast_log(LOG_ERROR, "No peer SSL certificate to verify\n");
647 ast_tcptls_close_session_file(tcptls_session);
648 ao2_ref(tcptls_session, -1);
652 res = SSL_get_verify_result(tcptls_session->ssl);
653 if (res != X509_V_OK) {
654 ast_log(LOG_ERROR, "Certificate did not verify: %s\n", X509_verify_cert_error_string(res));
656 ast_tcptls_close_session_file(tcptls_session);
657 ao2_ref(tcptls_session, -1);
660 if (!ast_test_flag(&tcptls_session->parent->tls_cfg->flags, AST_SSL_IGNORE_COMMON_NAME)) {
662 X509_NAME *name = X509_get_subject_name(peer);
663 STACK_OF(GENERAL_NAME) *alt_names;
668 /* Walk the certificate to check all available "Common Name" */
669 /* XXX Probably should do a gethostbyname on the hostname and compare that as well */
670 pos = X509_NAME_get_index_by_NID(name, NID_commonName, pos);
675 str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, pos));
676 if (!check_tcptls_cert_name(str, tcptls_session->parent->hostname, "common name")) {
683 alt_names = X509_get_ext_d2i(peer, NID_subject_alt_name, NULL, NULL);
684 if (alt_names != NULL) {
685 int alt_names_count = sk_GENERAL_NAME_num(alt_names);
687 for (pos = 0; pos < alt_names_count; pos++) {
688 const GENERAL_NAME *alt_name = sk_GENERAL_NAME_value(alt_names, pos);
690 if (alt_name->type != GEN_DNS) {
694 if (!check_tcptls_cert_name(alt_name->d.dNSName, tcptls_session->parent->hostname, "alt name")) {
700 sk_GENERAL_NAME_pop_free(alt_names, GENERAL_NAME_free);
705 ast_log(LOG_ERROR, "Certificate common name did not match (%s)\n", tcptls_session->parent->hostname);
707 ast_tcptls_close_session_file(tcptls_session);
708 ao2_ref(tcptls_session, -1);
715 if (!tcptls_session->f) { /* no success opening descriptor stacking */
716 SSL_free(tcptls_session->ssl);
721 if (!tcptls_session->f) {
722 ast_tcptls_close_session_file(tcptls_session);
723 ast_log(LOG_WARNING, "FILE * open failed!\n");
725 if (tcptls_session->parent->tls_cfg) {
726 ast_log(LOG_ERROR, "Attempted a TLS connection without OpenSSL support. This will not work!\n");
729 ao2_ref(tcptls_session, -1);
733 if (tcptls_session->parent->worker_fn) {
734 return tcptls_session->parent->worker_fn(tcptls_session);
736 return tcptls_session;
740 void *ast_tcptls_server_root(void *data)
742 struct ast_tcptls_session_args *desc = data;
744 struct ast_sockaddr addr;
745 struct ast_tcptls_session_instance *tcptls_session;
751 if (desc->periodic_fn) {
752 desc->periodic_fn(desc);
754 i = ast_wait_for_input(desc->accept_fd, desc->poll_timeout);
758 fd = ast_accept(desc->accept_fd, &addr);
760 if ((errno != EAGAIN) && (errno != EWOULDBLOCK) && (errno != EINTR) && (errno != ECONNABORTED)) {
761 ast_log(LOG_ERROR, "Accept failed: %s\n", strerror(errno));
766 tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor);
767 if (!tcptls_session) {
768 ast_log(LOG_WARNING, "No memory for new session: %s\n", strerror(errno));
770 ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
775 tcptls_session->overflow_buf = ast_str_create(128);
776 flags = fcntl(fd, F_GETFL);
777 fcntl(fd, F_SETFL, flags & ~O_NONBLOCK);
778 tcptls_session->fd = fd;
779 tcptls_session->parent = desc;
780 ast_sockaddr_copy(&tcptls_session->remote_address, &addr);
782 tcptls_session->client = 0;
784 /* This thread is now the only place that controls the single ref to tcptls_session */
785 if (ast_pthread_create_detached_background(&launched, NULL, handle_tcptls_connection, tcptls_session)) {
786 ast_log(LOG_ERROR, "Unable to launch helper thread: %s\n", strerror(errno));
787 ast_tcptls_close_session_file(tcptls_session);
788 ao2_ref(tcptls_session, -1);
795 static void __ssl_setup_certs(struct ast_tls_config *cfg, const size_t cert_file_len, const char *key_type_extension, const char *key_type)
797 char *cert_file = ast_strdupa(cfg->certfile);
799 memcpy(cert_file + cert_file_len - 8, key_type_extension, 5);
800 if (access(cert_file, F_OK) == 0) {
801 if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cert_file) == 0) {
802 ast_log(LOG_WARNING, "TLS/SSL error loading public %s key (certificate) from <%s>.\n", key_type, cert_file);
803 } else if (SSL_CTX_use_PrivateKey_file(cfg->ssl_ctx, cert_file, SSL_FILETYPE_PEM) == 0) {
804 ast_log(LOG_WARNING, "TLS/SSL error loading private %s key from <%s>.\n", key_type, cert_file);
805 } else if (SSL_CTX_check_private_key(cfg->ssl_ctx) == 0) {
806 ast_log(LOG_WARNING, "TLS/SSL error matching private %s key and certificate in <%s>.\n", key_type, cert_file);
812 static int __ssl_setup(struct ast_tls_config *cfg, int client)
824 /* Get rid of an old SSL_CTX since we're about to
828 SSL_CTX_free(cfg->ssl_ctx);
833 #ifndef OPENSSL_NO_SSL2
834 if (ast_test_flag(&cfg->flags, AST_SSL_SSLV2_CLIENT)) {
835 ast_log(LOG_WARNING, "Usage of SSLv2 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
836 cfg->ssl_ctx = SSL_CTX_new(SSLv2_client_method());
839 #ifndef OPENSSL_NO_SSL3_METHOD
840 if (ast_test_flag(&cfg->flags, AST_SSL_SSLV3_CLIENT)) {
841 ast_log(LOG_WARNING, "Usage of SSLv3 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
842 cfg->ssl_ctx = SSL_CTX_new(SSLv3_client_method());
845 if (ast_test_flag(&cfg->flags, AST_SSL_TLSV1_CLIENT)) {
846 cfg->ssl_ctx = SSL_CTX_new(TLSv1_client_method());
849 cfg->ssl_ctx = SSL_CTX_new(SSLv23_client_method());
853 cfg->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
857 ast_debug(1, "Sorry, SSL_CTX_new call returned null...\n");
862 /* Due to the POODLE vulnerability, completely disable
863 * SSLv2 and SSLv3 if we are not explicitly told to use
864 * them. SSLv23_*_method supports TLSv1+.
869 ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
870 SSL_CTX_set_options(cfg->ssl_ctx, ssl_opts);
873 SSL_CTX_set_verify(cfg->ssl_ctx,
874 ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE,
877 if (!ast_strlen_zero(cfg->certfile)) {
878 char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile;
879 if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cfg->certfile) == 0) {
881 /* Clients don't need a certificate, but if its setup we can use it */
882 ast_log(LOG_ERROR, "TLS/SSL error loading cert file. <%s>\n", cfg->certfile);
884 SSL_CTX_free(cfg->ssl_ctx);
889 if ((SSL_CTX_use_PrivateKey_file(cfg->ssl_ctx, tmpprivate, SSL_FILETYPE_PEM) == 0) || (SSL_CTX_check_private_key(cfg->ssl_ctx) == 0 )) {
891 /* Clients don't need a private key, but if its setup we can use it */
892 ast_log(LOG_ERROR, "TLS/SSL error loading private key file. <%s>\n", tmpprivate);
894 SSL_CTX_free(cfg->ssl_ctx);
900 size_t certfile_len = strlen(cfg->certfile);
902 /* expects a file name which contains _rsa. like asterisk_rsa.pem
903 * ignores any 3-character file-extension like .pem, .cer, .crt
905 if (certfile_len >= 8 && !strncmp(cfg->certfile + certfile_len - 8, "_rsa.", 5)) {
906 __ssl_setup_certs(cfg, certfile_len, "_ecc.", "ECC");
907 __ssl_setup_certs(cfg, certfile_len, "_dsa.", "DSA");
911 if (!ast_strlen_zero(cfg->cipher)) {
912 if (SSL_CTX_set_cipher_list(cfg->ssl_ctx, cfg->cipher) == 0 ) {
914 ast_log(LOG_ERROR, "TLS/SSL cipher error <%s>\n", cfg->cipher);
916 SSL_CTX_free(cfg->ssl_ctx);
922 if (!ast_strlen_zero(cfg->cafile) || !ast_strlen_zero(cfg->capath)) {
923 if (SSL_CTX_load_verify_locations(cfg->ssl_ctx, S_OR(cfg->cafile, NULL), S_OR(cfg->capath,NULL)) == 0) {
924 ast_log(LOG_ERROR, "TLS/SSL CA file(%s)/path(%s) error\n", cfg->cafile, cfg->capath);
928 #ifdef HAVE_OPENSSL_EC
930 if (!ast_strlen_zero(cfg->pvtfile)) {
931 BIO *bio = BIO_new_file(cfg->pvtfile, "r");
933 DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
935 if (SSL_CTX_set_tmp_dh(cfg->ssl_ctx, dh)) {
936 long options = SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE;
937 options = SSL_CTX_set_options(cfg->ssl_ctx, options);
938 ast_verb(2, "TLS/SSL DH initialized, PFS cipher-suites enabled\n");
945 #ifndef SSL_CTRL_SET_ECDH_AUTO
946 #define SSL_CTRL_SET_ECDH_AUTO 94
948 /* SSL_CTX_set_ecdh_auto(cfg->ssl_ctx, on); requires OpenSSL 1.0.2 which wraps: */
949 if (SSL_CTX_ctrl(cfg->ssl_ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL)) {
950 ast_verb(2, "TLS/SSL ECDH initialized (automatic), faster PFS ciphers enabled\n");
952 /* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
953 EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
955 if (SSL_CTX_set_tmp_ecdh(cfg->ssl_ctx, ecdh)) {
956 ast_verb(2, "TLS/SSL ECDH initialized (secp256r1), faster PFS cipher-suites enabled\n");
962 #endif /* #ifdef HAVE_OPENSSL_EC */
964 ast_verb(2, "TLS/SSL certificate ok\n"); /* We should log which one that is ok. This message doesn't really make sense in production use */
969 int ast_ssl_setup(struct ast_tls_config *cfg)
971 return __ssl_setup(cfg, 0);
974 void ast_ssl_teardown(struct ast_tls_config *cfg)
978 SSL_CTX_free(cfg->ssl_ctx);
984 struct ast_tcptls_session_instance *ast_tcptls_client_start(struct ast_tcptls_session_instance *tcptls_session)
986 struct ast_tcptls_session_args *desc;
989 if (!(desc = tcptls_session->parent)) {
990 goto client_start_error;
993 if (ast_connect(desc->accept_fd, &desc->remote_address)) {
994 ast_log(LOG_ERROR, "Unable to connect %s to %s: %s\n",
996 ast_sockaddr_stringify(&desc->remote_address),
998 goto client_start_error;
1001 flags = fcntl(desc->accept_fd, F_GETFL);
1002 fcntl(desc->accept_fd, F_SETFL, flags & ~O_NONBLOCK);
1004 if (desc->tls_cfg) {
1005 desc->tls_cfg->enabled = 1;
1006 __ssl_setup(desc->tls_cfg, 1);
1009 return handle_tcptls_connection(tcptls_session);
1013 close(desc->accept_fd);
1014 desc->accept_fd = -1;
1016 ao2_ref(tcptls_session, -1);
1021 struct ast_tcptls_session_instance *ast_tcptls_client_create(struct ast_tcptls_session_args *desc)
1024 struct ast_tcptls_session_instance *tcptls_session = NULL;
1026 /* Do nothing if nothing has changed */
1027 if (!ast_sockaddr_cmp(&desc->old_address, &desc->remote_address)) {
1028 ast_debug(1, "Nothing changed in %s\n", desc->name);
1032 /* If we return early, there is no connection */
1033 ast_sockaddr_setnull(&desc->old_address);
1035 if (desc->accept_fd != -1) {
1036 close(desc->accept_fd);
1039 desc->accept_fd = socket(ast_sockaddr_is_ipv6(&desc->remote_address) ?
1040 AF_INET6 : AF_INET, SOCK_STREAM, IPPROTO_TCP);
1041 if (desc->accept_fd < 0) {
1042 ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n",
1043 desc->name, strerror(errno));
1047 /* if a local address was specified, bind to it so the connection will
1048 originate from the desired address */
1049 if (!ast_sockaddr_isnull(&desc->local_address)) {
1050 setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
1051 if (ast_bind(desc->accept_fd, &desc->local_address)) {
1052 ast_log(LOG_ERROR, "Unable to bind %s to %s: %s\n",
1054 ast_sockaddr_stringify(&desc->local_address),
1060 if (!(tcptls_session = ao2_alloc(sizeof(*tcptls_session), session_instance_destructor))) {
1064 tcptls_session->overflow_buf = ast_str_create(128);
1065 tcptls_session->client = 1;
1066 tcptls_session->fd = desc->accept_fd;
1067 tcptls_session->parent = desc;
1068 tcptls_session->parent->worker_fn = NULL;
1069 ast_sockaddr_copy(&tcptls_session->remote_address,
1070 &desc->remote_address);
1072 /* Set current info */
1073 ast_sockaddr_copy(&desc->old_address, &desc->remote_address);
1074 return tcptls_session;
1077 close(desc->accept_fd);
1078 desc->accept_fd = -1;
1079 if (tcptls_session) {
1080 ao2_ref(tcptls_session, -1);
1085 void ast_tcptls_server_start(struct ast_tcptls_session_args *desc)
1090 /* Do nothing if nothing has changed */
1091 if (!ast_sockaddr_cmp(&desc->old_address, &desc->local_address)) {
1092 ast_debug(1, "Nothing changed in %s\n", desc->name);
1096 /* If we return early, there is no one listening */
1097 ast_sockaddr_setnull(&desc->old_address);
1099 /* Shutdown a running server if there is one */
1100 if (desc->master != AST_PTHREADT_NULL) {
1101 pthread_cancel(desc->master);
1102 pthread_kill(desc->master, SIGURG);
1103 pthread_join(desc->master, NULL);
1106 if (desc->accept_fd != -1) {
1107 close(desc->accept_fd);
1110 /* If there's no new server, stop here */
1111 if (ast_sockaddr_isnull(&desc->local_address)) {
1112 ast_debug(2, "Server disabled: %s\n", desc->name);
1116 desc->accept_fd = socket(ast_sockaddr_is_ipv6(&desc->local_address) ?
1117 AF_INET6 : AF_INET, SOCK_STREAM, 0);
1118 if (desc->accept_fd < 0) {
1119 ast_log(LOG_ERROR, "Unable to allocate socket for %s: %s\n", desc->name, strerror(errno));
1123 setsockopt(desc->accept_fd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof(x));
1124 if (ast_bind(desc->accept_fd, &desc->local_address)) {
1125 ast_log(LOG_ERROR, "Unable to bind %s to %s: %s\n",
1127 ast_sockaddr_stringify(&desc->local_address),
1131 if (listen(desc->accept_fd, 10)) {
1132 ast_log(LOG_ERROR, "Unable to listen for %s!\n", desc->name);
1135 flags = fcntl(desc->accept_fd, F_GETFL);
1136 fcntl(desc->accept_fd, F_SETFL, flags | O_NONBLOCK);
1137 if (ast_pthread_create_background(&desc->master, NULL, desc->accept_fn, desc)) {
1138 ast_log(LOG_ERROR, "Unable to launch thread for %s on %s: %s\n",
1140 ast_sockaddr_stringify(&desc->local_address),
1145 /* Set current info */
1146 ast_sockaddr_copy(&desc->old_address, &desc->local_address);
1151 close(desc->accept_fd);
1152 desc->accept_fd = -1;
1155 void ast_tcptls_close_session_file(struct ast_tcptls_session_instance *tcptls_session)
1157 if (tcptls_session->f) {
1158 fflush(tcptls_session->f);
1159 if (fclose(tcptls_session->f)) {
1160 ast_log(LOG_ERROR, "fclose() failed: %s\n", strerror(errno));
1162 tcptls_session->f = NULL;
1163 tcptls_session->fd = -1;
1164 } else if (tcptls_session->fd != -1) {
1166 * Issuing shutdown() is necessary here to avoid a race
1167 * condition where the last data written may not appear
1168 * in the TCP stream. See ASTERISK-23548
1170 shutdown(tcptls_session->fd, SHUT_RDWR);
1171 if (close(tcptls_session->fd)) {
1172 ast_log(LOG_ERROR, "close() failed: %s\n", strerror(errno));
1174 tcptls_session->fd = -1;
1176 ast_log(LOG_ERROR, "ast_tcptls_close_session_file invoked on session instance without file or file descriptor\n");
1180 void ast_tcptls_server_stop(struct ast_tcptls_session_args *desc)
1182 if (desc->master != AST_PTHREADT_NULL) {
1183 pthread_cancel(desc->master);
1184 pthread_kill(desc->master, SIGURG);
1185 pthread_join(desc->master, NULL);
1186 desc->master = AST_PTHREADT_NULL;
1188 if (desc->accept_fd != -1) {
1189 close(desc->accept_fd);
1191 desc->accept_fd = -1;
1192 ast_debug(2, "Stopped server :: %s\n", desc->name);
1195 int ast_tls_read_conf(struct ast_tls_config *tls_cfg, struct ast_tcptls_session_args *tls_desc, const char *varname, const char *value)
1197 if (!strcasecmp(varname, "tlsenable") || !strcasecmp(varname, "sslenable")) {
1198 tls_cfg->enabled = ast_true(value) ? 1 : 0;
1199 } else if (!strcasecmp(varname, "tlscertfile") || !strcasecmp(varname, "sslcert") || !strcasecmp(varname, "tlscert")) {
1200 ast_free(tls_cfg->certfile);
1201 tls_cfg->certfile = ast_strdup(value);
1202 } else if (!strcasecmp(varname, "tlsprivatekey") || !strcasecmp(varname, "sslprivatekey")) {
1203 ast_free(tls_cfg->pvtfile);
1204 tls_cfg->pvtfile = ast_strdup(value);
1205 } else if (!strcasecmp(varname, "tlscipher") || !strcasecmp(varname, "sslcipher")) {
1206 ast_free(tls_cfg->cipher);
1207 tls_cfg->cipher = ast_strdup(value);
1208 } else if (!strcasecmp(varname, "tlscafile")) {
1209 ast_free(tls_cfg->cafile);
1210 tls_cfg->cafile = ast_strdup(value);
1211 } else if (!strcasecmp(varname, "tlscapath") || !strcasecmp(varname, "tlscadir")) {
1212 ast_free(tls_cfg->capath);
1213 tls_cfg->capath = ast_strdup(value);
1214 } else if (!strcasecmp(varname, "tlsverifyclient")) {
1215 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_VERIFY_CLIENT);
1216 } else if (!strcasecmp(varname, "tlsdontverifyserver")) {
1217 ast_set2_flag(&tls_cfg->flags, ast_true(value), AST_SSL_DONT_VERIFY_SERVER);
1218 } else if (!strcasecmp(varname, "tlsbindaddr") || !strcasecmp(varname, "sslbindaddr")) {
1219 if (ast_parse_arg(value, PARSE_ADDR, &tls_desc->local_address))
1220 ast_log(LOG_ERROR, "Invalid %s '%s'\n", varname, value);
1221 } else if (!strcasecmp(varname, "tlsclientmethod") || !strcasecmp(varname, "sslclientmethod")) {
1222 if (!strcasecmp(value, "tlsv1")) {
1223 ast_set_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1224 ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
1225 ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1226 } else if (!strcasecmp(value, "sslv3")) {
1227 ast_set_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);
1228 ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1229 ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1230 } else if (!strcasecmp(value, "sslv2")) {
1231 ast_set_flag(&tls_cfg->flags, AST_SSL_SSLV2_CLIENT);
1232 ast_clear_flag(&tls_cfg->flags, AST_SSL_TLSV1_CLIENT);
1233 ast_clear_flag(&tls_cfg->flags, AST_SSL_SSLV3_CLIENT);