Skip to content

Commit 182f913

Browse files
jesjes
committed
Gate TLS hostname verification behind 'verify_hostname' config param
1 parent 06ded3a commit 182f913

9 files changed

+55
-9
lines changed

‎modules/tls_mgm/tls_config.c

+3
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ int tls_default_method = TLS_USE_SSLv23;
4949
int tls_verify_client_cert = 1;
5050
int tls_verify_server_cert = 1;
5151
int tls_require_client_cert = 1;
52+
/* disable hostname verification by default */
53+
int tls_verify_hostname = 0;
5254
/* disable CRL validation for all the certificates from the chain */
5355
int crl_check_all = 0;
5456
/* default location of certificates */
@@ -70,6 +72,7 @@ str match_address_col = str_init("match_ip_address");
7072
str match_domain_col = str_init("match_sip_domain");
7173
str method_col = str_init("method");
7274
str verify_cert_col = str_init("verify_cert");
75+
str verify_hostname_col = str_init("verify_hostname");
7376
str require_cert_col = str_init("require_cert");
7477
str certificate_col = str_init("certificate");
7578
str pk_col = str_init("private_key");

‎modules/tls_mgm/tls_config.h

+3-1
Original file line numberDiff line numberDiff line change
@@ -38,13 +38,14 @@
3838
#include "tls_config_helper.h"
3939
#include "../../str.h"
4040

41-
#define TLS_TABLE_VERSION 3
41+
#define TLS_TABLE_VERSION 4
4242

4343
extern int tls_default_method;
4444

4545
extern int tls_verify_client_cert;
4646
extern int tls_verify_server_cert;
4747
extern int tls_require_client_cert;
48+
extern int tls_verify_hostname;
4849
extern int crl_check_all;
4950
extern char *tls_cert_file;
5051
extern char *tls_pkey_file;
@@ -63,6 +64,7 @@ extern str match_domain_col;
6364
extern str method_col;
6465
extern str verify_cert_col;
6566
extern str require_cert_col;
67+
extern str verify_hostname_col;
6668
extern str certificate_col;
6769
extern str pk_col;
6870
extern str crl_check_col;

‎modules/tls_mgm/tls_domain.c

+6
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,10 @@ int set_all_domain_attr(struct tls_domain **dom, char **str_vals, int *int_vals,
243243
d->require_client_cert = int_vals[INT_VALS_REQUIRE_CERT_COL];
244244
}
245245

246+
if (int_vals[INT_VALS_VERIFY_HOSTNAME_COL] != -1) {
247+
d->verify_hostname = int_vals[INT_VALS_VERIFY_HOSTNAME_COL];
248+
}
249+
246250
p = (char *) (d + 1);
247251

248252
d->name.s = p;
@@ -537,9 +541,11 @@ int tls_new_domain(str *name, int type, struct tls_domain **dom)
537541
if (type == DOM_FLAG_SRV) {
538542
d->verify_cert = tls_verify_client_cert;
539543
d->require_client_cert = tls_require_client_cert;
544+
d->verify_hostname = 0;
540545
} else {
541546
d->verify_cert = tls_verify_server_cert;
542547
d->require_client_cert = 0;
548+
d->verify_hostname = tls_verify_hostname;
543549
}
544550
d->method = TLS_METHOD_UNSPEC;
545551

‎modules/tls_mgm/tls_domain.h

+3-2
Original file line numberDiff line numberDiff line change
@@ -59,13 +59,14 @@
5959
#define STR_VALS_CPLIST_COL 6
6060
#define STR_VALS_ECCURVE_COL 7
6161

62-
#define NO_INT_VALS 5
62+
#define NO_INT_VALS 6
6363

6464
#define INT_VALS_ID_COL 0
6565
#define INT_VALS_TYPE_COL 1
6666
#define INT_VALS_VERIFY_CERT_COL 2
6767
#define INT_VALS_REQUIRE_CERT_COL 3
6868
#define INT_VALS_CRL_CHECK_COL 4
69+
#define INT_VALS_VERIFY_HOSTNAME_COL 5
6970

7071
#define NO_BLOB_VALS 4
7172

@@ -74,7 +75,7 @@
7475
#define BLOB_VALS_CALIST_COL 2
7576
#define BLOB_VALS_DHPARAMS_COL 3
7677

77-
#define NO_DB_COLS 17
78+
#define NO_DB_COLS 18
7879

7980
#define CLIENT_DOMAIN_TYPE 1
8081
#define SERVER_DOMAIN_TYPE 2

‎modules/tls_mgm/tls_helper.h

+1
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ struct tls_domain {
8282
void *ctx; /* openssl's SSL_CTX or wolfSSL's WOLFSSL_CTX */
8383
int ctx_no; /* number of allocated contexts */
8484
int verify_cert;
85+
int verify_hostname;
8586
int require_client_cert;
8687
int crl_check_all;
8788
str cert;

‎modules/tls_mgm/tls_mgm.c

+11-1
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ static const param_export_t params[] = {
124124
{ "tls_method", STR_PARAM|USE_FUNC_PARAM, (void*)tlsp_set_method },
125125
{ "verify_cert", STR_PARAM|USE_FUNC_PARAM, (void*)tlsp_set_verify },
126126
{ "require_cert", STR_PARAM|USE_FUNC_PARAM, (void*)tlsp_set_require },
127+
{ "verify_hostname", STR_PARAM|USE_FUNC_PARAM, (void*)tlsp_set_verify_hostname },
127128
{ "certificate", STR_PARAM|USE_FUNC_PARAM, (void*)tlsp_set_certificate},
128129
{ "private_key", STR_PARAM|USE_FUNC_PARAM, (void*)tlsp_set_pk },
129130
{ "crl_check_all", STR_PARAM|USE_FUNC_PARAM, (void*)tlsp_set_crl_check },
@@ -141,6 +142,7 @@ static const param_export_t params[] = {
141142
{ "tls_method_col", STR_PARAM, &method_col.s },
142143
{ "verify_cert_col", STR_PARAM, &verify_cert_col.s },
143144
{ "require_cert_col", STR_PARAM, &require_cert_col.s },
145+
{ "verify_hostname_col", STR_PARAM, &verify_hostname_col.s },
144146
{ "certificate_col", STR_PARAM, &certificate_col.s },
145147
{ "private_key_col", STR_PARAM, &pk_col.s },
146148
{ "crl_check_all_col", STR_PARAM, &crl_check_col.s },
@@ -417,6 +419,7 @@ int load_info(struct tls_domain **serv_dom, struct tls_domain **cli_dom,
417419
columns[14] = &cplist_col;
418420
columns[15] = &dhparams_col;
419421
columns[16] = &eccurve_col;
422+
columns[17] = &verify_hostname_col;
420423

421424
/* checking if the table version is up to date*/
422425
if (db_check_table_version(&dr_dbf, db_hdl, &tls_db_table, TLS_TABLE_VERSION) != 0)
@@ -435,7 +438,7 @@ int load_info(struct tls_domain **serv_dom, struct tls_domain **cli_dom,
435438
goto error;
436439
}
437440
no_rows = estimate_available_rows(4 + 45 + 4 + 45 + 4 + 4 + 45 +
438-
45 + 4 + 45 + 45 + 4 * 4096, db_cols);
441+
45 + 4 + 45 + 45 + 4 * 4096 + 4, db_cols);
439442
if (no_rows == 0) no_rows = 5;
440443
if (dr_dbf.fetch_result(db_hdl, &res, no_rows) < 0) {
441444
LM_ERR("Error fetching rows\n");
@@ -517,6 +520,9 @@ int load_info(struct tls_domain **serv_dom, struct tls_domain **cli_dom,
517520
check_val(eccurve_col, ROW_VALUES(row) + 16, DB_STRING, 0, 0);
518521
str_vals[STR_VALS_ECCURVE_COL] = (char *) VAL_STRING(ROW_VALUES(row) + 16);
519522

523+
check_val(verify_hostname_col, ROW_VALUES(row) + 17, DB_INT, 0, 0);
524+
int_vals[INT_VALS_VERIFY_HOSTNAME_COL] = VAL_INT(ROW_VALUES(row) + 17);
525+
520526
if (db_add_domain(str_vals, int_vals, blob_vals, serv_dom, cli_dom,
521527
script_srv_doms, script_cli_doms) < 0) {
522528
if (str_vals[STR_VALS_DOMAIN_COL])
@@ -994,6 +1000,7 @@ static int mod_init(void) {
9941000
method_col.len = strlen(method_col.s);
9951001
verify_cert_col.len = strlen(verify_cert_col.s);
9961002
require_cert_col.len = strlen(require_cert_col.s);
1003+
verify_hostname_col.len = strlen(verify_hostname_col.s);
9971004
certificate_col.len = strlen(certificate_col.s);
9981005
pk_col.len = strlen(pk_col.s);
9991006
crl_check_col.len = strlen(crl_check_col.s);
@@ -1253,6 +1260,9 @@ static int list_domain(mi_item_t *domains_arr, struct tls_domain *d)
12531260
if (add_mi_bool(domain_item, MI_SSTR("REQ_CLI_CERT"), d->require_client_cert) < 0)
12541261
goto error;
12551262

1263+
if (add_mi_bool(domain_item, MI_SSTR("VERIFY_HOSTNAME"), d->verify_hostname) < 0)
1264+
goto error;
1265+
12561266
if (add_mi_bool(domain_item, MI_SSTR("CRL_CHECKALL"), d->crl_check_all) < 0)
12571267
goto error;
12581268

‎modules/tls_mgm/tls_params.c

+19
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,25 @@ int tlsp_set_require(modparam_t type, void *in)
262262
return 1;
263263
}
264264

265+
int tlsp_set_verify_hostname(modparam_t type, void *in)
266+
{
267+
str name;
268+
str val;
269+
unsigned int verify;
270+
271+
if (split_param_val((char*)in, &name, &val) < 0)
272+
return -1;
273+
274+
if (str2int(&val, &verify)!=0) {
275+
LM_ERR("option is not a number [%s]\n",val.s);
276+
return -1;
277+
}
278+
279+
set_domain_attr(name, verify_hostname, verify);
280+
281+
return 1;
282+
}
283+
265284
int tlsp_set_crl_check(modparam_t type, void *in)
266285
{
267286
str name;

‎modules/tls_mgm/tls_params.h

+2
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ int tlsp_set_verify(modparam_t type, void *val);
5757

5858
int tlsp_set_require(modparam_t type, void *val);
5959

60+
int tlsp_set_verify_hostname(modparam_t type, void *val);
61+
6062
int tlsp_set_crl_check(modparam_t type, void *val);
6163

6264
int tlsp_set_certificate(modparam_t type, void *val);

‎modules/tls_openssl/openssl_conn_ops.c

+7-5
Original file line numberDiff line numberDiff line change
@@ -221,11 +221,13 @@ int openssl_tls_conn_init(struct tcp_connection* c, struct tls_domain *tls_dom)
221221
return -1;
222222
}
223223

224-
param = SSL_get0_param(c->extra_data);
225-
X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
226-
if (!X509_VERIFY_PARAM_set1_host(param, c->hostname, strlen(c->hostname))) {
227-
LM_ERR("failed to set hostname for SSL context\n");
228-
return -1;
224+
if (tls_dom->verify_hostname) {
225+
param = SSL_get0_param(c->extra_data);
226+
X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
227+
if (!X509_VERIFY_PARAM_set1_host(param, c->hostname, strlen(c->hostname))) {
228+
LM_ERR("failed to set hostname for SSL context\n");
229+
return -1;
230+
}
229231
}
230232

231233
/* put pointers to the tcp_connection and tls_domain structs

0 commit comments

Comments
 (0)