[asterisk-bugs] [JIRA] (ASTERISK-21894) [patch] Initial support for SIP/TLS tlsverifyclient

[Serhij Stasyuk (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-21894?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=207233#comment-207233 ] 

Serhij Stasyuk commented on ASTERISK-21894:
-------------------------------------------

> why are we including large swathes from OpenSSL?

OpenSSL version 1.0.2 is not released yet, it is available only from SVN (version number is already defined in it). I'm not sure what version it will be exactly and when it will be released.

> Additionally, code submitted to Asterisk should use the standard Asterisk preamble.
I've already commented it if you are talking about "2.2. File structure and header inclusion". If it is about something else please point me to the guide or note.

Thanks for your comments and in advance for more help from you :)
                
> [patch] Initial support for SIP/TLS tlsverifyclient
> ---------------------------------------------------
>
>                 Key: ASTERISK-21894
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-21894
>             Project: Asterisk
>          Issue Type: New Feature
>      Security Level: None
>          Components: Channels/chan_sip/TCP-TLS
>    Affects Versions: SVN, 11.4.0
>            Reporter: Serhij Stasyuk
>         Attachments: asterisk-trunk-siptls.patch
>
>
> Here is initial support for tlsverifyclient for sip channels.
> Now it "works" only for peers. RFC 5922 http://tools.ietf.org/html/rfc5922 requires server to compare domain name with SIP headers. This is not done yet.
> The very first thing that is verified during mutual TLS verification on server side is certificate exchange. OpenSSL handles all certificate-related tasks but it does not verify CN and subjectAltName against desired one.
> Desired name (SIP) is not exactly available at the moment of SSL session establishment, so the only name we can use is host peer field from config. This comparison is done by this patch.
> I'm not sure what is the reason of disabling wildcard certificate matching required by Section 7.2 of RFC 5922 <http://tools.ietf.org/html/rfc5922#section-7.2> Wildcard certificate is very convenient mechanism for some deployment schemes and is adopted by customers and service providers and I see no reason to restrict their usage here. If it is required, configuration option can be introduced, like tlsallowwildcards. Patch can be easily adopted to it instead of constant.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira