[asterisk-bugs] [JIRA] (ASTERISK-21894) [patch] Initial support for SIP/TLS tlsverifyclient

[Joshua Colp (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-21894?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Joshua Colp updated ASTERISK-21894:
-----------------------------------

    Affects Version/s: 13.18.4

> [patch] Initial support for SIP/TLS tlsverifyclient
> ---------------------------------------------------
>
>                 Key: ASTERISK-21894
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-21894
>             Project: Asterisk
>          Issue Type: New Feature
>      Security Level: None
>          Components: Channels/chan_sip/TCP-TLS
>    Affects Versions: SVN, 11.4.0, 13.18.4
>            Reporter: Serhij Stasyuk
>         Attachments: asterisk-trunk-siptls.patch
>
>
> Here is initial support for tlsverifyclient for sip channels.
> Now it "works" only for peers. RFC 5922 http://tools.ietf.org/html/rfc5922 requires server to compare domain name with SIP headers. This is not done yet.
> The very first thing that is verified during mutual TLS verification on server side is certificate exchange. OpenSSL handles all certificate-related tasks but it does not verify CN and subjectAltName against desired one.
> Desired name (SIP) is not exactly available at the moment of SSL session establishment, so the only name we can use is host peer field from config. This comparison is done by this patch.
> I'm not sure what is the reason of disabling wildcard certificate matching required by Section 7.2 of RFC 5922 <http://tools.ietf.org/html/rfc5922#section-7.2> Wildcard certificate is very convenient mechanism for some deployment schemes and is adopted by customers and service providers and I see no reason to restrict their usage here. If it is required, configuration option can be introduced, like tlsallowwildcards. Patch can be easily adopted to it instead of constant.



--
This message was sent by Atlassian JIRA
(v6.2#6252)