[asterisk-commits] mmichelson: branch 10 r353820 - in /branches/10: ./ configs/ include/asterisk...

SVN commits to the Asterisk project asterisk-commits at lists.digium.com
Thu Feb 2 12:48:10 CST 2012


Author: mmichelson
Date: Thu Feb  2 12:48:05 2012
New Revision: 353820

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=353820
Log:
Fix TLS port binding behavior as well as reload behavior:

* Removes references to tlsbindport from http.conf.sample and manager.conf.sample
* Properly bind to port specified in tlsbindaddr, using the default port if specified.
* On a reload, properly close socket if the service has been disabled.

A note has been added to UPGRADE.txt to indicate how ports must be set for TLS.

(closes issue ASTERISK-16959)
reported by Olaf Holthausen

(closes issue ASTERISK-19201)
reported by Chris Mylonas

(closes issue ASTERISK-19204)
reported by Chris Mylonas

Review: https://reviewboard.asterisk.org/r/1709
........

Merged revisions 353770 from http://svn.asterisk.org/svn/asterisk/branches/1.8

Modified:
    branches/10/   (props changed)
    branches/10/configs/http.conf.sample
    branches/10/configs/manager.conf.sample
    branches/10/include/asterisk/manager.h
    branches/10/main/http.c
    branches/10/main/manager.c

Propchange: branches/10/
------------------------------------------------------------------------------
Binary property 'branch-1.8-merged' - no diff available.

Modified: branches/10/configs/http.conf.sample
URL: http://svnview.digium.com/svn/asterisk/branches/10/configs/http.conf.sample?view=diff&rev=353820&r1=353819&r2=353820
==============================================================================
--- branches/10/configs/http.conf.sample (original)
+++ branches/10/configs/http.conf.sample Thu Feb  2 12:48:05 2012
@@ -56,8 +56,7 @@
 ; explicitly enable tls, define the port to use,
 ; and have a certificate somewhere.
 ;tlsenable=yes          ; enable tls - default no.
-;tlsbindport=4433       ; port to use - default is 8089
-;tlsbindaddr=0.0.0.0    ; address to bind to - default is bindaddr.
+;tlsbindaddr=0.0.0.0:8089    ; address and port to bind to - default is bindaddr and port 8089.
 ;
 ;tlscertfile=</path/to/certificate.pem>  ; path to the certificate file (*.pem) only.
 ;tlsprivatekey=</path/to/private.pem>    ; path to private key file (*.pem) only.

Modified: branches/10/configs/manager.conf.sample
URL: http://svnview.digium.com/svn/asterisk/branches/10/configs/manager.conf.sample?view=diff&rev=353820&r1=353819&r2=353820
==============================================================================
--- branches/10/configs/manager.conf.sample (original)
+++ branches/10/configs/manager.conf.sample Thu Feb  2 12:48:05 2012
@@ -33,8 +33,7 @@
 ;	openssl s_client -connect my_host:5039
 ;
 ;tlsenable=no		; set to YES to enable it
-;tlsbindport=5039		; the port to bind to
-;tlsbindaddr=0.0.0.0		; address to bind to, default to bindaddr
+;tlsbindaddr=0.0.0.0:5039		; address and port to bind to, default to bindaddr and port 5039
 ;tlscertfile=/tmp/asterisk.pem	; path to the certificate.
 ;tlsprivatekey=/tmp/private.pem ; path to the private key, if no private given,
                                 ; if no tlsprivatekey is given, default is to search

Modified: branches/10/include/asterisk/manager.h
URL: http://svnview.digium.com/svn/asterisk/branches/10/include/asterisk/manager.h?view=diff&rev=353820&r1=353819&r2=353820
==============================================================================
--- branches/10/include/asterisk/manager.h (original)
+++ branches/10/include/asterisk/manager.h Thu Feb  2 12:48:05 2012
@@ -56,6 +56,7 @@
 
 #define AMI_VERSION                     "1.2"
 #define DEFAULT_MANAGER_PORT 5038	/* Default port for Asterisk management via TCP */
+#define DEFAULT_MANAGER_TLS_PORT 5039	/* Default port for Asterisk management via TCP */
 
 /*! \name Constant return values
  *\note Currently, returning anything other than zero causes the session to terminate.

Modified: branches/10/main/http.c
URL: http://svnview.digium.com/svn/asterisk/branches/10/main/http.c?view=diff&rev=353820&r1=353819&r2=353820
==============================================================================
--- branches/10/main/http.c (original)
+++ branches/10/main/http.c Thu Feb  2 12:48:05 2012
@@ -1005,13 +1005,15 @@
 	uint32_t bindport = DEFAULT_PORT;
 	struct ast_sockaddr *addrs = NULL;
 	int num_addrs = 0;
+	int http_tls_was_enabled = 0;
 
 	cfg = ast_config_load2("http.conf", "http", config_flags);
 	if (cfg == CONFIG_STATUS_FILEMISSING || cfg == CONFIG_STATUS_FILEUNCHANGED || cfg == CONFIG_STATUS_FILEINVALID) {
 		return 0;
 	}
 
-	/* default values */
+	http_tls_was_enabled = (reload && http_tls_cfg.enabled);
+
 	http_tls_cfg.enabled = 0;
 	if (http_tls_cfg.certfile) {
 		ast_free(http_tls_cfg.certfile);
@@ -1033,6 +1035,8 @@
 		ast_free(redirect);
 	}
 	AST_RWLIST_UNLOCK(&uri_redirects);
+
+	ast_sockaddr_setnull(&https_desc.local_address);
 
 	if (cfg) {
 		v = ast_variable_browse(cfg, "general");
@@ -1113,8 +1117,9 @@
 			ast_sockaddr_set_port(&https_desc.local_address, DEFAULT_TLS_PORT);
 		}
 	}
-
-	if (enabled && !ast_sockaddr_isnull(&https_desc.local_address)) {
+	if (http_tls_was_enabled && !http_tls_cfg.enabled) {
+		ast_tcptls_server_stop(&https_desc);
+	} else if (http_tls_cfg.enabled && !ast_sockaddr_isnull(&https_desc.local_address)) {
 		/* We can get here either because a TLS-specific address was specified
 		 * or because we copied the non-TLS address here. In the case where
 		 * we read an explicit address from the config, there may have been

Modified: branches/10/main/manager.c
URL: http://svnview.digium.com/svn/asterisk/branches/10/main/manager.c?view=diff&rev=353820&r1=353819&r2=353820
==============================================================================
--- branches/10/main/manager.c (original)
+++ branches/10/main/manager.c Thu Feb  2 12:48:05 2012
@@ -6635,6 +6635,7 @@
 	char a1_hash[256];
 	struct sockaddr_in ami_desc_local_address_tmp = { 0, };
 	struct sockaddr_in amis_desc_local_address_tmp = { 0, };
+	int tls_was_enabled = 0;
 
 	manager_enabled = 0;
 
@@ -6698,10 +6699,15 @@
 
 	/* default values */
 	ast_copy_string(global_realm, S_OR(ast_config_AST_SYSTEM_NAME, DEFAULT_REALM), sizeof(global_realm));
-	memset(&ami_desc.local_address, 0, sizeof(struct sockaddr_in));
-	memset(&amis_desc.local_address, 0, sizeof(amis_desc.local_address));
-	amis_desc_local_address_tmp.sin_port = htons(5039);
+	ast_sockaddr_setnull(&ami_desc.local_address);
+	ast_sockaddr_setnull(&amis_desc.local_address);
+
+	ami_desc_local_address_tmp.sin_family = AF_INET;
+	amis_desc_local_address_tmp.sin_family = AF_INET;
+
 	ami_desc_local_address_tmp.sin_port = htons(DEFAULT_MANAGER_PORT);
+
+	tls_was_enabled = (reload && ami_tls_cfg.enabled);
 
 	ami_tls_cfg.enabled = 0;
 	if (ami_tls_cfg.certfile) {
@@ -6776,13 +6782,16 @@
 		}
 	}
 
-	ami_desc_local_address_tmp.sin_family = AF_INET;
-	amis_desc_local_address_tmp.sin_family = AF_INET;
+	ast_sockaddr_to_sin(&amis_desc.local_address, &amis_desc_local_address_tmp);
 
 	/* if the amis address has not been set, default is the same as non secure ami */
 	if (!amis_desc_local_address_tmp.sin_addr.s_addr) {
 		amis_desc_local_address_tmp.sin_addr =
 		    ami_desc_local_address_tmp.sin_addr;
+	}
+
+	if (!amis_desc_local_address_tmp.sin_port) {
+		amis_desc_local_address_tmp.sin_port = htons(DEFAULT_MANAGER_TLS_PORT);
 	}
 
 	if (manager_enabled) {
@@ -7021,7 +7030,9 @@
 	manager_event(EVENT_FLAG_SYSTEM, "Reload", "Module: Manager\r\nStatus: %s\r\nMessage: Manager reload Requested\r\n", manager_enabled ? "Enabled" : "Disabled");
 
 	ast_tcptls_server_start(&ami_desc);
-	if (ast_ssl_setup(amis_desc.tls_cfg)) {
+	if (tls_was_enabled && !ami_tls_cfg.enabled) {
+		ast_tcptls_server_stop(&amis_desc);
+	} else if (ast_ssl_setup(amis_desc.tls_cfg)) {
 		ast_tcptls_server_start(&amis_desc);
 	}
 	return 0;




More information about the asterisk-commits mailing list