[asterisk-commits] rmudgett: branch 12 r424393 - in /branches/12: configs/ res/ res/res_pjsip/

SVN commits to the Asterisk project asterisk-commits at lists.digium.com
Thu Oct 2 16:46:05 CDT 2014


Author: rmudgett
Date: Thu Oct  2 16:45:58 2014
New Revision: 424393

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=424393
Log:
res_pjsip: Make transport cipher option accept a comma separated list of cipher names.

Improvements to the res_pjsip transport cipher option.

* Made the cipher option accept a comma separated list of OpenSSL cipher
names.  Users of realtime will be glad if they have more than one name to
list.

* Added the CLI command 'pjsip list ciphers' so a user can know what
OpenSSL names are available for the cipher option.

* Updated the cipher option online XML documentation to specify what is
expected for the value.

* Updated pjsip.conf.sample to not indicate that ALL is acceptable since
ALL does not imply a preference order for the ciphers and PJSIP does not
simply pass the string to OpenSSL for interpretation.

ASTERISK-24199 #close
Reported by: Joshua Colp

Review: https://reviewboard.asterisk.org/r/4018/

Modified:
    branches/12/configs/pjsip.conf.sample
    branches/12/res/res_pjsip.c
    branches/12/res/res_pjsip/config_transport.c

Modified: branches/12/configs/pjsip.conf.sample
URL: http://svnview.digium.com/svn/asterisk/branches/12/configs/pjsip.conf.sample?view=diff&rev=424393&r1=424392&r2=424393
==============================================================================
--- branches/12/configs/pjsip.conf.sample (original)
+++ branches/12/configs/pjsip.conf.sample Thu Oct  2 16:45:58 2014
@@ -148,7 +148,7 @@
 ;bind=0.0.0.0
 ;cert_file=/path/mycert.crt
 ;priv_key_file=/path/mykey.key
-;cipher=ALL
+;cipher=ADH-AES256-SHA,ADH-AES128-SHA
 ;method=tlsv1
 
 
@@ -600,7 +600,7 @@
 ;ca_list_file=  ; File containing a list of certificates to read TLS ONLY
                 ; (default: "")
 ;cert_file=     ; Certificate file for endpoint TLS ONLY (default: "")
-;cipher=        ; Preferred Cryptography Cipher TLS ONLY (default: "")
+;cipher=        ; Preferred cryptography cipher names TLS ONLY (default: "")
 ;domain=        ; Domain the transport comes from (default: "")
 ;external_media_address=        ; External IP address to use in RTP handling
                                 ; (default: "")

Modified: branches/12/res/res_pjsip.c
URL: http://svnview.digium.com/svn/asterisk/branches/12/res/res_pjsip.c?view=diff&rev=424393&r1=424392&r2=424393
==============================================================================
--- branches/12/res/res_pjsip.c (original)
+++ branches/12/res/res_pjsip.c Thu Oct  2 16:45:58 2014
@@ -653,9 +653,9 @@
 					<description><para>
 						This option only applies if <replaceable>media_encryption</replaceable> is
 						set to <literal>dtls</literal>.
-					</para><para>
-						Many options for acceptable ciphers. See link for more:
-						http://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS
+					</para>
+					<para>Many options for acceptable ciphers. See link for more:</para>
+					<para>http://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS
 					</para></description>
 				</configOption>
 				<configOption name="dtls_ca_file">
@@ -820,11 +820,17 @@
 					<synopsis>Certificate file for endpoint (TLS ONLY)</synopsis>
 				</configOption>
 				<configOption name="cipher">
-					<synopsis>Preferred Cryptography Cipher (TLS ONLY)</synopsis>
-					<description><para>
-						Many options for acceptable ciphers see link for more:
-						http://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS
-					</para></description>
+					<synopsis>Preferred cryptography cipher names (TLS ONLY)</synopsis>
+					<description>
+					<para>Comma separated list of cipher names or numeric equivalents.
+						Numeric quivalents can be either decimal or hexadecimal (0xX).
+					</para>
+					<para>There are many cipher names.  Use the CLI command
+						<literal>pjsip list ciphers</literal> to see a list of cipher
+						names available for your installation.  See link for more:</para>
+					<para>http://www.openssl.org/docs/apps/ciphers.html#CIPHER_SUITE_NAMES
+					</para>
+					</description>
 				</configOption>
 				<configOption name="domain">
 					<synopsis>Domain the transport comes from</synopsis>

Modified: branches/12/res/res_pjsip/config_transport.c
URL: http://svnview.digium.com/svn/asterisk/branches/12/res/res_pjsip/config_transport.c?view=diff&rev=424393&r1=424392&r2=424393
==============================================================================
--- branches/12/res/res_pjsip/config_transport.c (original)
+++ branches/12/res/res_pjsip/config_transport.c Thu Oct  2 16:45:58 2014
@@ -389,17 +389,19 @@
 /*! \brief Helper function which turns a cipher name into an identifier */
 static pj_ssl_cipher cipher_name_to_id(const char *name)
 {
-	pj_ssl_cipher ciphers[100], id = 0;
+	pj_ssl_cipher ciphers[100];
+	pj_ssl_cipher id = 0;
 	unsigned int cipher_num = PJ_ARRAY_SIZE(ciphers);
 	int pos;
+	const char *pos_name;
 
 	if (pj_ssl_cipher_get_availables(ciphers, &cipher_num)) {
 		return 0;
 	}
 
 	for (pos = 0; pos < cipher_num; ++pos) {
-		if (!pj_ssl_cipher_name(ciphers[pos]) ||
-			strcmp(pj_ssl_cipher_name(ciphers[pos]), name)) {
+		pos_name = pj_ssl_cipher_name(ciphers[pos]);
+		if (!pos_name || strcmp(pos_name, name)) {
 			continue;
 		}
 
@@ -410,60 +412,130 @@
 	return id;
 }
 
-/*! \brief Custom handler for TLS cipher setting */
-static int transport_tls_cipher_handler(const struct aco_option *opt, struct ast_variable *var, void *obj)
-{
-	struct ast_sip_transport *transport = obj;
+/*!
+ * \internal
+ * \brief Add a new cipher to the transport's cipher list array.
+ *
+ * \param transport Which transport to add the cipher to.
+ * \param name Cipher identifier name.
+ *
+ * \retval 0 on success.
+ * \retval -1 on error.
+ */
+static int transport_cipher_add(struct ast_sip_transport *transport, const char *name)
+{
 	pj_ssl_cipher cipher;
-
-	if (ast_strlen_zero(var->value)) {
-		return 0;
-	}
-
-	if (transport->tls.ciphers_num == (SIP_TLS_MAX_CIPHERS - 1)) {
-		return -1;
-	}
-
-	cipher = cipher_name_to_id(var->value);
-
+	int idx;
+
+	cipher = cipher_name_to_id(name);
 	if (!cipher) {
 		/* TODO: Check this over/tweak - it's taken from pjsua for now */
-		if (!strnicmp(var->value, "0x", 2)) {
-			pj_str_t cipher_st = pj_str((char*)var->value + 2);
+		if (!strnicmp(name, "0x", 2)) {
+			pj_str_t cipher_st = pj_str((char *) name + 2);
 			cipher = pj_strtoul2(&cipher_st, NULL, 16);
 		} else {
-			cipher = atoi(var->value);
+			cipher = atoi(name);
 		}
 	}
 
 	if (pj_ssl_cipher_is_supported(cipher)) {
+		for (idx = transport->tls.ciphers_num; idx--;) {
+			if (transport->ciphers[idx] == cipher) {
+				/* The cipher is already in the list. */
+				return 0;
+			}
+		}
 		transport->ciphers[transport->tls.ciphers_num++] = cipher;
 		return 0;
 	} else {
-		ast_log(LOG_ERROR, "Cipher '%s' is unsupported\n", var->value);
-		return -1;
-	}
+		ast_log(LOG_ERROR, "Cipher '%s' is unsupported\n", name);
+		return -1;
+	}
+}
+
+/*! \brief Custom handler for TLS cipher setting */
+static int transport_tls_cipher_handler(const struct aco_option *opt, struct ast_variable *var, void *obj)
+{
+	struct ast_sip_transport *transport = obj;
+	char *parse;
+	char *name;
+	int res = 0;
+
+	parse = ast_strdupa(S_OR(var->value, ""));
+	while ((name = strsep(&parse, ","))) {
+		name = ast_strip(name);
+		if (ast_strlen_zero(name)) {
+			continue;
+		}
+		if (ARRAY_LEN(transport->ciphers) <= transport->tls.ciphers_num) {
+			ast_log(LOG_ERROR, "Too many ciphers specified\n");
+			res = -1;
+			break;
+		}
+		res |= transport_cipher_add(transport, name);
+	}
+	return res ? -1 : 0;
+}
+
+static void cipher_to_str(char **buf, const pj_ssl_cipher *ciphers, unsigned int cipher_num)
+{
+	struct ast_str *str;
+	int idx;
+
+	str = ast_str_create(128);
+	if (!str) {
+		*buf = NULL;
+		return;
+	}
+
+	for (idx = 0; idx < cipher_num; ++idx) {
+		ast_str_append(&str, 0, "%s", pj_ssl_cipher_name(ciphers[idx]));
+		if (idx < cipher_num - 1) {
+			ast_str_append(&str, 0, ", ");
+		}
+	}
+
+	*buf = ast_strdup(ast_str_buffer(str));
+	ast_free(str);
 }
 
 static int transport_tls_cipher_to_str(const void *obj, const intptr_t *args, char **buf)
 {
-	RAII_VAR(struct ast_str *, str, ast_str_create(MAX_OBJECT_FIELD), ast_free);
-	const struct ast_sip_transport *transport = obj;
-	int i;
-
-	if (!str) {
-		return -1;
-	}
-
-	for (i = 0; i < transport->tls.ciphers_num; ++i) {
-		ast_str_append(&str, 0, "%s", pj_ssl_cipher_name(transport->ciphers[i]));
-		if (i < transport->tls.ciphers_num - 1) {
-			ast_str_append(&str, 0, ",");
-		}
-	}
-
-	*buf = ast_strdup(ast_str_buffer(str));
-	return 0;
+	const struct ast_sip_transport *transport = obj;
+
+	cipher_to_str(buf, transport->ciphers, transport->tls.ciphers_num);
+	return *buf ? 0 : -1;
+}
+
+static char *handle_pjsip_list_ciphers(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
+{
+	pj_ssl_cipher ciphers[100];
+	unsigned int cipher_num = PJ_ARRAY_SIZE(ciphers);
+	char *buf;
+
+	switch (cmd) {
+	case CLI_INIT:
+		e->command = "pjsip list ciphers";
+		e->usage = "Usage: pjsip list ciphers\n"
+			"       List available OpenSSL cipher names.\n";
+		return NULL;
+	case CLI_GENERATE:
+		return NULL;
+	}
+
+	if (pj_ssl_cipher_get_availables(ciphers, &cipher_num) || !cipher_num) {
+		buf = NULL;
+	} else {
+		cipher_to_str(&buf, ciphers, cipher_num);
+	}
+
+	if (!ast_strlen_zero(buf)) {
+		ast_cli(a->fd, "Available ciphers: '%s'\n", buf);
+	} else {
+		ast_cli(a->fd, "No available ciphers\n");
+	}
+	ast_free(buf);
+	return CLI_SUCCESS;
 }
 
 /*! \brief Custom handler for localnet setting */
@@ -638,6 +710,7 @@
 }
 
 static struct ast_cli_entry cli_commands[] = {
+	AST_CLI_DEFINE(handle_pjsip_list_ciphers, "List available OpenSSL cipher names"),
 	AST_CLI_DEFINE(ast_sip_cli_traverse_objects, "List PJSIP Transports",
 		.command = "pjsip list transports",
 		.usage = "Usage: pjsip list transports\n"




More information about the asterisk-commits mailing list