-
- Downloads
res_pjsip: allow TLS verification of wildcard cert-bearing servers
Rightly the use of wildcards in certificates is disallowed in accordance with RFC5922. However, RFC2818 does make some allowances with regards to their use when using subject alt names with DNS name types. As such this patch creates a new setting for TLS transports called 'allow_wildcard_certs', which when it and 'verify_server' are both enabled allows DNS name types, as well as the common name that start with '*.' to match as a wildcard. For instance: *.example.com will match for: foo.example.com Partial matching is not allowed, e.g. f*.example.com, foo.*.com, etc... And the starting wildcard only matches for a single level. For instance: *.example.com will NOT match for: foo.bar.example.com The new setting is disabled by default. ASTERISK-30072 #close Change-Id: If0be3fdab2e09c2a66bb54824fca406ebaac3da4
parent
4a11ae7e
No related branches found
No related tags found
Showing
- configs/samples/pjsip.conf.sample 9 additions, 0 deletionsconfigs/samples/pjsip.conf.sample
- contrib/ast-db-manage/config/versions/58e440314c2a_allow_wildcard_certs.py 29 additions, 0 deletions...nage/config/versions/58e440314c2a_allow_wildcard_certs.py
- doc/CHANGES-staging/allow_wildcard_certs.txt 9 additions, 0 deletionsdoc/CHANGES-staging/allow_wildcard_certs.txt
- include/asterisk/res_pjsip.h 8 additions, 0 deletionsinclude/asterisk/res_pjsip.h
- res/res_pjsip/config_transport.c 29 additions, 2 deletionsres/res_pjsip/config_transport.c
- res/res_pjsip/pjsip_config.xml 12 additions, 0 deletionsres/res_pjsip/pjsip_config.xml
- res/res_pjsip/pjsip_transport_events.c 122 additions, 0 deletionsres/res_pjsip/pjsip_transport_events.c
Loading
Please register or sign in to comment