kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-12 15:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "res_rtp_asterisk: Enable Forward Secrecy (PFS) for DTLS." into 13

Browse Source
This commit is contained in:
zuul
2016-07-14 09:55:08 -05:00
committed by Gerrit Code Review
parent 3c1a40eb8d 332beb27d8
commit b12aee68be
5 changed files with 57 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
res/res_rtp_asterisk.c
View File

@@ -1340,7 +1340,7 @@ static int ast_rtp_dtls_set_configuration(struct ast_rtp_instance *instance, con
{
struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
int res;
#ifndef HAVE_OPENSSL_ECDH_AUTO
#ifdef HAVE_OPENSSL_EC
EC_KEY *ecdh;
#endif
@@ -1368,15 +1368,42 @@ static int ast_rtp_dtls_set_configuration(struct ast_rtp_instance *instance, con
SSL_CTX_set_read_ahead(rtp->ssl_ctx, 1);
#ifdef HAVE_OPENSSL_ECDH_AUTO
SSL_CTX_set_ecdh_auto(rtp->ssl_ctx, 1);
#else
#ifdef HAVE_OPENSSL_EC
if (!ast_strlen_zero(dtls_cfg->pvtfile)) {
BIO *bio = BIO_new_file(dtls_cfg->pvtfile, "r");
if (bio != NULL) {
DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
if (dh != NULL) {
if (SSL_CTX_set_tmp_dh(rtp->ssl_ctx, dh)) {
long options = SSL_OP_CIPHER_SERVER_PREFERENCE |
SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE;
options = SSL_CTX_set_options(rtp->ssl_ctx, options);
ast_verb(2, "DTLS DH initialized, PFS enabled\n");
}
DH_free(dh);
}
BIO_free(bio);
}
}
/* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
if (ecdh) {
SSL_CTX_set_tmp_ecdh(rtp->ssl_ctx, ecdh);
if (ecdh != NULL) {
if (SSL_CTX_set_tmp_ecdh(rtp->ssl_ctx, ecdh)) {
#ifndef SSL_CTRL_SET_ECDH_AUTO
#define SSL_CTRL_SET_ECDH_AUTO 94
#endif
/* SSL_CTX_set_ecdh_auto(rtp->ssl_ctx, on); requires OpenSSL 1.0.2 which wraps: */
if (SSL_CTX_ctrl(rtp->ssl_ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL)) {
ast_verb(2, "DTLS ECDH initialized (automatic), faster PFS enabled\n");
} else {
ast_verb(2, "DTLS ECDH initialized (secp256r1), faster PFS enabled\n");
}
}
EC_KEY_free(ecdh);
}
#endif
#endif /* #ifdef HAVE_OPENSSL_EC */
rtp->dtls_verify = dtls_cfg->verify;