[Devel] [ openser-Patches-1464264 ] support for TLS client domains (name based and socket based)

Klaus Darilion klaus.mailinglists at pernau.at
Tue Apr 4 16:49:51 CEST 2006


Hi!

It would be nice if someone could review this patch - I'm still not an 
openser expert. I did some tests and it worked fine.

regards
klaus

SourceForge.net wrote:
> Patches item #1464264, was opened at 2006-04-04 16:47
> Message generated for change (Tracker Item Submitted) made by Item Submitter
> You can respond by visiting: 
> https://sourceforge.net/tracker/?func=detail&atid=743022&aid=1464264&group_id=139143
> 
> Please note that this message will contain a full copy of the comment thread,
> including the initial issue submission, for this request,
> not just the latest update.
> Category: core
> Group: ver devel
> Status: Open
> Resolution: None
> Priority: 5
> Submitted By: Klaus Darilion (klaus_darilion)
> Assigned to: Nobody/Anonymous (nobody)
> Summary: support for TLS client domains (name based and socket based)
> 
> Initial Comment:
>     
> _________________________________________________________
> 
> 1.6.12. tls_client_domain_avp=number
> 
>    This sets the interger AVP used for name based TLS
> server
>    domains (please see tls_client_domain for more details).
>    Setting the value to 0 disables name based TLS
> client domains.
> 
>    It's usable only if TLS support was compiled.
> 
>    Default value is 0.
> 
>    Example 1-12. Set tls_client_domain_avp variable
> ...
> tls_client_domain_avp=400    # only integer named AVPs
> are supported
> ...
>     
> _________________________________________________________
> 
>    If you only run one domain, the main one is enough.
> If you are
>    running several TLS servers (that is, you have more
> than one
>    listen=tls:ip:port entry in the config file), you
> can specify
>    some parameters for each of them separately (not all the
>    above).
> 
>    The wording 'TLS domain' means that this TLS
> connection will
>    have different parameters than another TLS
> connection (from
>    another TLS domain). Thus, TLS domains must are not
> directly
>    related to different SIP domains, although they are
> often used
>    in common. Depending on the direction of the TLS
> handshake, a
>    TLS domain is called 'client domain' (=outgouing TLS
>    connection) or 'server domain' (= incoming TLS
> connection).
> 
>    For example, TLS domains can be used in virtual hosting
>    scenarios with TLS. OpenSER offers SIP service for
> multiple
>    domains, e.g. atlanta.com and biloxi.com. Altough
> both domains
>    will be hosted a single SIP proxy, the SIP proxy needs 2
>    certificates: One for atlanta.com and one for
> biloxi.com. For
>    incoming TLS connections, the SIP proxy has to
> present the
>    respective certificate during the TLS handshake. As
> the SIP
>    proxy does not have received a SIP message yet (this
> is done
>    after the TLS handshake), the SIP proxy can not
> retrieve the
>    target domain (which will be usually retrieved from
> the domain
>    in the request URI). Thus, distinction for these
> domains must
>    be done by using multiple sockets. The socket on
> which the TLS
>    connection is received, identifies the respective
> domain. Thus
>    the SIP proxy is able to present the proper certificate.
> 
>    For outgoing TLS connections, the SIP proxy usually
> has to
>    provide a client certificate. In this scenario,
> socket based
>    distinction is not possible as there is no dedicated
> outgoing
>    socket. Thus, the certificate selection (selection
> of the
>    proper TLS client domain) will be name based. For this
>    purpose, TLS client domains can be associated with a
> name
>    (e.g. the domain can be used as name). If the SIP proxy
>    establishes a new outgoing TLS connection, it checks
> for the
>    TLS client domain AVP (parameter
> tls_client_domain_avp). If
>    this AVP is set (e.g. in OpenSER.cfg), OpenSER
> searches for a
>    TLS client domain with the same name and uses the
> certificates
>    defined in the respective tls_client_domain section.
> 
>    TLS client domains can also be socket based. If name
> based
>    domains are disabled or no name based AVP is found,
> OpenSER
>    searches for socket based TLS client domains. In
> this case the
>    mapping between to the TLS client domain is done
> based on the
>    destination socket of the underlying outgoing TCP
> connection.
> 
>    Note: If there is already an existing TLS connection
> to the
>    remote target, it will be reused wether the TLS
> client domain
>    AVP matches or not.
> 
> ...
> listen=tls:IP_2:port2
> listen=tls:IP_3:port4
> ...
> # set the TLS client domain AVP
> tls_client_domain_avp = 400
> ...
> # socket based TLS server domains (for virtual SIPS
> hosting)
> tls_server_domain[IP_2:port2] {
>     #specify parameters for a domain in particular,
> otherwise,
>     #it will use the default. These are the possible
> parameters to
>     #change for each domain
>     tls_certificate = "/certs/atlanta.com/cert.pem"
>     tls_private_key = "/certs/atlanta.com/privkey.pem"
>     tls_ca_list     = "/certs/wellknownCAs"
>     tls_method=tlsv1
> }
> tls_server_domain[IP_3:port3] {
>     tls_certificate = "/certs/biloxy.com/cert.pem"
>     tls_private_key = "/certs/biloxy.com/privkey.pem"
>     tls_ca_list     = "/certs/wellknownCAs"
>     tls_method=tlsv1
> }
> # name based TLS client domains (for virtual SIPS hosting)
> tls_client_domain["atlanta.com"] {
>     tls_certificate = "/certs/atlanta.com/cert.pem"
>     tls_private_key = "/certs/atlanta.com/privkey.pem"
>     tls_ca_list     = "/certs/wellknownCAs"
>     tls_method=tlsv1
> }
> tls_client_domain["biloxi.com"] {
>     tls_certificate = "/certs/biloxy.com/cert.pem"
>     tls_private_key = "/certs/biloxy.com/privkey.pem"
>     tls_ca_list     = "/certs/wellknownCAs"
>     tls_method=tlsv1
> }
> # socket based TLS server domains (for TLS based
> downstream from GW pro
> vider)
> tls_client_domain[IP_5:port5] {
>     tls_certificate = "/certs/local/cert.pem"
>     tls_private_key = "/certs/local/privkey.pem"
>     tls_ca_list     = "/certs/GWproviderSelfSignedCA"
>     tls_method=tlsv1
> }
> # socket based TLS client domains (for TLS based
> upstream to GW provide
> r)
> # GW IP: 1.2.3.4, GW port: 6677
> tls_client_domain[1.2.3.4:6677] {
>     tls_certificate = "/certs/local/cert.pem"
>     tls_private_key = "/certs/local/privkey.pem"
>     tls_ca_list     = "/certs/GWproviderSelfSignedCA"
>     tls_method=tlsv1
> }
> ...
> route{
> ...
>     # calls to other SIP domains
>     # set the proper SSL context (certificate) for
> local hosted domains
>     avp_write("$fd","$avp(i:400)");
>     t_relay(); # uses NAPTR and SRV lookups
>     exit;
> ...
>     # calls to the PSTN GW
>     t_relay("tls:1.2.3.4:6677");
>     exit;
> ...
>     
> _________________________________________________________
> 
> 
> 
> ----------------------------------------------------------------------
> 
> You can respond by visiting: 
> https://sourceforge.net/tracker/?func=detail&atid=743022&aid=1464264&group_id=139143
> 
> _______________________________________________
> Devel mailing list
> Devel at openser.org
> http://openser.org/cgi-bin/mailman/listinfo/devel




More information about the Devel mailing list