Skip to content

#3798 Don't require certificate for TLS clients #3825

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rsmck wants to merge 1 commit into
base: 3.6
Choose a base branch
from
+42 −18
Open

#3798 Don't require certificate for TLS clients #3825

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 24 additions & 5 deletions modules/tls_mgm/tls_mgm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -642,11 +642,21 @@ static int init_tls_dom(struct tls_domain *d)
}

if (!d->cert.s) {
init_flags |= TLS_DOM_CERT_FILE_FL;
LM_NOTICE("no certificate for tls domain '%.*s' defined, using default '%s'\n",
d->name.len, ZSW(d->name.s), tls_cert_file);
d->cert.s = tls_cert_file;
d->cert.len = len(tls_cert_file);
/* Client domains can operate without a certificate (RFC 8446 4.4.2.4,
* RFC 5246 7.4.6) - an empty certificate message will be sent if the
* server requests one. Server domains require a certificate. */
if (d->flags & DOM_FLAG_SRV) {
init_flags |= TLS_DOM_CERT_FILE_FL;
LM_NOTICE("no certificate for tls server domain '%.*s' defined, "
"using default '%s'\n",
d->name.len, ZSW(d->name.s), tls_cert_file);
d->cert.s = tls_cert_file;
d->cert.len = len(tls_cert_file);
} else {
LM_INFO("no certificate for tls client domain '%.*s', "
"will not send client certificate\n",
d->name.len, ZSW(d->name.s));
}
}

if (!d->ca.s) {
Expand Down Expand Up @@ -722,6 +732,15 @@ static int init_tls_domains(struct tls_domain **dom)
prev = NULL;
while (d) {
if (!d->pkey.s) {
/* Client domains without a certificate don't need a private key */
if (!d->cert.s && (d->flags & DOM_FLAG_CLI)) {
LM_DBG("no private key needed for tls client domain '%.*s' "
"(no certificate configured)\n",
d->name.len, ZSW(d->name.s));
prev = d;
d = d->next;
continue;
}
LM_NOTICE("no private key for tls domain '%.*s' defined, using default '%s'\n",
d->name.len, ZSW(d->name.s), tls_pkey_file);
d->pkey.s = tls_pkey_file;
Expand Down
16 changes: 9 additions & 7 deletions modules/tls_openssl/openssl_config.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -831,14 +831,16 @@ int openssl_init_tls_dom(struct tls_domain *d, int init_flags)
}

/*
* load certificate
* load certificate (optional for client domains per RFC 8446 4.4.2.4)
*/
if (!(d->flags & DOM_FLAG_DB) || init_flags & TLS_DOM_CERT_FILE_FL) {
if (load_certificate(((void**)d->ctx)[i], d->cert.s) < 0)
return -1;
} else
if (load_certificate_db(((void**)d->ctx)[i], &d->cert) < 0)
return -1;
if (d->cert.s) {
if (!(d->flags & DOM_FLAG_DB) || init_flags & TLS_DOM_CERT_FILE_FL) {
if (load_certificate(((void**)d->ctx)[i], d->cert.s) < 0)
return -1;
} else
if (load_certificate_db(((void**)d->ctx)[i], &d->cert) < 0)
return -1;
}

/**
* load crl from directory
Expand Down
15 changes: 9 additions & 6 deletions modules/tls_wolfssl/wolfssl_config.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -532,12 +532,15 @@ int _wolfssl_init_tls_dom(struct tls_domain *d, int init_flags)
goto end;
}

if (!(d->flags & DOM_FLAG_DB) || init_flags & TLS_DOM_CERT_FILE_FL) {
if (load_certificate(d->ctx, d->cert.s) < 0)
goto end;
} else {
if (load_certificate_db(d->ctx, &d->cert) < 0)
goto end;
/* load certificate (optional for client domains per RFC 8446 4.4.2.4) */
if (d->cert.s) {
if (!(d->flags & DOM_FLAG_DB) || init_flags & TLS_DOM_CERT_FILE_FL) {
if (load_certificate(d->ctx, d->cert.s) < 0)
goto end;
} else {
if (load_certificate_db(d->ctx, &d->cert) < 0)
goto end;
}
}

if (d->crl_directory && load_crl(d->ctx, d->crl_directory,
Expand Down