tls_domain.c

Go to the documentation of this file.

/*
 * $Id: tls_domain.c 4680 2008-08-12 07:26:43Z klaus_darilion $
 *
 * Copyright (C) 2001-2003 FhG Fokus
 * Copyright (C) 2004,2005 Free Software Foundation, Inc.
 * Copyright (C) 2006 enum.at
 *
 * This file is part of Kamailio, a free SIP server.
 *
 * Kamailio is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version
 *
 * Kamailio is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License 
 * along with this program; if not, write to the Free Software 
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */

/*!
 * \file
 * \brief Kamailio TLS support :: Domains
 * \ingroup tls
 * Module: \ref tls
 */

#include "tls_server.h"
#include "tls_domain.h"
#include <stdlib.h>

struct tls_domain *tls_server_domains = NULL;
struct tls_domain *tls_client_domains = NULL;
struct tls_domain *tls_default_server_domain = NULL;
struct tls_domain *tls_default_client_domain = NULL;

/*! \brief
 * find server domain with given ip and port 
 * it will only return server domains which do not
 * have a server_name defined (as to those will be swtiched
 * in the servername callback function).
 * If IP:port with empty server_name is not found in the list 
 * it will return the default server domain
 * \return default domain if virtual domain not found
 */
struct tls_domain *
tls_find_server_domain(struct ip_addr *ip, unsigned short port)
{
   struct tls_domain *p = tls_server_domains;
   while (p) {
      if ((p->port == port) && ip_addr_cmp(&p->addr, ip)
#ifndef OPENSSL_NO_TLSEXT
         && (p->server_name == NULL)
#endif
         ) {
         LM_DBG("socket based TLS server domain found\n");
         return p;
      }
      p = p->next;
   }
   LM_DBG("socket based TLS server domain not found, "
      "Using default TLS server domain settings\n");
   return tls_default_server_domain;
}


#ifndef OPENSSL_NO_TLSEXT
/*
 * find server domain with given ip and port 
 * and matching server_name.
 * If none is found, it will return 0
 */
struct tls_domain *
tls_find_server_domain_server_name(struct ip_addr *ip, 
   unsigned short port, const char *server_name)
{
   struct tls_domain *p = tls_server_domains;
   LM_DBG("looking up TLS server domain for socket [%s:%d] and "
      "server_name '%s' ...\n", ip_addr2a(ip), port, server_name);
   while (p) {
      LM_DBG("comparing with TLS server domain [%s:%d] and "
         "server_name %p:'%s' ...\n", ip_addr2a(&p->addr), p->port, 
         p->server_name, p->server_name?p->server_name:"");
      if ((p->port == port) && ip_addr_cmp(&p->addr, ip) && p->server_name
         && !strcasecmp(p->server_name,server_name)) {
         LM_DBG("socket+server_name based TLS server domain found\n");
         return p;
      }
      p = p->next;
   }
   LM_DBG("socket+server_name based TLS server domain not found\n");
   return 0;
}
#endif


/*! \brief
 * find client domain with given ip and port,
 * return default domain if virtual domain not found
 */
struct tls_domain *
tls_find_client_domain(struct ip_addr *ip, unsigned short port)
{
   struct tls_domain *p = tls_client_domains;
   while (p) {
      if ((p->name.len == 0) && (p->port == port) && ip_addr_cmp(&p->addr, ip)) {
         LM_DBG("virtual TLS client domain found\n");
         return p;
      }
      p = p->next;
   }
   LM_DBG("virtual TLS client domain not found, "
      "Using default TLS client domain settings\n");
   return tls_default_client_domain;
}

/*! \brief
 * find client domain with given name,
 * return 0 if name based virtual domain not found
 */
struct tls_domain *
tls_find_client_domain_name(str name)
{
   struct tls_domain *p = tls_client_domains;
   while (p) {
      if ((p->name.len == name.len) && !strncasecmp(p->name.s, name.s, name.len)) {
         LM_DBG("virtual TLS client domain found\n");
         return p;
      }
      p = p->next;
   }
   LM_DBG("virtual TLS client domain not found\n");
   return 0;
}


/*! \brief
 * create a new server domain (identified by a socket)
 */
int
tls_new_server_domain(struct ip_addr *ip, unsigned short port)
{
   struct tls_domain *d = tls_server_domains;

   LM_DBG("creating server domain for [%s:%d]\n", 
      ip_addr2a(ip), port);
   // check if for this socket is already a domain defined
   while (d) {
      if ((d->port == port) && ip_addr_cmp(&d->addr, ip)) {
#ifdef OPENSSL_NO_TLSEXT
         LM_ERR("TLS server domain for socket [%s:%d] already defined\n",
            ip_addr2a(ip), port);
         return -1;
#else
         LM_WARN("TLS server domain for socket [%s:%d] already defined\n",
            ip_addr2a(ip), port);
#endif
      }
      d = d->next;
   }
   LM_DBG("creating a new TLS server domain ...\n");

   d = tls_new_domain(TLS_DOMAIN_SRV);
   if (d == NULL) {
      LM_ERR("pkg memory allocation failure\n");
      return -1;
   }

   /* fill socket data */
   memcpy(&d->addr, ip, sizeof(struct ip_addr));
   d->port = port;

   /* add this new domain to the linked list */
   d->next = tls_server_domains;
   tls_server_domains = d;
   return 0;
}

/*! \brief
 * create a new client domain (identified by a socket)
 */
int
tls_new_client_domain(struct ip_addr *ip, unsigned short port)
{
   struct tls_domain *d;

   d = tls_new_domain(TLS_DOMAIN_CLI);
   if (d == NULL) {
      LM_ERR("pkg memory allocation failure\n");
      return -1;
   }

   /* fill socket data */
   memcpy(&d->addr, ip, sizeof(struct ip_addr));
   d->port = port;

   /* add this new domain to the linked list */
   d->next = tls_client_domains;
   tls_client_domains = d;
   return 0;
}

/*! \brief
 * create a new client domain (identified by a string)
 */
int
tls_new_client_domain_name(char *s, int len)
{
   struct tls_domain *d;

   d = tls_new_domain(TLS_DOMAIN_CLI | TLS_DOMAIN_NAME);
   if (d == NULL) {
      LM_ERR("pkg memory allocation failure\n");
      return -1;
   }

   /* initialize name data */
   d->name.s = pkg_malloc(len);
   if (d->name.s == NULL) {
      LM_ERR("pkg memory allocation failure\n");
      pkg_free(d);
      return -1;
   }
   memcpy(d->name.s, s, len);
   d->name.len = len;

   /* add this new domain to the linked list */
   d->next = tls_client_domains;
   tls_client_domains = d;
   return 0;
}

/*! \brief
 * allocate memory and set default values for
 * TLS domain structure
 */
struct tls_domain *tls_new_domain(int type)
{
   struct tls_domain *d;

   d = pkg_malloc(sizeof(struct tls_domain));
   if (d == NULL) {
      LM_ERR("pkg memory allocation failure\n");
      return 0;
   }
   memset( d, 0, sizeof(struct tls_domain));

   d->type = type;

   if (type & TLS_DOMAIN_SRV) {
      d->verify_cert         = tls_verify_client_cert;
      d->require_client_cert = tls_require_client_cert;
   } else {
      d->verify_cert         = tls_verify_server_cert;
      d->require_client_cert = 0;
   }
   d->method = TLS_METHOD_UNSPEC;

   return d;
}

/*! \brief
 * clean up 
 */
void
tls_free_domains(void)
{
   struct tls_domain *p;
   while (tls_server_domains) {
      p = tls_server_domains;
      tls_server_domains = tls_server_domains->next;
      pkg_free(p);
   }
   while (tls_client_domains) {
      p = tls_client_domains;
      tls_client_domains = tls_client_domains->next;
      /* ToDo: If socket based client domains will be implemented, the name may
         be empty (must be set to NULL manually). Thus no need to free it */
      if (p->name.s) {
         pkg_free(p->name.s);
      }
      pkg_free(p);
   }
   pkg_free(tls_default_client_domain);
   pkg_free(tls_default_server_domain);
}