Pre-Submission Checklist

Commit message has the format required by CONTRIBUTING guide
Commits are split per component (core, individual modules, libs, utils, ...)
Each component has a single commit (if not, squash them into one commit)
No commits to README files for modules (changes must be done to docbook files
in doc/ subfolder, the README file is autogenerated)

Type Of Change

Small bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds new functionality)
Breaking change (fix or feature that would change existing functionality)

Checklist:

PR should be backported to stable branches
Tested changes locally
Related to issue #XXXX (replace XXXX with an open issue number)

Description

When the stirshaken module is in use and configured to cache certifications, validation will succeed on the very first attempt but will then fail every time the certificate is loaded from cache. The reason is because this module only saves the certificate and discards the any supplied chain certificates. This patch causes the module to save all supplied certificates and properly loads them upon retrieval.

For the loading to work a patch is required in libstirshaken. A PR has already been submitted and is linked below. Without that patch the problem will persist but no other harm is done. This is a safe change to make that does not break existing behaviour.

save all certificates provided by signor to the disk cache
properly load all certificates when loading from cache
requires patch to libstirshaken (PR 123); this patch causes no harm (but no benefit) without it
resolve unrelated compiler warnings on 32bit systems

signalwire/libstirshaken#123

You can view, comment on, or merge this pull request online at:

https://github.com/kamailio/kamailio/pull/3175

Commit Summary

59eb3c0 stirshaken: Properly handle intermediary/chain certificates when caching certificates
88b19e9 stirshaken: close file in write failure cases

File Changes

(1 file)

M src/modules/stirshaken/stirshaken_mod.c (106)

Patch Links:

—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.