Note: See below for more info about motivation of this feature.

[ * ] Commit message has the format required by CONTRIBUTING guide
[ * ] Commits are split per component (core, individual modules, libs, utils, ...)
[ * ] Each component has a single commit (if not, squash them into one commit)
[ * ] No commits to README files for modules (changes must be done to docbook files
in doc/ subfolder, the README file is autogenerated)

This feature aims to replace require_certificate and verify_certificate params with a single option, verify_client:

Provides flexibility: require_certificate and verify_certificate are both booleans, so there are only 4 max combinations of params, and only 3 of them make sense (require_certificate=1 and verify_certificate=0 does not). In contrast, verify_client is a list of enumerated values, which can be more gracefully expanded by adding additional behaviors to the enum.
Motivation for this feature is to enable optional_no_ca behavior, described in the docbook; Without this feature, that behavior cannot be represented by any combination of require_certificate and verify_certificate. I figured if I need to add another variable to support desired behavior, it may as well be one that can hold more than just boolean values.
This feature was inspired from a similar one in Nginx; that software has a similar "ssl_verify_client" option that takes the same "on", "off", "optional", and "optional_no_ca" values, which effectively implement the same feature. Note that there is no shared code between implementations, and that these behaviors are implemented (in both cases) via a very thin layer of glue code on top of the OpenSSL library.
Note that the only function definition in tls_verify.c, verify_callback(int pre_verify_ok, X509_STORE_CTX *ctx), has been compiled into the kamailio binary, but apparently not used. Rather than modify the existing function, I added a simple 1-line function (2 if you count the log message too) to enable this feature.

Please let me know if I can answer any questions. Thanks!

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or unsubscribe.