We ran into an issue recently with certificate validation and this modification to the source code helped us quickly identify the root cause. Previously we had no way of seeing which domain was invalid. I didn't like using malloc here but hopefully freeing it in the same context ensures no memory leak as well avoid any memory corruption... with the memcpy and '\0'... hope this helps...
<!-- Kamailio Pull Request Template -->
<!-- IMPORTANT: - for detailed contributing guidelines, read: https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md - pull requests must be done to master branch, unless they are backports of fixes from master branch to a stable branch - backports to stable branches must be done with 'git cherry-pick -x ...' - code is contributed under BSD for core and main components (tm, sl, auth, tls) - code is contributed GPLv2 or a compatible license for the other components - GPL code is contributed with OpenSSL licensing exception -->
#### Pre-Submission Checklist <!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply --> <!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above--> <!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list --> - [ ] Commit message has the format required by CONTRIBUTING guide - [ ] Commits are split per component (core, individual modules, libs, utils, ...) - [ ] Each component has a single commit (if not, squash them into one commit) - [ ] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change - [x ] Small bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist: <!-- Go over all points below, and after creating the PR, tick the checkboxes that apply --> - [ ] PR should be backported to stable branches - [x ] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description <!-- Describe your changes in detail -->
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/2873
-- Commit Summary --
* <a href="https://github.com/kamailio/kamailio/pull/2873/commits/b7673a8423ed17b78f818b349d19faa4fdd80d6d">Expose the domain in certificate validation errors</a>
-- File Changes --
M src/modules/tls/tls_util.h (6)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/2873.patch https://github.com/kamailio/kamailio/pull/2873.diff
@miconda commented on this pull request.
@@ -39,7 +39,11 @@ static inline int tls_err_ret(char *s, tls_domains_cfg_t **tls_domains_cfg) {
{ while((err = ERR_get_error())) { ret = 1; - ERR("%s%s\n", s ? s : "", ERR_error_string(err, 0)); + char *errbuf = (char*)malloc(sizeof(char)*((*tls_domains_cfg)->srv_default->server_name.len+1)); + memcpy(errbuf, (*tls_domains_cfg)->srv_default->server_name.s, (*tls_domains_cfg)->srv_default->server_name.len); + errbuf[(*tls_domains_cfg)->srv_default->server_name.len] = '\0'; + ERR("%s%s -> %s -> verify_client is:%d\n", s ? s : "", ERR_error_string(err, 0), errbuf, (*tls_domains_cfg)->srv_default->verify_client); + free(errbuf);
There is no need to allocate memory and copy to it a 0-terminated string from `(*tls_domains_cfg)->srv_default->server_name`, you can use `%.*s` instead of `%s` and provide first the length and then the pointer. Should be plenty of examples in Kamailio code.
Then, because the patch is to tls module, the commit message has to be prefixed with `tls: ` -- see contributing guidelines:
* https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md#com...
Closed #2873.
I am going to close this one, after a second look at it, seems to be specific to your case, because it looks at the default server profile only, also it does not check if server_name is set or not, because it is not a mandatory field.
Ok thank you for checking . This was very helpful for us to quickly isolate the cert issue… perhaps there is an opportunity to improve or add some additional logging mode for the tls module in the future
I pushed a commit trying to get sni from ssl structure.
-
Daniel-Constantin Mierla -
Todd