[OpenSIPS-Devel] [OpenSIPS/opensips] 7a7a05: tls_mgm: fix require_cert and verify_cert enforcem...

[Răzvan Crainea]

  Branch: refs/heads/4.0
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 7a7a0571b9692aa2e019746e2b8d10269e343673
      https://github.com/OpenSIPS/opensips/commit/7a7a0571b9692aa2e019746e2b8d10269e343673
  Author: Ivan Poddubny <ivan.poddubny at gmail.com>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M modules/tls_openssl/openssl_config.c
    M modules/tls_wolfssl/wolfssl_config.c

  Log Message:
  -----------
  tls_mgm: fix require_cert and verify_cert enforcement for virtual domains

Multiple virtual TLS domains can be defined on a single socket via
match_sip_domain (SNI), each with distinct require_cert and verify_cert
settings. However, these domain-specific verification rules were
never applied to the connection during the TLS handshake, leaving only
the socket's default settings enforced.

This commit adds SSL_set_verify to the SNI callbacks for both OpenSSL
and WolfSSL to ensure the correct domain-specific rules are applied.

(cherry picked from commit 5526637f38b855b51d3627e30618c9458a1d0ce9)


  Commit: b9f88a2bf7fdac6ded60ddb7bafe56f33a585c75
      https://github.com/OpenSIPS/opensips/commit/b9f88a2bf7fdac6ded60ddb7bafe56f33a585c75
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M modules/tls_mgm/tls_helper.h
    M modules/tls_openssl/openssl_config.c
    M modules/tls_wolfssl/wolfssl_config.c

  Log Message:
  -----------
  tls_mgm: unify TLS verify mode selection

(cherry picked from commit 3ed3b93187fc577a339d68c85c704e04f4118274)


Compare: https://github.com/OpenSIPS/opensips/compare/a043cf558064...b9f88a2bf7fd

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications