[OpenSIPS-Devel] [OpenSIPS/opensips] 5ae1eb: tls_mgm: fix require_cert and verify_cert enforcem...

[Răzvan Crainea]

  Branch: refs/heads/3.6
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 5ae1eb7d7bcaa9faf375b15348bd834744452732
      https://github.com/OpenSIPS/opensips/commit/5ae1eb7d7bcaa9faf375b15348bd834744452732
  Author: Ivan Poddubny <ivan.poddubny at gmail.com>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M modules/tls_openssl/openssl_config.c
    M modules/tls_wolfssl/wolfssl_config.c

  Log Message:
  -----------
  tls_mgm: fix require_cert and verify_cert enforcement for virtual domains

Multiple virtual TLS domains can be defined on a single socket via
match_sip_domain (SNI), each with distinct require_cert and verify_cert
settings. However, these domain-specific verification rules were
never applied to the connection during the TLS handshake, leaving only
the socket's default settings enforced.

This commit adds SSL_set_verify to the SNI callbacks for both OpenSSL
and WolfSSL to ensure the correct domain-specific rules are applied.

(cherry picked from commit 5526637f38b855b51d3627e30618c9458a1d0ce9)


  Commit: 5e99b31d1e5f391a27ade4e0e4489d7c7aab731e
      https://github.com/OpenSIPS/opensips/commit/5e99b31d1e5f391a27ade4e0e4489d7c7aab731e
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-07-21 (Tue, 21 Jul 2026)

  Changed paths:
    M modules/tls_mgm/tls_helper.h
    M modules/tls_openssl/openssl_config.c
    M modules/tls_wolfssl/wolfssl_config.c

  Log Message:
  -----------
  tls_mgm: unify TLS verify mode selection

(cherry picked from commit 3ed3b93187fc577a339d68c85c704e04f4118274)


Compare: https://github.com/OpenSIPS/opensips/compare/1416003fd4d0...5e99b31d1e5f

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications