Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow app gets the native SSL socket instance in TLS verification callback #3630

Merged
merged 1 commit into from
Aug 22, 2023

Conversation

nanangizz
Copy link
Member

The TLS verification callback, pjsip_tls_setting.on_verify_cb, can be used by app to implement its own TLS verification. And there is a request to allow app to set/override the TLS Alert code (for TLS close_notify) when it fails the app's verification (while it passes the OpenSSL verification, so alert code is 0).

So, this PR adds the native SSL socket instance to the verification callback which allow app to directly access the native SSL socket, which hopefully it can override the verification result (via SSL_set_verify_result()?) and do some other things too if needed.

Application using PJLIB SSL socket can get the native SSL socket instance from PJLIB SSL socket info (pj_ssl_sock_info).
Application using PJSIP TLS transport first gets the PJLIB SSL socket instance from pjsip_tls_on_verify_param, then use it to query the PJLIB SSL socket info.

Thanks Peter Koletzki for the request/feedback.

@PeterKoletzki
Copy link

This solution looks good for me. When SSL_set_verify_result() hopefully will do the required update of the alert code, than this PR solves the requirement.

@nanangizz
Copy link
Member Author

This solution looks good for me. When SSL_set_verify_result() hopefully will do the required update of the alert code, than this PR solves the requirement.

Thanks for the feedback. Please update again whether it works or if you find a better way perhaps.

@nanangizz nanangizz merged commit fd88803 into master Aug 22, 2023
34 checks passed
@nanangizz nanangizz deleted the ssl-verify2 branch August 22, 2023 06:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants