|
|
@@ -9,9 +9,13 @@ Edited by
|
|
|
Klaus Darilion
|
|
|
|
|
|
Copyright © 2006 enum.at
|
|
|
+ Revision History
|
|
|
+ Revision $Revision$ $Date: 2008-03-04 15:15:47 +0200
|
|
|
+ (Tue, 04 Mar 2008) $
|
|
|
__________________________________________________________
|
|
|
|
|
|
Table of Contents
|
|
|
+
|
|
|
1. User's Guide
|
|
|
|
|
|
1.1. Overview
|
|
|
@@ -56,10 +60,10 @@ Klaus Darilion
|
|
|
2. Frequently Asked Questions
|
|
|
|
|
|
List of Examples
|
|
|
- 1-1. is_peer_verified usage
|
|
|
- 1-2. Example of $tls_[peer|my]_[subject|issuer]
|
|
|
- 1-3. Example of TLS logging
|
|
|
- __________________________________________________________
|
|
|
+
|
|
|
+ 1.1. is_peer_verified usage
|
|
|
+ 1.2. Example of $tls_[peer|my]_[subject|issuer]
|
|
|
+ 1.3. Example of TLS logging
|
|
|
|
|
|
Chapter 1. User's Guide
|
|
|
|
|
|
@@ -68,31 +72,26 @@ Chapter 1. User's Guide
|
|
|
This module implements TLS related functions to use in the
|
|
|
routing script, and exports pseudo variables with certificate
|
|
|
and TLS parameters.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.2. Dependencies
|
|
|
|
|
|
1.2.1. OpenSER core
|
|
|
|
|
|
OpenSER must be compiled with TLS=1.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.2.2. External Libraries or Applications
|
|
|
|
|
|
The following libraries or applications must be installed
|
|
|
before running OpenSER with this module loaded:
|
|
|
-
|
|
|
* openssl (libssl).
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.3. Exported Parameters
|
|
|
|
|
|
None!
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.4. Exported Functions
|
|
|
|
|
|
-1.4.1. is_peer_verified
|
|
|
+1.4.1. is_peer_verified
|
|
|
|
|
|
Returns 1 if the message is received via TLS and the peer was
|
|
|
verified during TLS connection handshake, otherwise it returns
|
|
|
@@ -100,7 +99,7 @@ Chapter 1. User's Guide
|
|
|
|
|
|
This function can be used from REQUEST_ROUTE.
|
|
|
|
|
|
- Example 1-1. is_peer_verified usage
|
|
|
+ Example 1.1. is_peer_verified usage
|
|
|
...
|
|
|
if (is_peer_verified()) {
|
|
|
xlog("L_INFO","request from verified TLS peer\n");
|
|
|
@@ -108,7 +107,6 @@ if (is_peer_verified()) {
|
|
|
xlog("L_INFO","request not verified\n");
|
|
|
}
|
|
|
...
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5. Pseudo-Variables
|
|
|
|
|
|
@@ -117,150 +115,126 @@ if (is_peer_verified()) {
|
|
|
Some pseudo variables are available for both, the peer'S
|
|
|
certificate and the local certificate. Further, some parameters
|
|
|
can be read from the "Subject" field or the "Issuer" field.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.1. $tls_version
|
|
|
|
|
|
$tls_version - the TLS/SSL version which is used on the TLS
|
|
|
connection from which the message was received. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.2. $tls_description
|
|
|
|
|
|
$tls_description - the TLS/SSL description of the TLS
|
|
|
connection from which the message was received. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.3. $tls_cipher_info
|
|
|
|
|
|
$tls_cipher_info - the TLS/SSL cipher which is used on the TLS
|
|
|
connection from which the message was received. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.4. $tls_cipher_bits
|
|
|
|
|
|
$tls_cipher_bits - the number of cipher bits which are used on
|
|
|
the TLS connection from which the message was received. String
|
|
|
and Integer type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.5. $tls_[peer|my]_version
|
|
|
|
|
|
$tls_[peer|my]_version - the version of the certificate. String
|
|
|
type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.6. $tls_[peer|my]_serial
|
|
|
|
|
|
$tls_[peer|my]_serial - the serial number of the certificate.
|
|
|
String and Integer type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.7. $tls_[peer|my]_[subject|issuer]
|
|
|
|
|
|
$tls_[peer|my]_[subject|issuer] - ASCII dump of the fields in
|
|
|
the issuer/subject section of the certificate. String type.
|
|
|
|
|
|
- Example 1-2. Example of $tls_[peer|my]_[subject|issuer]
|
|
|
+ Example 1.2. Example of $tls_[peer|my]_[subject|issuer]
|
|
|
/C=AT/ST=Vienna/L=Vienna/O=enum.at/CN=enum.at
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.8. $tls_[peer|my]_[subject|issuer]_cn
|
|
|
|
|
|
$tls_[peer|my]_[subject|issuer]_cn - commonName in the
|
|
|
issuer/subject section of the certificate. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.9. $tls_[peer|my]_[subject|issuer]_locality
|
|
|
|
|
|
$tls_[peer|my]_[subject|issuer]_locality - localityName in the
|
|
|
issuer/subject section of the certificate. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.10. $tls_[peer|my]_[subject|issuer]_country
|
|
|
|
|
|
$tls_[peer|my]_[subject|issuer]_country - countryName in the
|
|
|
issuer/subject section of the certificate. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.11. $tls_[peer|my]_[subject|issuer]_state
|
|
|
|
|
|
$tls_[peer|my]_[subject|issuer]_state - stateOrProvinceName in
|
|
|
the issuer/subject section of the certificate. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.12. $tls_[peer|my]_[subject|issuer]_organization
|
|
|
|
|
|
$tls_[peer|my]_[subject|issuer]_organization - organizationName
|
|
|
in the issuer/subject section of the certificate. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.13. $tls_[peer|my]_[subject|issuer]_unit
|
|
|
|
|
|
$tls_[peer|my]_[subject|issuer]_unit - organizationalUnitName
|
|
|
in the issuer/subject section of the certificate. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.14. $tls_[peer|my]_san_email
|
|
|
|
|
|
$tls_[peer|my]_san_email - email address in the "subject
|
|
|
alternative name" extension. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.15. $tls_[peer|my]_san_hostname
|
|
|
|
|
|
$tls_[peer|my]_san_hostname - hostname (DNS) in the "subject
|
|
|
alternative name" extension. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.16. $tls_[peer|my]_san_uri
|
|
|
|
|
|
$tls_[peer|my]_san_uri - URI in the "subject alternative name"
|
|
|
extension. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.17. $tls_[peer|my]_san_ip
|
|
|
|
|
|
$tls_[peer|my]_san_ip - ip address in the "subject alternative
|
|
|
- name' extension. String type. '"
|
|
|
- __________________________________________________________
|
|
|
+ name" extension. String type.
|
|
|
|
|
|
1.5.18. $tls_peer_verified
|
|
|
|
|
|
$tls_peer_verified - Returns 1 if the peer's certificate was
|
|
|
successful verified. Otherwise it returns 0. String and Integer
|
|
|
type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.19. $tls_peer_revoked
|
|
|
|
|
|
$tls_peer_revoked - Returns 1 if the peer's certificate was
|
|
|
revoked. Otherwise it returns 0. String and Integer type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.20. $tls_peer_expired
|
|
|
|
|
|
$tls_peer_expired - Returns 1 if the peer's certificate is
|
|
|
expired. Otherwise it returns 0. String and Integer type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.21. $tls_peer_selfsigned
|
|
|
|
|
|
$tls_peer_selfsigned - Returns 1 if the peer's certificate is
|
|
|
selfsigned. Otherwise it returns 0. String and Integer type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.22. $tls_peer_notBefore
|
|
|
|
|
|
$tls_peer_notBefore - Returns the notBefore validity date of
|
|
|
the peer's certificate. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.5.23. $tls_peer_notAfter
|
|
|
|
|
|
$tls_peer_notAfter - Returns the notAfter validity date of the
|
|
|
peer's certificate. String type.
|
|
|
- __________________________________________________________
|
|
|
|
|
|
1.6. Debug TLS connections
|
|
|
|
|
|
@@ -268,7 +242,7 @@ if (is_peer_verified()) {
|
|
|
statements into your OpenSER.cfg. This will dump all available
|
|
|
TLS pseudo variables.
|
|
|
|
|
|
- Example 1-3. Example of TLS logging
|
|
|
+ Example 1.3. Example of TLS logging
|
|
|
xlog("L_INFO","==================== start TLS pseudo variables =========
|
|
|
========='\n");
|
|
|
xlog("L_INFO","$$tls_version = '$tls_version'\n");
|
|
|
@@ -366,46 +340,45 @@ xlog("L_INFO","$$tls_peer_notAfter = '$tls_peer_notAfter'\n
|
|
|
");
|
|
|
xlog("L_INFO","==================== end TLS pseudo variables ===========
|
|
|
======='\n");
|
|
|
- __________________________________________________________
|
|
|
|
|
|
Chapter 2. Frequently Asked Questions
|
|
|
|
|
|
- 2.1. What is the difference between the TLS directory and the
|
|
|
- TLSOPS module directory?
|
|
|
+ 2.1.
|
|
|
+
|
|
|
+ What is the difference between the TLS directory and the TLSOPS
|
|
|
+ module directory?
|
|
|
|
|
|
- 2.2. Where can I find more about OpenSER?
|
|
|
- 2.3. Where can I post a question about this module?
|
|
|
- 2.4. How can I report a bug?
|
|
|
+ The code in the TLS directory implements the TLS transport
|
|
|
+ layer. The TLSOPS module implements TLS related functions which
|
|
|
+ can be used in the routing script.
|
|
|
|
|
|
- 2.1. What is the difference between the TLS directory and the
|
|
|
- TLSOPS module directory?
|
|
|
+ 2.2.
|
|
|
|
|
|
- The code in the TLS directory implements the TLS transport
|
|
|
- layer. The TLSOPS module implements TLS related functions which
|
|
|
- can be used in the routing script.
|
|
|
+ Where can I find more about OpenSER?
|
|
|
|
|
|
- 2.2. Where can I find more about OpenSER?
|
|
|
+ Take a look at http://openser.org/.
|
|
|
|
|
|
- Take a look at http://openser.org/.
|
|
|
+ 2.3.
|
|
|
|
|
|
- 2.3. Where can I post a question about this module?
|
|
|
+ Where can I post a question about this module?
|
|
|
|
|
|
- First at all check if your question was already answered on one
|
|
|
- of our mailing lists:
|
|
|
+ First at all check if your question was already answered on one
|
|
|
+ of our mailing lists:
|
|
|
+ * User Mailing List -
|
|
|
+ http://openser.org/cgi-bin/mailman/listinfo/users
|
|
|
+ * Developer Mailing List -
|
|
|
+ http://openser.org/cgi-bin/mailman/listinfo/devel
|
|
|
|
|
|
- * User Mailing List -
|
|
|
- http://openser.org/cgi-bin/mailman/listinfo/users
|
|
|
- * Developer Mailing List -
|
|
|
- http://openser.org/cgi-bin/mailman/listinfo/devel
|
|
|
+ E-mails regarding any stable OpenSER release should be sent to
|
|
|
+ <[email protected]> and e-mails regarding development versions
|
|
|
+ should be sent to <[email protected]>.
|
|
|
|
|
|
- E-mails regarding any stable OpenSER release should be sent to
|
|
|
- <[email protected]> and e-mails regarding development versions
|
|
|
- should be sent to <[email protected]>.
|
|
|
+ If you want to keep the mail private, send it to
|
|
|
+ <[email protected]>.
|
|
|
|
|
|
- If you want to keep the mail private, send it to
|
|
|
- <[email protected]>.
|
|
|
+ 2.4.
|
|
|
|
|
|
- 2.4. How can I report a bug?
|
|
|
+ How can I report a bug?
|
|
|
|
|
|
- Please follow the guidelines provided at:
|
|
|
- http://sourceforge.net/tracker/?group_id=139143.
|
|
|
+ Please follow the guidelines provided at:
|
|
|
+ http://sourceforge.net/tracker/?group_id=139143.
|
Daniel-Constantin Mierla