Asterisk
/
asterisk
mirror of https://github.com/asterisk/asterisk
1
0
Fork 0
Code Issues Releases Wiki Activity

pjsip: Add TLS transport reload support for certificate and key.

Browse Source 
This change adds support using the pjsip_tls_transport_restart
function for reloading the TLS certificate and key, if the filenames
remain unchanged. This is useful for Let's Encrypt and other
situations. Note that no restart of the transport will occur if
the certificate and key remain unchanged.

ASTERISK-30186

Change-Id: I9bc95a6bf791830a9491ad9fa43c17d4010028d0
pull/30/head
Joshua C. Colp 3 years ago committed by Friendly Automation
parent b2fdccc6a4
commit cffaf12d19
11 changed files with 389 additions and 127 deletions
Show Stats Download Patch File Download Diff File

9
configs/samples/pjsip.conf.sample
Unescape View File

@ -1054,11 +1054,16 @@
; and/or "asterisk_ecc.pem" are loaded (certificate, inter-
; mediates, private key), to support multiple algorithms for
; server authentication (RSA, DSA, ECDSA). If the chains are
; different, at least OpenSSL 1.0.2 is required.
; different, at least OpenSSL 1.0.2 is required. This option
; can be reloaded resulting in an updated certificate if the
; filename remains unchanged.
; (default: "")
;cipher= ; Preferred cryptography cipher names TLS ONLY (default: "")
;method= ; Method of SSL transport TLS ONLY (default: "")
;priv_key_file= ; Private key file TLS ONLY (default: "")
;priv_key_file= ; Private key file TLS ONLY. This option can be reloaded
; resulting in an updated private key if the filename remains
; unchanged.
; (default: "")
;verify_client= ; Require verification of client certificate TLS ONLY (default:
; "")
;verify_server= ; Require verification of server certificate TLS ONLY (default:

243
configure vendored
Unescape View File

@ -940,6 +940,10 @@ PBX_POPT
POPT_DIR
POPT_INCLUDE
POPT_LIB
PBX_PJSIP_TLS_TRANSPORT_RESTART
PJSIP_TLS_TRANSPORT_RESTART_DIR
PJSIP_TLS_TRANSPORT_RESTART_INCLUDE
PJSIP_TLS_TRANSPORT_RESTART_LIB
PBX_PJSIP_OAUTH_AUTHENTICATION
PJSIP_OAUTH_AUTHENTICATION_DIR
PJSIP_OAUTH_AUTHENTICATION_INCLUDE
@ -10213,8 +10217,8 @@ printf "%s\n" "$as_me: checking whether system openssl > 1.1.0" >&6;}
if test "x${PBX_OPENSSL}" != "x1" -a "${USE_OPENSSL}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for openssl >= 1.1.0" >&5
printf %s "checking for openssl >= 1.1.0... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for OPENSSL" >&5
printf %s "checking for OPENSSL... " >&6; }
if test -n "$OPENSSL_CFLAGS"; then
pkg_cv_OPENSSL_CFLAGS="$OPENSSL_CFLAGS"
@ -10254,7 +10258,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -10275,7 +10279,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_OPENSSL=0
@ -10304,8 +10308,8 @@ printf "%s\n" "$as_me: checking whether alternate openssl11 is installed" >&6;}
if test "x${PBX_OPENSSL}" != "x1" -a "${USE_OPENSSL}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for openssl11" >&5
printf %s "checking for openssl11... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for OPENSSL" >&5
printf %s "checking for OPENSSL... " >&6; }
if test -n "$OPENSSL_CFLAGS"; then
pkg_cv_OPENSSL_CFLAGS="$OPENSSL_CFLAGS"
@ -10345,7 +10349,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -10366,7 +10370,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_OPENSSL=0
@ -10400,8 +10404,8 @@ printf "%s\n" "$as_me: checking fallback system openssl" >&6;}
if test "x${PBX_OPENSSL}" != "x1" -a "${USE_OPENSSL}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for openssl" >&5
printf %s "checking for openssl... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for OPENSSL" >&5
printf %s "checking for OPENSSL... " >&6; }
if test -n "$OPENSSL_CFLAGS"; then
pkg_cv_OPENSSL_CFLAGS="$OPENSSL_CFLAGS"
@ -10441,7 +10445,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -10462,7 +10466,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_OPENSSL=0
@ -11087,6 +11091,9 @@ printf "%s\n" "#define HAVE_PJSIP_OAUTH_AUTHENTICATION 1" >>confdefs.h
printf "%s\n" "#define HAVE_PJPROJECT_ON_VALID_ICE_PAIR_CALLBACK 1" >>confdefs.h
printf "%s\n" "#define HAVE_PJSIP_TLS_TRANSPORT_RESTART 1" >>confdefs.h
@ -13162,6 +13169,18 @@ PBX_PJSIP_OAUTH_AUTHENTICATION=0
PJSIP_TLS_TRANSPORT_RESTART_DESCRIP="PJSIP TLS Transport Restart Support"
PJSIP_TLS_TRANSPORT_RESTART_OPTION=pjsip
PJSIP_TLS_TRANSPORT_RESTART_DIR=${PJPROJECT_DIR}
PBX_PJSIP_TLS_TRANSPORT_RESTART=0
fi
@ -14835,8 +14854,8 @@ fi
if test "x${PBX_LIBEDIT}" != "x1" -a "${USE_LIBEDIT}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libedit" >&5
printf %s "checking for libedit... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for LIBEDIT" >&5
printf %s "checking for LIBEDIT... " >&6; }
if test -n "$LIBEDIT_CFLAGS"; then
pkg_cv_LIBEDIT_CFLAGS="$LIBEDIT_CFLAGS"
@ -14876,7 +14895,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -14897,7 +14916,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_LIBEDIT=0
@ -15296,8 +15315,8 @@ if test "$JANSSON_BUNDLED" = "no" ; then
if test "x${PBX_JANSSON}" != "x1" -a "${USE_JANSSON}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for jansson >= 2.11" >&5
printf %s "checking for jansson >= 2.11... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for JANSSON" >&5
printf %s "checking for JANSSON... " >&6; }
if test -n "$JANSSON_CFLAGS"; then
pkg_cv_JANSSON_CFLAGS="$JANSSON_CFLAGS"
@ -15337,7 +15356,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -15358,7 +15377,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_JANSSON=0
@ -15614,8 +15633,8 @@ fi
if test "x${PBX_LIBXML2}" != "x1" -a "${USE_LIBXML2}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libxml-2.0" >&5
printf %s "checking for libxml-2.0... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for LIBXML2" >&5
printf %s "checking for LIBXML2... " >&6; }
if test -n "$LIBXML2_CFLAGS"; then
pkg_cv_LIBXML2_CFLAGS="$LIBXML2_CFLAGS"
@ -15655,7 +15674,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -15676,7 +15695,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_LIBXML2=0
@ -22889,8 +22908,8 @@ if test "${USE_ILBC}" != "no"; then
if test "x${PBX_ILBC}" != "x1" -a "${USE_ILBC}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libilbc" >&5
printf %s "checking for libilbc... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ILBC" >&5
printf %s "checking for ILBC... " >&6; }
if test -n "$ILBC_CFLAGS"; then
pkg_cv_ILBC_CFLAGS="$ILBC_CFLAGS"
@ -22930,7 +22949,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -22951,7 +22970,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_ILBC=0
@ -25148,8 +25167,8 @@ rm -f core conftest.err conftest.$ac_objext conftest.beam \
if test "x${PBX_NETSNMP}" != "x1" -a "${USE_NETSNMP}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for netsnmp-agent" >&5
printf %s "checking for netsnmp-agent... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for NETSNMP" >&5
printf %s "checking for NETSNMP... " >&6; }
if test -n "$NETSNMP_CFLAGS"; then
pkg_cv_NETSNMP_CFLAGS="$NETSNMP_CFLAGS"
@ -25189,7 +25208,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -25210,7 +25229,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_NETSNMP=0
@ -26575,8 +26594,8 @@ if test "$USE_PJPROJECT" != "no" ; then
if test "x${PBX_PJPROJECT}" != "x1" -a "${USE_PJPROJECT}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libpjproject" >&5
printf %s "checking for libpjproject... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for PJPROJECT" >&5
printf %s "checking for PJPROJECT... " >&6; }
if test -n "$PJPROJECT_CFLAGS"; then
pkg_cv_PJPROJECT_CFLAGS="$PJPROJECT_CFLAGS"
@ -26616,7 +26635,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -26637,7 +26656,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_PJPROJECT=0
@ -27824,6 +27843,102 @@ _ACEOF
fi
if test "x${PBX_PJSIP_TLS_TRANSPORT_RESTART}" != "x1" -a "${USE_PJSIP_TLS_TRANSPORT_RESTART}" != "no"; then
pbxlibdir=""
# if --with-PJSIP_TLS_TRANSPORT_RESTART=DIR has been specified, use it.
if test "x${PJSIP_TLS_TRANSPORT_RESTART_DIR}" != "x"; then
if test -d ${PJSIP_TLS_TRANSPORT_RESTART_DIR}/lib; then
pbxlibdir="-L${PJSIP_TLS_TRANSPORT_RESTART_DIR}/lib"
else
pbxlibdir="-L${PJSIP_TLS_TRANSPORT_RESTART_DIR}"
fi
fi
ast_ext_lib_check_save_CFLAGS="${CFLAGS}"
CFLAGS="${CFLAGS} $PJPROJECT_CFLAGS"
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pjsip_tls_transport_restart in -lpjsip" >&5
printf %s "checking for pjsip_tls_transport_restart in -lpjsip... " >&6; }
if test ${ac_cv_lib_pjsip_pjsip_tls_transport_restart+y}
then :
printf %s "(cached) " >&6
else $as_nop
ac_check_lib_save_LIBS=$LIBS
LIBS="-lpjsip ${pbxlibdir} $PJPROJECT_LIB $LIBS"
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h. */
/* Override any GCC internal prototype to avoid an error.
Use char because int might match the return type of a GCC
builtin and then its argument prototype would still apply. */
char pjsip_tls_transport_restart ();
int
main (void)
{
return pjsip_tls_transport_restart ();
;
return 0;
}
_ACEOF
if ac_fn_c_try_link "$LINENO"
then :
ac_cv_lib_pjsip_pjsip_tls_transport_restart=yes
else $as_nop
ac_cv_lib_pjsip_pjsip_tls_transport_restart=no
fi
rm -f core conftest.err conftest.$ac_objext conftest.beam \
conftest$ac_exeext conftest.$ac_ext
LIBS=$ac_check_lib_save_LIBS
fi
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_pjsip_pjsip_tls_transport_restart" >&5
printf "%s\n" "$ac_cv_lib_pjsip_pjsip_tls_transport_restart" >&6; }
if test "x$ac_cv_lib_pjsip_pjsip_tls_transport_restart" = xyes
then :
AST_PJSIP_TLS_TRANSPORT_RESTART_FOUND=yes
else $as_nop
AST_PJSIP_TLS_TRANSPORT_RESTART_FOUND=no
fi
CFLAGS="${ast_ext_lib_check_save_CFLAGS}"
# now check for the header.
if test "${AST_PJSIP_TLS_TRANSPORT_RESTART_FOUND}" = "yes"; then
PJSIP_TLS_TRANSPORT_RESTART_LIB="${pbxlibdir} -lpjsip $PJPROJECT_LIB"
# if --with-PJSIP_TLS_TRANSPORT_RESTART=DIR has been specified, use it.
if test "x${PJSIP_TLS_TRANSPORT_RESTART_DIR}" != "x"; then
PJSIP_TLS_TRANSPORT_RESTART_INCLUDE="-I${PJSIP_TLS_TRANSPORT_RESTART_DIR}/include"
fi
PJSIP_TLS_TRANSPORT_RESTART_INCLUDE="${PJSIP_TLS_TRANSPORT_RESTART_INCLUDE} $PJPROJECT_CFLAGS"
# check for the header
ast_ext_lib_check_saved_CPPFLAGS="${CPPFLAGS}"
CPPFLAGS="${CPPFLAGS} ${PJSIP_TLS_TRANSPORT_RESTART_INCLUDE}"
ac_fn_c_check_header_compile "$LINENO" "pjsip.h" "ac_cv_header_pjsip_h" "$ac_includes_default"
if test "x$ac_cv_header_pjsip_h" = xyes
then :
PJSIP_TLS_TRANSPORT_RESTART_HEADER_FOUND=1
else $as_nop
PJSIP_TLS_TRANSPORT_RESTART_HEADER_FOUND=0
fi
CPPFLAGS="${ast_ext_lib_check_saved_CPPFLAGS}"
if test "x${PJSIP_TLS_TRANSPORT_RESTART_HEADER_FOUND}" = "x0" ; then
PJSIP_TLS_TRANSPORT_RESTART_LIB=""
PJSIP_TLS_TRANSPORT_RESTART_INCLUDE=""
else
PBX_PJSIP_TLS_TRANSPORT_RESTART=1
cat >>confdefs.h <<_ACEOF
#define HAVE_PJSIP_TLS_TRANSPORT_RESTART 1
_ACEOF
fi
fi
fi
fi
fi
@ -27835,8 +27950,8 @@ fi
if test "x${PBX_PYTHONDEV}" != "x1" -a "${USE_PYTHONDEV}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for python-2.7" >&5
printf %s "checking for python-2.7... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for PYTHONDEV" >&5
printf %s "checking for PYTHONDEV... " >&6; }
if test -n "$PYTHONDEV_CFLAGS"; then
pkg_cv_PYTHONDEV_CFLAGS="$PYTHONDEV_CFLAGS"
@ -27876,7 +27991,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -27897,7 +28012,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_PYTHONDEV=0
@ -27923,8 +28038,8 @@ fi
if test "x${PBX_PYTHONDEV}" != "x1" -a "${USE_PYTHONDEV}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for python2" >&5
printf %s "checking for python2... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for PYTHONDEV" >&5
printf %s "checking for PYTHONDEV... " >&6; }
if test -n "$PYTHONDEV_CFLAGS"; then
pkg_cv_PYTHONDEV_CFLAGS="$PYTHONDEV_CFLAGS"
@ -27964,7 +28079,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -27985,7 +28100,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_PYTHONDEV=0
@ -28011,8 +28126,8 @@ fi
if test "x${PBX_PYTHONDEV}" != "x1" -a "${USE_PYTHONDEV}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for python" >&5
printf %s "checking for python... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for PYTHONDEV" >&5
printf %s "checking for PYTHONDEV... " >&6; }
if test -n "$PYTHONDEV_CFLAGS"; then
pkg_cv_PYTHONDEV_CFLAGS="$PYTHONDEV_CFLAGS"
@ -28052,7 +28167,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -28073,7 +28188,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_PYTHONDEV=0
@ -28207,8 +28322,8 @@ fi
if test "x${PBX_PORTAUDIO}" != "x1" -a "${USE_PORTAUDIO}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for portaudio-2.0" >&5
printf %s "checking for portaudio-2.0... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for PORTAUDIO" >&5
printf %s "checking for PORTAUDIO... " >&6; }
if test -n "$PORTAUDIO_CFLAGS"; then
pkg_cv_PORTAUDIO_CFLAGS="$PORTAUDIO_CFLAGS"
@ -28248,7 +28363,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -28269,7 +28384,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_PORTAUDIO=0
@ -34125,8 +34240,8 @@ for ver in 3.0 2.6 2.4 2.2 2.0; do
if test "x${PBX_GMIME}" != "x1" -a "${USE_GMIME}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for gmime-$ver" >&5
printf %s "checking for gmime-$ver... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for GMIME" >&5
printf %s "checking for GMIME... " >&6; }
if test -n "$GMIME_CFLAGS"; then
pkg_cv_GMIME_CFLAGS="$GMIME_CFLAGS"
@ -34166,7 +34281,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -34187,7 +34302,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_GMIME=0
@ -35485,8 +35600,8 @@ fi
if test "x${PBX_GTK2}" != "x1" -a "${USE_GTK2}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for gtk+-2.0" >&5
printf %s "checking for gtk+-2.0... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for GTK2" >&5
printf %s "checking for GTK2... " >&6; }
if test -n "$GTK2_CFLAGS"; then
pkg_cv_GTK2_CFLAGS="$GTK2_CFLAGS"
@ -35526,7 +35641,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -35547,7 +35662,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_GTK2=0
@ -35596,8 +35711,8 @@ fi
if test "x${PBX_SYSTEMD}" != "x1" -a "${USE_SYSTEMD}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libsystemd" >&5
printf %s "checking for libsystemd... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
printf %s "checking for SYSTEMD... " >&6; }
if test -n "$SYSTEMD_CFLAGS"; then
pkg_cv_SYSTEMD_CFLAGS="$SYSTEMD_CFLAGS"
@ -35637,7 +35752,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -35658,7 +35773,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_SYSTEMD=0

2
configure.ac
Unescape View File

@ -589,6 +589,7 @@ AST_EXT_LIB_SETUP_OPTIONAL([PJSIP_INV_ACCEPT_MULTIPLE_SDP_ANSWERS], [PJSIP INVIT
AST_EXT_LIB_SETUP_OPTIONAL([PJSIP_ENDPOINT_COMPACT_FORM], [PJSIP Compact Form Support on Endpoint], [PJPROJECT], [pjsip])
AST_EXT_LIB_SETUP_OPTIONAL([PJSIP_TRANSPORT_DISABLE_CONNECTION_REUSE], [PJSIP Transport Connection Reuse Disabling], [PJPROJECT], [pjsip])
AST_EXT_LIB_SETUP_OPTIONAL([PJSIP_OAUTH_AUTHENTICATION], [PJSIP OAuth Authentication Support], [PJPROJECT], [pjsip])
AST_EXT_LIB_SETUP_OPTIONAL([PJSIP_TLS_TRANSPORT_RESTART], [PJSIP TLS Transport Restart Support], [PJPROJECT], [pjsip])
fi
AST_EXT_LIB_SETUP([POPT], [popt], [popt])
@ -2495,6 +2496,7 @@ if test "$USE_PJPROJECT" != "no" ; then
AST_EXT_LIB_CHECK([PJSIP_INV_SESSION_REF], [pjsip], [pjsip_inv_add_ref], [pjsip.h], [$PJPROJECT_LIB], [$PJPROJECT_CFLAGS])
AST_EXT_LIB_CHECK([PJSIP_AUTH_CLT_DEINIT], [pjsip], [pjsip_auth_clt_deinit], [pjsip.h], [$PJPROJECT_LIB], [$PJPROJECT_CFLAGS])
AST_EXT_LIB_CHECK([PJSIP_TSX_LAYER_FIND_TSX2], [pjsip], [pjsip_tsx_layer_find_tsx2], [pjsip.h], [$PJPROJECT_LIB], [$PJPROJECT_CFLAGS])
AST_EXT_LIB_CHECK([PJSIP_TLS_TRANSPORT_RESTART], [pjsip], [pjsip_tls_transport_restart], [pjsip.h], [$PJPROJECT_LIB], [$PJPROJECT_CFLAGS])
fi
fi

5
doc/CHANGES-staging/res_pjsip_tls_cert_key_reload.txt
Unescape View File

@ -0,0 +1,5 @@
Subject: res_pjsip
TLS transports in res_pjsip can now reload their TLS certificate
and private key files, provided the filename of them has not
changed.

125
include/asterisk/autoconfig.h.in
Unescape View File

@ -19,19 +19,14 @@
of a mutex to its initializer. */
#undef CAN_COMPARE_MUTEX_TO_INIT_VALUE
/* Define to 1 if the `closedir' function returns void instead of `int'. */
/* Define to 1 if the `closedir' function returns void instead of int. */
#undef CLOSEDIR_VOID
/* Some configure tests will unexpectedly fail if configure is run by a
non-root user. These may be able to be tested at runtime. */
#undef CONFIGURE_RAN_AS_ROOT
/* Define to one of `_getb67', `GETB67', `getb67' for Cray-2 and Cray-YMP
systems. This function is required for `alloca.c' support on those systems.
*/
#undef CRAY_STACKSEG_END
/* Define to 1 if using `alloca.c'. */
/* Define to 1 if using 'alloca.c'. */
#undef C_ALLOCA
/* Define to 1 if anonymous semaphores work. */
@ -43,11 +38,10 @@
/* Define to 1 if you have the `acosl' function. */
#undef HAVE_ACOSL
/* Define to 1 if you have `alloca', as a function or macro. */
/* Define to 1 if you have 'alloca', as a function or macro. */
#undef HAVE_ALLOCA
/* Define to 1 if you have <alloca.h> and it should be used (not on Ultrix).
*/
/* Define to 1 if <alloca.h> works. */
#undef HAVE_ALLOCA_H
/* Define to 1 if you have the Advanced Linux Sound Architecture library. */
@ -505,12 +499,12 @@
/* Define to 1 if you have the `memmove' function. */
#undef HAVE_MEMMOVE
/* Define to 1 if you have the <memory.h> header file. */
#undef HAVE_MEMORY_H
/* Define to 1 if you have the `memset' function. */
#undef HAVE_MEMSET
/* Define to 1 if you have the <minix/config.h> header file. */
#undef HAVE_MINIX_CONFIG_H
/* Define to 1 if you have the `mkdir' function. */
#undef HAVE_MKDIR
@ -656,6 +650,10 @@
/* Define if your system has the PJSIP_TLS_TRANSPORT_PROTO headers. */
#undef HAVE_PJSIP_TLS_TRANSPORT_PROTO
/* Define to 1 if PJPROJECT has the PJSIP TLS Transport Restart Support
feature. */
#undef HAVE_PJSIP_TLS_TRANSPORT_RESTART
/* Define if your system has the PJSIP_TRANSPORT_DISABLE_CONNECTION_REUSE
headers. */
#undef HAVE_PJSIP_TRANSPORT_DISABLE_CONNECTION_REUSE
@ -1246,6 +1244,9 @@
/* Define to 1 if you have the `vprintf' function. */
#undef HAVE_VPRINTF
/* Define to 1 if you have the <wchar.h> header file. */
#undef HAVE_WCHAR_H
/* Define to 1 if you have the <winsock2.h> header file. */
#undef HAVE_WINSOCK2_H
@ -1400,10 +1401,13 @@
STACK_DIRECTION = 0 => direction of growth unknown */
#undef STACK_DIRECTION
/* Define to 1 if you have the ANSI C header files. */
/* Define to 1 if all of the C90 standard headers exist (not just the ones
required in a freestanding environment). This macro is provided for
backward compatibility; new code need not use it. */
#undef STDC_HEADERS
/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. This
macro is obsolete. */
#undef TIME_WITH_SYS_TIME
/* Define to 1 if your <sys/time.h> declares `struct tm'. */
@ -1416,32 +1420,93 @@
#ifndef _ALL_SOURCE
# undef _ALL_SOURCE
#endif
/* Enable general extensions on macOS. */
#ifndef _DARWIN_C_SOURCE
# undef _DARWIN_C_SOURCE
#endif
/* Enable general extensions on Solaris. */
#ifndef __EXTENSIONS__
# undef __EXTENSIONS__
#endif
/* Enable GNU extensions on systems that have them. */
#ifndef _GNU_SOURCE
# undef _GNU_SOURCE
#endif
/* Enable threading extensions on Solaris. */
/* Enable X/Open compliant socket functions that do not require linking
with -lxnet on HP-UX 11.11. */
#ifndef _HPUX_ALT_XOPEN_SOCKET_API
# undef _HPUX_ALT_XOPEN_SOCKET_API
#endif
/* Identify the host operating system as Minix.
This macro does not affect the system headers' behavior.
A future release of Autoconf may stop defining this macro. */
#ifndef _MINIX
# undef _MINIX
#endif
/* Enable general extensions on NetBSD.
Enable NetBSD compatibility extensions on Minix. */
#ifndef _NETBSD_SOURCE
# undef _NETBSD_SOURCE
#endif
/* Enable OpenBSD compatibility extensions on NetBSD.
Oddly enough, this does nothing on OpenBSD. */
#ifndef _OPENBSD_SOURCE
# undef _OPENBSD_SOURCE
#endif
/* Define to 1 if needed for POSIX-compatible behavior. */
#ifndef _POSIX_SOURCE
# undef _POSIX_SOURCE
#endif
/* Define to 2 if needed for POSIX-compatible behavior. */
#ifndef _POSIX_1_SOURCE
# undef _POSIX_1_SOURCE
#endif
/* Enable POSIX-compatible threading on Solaris. */
#ifndef _POSIX_PTHREAD_SEMANTICS
# undef _POSIX_PTHREAD_SEMANTICS
#endif
/* Enable extensions specified by ISO/IEC TS 18661-5:2014. */
#ifndef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
# undef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-1:2014. */
#ifndef __STDC_WANT_IEC_60559_BFP_EXT__
# undef __STDC_WANT_IEC_60559_BFP_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-2:2015. */
#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
# undef __STDC_WANT_IEC_60559_DFP_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-4:2015. */
#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
# undef __STDC_WANT_IEC_60559_FUNCS_EXT__
#endif
/* Enable extensions specified by ISO/IEC TS 18661-3:2015. */
#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
# undef __STDC_WANT_IEC_60559_TYPES_EXT__
#endif
/* Enable extensions specified by ISO/IEC TR 24731-2:2010. */
#ifndef __STDC_WANT_LIB_EXT2__
# undef __STDC_WANT_LIB_EXT2__
#endif
/* Enable extensions specified by ISO/IEC 24747:2009. */
#ifndef __STDC_WANT_MATH_SPEC_FUNCS__
# undef __STDC_WANT_MATH_SPEC_FUNCS__
#endif
/* Enable extensions on HP NonStop. */
#ifndef _TANDEM_SOURCE
# undef _TANDEM_SOURCE
#endif
/* Enable general extensions on Solaris. */
#ifndef __EXTENSIONS__
# undef __EXTENSIONS__
/* Enable X/Open extensions. Define to 500 only if necessary
to make mbstate_t available. */
#ifndef _XOPEN_SOURCE
# undef _XOPEN_SOURCE
#endif
/* Define to 1 if running on Darwin. */
#undef _DARWIN_UNLIMITED_SELECT
/* Enable large inode numbers on Mac OS X 10.5. */
#ifndef _DARWIN_USE_64_BIT_INODE
# define _DARWIN_USE_64_BIT_INODE 1
#endif
/* Number of bits in a file offset, on hosts where this is settable. */
#undef _FILE_OFFSET_BITS
@ -1459,16 +1524,6 @@
/* Define for large files, on AIX-style hosts. */
#undef _LARGE_FILES
/* Define to 1 if on MINIX. */
#undef _MINIX
/* Define to 2 if the system does not provide POSIX.1 features except with
this defined. */
#undef _POSIX_1_SOURCE
/* Define to 1 if you need to in order for `stat' and other things to work. */
#undef _POSIX_SOURCE
/* Define to empty if `const' does not conform to ANSI C. */
#undef const
@ -1490,7 +1545,7 @@
/* Define to `long int' if <sys/types.h> does not define. */
#undef off_t
/* Define to `int' if <sys/types.h> does not define. */
/* Define as a signed integer type capable of holding a process identifier. */
#undef pid_t
/* Define to `unsigned int' if <sys/types.h> does not define. */

15
include/asterisk/res_pjsip.h
Unescape View File

@ -51,6 +51,11 @@
#include "asterisk/stasis_endpoints.h"
#include "asterisk/stream.h"
#ifdef HAVE_PJSIP_TLS_TRANSPORT_RESTART
/* Needed for knowing if the cert or priv key files changed */
#include <sys/stat.h>
#endif
#define PJSIP_MINVERSION(m,n,p) (((m << 24) | (n << 16) | (p << 8)) >= PJ_VERSION_NUM)
#ifndef PJSIP_EXPIRES_NOT_SPECIFIED
@ -184,6 +189,16 @@ struct ast_sip_transport_state {
* If true, fail if server certificate cannot verify (TLS only)
*/
int verify_server;
#ifdef HAVE_PJSIP_TLS_TRANSPORT_RESTART
/*!
* The stats information for the certificate file, if configured
*/
struct stat cert_file_stat;
/*!
* The stats information for the private key file, if configured
*/
struct stat privkey_file_stat;
#endif
};
#define ast_sip_transport_is_nonlocal(transport_state, addr) \

22
menuselect/autoconfig.h.in
Unescape View File

@ -4,19 +4,13 @@
#define MENUSELECT_AUTOCONFIG_H
/* Define to one of `_getb67', `GETB67', `getb67' for Cray-2 and Cray-YMP
systems. This function is required for `alloca.c' support on those systems.
*/
#undef CRAY_STACKSEG_END
/* Define to 1 if using `alloca.c'. */
/* Define to 1 if using 'alloca.c'. */
#undef C_ALLOCA
/* Define to 1 if you have `alloca', as a function or macro. */
/* Define to 1 if you have 'alloca', as a function or macro. */
#undef HAVE_ALLOCA
/* Define to 1 if you have <alloca.h> and it should be used (not on Ultrix).
*/
/* Define to 1 if <alloca.h> works. */
#undef HAVE_ALLOCA_H
/* Define to 1 if you have the `asprintf' function. */
@ -37,9 +31,6 @@
/* Define if your system has the LIBXML2 libraries. */
#undef HAVE_LIBXML2
/* Define to 1 if you have the <memory.h> header file. */
#undef HAVE_MEMORY_H
/* Define to 1 if you have the ncurses library. */
#undef HAVE_NCURSES
@ -52,6 +43,9 @@
/* Define to 1 if you have the <stdint.h> header file. */
#undef HAVE_STDINT_H
/* Define to 1 if you have the <stdio.h> header file. */
#undef HAVE_STDIO_H
/* Define to 1 if you have the <stdlib.h> header file. */
#undef HAVE_STDLIB_H
@ -117,7 +111,9 @@
STACK_DIRECTION = 0 => direction of growth unknown */
#undef STACK_DIRECTION
/* Define to 1 if you have the ANSI C header files. */
/* Define to 1 if all of the C90 standard headers exist (not just the ones
required in a freestanding environment). This macro is provided for
backward compatibility; new code need not use it. */
#undef STDC_HEADERS
/* Define to `unsigned int' if <sys/types.h> does not define. */

16
menuselect/configure vendored
Unescape View File

@ -5024,8 +5024,8 @@ printf "%s\n" "$ac_cv_path_SED" >&6; }
if test "x${PBX_LIBXML2}" != "x1" -a "${USE_LIBXML2}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libxml-2.0" >&5
printf %s "checking for libxml-2.0... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for LIBXML2" >&5
printf %s "checking for LIBXML2... " >&6; }
if test -n "$LIBXML2_CFLAGS"; then
pkg_cv_LIBXML2_CFLAGS="$LIBXML2_CFLAGS"
@ -5065,7 +5065,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -5086,7 +5086,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_LIBXML2=0
@ -5270,8 +5270,8 @@ fi
if test "x${PBX_GTK2}" != "x1" -a "${USE_GTK2}" != "no"; then
pkg_failed=no
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for gtk+-2.0" >&5
printf %s "checking for gtk+-2.0... " >&6; }
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for GTK2" >&5
printf %s "checking for GTK2... " >&6; }
if test -n "$GTK2_CFLAGS"; then
pkg_cv_GTK2_CFLAGS="$GTK2_CFLAGS"
@ -5311,7 +5311,7 @@ fi
if test $pkg_failed = yes; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@ -5332,7 +5332,7 @@ fi
elif test $pkg_failed = untried; then
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
printf "%s\n" "no" >&6; }
PBX_GTK2=0

70
res/res_pjsip/config_transport.c
Unescape View File

@ -577,6 +577,22 @@ static void copy_state_to_transport(struct ast_sip_transport *transport)
memcpy(&transport->external_address, &transport->state->external_signaling_address, sizeof(transport->external_signaling_address));
}
#ifdef HAVE_PJSIP_TLS_TRANSPORT_RESTART
static int file_stat_cmp(const struct stat *old_stat, const struct stat *new_stat)
{
return old_stat->st_size != new_stat->st_size
|| old_stat->st_mtime != new_stat->st_mtime
#if defined(HAVE_STRUCT_STAT_ST_MTIM)
|| old_stat->st_mtim.tv_nsec != new_stat->st_mtim.tv_nsec
#elif defined(HAVE_STRUCT_STAT_ST_MTIMENSEC)
|| old_stat->st_mtimensec != new_stat->st_mtimensec
#elif defined(HAVE_STRUCT_STAT_ST_MTIMESPEC)
|| old_stat->st_mtimespec.tv_nsec != new_stat->st_mtimespec.tv_nsec
#endif
;
}
#endif
static int has_state_changed(struct ast_sip_transport_state *a, struct ast_sip_transport_state *b)
{
if (a->type != b->type) {
@ -618,6 +634,12 @@ static int has_state_changed(struct ast_sip_transport_state *a, struct ast_sip_t
return -1;
}
#ifdef HAVE_PJSIP_TLS_TRANSPORT_RESTART
if (file_stat_cmp(&a->cert_file_stat, &b->cert_file_stat) || file_stat_cmp(&a->privkey_file_stat, &b->privkey_file_stat)) {
return -1;
}
#endif
return 0;
}
@ -742,11 +764,31 @@ static int transport_apply(const struct ast_sorcery *sorcery, void *obj)
res = PJ_SUCCESS;
} else if (!transport->allow_reload && perm_state) {
/* We inherit the transport from perm state, untouched */
#ifdef HAVE_PJSIP_TLS_TRANSPORT_RESTART
ast_log(LOG_NOTICE, "Transport '%s' is not fully reloadable, not reloading: protocol, bind, TLS (everything but certificate and private key if filename is unchanged), TCP, ToS, or CoS options.\n", transport_id);
/* If this is a TLS transport and the certificate or private key has changed, then restart the transport so it uses the new one */
if (transport->type == AST_TRANSPORT_TLS) {
if (strcmp(perm_state->transport->cert_file, temp_state->transport->cert_file) ||
strcmp(perm_state->transport->privkey_file, temp_state->transport->privkey_file)) {
ast_log(LOG_ERROR, "Unable to restart TLS transport '%s' as certificate or private key filename has changed\n",
transport_id);
} else if (file_stat_cmp(&perm_state->state->cert_file_stat, &temp_state->state->cert_file_stat) ||
file_stat_cmp(&perm_state->state->privkey_file_stat, &temp_state->state->privkey_file_stat)) {
if (pjsip_tls_transport_restart(perm_state->state->factory, &perm_state->state->host, NULL) != PJ_SUCCESS) {
ast_log(LOG_ERROR, "Failed to restart TLS transport '%s'\n", transport_id);
} else {
sprintf(perm_state->state->factory->info, "%s", transport_id);
}
}
}
#else
ast_log(LOG_NOTICE, "Transport '%s' is not fully reloadable, not reloading: protocol, bind, TLS, TCP, ToS, or CoS options.\n", transport_id);
#endif
temp_state->state->transport = perm_state->state->transport;
perm_state->state->transport = NULL;
temp_state->state->factory = perm_state->state->factory;
perm_state->state->factory = NULL;
res = PJ_SUCCESS;
} else if (transport->type == AST_TRANSPORT_UDP) {
@ -841,8 +883,12 @@ static int transport_apply(const struct ast_sorcery *sorcery, void *obj)
}
if (res == PJ_SUCCESS) {
/*
* PJSIP uses 100 bytes to store information, and during a restart will repopulate
* the field so ensure there is sufficient space - even though we'll revert it after.
*/
temp_state->state->factory->info = pj_pool_alloc(
temp_state->state->factory->pool, (strlen(transport_id) + 1));
temp_state->state->factory->pool, (MAX(MAX_OBJECT_FIELD, 100) + 1));
/*
* Store transport id on the factory instance so it can be used
* later to look up the transport state.
@ -918,18 +964,34 @@ static int transport_tls_file_handler(const struct aco_option *opt, struct ast_v
ast_string_field_set(transport, ca_list_file, var->value);
} else if (!strcasecmp(var->name, "ca_list_path")) {
#ifdef HAVE_PJ_SSL_CERT_LOAD_FROM_FILES2
state->tls.ca_list_path = pj_str((char*)var->value);
state->tls.ca_list_path = pj_str((char *)var->value);
ast_string_field_set(transport, ca_list_path, var->value);
#else
ast_log(LOG_WARNING, "Asterisk has been built against a version of pjproject that does not "
"support the 'ca_list_path' option. Please upgrade to version 2.4 or later.\n");
#endif
} else if (!strcasecmp(var->name, "cert_file")) {
state->tls.cert_file = pj_str((char*)var->value);
state->tls.cert_file = pj_str((char *)var->value);
ast_string_field_set(transport, cert_file, var->value);
#ifdef HAVE_PJSIP_TLS_TRANSPORT_RESTART
if (stat(var->value, &state->cert_file_stat)) {
ast_log(LOG_ERROR, "Failed to stat certificate file '%s' for transport '%s' due to '%s'\n",
var->value, ast_sorcery_object_get_id(obj), strerror(errno));
return -1;
}
ast_sorcery_object_set_has_dynamic_contents(transport);
#endif
} else if (!strcasecmp(var->name, "priv_key_file")) {
state->tls.privkey_file = pj_str((char*)var->value);
state->tls.privkey_file = pj_str((char *)var->value);
ast_string_field_set(transport, privkey_file, var->value);
#ifdef HAVE_PJSIP_TLS_TRANSPORT_RESTART
if (stat(var->value, &state->privkey_file_stat)) {
ast_log(LOG_ERROR, "Failed to stat private key file '%s' for transport '%s' due to '%s'\n",
var->value, ast_sorcery_object_get_id(obj), strerror(errno));
return -1;
}
ast_sorcery_object_set_has_dynamic_contents(transport);
#endif
}
return 0;

8
res/res_pjsip/pjsip_config.xml
Unescape View File

@ -1657,7 +1657,8 @@
A path to a .crt or .pem file can be provided. However, only
the certificate is read from the file, not the private key.
The <literal>priv_key_file</literal> option must supply a
matching key file.
matching key file. The certificate file can be reloaded if
the filename in configuration remains unchanged.
</para></description>
</configOption>
<configOption name="cipher">
@ -1721,6 +1722,11 @@
</configOption>
<configOption name="priv_key_file">
<synopsis>Private key file (TLS ONLY, not WSS)</synopsis>
<description><para>
A path to a key file can be provided. The private key file
can be reloaded if the filename in configuration remains
unchanged.
</para></description>
</configOption>
<configOption name="protocol" default="udp">
<synopsis>Protocol to use for SIP traffic</synopsis>

1
third-party/pjproject/configure.m4 vendored
Unescape View File

@ -131,6 +131,7 @@ AC_DEFUN([_PJPROJECT_CONFIGURE],
AC_DEFINE([HAVE_PJSIP_TRANSPORT_DISABLE_CONNECTION_REUSE], 1, [Define if your system has HAVE_PJSIP_TRANSPORT_DISABLE_CONNECTION_REUSE declared])
AC_DEFINE([HAVE_PJSIP_OAUTH_AUTHENTICATION], 1, [Define if your system has HAVE_PJSIP_OAUTH_AUTHENTICATION declared])
AC_DEFINE([HAVE_PJPROJECT_ON_VALID_ICE_PAIR_CALLBACK], 1, [Define if your system has the on_valid_pair pjnath callback.])
AC_DEFINE([HAVE_PJSIP_TLS_TRANSPORT_RESTART], 1, [Define if your system has pjsip_tls_transport_restart support.])
AC_SUBST([PJPROJECT_BUNDLED])
AC_SUBST([PJPROJECT_BUNDLED_OOT])

Write Preview
Loading…
Cancel
Save