ben.carrasco/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-07-24 13:12:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add mechanism to set OpenSSL session timeout

Browse Source 
In a sofia profile, you can now set the parameter tls-timeout to a
positive integer value which represents the maximum time in seconds
that OpenSSL will keep a TLS session (and its ephemeral keys) alive.

This value is passed to OpenSSL's SSL_CTX_set_timeout(3).

OpenSSL's default value is 300 seconds, but the relevant standard
(RFC 2246) suggests that much longer session lifetimes are
acceptable (it recommends values less than 24 hours).

Longer values can be useful for extending battery life on mobile
devices.

Signed-off-by: Travis Cross <tc@traviscross.com>
This commit is contained in:
Travis Cross
2012-06-08 22:06:55 +00:00
parent 45fdf0db19
commit c85c8d7bbd
9 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mod/endpoints/mod_sofia/conf/sofia.conf.xml
+2
View File
@@ -242,6 +242,8 @@
<!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not
work with TLSv1 -->
<param name="tls-version" value="$${sip_tls_version}"/>
<!-- TLS maximum session lifetime -->
<!-- <param name="tls-timeout" value="300"/> -->
<!-- turn on auto-flush during bridge (skip timer sleep when the socket
already has data) (reduces delay on latent connections default
src/mod/endpoints/mod_sofia/mod_sofia.h
+1
View File
@@ -596,6 +596,7 @@ struct sofia_profile {
switch_port_t sip_port;
switch_port_t tls_sip_port;
int tls_version;
unsigned int tls_timeout;
char *inbound_codec_string;
char *outbound_codec_string;
int running;
src/mod/endpoints/mod_sofia/sofia.c
+6
View File
@@ -2071,6 +2071,8 @@ void *SWITCH_THREAD_FUNC sofia_profile_thread_run(switch_thread_t *thread, void
TPTAG_TLS_VERIFY_SUBJECTS(profile->tls_verify_in_subjects)),
TAG_IF(sofia_test_pflag(profile, PFLAG_TLS),
TPTAG_TLS_VERSION(profile->tls_version)),
TAG_IF(sofia_test_pflag(profile, PFLAG_TLS) && profile->tls_timeout,
TPTAG_TLS_TIMEOUT(profile->tls_timeout)),
TAG_IF(!strchr(profile->sipip, ':'),
NTATAG_UDP_MTU(65535)),
TAG_IF(sofia_test_pflag(profile, PFLAG_DISABLE_SRV),
@@ -3934,6 +3936,7 @@ switch_status_t config_sofia(int reload, char *profile_name)
profile->sip_force_expires = 0;
profile->sip_expires_max_deviation = 0;
profile->tls_version = 0;
profile->tls_timeout = 300;
profile->mflags = MFLAG_REFER | MFLAG_REGISTER;
profile->server_rport_level = 1;
profile->client_rport_level = 1;
@@ -4754,6 +4757,9 @@ switch_status_t config_sofia(int reload, char *profile_name)
} else {
profile->tls_version = 0;
}
} else if (!strcasecmp(var, "tls-timeout")) {
int v = atoi(val);
profile->tls_timeout = v > 0 ? (unsigned int)v : 300;
} else if (!strcasecmp(var, "timer-T1")) {
int v = atoi(val);
if (v > 0) {