MeeGo Coverity issue CID#11755

git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@15746 d0543943-73ff-0310-b7d9-9358b9ac24b2

Ignore-this: 9ba9bcd0507b4925c49328e6318404b9

darcs-hash:20090629125227-9e0af-412192f59d8eefc741931877dd8d0574c27fc5b1.gz

Ignore-this: 49f502ccaaf771abed1e5b2d00eaa8b8

Coverity issue.

darcs-hash:20090513101456-db55f-37dbbb641401e6561e3fd81dfa184e09de6c0a5e.gz

Ignore-this: a651d5eb213850d9dfd317102a432f8e

Coverity issue.

darcs-hash:20090512182333-db55f-dc6aba55d33b314bcfc4fafbb7658132cc979910.gz

Ignore-this: 2ffe592459d1e87748010ad1da93b460

darcs-hash:20090429180320-db55f-24b014f2cac18138c59ddc6598fc5607616fa630.gz

Ignore-this: b81c43b73fcefa2dd58dd3366dd60368

darcs-hash:20090311165258-db55f-cef20213633caeb1bff3bc43a6e0ece5c0fbe500.gz

Ignore-this: 463ce3a08bd78c8603f1c345e91f440c

Fixed return value from tport_set_params(), too.

darcs-hash:20090303135630-db55f-1f6f116757fd71c8f0427d012feebdf2b0a5203e.gz

Ignore-this: 862cf3e8ef5c17e9ac955dcdba317f1f

darcs-hash:20090212131708-db55f-98e310c1be511851b709363d9a7081431e99103c.gz

Ignore-this: 5d96f6f5d776bf8fb49e221b2f65ca60

darcs-hash:20090212131731-c21f9-3b06d3024bb39835575d29b710dcc9176b1dae3e.gz

Ignore-this: 7b7e2d1cc9f61b41c4d44dc8ff4d246e

darcs-hash:20090211210108-c21f9-65d56056f28ba91d8b3819c986156fde78872f80.gz

sofia-sip/tport.h:
* tport_delivered_from_subjects() returns type (su_strlst_t const *)
* Export tport_subject_search()

sofia-sip/tport_tag.h + tport_tag.c:
* Remove TPTAG_TLS_VERIFY_PEER()
  - Depreciated.  Use TPTAG_TLS_VERIFY_POLICY instead.
  - Binary Compatibility is preserved.
* Add TPTAG_TLS_VERIFY_POLICY()
  - tport can verify incoming and/or outgoing connections, using:
    1) Certificate Signatures only - or -
    2) Certificate Signatures and Certificate Subjects
* Add TPTAG_TLS_VERIFY_DEPTH()
  - Restrict certificate chain verification to a set length.
* Add TPTAG_TLS_VERIFY_DATE()
  - Disable notBefore/notAfter checking (application: embedded devices)
* Add TPTAG_TLS_VERIFY_SUBJECTS()
  - Incoming connections must present client certificates with subjects
    that match an item in this list.
  - Intended Use: Proxy Authentication
* Replaced TPTAG_TRUSTED() with TPTAG_X509_SUBJECT()
  - Commented out for future use.
  - Intended Use: SIP User Identities in Server Certificates.
* Add appropriate doxygen documentation.

tport.c
* Add tport_subject_search()
  - Subject can be a hostname, IP Address, or a URI.
  - Valid subject examples include:
      example.com
      alice@example.com
      sip:alice@example.com
      sips:alice@example.com
* tport_by_addrinfo() matches tpn_canon against the subject list
    of reusable TLS connections.

tport_tls.h:
* Add tls_init_secondary()
* Remove tls_init_slave() & tls_init_client()

tport_tls.c:
* tls_verify_cb() supports TPTAG_TLS_VERIFY_DATE()
* tls_post_connection_check() verifies certificate subjects.
* tls_init_secondary()
  - Replaces tls_init_slave(), tls_init_client(), and tls_clone().

tport_type_tls.c:
* Removed erroneous reference to tport_tls_deliver()
* Fix a memory leak caused by duplicate calls to tls_clone().
* Populate the (tport_t *)->tp_subjects field with peer certificate data for
  new secondary connections.

darcs-hash:20090115155045-2152f-aaec406d8e5dbf146949d4d3cbc9f56e201cba46.gz

darcs-hash:20090108210046-db55f-13f932a4808875f335157d843d9612e9e0d447c4.gz

tport_type_tls.c:
* tport_tls_accept():
  - Replaces tport_accept for incoming TLS connections.
* tport_tls_connect():
  - Replaces tport_base_connect() for outgoing TLS connections.

tport_tls.c:
* tls_t now use a memory home instead of malloc.
* removed tls_check_hosts()
* tls_connect():
  - Replaces tport_base_connect for TLS connection setup.
  - Completes TLS handshake and verifies peer certificates.
  - Destroys suspect TLS connections before sending/receiving payload.
  - Populates a su_strlst_t with subjects from the peer certificate.

tport.c:
* tport_is_verified()
  - true if peer certificate validated successfully
* tport_delivered_from_subjects()
  - Certificate subjects listed in the peer certificate.

darcs-hash:20081216221937-2152f-3d6b74d411b57c22230e4840fca133da48c86368.gz

- Expose tport_setname() and tport_wakeup() via tport_internal.h
- Add tport_register_secondary() for adding secondaries to a root, and
  to alleviate the need to export tprb_append.

darcs-hash:20081216175826-2152f-1a5680d4ca61ba2405b497cfc12bde3a776bfd64.gz

With this tag, the verification of certificates can be controlled:
0: no verify certificates.
1: on server mode, the certificate returned by client is checked and
   if fail the TLS/SSL handshake is immediately terminated.
1: on client mode, the server certificate is verified and
   if fail the TLS/SSL handshake is immediately terminated.

I added this tag, because I'd like that my application not connected to a
server with a untrusted certificate.

darcs-hash:20081126184231-daa5a-26fe2a4f958d2f931d3f7e9b31bc0426e7250a1f.gz

darcs-hash:20081126183839-db55f-8bc76861b38b4cdd6423e5fcaf645bcad55f24b8.gz

darcs-hash:20081126183803-db55f-727c15892f5adb0e8e4eab1adb6d8736aec37042.gz

darcs-hash:20080712140848-db55f-1bd597d7996c8134498d141ef65a398335aeffa0.gz

darcs-hash:20080605142318-db55f-1c7c5d21fed5f16f494ab5f8e2f32e92af76232c.gz

darcs-hash:20080520174646-65a35-8569642c161239440146ee7f69aa0f37e27969d4.gz

darcs-hash:20080307164706-65a35-034b8624e76d011172beb02c452c4e915401d81c.gz

darcs-hash:20080227210645-16063-e17f3dda993f7967fc65ac3bd03a002700cd7ec4.gz

darcs-hash:20080212192626-65a35-d6f9acae497f28ca3f8d8a71271ec391a9cd2d5a.gz

darcs-hash:20071129171740-88462-33724a96db36afb7ac6d070bafe3f27ff88d1c53.gz

darcs-hash:20071127004934-65a35-47eede77927f8d19090936acfd2ccd61f9b84cbb.gz

darcs-hash:20071120175354-65a35-38ae636463914aba38d4315e98fca03f4614d03f.gz

darcs-hash:20071120170919-65a35-7ed08de61d6d7829d71619c1aead27efe7616933.gz

darcs-hash:20070920173622-65a35-344f484ee50de63c28e6e9b82658784672064641.gz

Now detecting closed connections on TLS, too.

Added tests for idle timeout, receive timeout, ping-pong timeout.

darcs-hash:20070725160906-65a35-0d568677e950abbc55b7ab10ae9a1fc8000155e6.gz

darcs-hash:20070725160533-65a35-c1217c49eab31628bb688cb1ed74e315a2dd8a9e.gz

darcs-hash:20070725085957-65a35-9a64b07513fdcc0a82bd4d6bf11d5d9a055ccdd8.gz

darcs-hash:20070628122222-1b897-6c46d2c3a967791e436abd2b1adee945f7361616.gz

The error callback from tport can now be registered even if there is no
request pending on transport (e.g., when keeping a transport connection open
for inbound messages).

darcs-hash:20070601191534-65a35-7b3e22bb692673dc70e1630d1e63313ed840dcdc.gz

darcs-hash:20070601191152-65a35-d011b3bd54b3aa6ac33b7972a9963ce0ffeaaade.gz

darcs-hash:20070507113036-5b6ca-b8d0fe36f0c3b716ff2885ea3810b16851ef758a.gz

darcs-hash:20070423131444-1b897-6275c45cd5d9b5275c93219c8a38f11557bc5851.gz

Warnings when SCTP  was enabled or IP6 disabled.

darcs-hash:20070420064929-65a35-c60a8a2d248e4688eff2918dd813fc3859eb22a4.gz

This caused an assertion failure in tport.c on Solaris.

darcs-hash:20070222203347-88462-92bb0549818eb67da9b3de4cb192c78e898e16a4.gz

darcs-hash:20070209132157-55b16-e645125e58da7e344f44d354b0e73a1dee182206.gz