search

sipwise / kamailio

Kamailio SIP Proxy with Sipwise patches
http://www.kamailio.org/
Other
58 stars 27 forks source link

Wrong TLS encryption lookup in latest versions #11

Open christiance3 opened 5 months ago

christiance3 commented 5 months ago

Hi SipWise team!

In advance, I apologize if this is not the right way to open an issue. I am having problems in mr12.2.1 and mr.11.5.1 LTS versions when sending TLS messages in outbound. The problem is related to the TLS handshake and occurs since the last kamailio updates.

lb[139414]: ERROR: tls [tls_server.c:1332]: tls_h_read_f(): protocol level error.
lb[139414]: ERROR: tls [tls_util.h:49]: tls_err_ret(): TLS accept:error:0A0000C1:SSL routines::no shared cipher (sni: unknown)
lb[139414]: ERROR: tls [tls_server.c:1336]: tls_h_read_f(): src addr: x.x.x.x.x.x:port
lb[139414]: ERROR: tls [tls_server.c:1339]: tls_h_read_f(): dst addr: x.x.x.x.x:port

It seems that kamailio had the problem a few weeks ago in his 5.7.x and it was solved in this commit.

https://github.com/kamailio/kamailio/commit/73d0a6a0dd1ca334bb57dad37754e3ccefb9647c

This issue explains perfectly what happens https://github.com/kamailio/kamailio/issues/3765

We can also reproduce the same problem in sipwise by adding a peer enabling the probe trying to send OPTIONS in TLS

I have been testing with different types of certificates (which work perfectly in previous versions).

In the last updates of these versions I see that the parameter is added in the kamailio-lb of static, which will make use tls or tlsa module. I have tried both and the result is the same.

Is it likely that we have to make this adaptation in this repo sipwise/kamailio?

Thank you in advance for your support. For my part I continue investigating in search of solutions.

linuxmaniac commented 5 months ago

5.7 https://github.com/kamailio/kamailio/commit/73b19da1e0dd512f9eb77ca0606092c545e8fb99