<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi Daniel,</p>
<p>yes I am using the tls.cfg file. I tried your suggestion to add
the cipher suite string (notice the !EDCHE which I also added to
the httpd ssl.conf) but nothing changed.<br>
</p>
<p> [server:default]<br>
method = TLSv1<br>
cipher_list =
!DH:!ECDHE:!EDH:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL<br>
verify_certificate = no<br>
require_certificate = no<br>
private_key =
/etc/letsencrypt/live/webrtc.ddnss.de/privkey.pem<br>
certificate =
/etc/letsencrypt/live/webrtc.ddnss.de/fullchain.pem<br>
#ca_list = ./modules/tls/cacert.pem<br>
#crl = ./modules/tls/crl.pem</p>
<p>Also here is a log snippet from tls module section of kamailio
initialization. Notice first two lines. Also it seems to me the
module actually ignores the local openssl installation and uses
its own which has been compiled with the module itself (?). <br>
Other than that it seems to be accepting the cipher_list value
just fine:<br>
</p>
<p>Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_mod.c:355]: mod_init(): With ECDH-Support!<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_mod.c:358]: mod_init(): With Diffie Hellman<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_init.c:587]: init_tls_h(): tls: _init_tls_h: compiled with
openssl version "OpenSSL 1.0.1e-fips 11 Feb 2013" (0x1000105f),
kerberos support: on, compression: on<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_init.c:595]: init_tls_h(): tls: init_tls_h: installed openssl
library version "OpenSSL 1.0.1e-fips 11 Feb 2013" (0x1000105f),
kerberos support: on, zlib compression:<br>
compiler:
gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB
-DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H
-DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: WARNING:
tls [tls_init.c:649]: init_tls_h(): tls: openssl bug #1491
(crash/mem leaks on low memory) workaround enabled (on low memory
tls operations will fail preemptively) with free<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO:
<core> [cfg/cfg_ctx.c:613]: cfg_set_now(): INFO:
cfg_set_now(): tls.low_mem_threshold1 has been changed to 7864320<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO:
<core> [cfg/cfg_ctx.c:613]: cfg_set_now(): INFO:
cfg_set_now(): tls.low_mem_threshold2 has been changed to 3932160<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: WARNING: tm
[tm.c:594]: fixup_routes(): WARNING: t_on_branch("MANAGE_BRANCH"):
empty/non existing route<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: WARNING: tm
[tm.c:594]: fixup_routes(): WARNING: t_on_reply("MANAGE_REPLY"):
empty/non existing route<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: WARNING: tm
[tm.c:594]: fixup_routes(): WARNING:
t_on_failure("MANAGE_FAILURE"): empty/non existing route<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO:
<core> [udp_server.c:175]: probe_max_receive_buffer():
SO_RCVBUF is initially 212992<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO:
<core> [udp_server.c:225]: probe_max_receive_buffer():
SO_RCVBUF is finally 425984<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:275]: fill_missing(): TLSs<default>:
tls_method=12<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:287]: fill_missing(): TLSs<default>:
certificate='/etc/letsencrypt/live/webrtc.ddnss.de/fullchain.pem'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:294]: fill_missing(): TLSs<default>:
ca_list='(null)'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:301]: fill_missing(): TLSs<default>:
crl='(null)'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:305]: fill_missing(): TLSs<default>:
require_certificate=0<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:312]: fill_missing(): TLSs<default>:
cipher_list='!DH:!ECDHE:!EDH:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:319]: fill_missing(): TLSs<default>:
private_key='/etc/letsencrypt/live/webrtc.ddnss.de/privkey.pem'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:323]: fill_missing(): TLSs<default>:
verify_certificate=0<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:326]: fill_missing(): TLSs<default>:
verify_depth=9<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:670]: set_verification(): TLSs<default>: No
client certificate required and no checks performed<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:275]: fill_missing(): TLSc<default>:
tls_method=12<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:287]: fill_missing(): TLSc<default>:
certificate='(null)'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:294]: fill_missing(): TLSc<default>:
ca_list='(null)'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:301]: fill_missing(): TLSc<default>:
crl='(null)'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:305]: fill_missing(): TLSc<default>:
require_certificate=1<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:312]: fill_missing(): TLSc<default>:
cipher_list='(null)'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:319]: fill_missing(): TLSc<default>:
private_key='(null)'<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:323]: fill_missing(): TLSc<default>:
verify_certificate=1<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:326]: fill_missing(): TLSc<default>:
verify_depth=9<br>
Nov 24 18:56:20 kamailio-sip /usr/sbin/kamailio[2864]: INFO: tls
[tls_domain.c:655]: set_verification(): TLSc<default>:
Server MUST present valid certificate</p>
<p>Would it be possible to compile the tls module with certain
openssl config switches (i.e. no-ec no-dh)?<br>
Any other ideas?<br>
<br>
Best regards,<br>
Ilyas Keskin<br>
</p>
<div class="moz-cite-prefix">Am 24.11.2017 um 15:45 schrieb
Daniel-Constantin Mierla:<br>
</div>
<blockquote type="cite"
cite="mid:343748a6-7f53-93ba-f679-f21639b15687@gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p>Hello,<br>
</p>
<br>
<div class="moz-cite-prefix">On 23.11.17 22:42, Ilyas Keskin
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:8380a96b-a9d9-1761-48e3-f5bfd74b7a28@gmx.de">
<meta http-equiv="content-type" content="text/html;
charset=utf-8">
<p><tt>Hi there,</tt></p>
<p><tt>I have set up a Kamailio 4.2.0 SIP server (centOS 7) for
a university project regarding WebRTC comunication. While
kamailio handles the signaling path I use the SIP.js demo
phone js application (hosted on the same machine as
kamaillio) for actual WebRTC stuff. </tt><tt><br>
</tt><tt>For a deeper understanding and documetation purposes
I have been trying to sniff the traffic with wireshark but
failed due to the fact that kamailio uses Elliptic Curve
Diffie Hellmann cipher suite (see wireshark snippet below)
which is not decryptable.</tt><tt><br>
</tt></p>
<p><tt>Secure Sockets Layer</tt><tt><br>
</tt><tt> TLSv1.2 Record Layer: Handshake Protocol: Server
Hello</tt><tt><br>
</tt><tt> Content Type: Handshake (22)</tt><tt><br>
</tt><tt> Version: TLS 1.2 (0x0303)</tt><tt><br>
</tt><tt> Length: 89</tt><tt><br>
</tt><tt> Handshake Protocol: Server Hello</tt><tt><br>
</tt><tt> Handshake Type: Server Hello (2)</tt><tt><br>
</tt><tt> Length: 85</tt><tt><br>
</tt><tt> Version: TLS 1.2 (0x0303)</tt><tt><br>
</tt><tt> Random:
b8916e4e0f7c712503a77afcf4c9228598092c166353be50...</tt><tt><br>
</tt><tt> Session ID Length: 32</tt><tt><br>
</tt><tt> Session ID:
b0a31a6699a001b7991645dc61064ca4c4b073eff6913f26...</tt><tt><br>
</tt><tt> Cipher Suite:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)</tt><tt><br>
</tt><tt> Compression Method: null (0)</tt><tt><br>
</tt><tt> Extensions Length: 13</tt><tt><br>
</tt><tt> Extension: renegotiation_info (len=1)</tt><tt><br>
</tt><tt> Extension: ec_point_formats (len=4)</tt><font
face="Courier New, Courier, monospace"><br>
</font><br>
</p>
<p><tt>I already tried importing captured SSLKEYLOG pre master
secret from chrome and private key file issued by
letsencrypt without success.</tt><tt><br>
</tt></p>
<p><tt>On top of that I set this line <br>
</tt></p>
<p><tt> SSLCipherSuite
!DH:!ECDH:!EDH:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
<br>
</tt></p>
<p><tt>in /etc/httpd/conf.d/ssl.conf and compiled openssl with
no-ec no-dh (which worked see below).</tt></p>
<p><tt>[admin@kamailio-sip ~]$ openssl ciphers<br>
SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:IDEA-CBC-SHA:PSK-AES128-CBC-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:SRP-3DES-EDE-CBC-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA<br>
[admin@kamailio-sip ~]$</tt></p>
<p><tt><br>
</tt></p>
<p><tt>Setting <br>
</tt></p>
<p><tt> modparam("tls", "cipher_list", "AESCCM") <br>
</tt></p>
<p><tt>(or different ciphers) in /etc/kamailio/kamailio.cfg
seems to have no effect on the actual negoiated cipher
suite.<br>
</tt></p>
<p><tt>Am I missing something? Any help or pointers into the
right direction will be much appreciated.</tt></p>
<br>
</blockquote>
<tt>are you also using tls.cfg? If yes, there is an attribute for
chiper list in it as well, try and see if works with it.<br>
<br>
Cheers,<br>
Daniel<br>
</tt>
<pre class="moz-signature" cols="72">--
Daniel-Constantin Mierla
<a class="moz-txt-link-abbreviated" href="http://www.twitter.com/miconda" moz-do-not-send="true">www.twitter.com/miconda</a> -- <a class="moz-txt-link-abbreviated" href="http://www.linkedin.com/in/miconda" moz-do-not-send="true">www.linkedin.com/in/miconda</a>
Kamailio Advanced Training - <a class="moz-txt-link-abbreviated" href="http://www.asipto.com" moz-do-not-send="true">www.asipto.com</a>
Kamailio World Conference - May 14-16, 2018 - <a class="moz-txt-link-abbreviated" href="http://www.kamailioworld.com" moz-do-not-send="true">www.kamailioworld.com</a></pre>
</blockquote>
<br>
</body>
</html>