<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<p>as I noticed a debug message about it, likely is the
renegotiation, see:</p>
<p> -
<a class="moz-txt-link-freetext" href="https://www.kamailio.org/docs/modules/stable/modules/tls.html#tls.p.renegotiation">https://www.kamailio.org/docs/modules/stable/modules/tls.html#tls.p.renegotiation</a></p>
<p>Cheers,<br>
Daniel<br>
</p>
<div class="moz-cite-prefix">On 28.09.22 09:19, Leonid Fainshtein
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAJr_9Taq7O-M-ibJ6d6CbEjtsDg=-d=6WjizSD3BOidvJ1eL-A@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default"
style="font-family:arial,helvetica,sans-serif">Hi,</div>
<div class="gmail_default"
style="font-family:arial,helvetica,sans-serif">I'm reposting
my request. Any idea how to fix this?</div>
<div class="gmail_default"
style="font-family:arial,helvetica,sans-serif"><br>
</div>
<div>
<div dir="ltr" class="gmail_signature"
data-smartmail="gmail_signature">Best regards,<br>
Leonid </div>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Sun, Sep 4, 2022 at 11:53
AM Leonid Fainshtein <<a
href="mailto:leonid.fainshtein@xorcom.com"
moz-do-not-send="true" class="moz-txt-link-freetext">leonid.fainshtein@xorcom.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:arial,helvetica,sans-serif">Hi,</div>
<div style="font-family:arial,helvetica,sans-serif">I have
a problem creating a TLS connection when tls_method is
configured as one of the "loose" methods: SSLv23, <span
style="font-family:Arial,Helvetica,sans-serif">TLSv1+, </span><span
style="font-family:Arial,Helvetica,sans-serif">TLSv1.1+, </span><span
style="font-family:Arial,Helvetica,sans-serif">TLSv1.2+.</span></div>
<div style="font-family:arial,helvetica,sans-serif"><span
style="font-family:Arial,Helvetica,sans-serif">The
problem doesn't happen when the tls_method is defined
"strictly": </span><span
style="font-family:Arial,Helvetica,sans-serif">TLSv1, </span><span
style="font-family:Arial,Helvetica,sans-serif">TLSv1.1,
or </span><span
style="font-family:Arial,Helvetica,sans-serif">TLSv1.2.</span></div>
<div style="font-family:arial,helvetica,sans-serif"><span
style="font-family:Arial,Helvetica,sans-serif">The
problem is reproducible with the modern Yealink phones
and also with sipexer. </span></div>
<div style="font-family:arial,helvetica,sans-serif">I have
Kamailio v.5.5.4 installed from the Kamailio repo (<a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532186/?link=http%3A%2F%2Fdeb.kamailio.org%2Fkamailio55"
target="_blank" moz-do-not-send="true">http://deb.kamailio.org/kamailio55</a>),
on Ubuntu 18.04, OpenSSL ver.1.1.1-1ubuntu2.1~18.04.20</div>
<div>
<div dir="ltr"><br>
</div>
<div dir="ltr">
<div style="font-family:arial,helvetica,sans-serif">The
sipexer output:</div>
<div style="font-family:arial,helvetica,sans-serif">--------------------------</div>
$ ./sipexer -register -vl 3 -co -com -ex 60 -fuser
2001 -cb -au 2001 -ap "......" -sd -sw 20000 -tk
./id_rsa tls:<a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2Fnnnnnnnnn.com%3A5061"
target="_blank" moz-do-not-send="true">nnnnnnnnn.com:5061</a><br>
<br>
[debug] [sipexer.go:912] main.main(): parsed socket
address argument ({Val:tls:<a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2Fnnnnnnnnn.com%3A5061"
target="_blank" moz-do-not-send="true">nnnnnnnnn.com:5061</a>
Proto:tls Addr:<a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2Fnnnnnnnnn.com"
target="_blank" moz-do-not-send="true">nnnnnnnnn.com</a>
Port:5061 PortNo:5061 AType:8 ProtoId:3})<br>
[debug] [sipexer.go:1800] main.SIPExerSendTLS():
client: <a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2F192.168.0.178%3A41586"
target="_blank" moz-do-not-send="true">192.168.0.178:41586</a>
connected to: <a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2F142.93.233.32%3A5061"
target="_blank" moz-do-not-send="true">142.93.233.32:5061</a><br>
[debug] [sipexer.go:1803] main.SIPExerSendTLS(): [48
130 1 34 48 13 6 9 42 134 72 134 247 13 1 1 1 5 0 3
130 1 15 0 48 130 1 10 2 130 1 1 0 222 21 229 237 77
230 193 157 183 132 186 194 65 98 162 250 243 232 189
223 115 181 41 199 130 221 201 143 254 218 254 201 82
173 233 44 158 103 150 78 210 162 187 138 5 179 11 47
208 0 117 27 186 180 197 229 94 13 63 72 227 27 169
127 197 173 67 52 182 68 140 220 132 20 241 57 24 182
29 234 58 60 214 145 225 29 251 240 190 159 43 233 53
57 121 159 81 4 200 12 193 90 91 158 78 196 25 202 74
111 106 215 164 12 178 120 129 8 81 1 245 181 149 20
47 197 165 74 126 24 249 241 187 197 249 209 192 11
204 254 110 19 248 79 122 11 131 24 101 155 237 110
186 5 214 88 79 255 185 156 52 12 29 222 254 76 71 171
142 28 69 22 34 31 111 105 87 7 108 68 6 23 199 236
134 154 42 208 199 158 190 48 193 192 179 120 189 199
117 71 104 231 127 73 128 91 234 168 175 207 55 6 191
144 209 25 10 182 27 53 182 182 96 248 198 206 220 207
102 236 194 96 67 159 34 112 81 145 2 166 207 86 247
232 117 126 158 214 215 10 226 68 81 235 169 81 2 3 1
0 1] <nil><br>
[debug] [sipexer.go:1804] main.SIPExerSendTLS(): CN=<a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2Fnnnnnnnnn.com"
target="_blank" moz-do-not-send="true">nnnnnnnnn.com</a><br>
[debug] [sipexer.go:1803] main.SIPExerSendTLS(): [48
130 2 34....247 31 2 3 1 0 1] <nil><br>
[debug] [sipexer.go:1804] main.SIPExerSendTLS():
CN=ZeroSSL RSA Domain Secure Site CA,O=ZeroSSL,C=AT<br>
[debug] [sipexer.go:1803] main.SIPExerSendTLS(): [48
130 2 34 48 ....130 15 2 3 1 0 1] <nil><br>
[debug] [sipexer.go:1804] main.SIPExerSendTLS():
CN=USERTrust RSA Certification Authority,O=The
USERTRUST Network,L=Jersey City,ST=New Jersey,C=US<br>
[debug] [sipexer.go:1806] main.SIPExerSendTLS():
client: handshake: true<br>
[debug] [sipexer.go:1807] main.SIPExerSendTLS():
client: mutual: true<br>
[info] [sipexer.go:1432] main.SIPExerDialogLoop():
local socket address: <a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2F192.168.0.178%3A41586"
target="_blank" moz-do-not-send="true">192.168.0.178:41586</a>
(tls)<br>
[info] [sipexer.go:1433] main.SIPExerDialogLoop():
local via address: <a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2F192.168.0.178%3A41586"
target="_blank" moz-do-not-send="true">192.168.0.178:41586</a><br>
[info] [sipexer.go:1434] main.SIPExerDialogLoop():
sending to tls 142.xx.yy.32:5061: [[---<br>
REGISTER <a class="moz-txt-link-freetext" href="sip:nnnnnnnnn.com:5061;transport=tls">sip:nnnnnnnnn.com:5061;transport=tls</a> SIP/2.0<br>
Via: SIP/2.0/TLS
192.168.0.178:41586;rport;branch=z9hG4bKSG.f7a247eb-5440-4e7a-8a5a-4f849684f30d<br>
From: <<a href="mailto:sip%3A2001@nnnnnnnnn.com"
target="_blank" moz-do-not-send="true">sip:2001@nnnnnnnnn.com</a>>;tag=33e66091-193c-4535-b659-d5e562aca5a4<br>
To: <<a href="mailto:sip%3A2001@nnnnnnnnn.com"
target="_blank" moz-do-not-send="true">sip:2001@nnnnnnnnn.com</a>><br>
Call-ID: 4556156d-e8da-4632-82f7-f3ab3c4c73a1<br>
CSeq: 621470 REGISTER<br>
Date: Sun, 04 Sep 2022 11:21:33 IDT<br>
Contact: <a class="moz-txt-link-rfc2396E" href="sip:192.168.0.178:41586;transport=tls"><sip:192.168.0.178:41586;transport=tls></a><br>
Expires: 60<br>
User-Agent: SIPExer v1.0.2<br>
Content-Length: 0<br>
<br>
<br>
[info] [sipexer.go:1436] main.SIPExerDialogLoop():
---]]<br>
<br>
[error] [sipexer.go:1312]
main.SIPExerDialogReadBytes(): not receiving after
32000ms (bytes 0 - EOF)<br>
<div style="font-family:arial,helvetica,sans-serif"><span
style="font-family:Arial,Helvetica,sans-serif">[debug]
[sipexer.go:1009] main.SIPExerExit(): return code:
-1154</span></div>
<div style="font-family:arial,helvetica,sans-serif"><br>
</div>
<div style="font-family:arial,helvetica,sans-serif">The
Kamailio debug log:</div>
<div style="font-family:arial,helvetica,sans-serif">---------------------------------</div>
<div style="font-family:arial,helvetica,sans-serif">Sep
4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: <core> [core/ip_addr.c:577]:
print_ip(): tcpconn_new: new tcp connection:
207.232.46.53<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: <core>
[core/tcp_main.c:1175]: tcpconn_new(): on port
18566, type 3, socket 72<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: <core>
[core/tcp_main.c:1507]: tcpconn_add(): hashes:
1963:2250:2856, 16<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: <core> [core/io_wait.h:375]:
io_watch_add(): processing
io_watch_add(0x5648d2a55e40, 72, 2, 0x7f9dcaf01958)
- fd_no=63<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: <core> [core/io_wait.h:600]:
io_watch_del(): DBG: io_watch_del (0x5648d2a55e40,
72, -1, 0x0) fd_no=64 called<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: <core>
[core/tcp_main.c:4471]: handle_tcpconn_ev(): sending
to child, events 1<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: <core>
[core/tcp_main.c:4141]: send2child(): selected tcp
worker idx:7 proc:45 pid:25549 for activity on
[tls:142.xx.yy.32:5061], 0x7f9dcaf01958<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core>
[core/tcp_read.c:1737]: handle_io(): received n=8
con=0x7f9dcaf01958, fd=10<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_server.c:244]:
tls_complete_init(): completing tls connection
initialization<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_server.c:274]:
tls_complete_init(): Using initial TLS domain
TLSs<default> (dom 0x7f9dc4c17078 ctx
0x7f9dc4c65da0 sn [])<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:1208]:
tls_lookup_private_key(): Private key lookup for
SSL_CTX-0x7f9dc4c65da0: (nil)<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:778]:
sr_ssl_ctx_info_callback(): SSL handshake started<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:979]:
tls_server_name_cb(): received server_name (TLS
extension): '<a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2Ftmx.cpbxmt-demo187.xorcom.com"
target="_blank" moz-do-not-send="true">tmx.cpbxmt-demo187.xorcom.com</a>'<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:998]:
tls_server_name_cb(): TLS cfg domain selected for
received server name [<a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2Ftmx.cpbxmt-demo187.xorcom.com"
target="_blank" moz-do-not-send="true">tmx.cpbxmt-demo187.xorcom.com</a>]:
socket [:0] server name='' - switching SSL CTX to
0x7f9dc4c65da0 dom 0x7f9dc4c17078 (default)<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core>
[core/tcp_main.c:2720]: tcpconn_do_send():
sending...<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core>
[core/tcp_main.c:2753]: tcpconn_do_send(): after
real write: c= 0x7f9dcaf01958 n=5435 fd=10<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core>
[core/tcp_main.c:2754]: tcpconn_do_send(): buf=<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
#026#003#003<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core> [core/io_wait.h:375]:
io_watch_add(): processing
io_watch_add(0x5648d29e8c80, 10, 2, 0x7f9dcaf01958)
- fd_no=1<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:1208]:
tls_lookup_private_key(): Private key lookup for
SSL_CTX-0x7f9dc4c65da0: (nil)<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:790]:
sr_ssl_ctx_info_callback(): SSL handshake done<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:778]:
sr_ssl_ctx_info_callback(): SSL handshake started<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:782]:
sr_ssl_ctx_info_callback(): SSL renegotiation
initiated by client<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:790]:
sr_ssl_ctx_info_callback(): SSL handshake done<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:778]:
sr_ssl_ctx_info_callback(): SSL handshake started<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:782]:
sr_ssl_ctx_info_callback(): SSL renegotiation
initiated by client<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_domain.c:790]:
sr_ssl_ctx_info_callback(): SSL handshake done<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_server.c:470]:
tls_accept(): TLS accept successful<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_server.c:477]:
tls_accept(): tls_accept: new connection from <a
href="https://gmlnk.com/api/v1/track/link/click/608535f77fc26b8402a04a3e/1664349532187/?link=http%3A%2F%2F207.232.46.53%3A18566"
target="_blank" moz-do-not-send="true">207.232.46.53:18566</a>
using TLSv1.3 TLS_AES_256_GCM_SHA384 256<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_server.c:480]:
tls_accept(): tls_accept: local socket:
142.xx.yy.32:5061<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_server.c:491]:
tls_accept(): tls_accept: client did not present a
certificate<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: tls [tls_server.c:1245]:
tls_h_read_f(): Reading on a renegotiation of
connection (n:-1) (2)<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core>
[core/tcp_read.c:1503]: tcp_read_req(): EOF<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core> [core/io_wait.h:600]:
io_watch_del(): DBG: io_watch_del (0x5648d29e8c80,
10, -1, 0x10) fd_no=2 called<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core>
[core/tcp_read.c:1872]: handle_io(): removing from
list 0x7f9dcaf01958 id 16 fd 10, state 2, flags
4018, main fd 72, refcnt 2 ([207.232.46.53]:18566
-> [207.232.46.53]:5061)<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core>
[core/tcp_read.c:1656]: release_tcpconn(): releasing
con 0x7f9dcaf01958, state -1, fd=10, id=16
([207.232.46.53]:18566 -> [207.232.46.53]:5061)<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
45(25549) DEBUG: <core>
[core/tcp_read.c:1660]: release_tcpconn():
extra_data 0x7f9dcaefe628<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: <core>
[core/tcp_main.c:3573]: handle_tcp_child(): reader
response= 7f9dcaf01958, -1 from 7<br>
Sep 4 08:21:33 cpbxmt-demo187 kamailio[23878]:
46(25550) DEBUG: tls [tls_server.c:729]:
tls_h_tcpconn_close_f(): Closing SSL connection
0x7f9dcaefe628<br>
</div>
<div style="font-family:arial,helvetica,sans-serif"><br>
</div>
<div style="font-family:arial,helvetica,sans-serif">As
far as I understood the log, the certificate was
accepted but something wrong happened later.</div>
<br>
</div>
<div dir="ltr">
<div style="font-family:arial,helvetica,sans-serif">Any
suggestion?</div>
</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Best regards,<br>
Leonid Fainshtein<br>
<br>
</div>
</div>
<img style="display: none; max-width: 0px; max-height:
0px;"
src="https://gmopn.com/api/v1/track/email/view/608535f77fc26b8402a04a3e/1662279290833/pixel.gif"
moz-do-not-send="true"></div>
</blockquote>
</div>
<img style="display: none; max-width: 0; max-height: 0"
src="https://gmopn.com/api/v1/track/email/view/608535f77fc26b8402a04a3e/1664349436793/pixel.gif"
moz-do-not-send="true"></div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
* <a class="moz-txt-link-abbreviated" href="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a>
Important: keep the mailing list in the recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe:
* <a class="moz-txt-link-freetext" href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Daniel-Constantin Mierla -- <a class="moz-txt-link-abbreviated" href="http://www.asipto.com">www.asipto.com</a>
<a class="moz-txt-link-abbreviated" href="http://www.twitter.com/miconda">www.twitter.com/miconda</a> -- <a class="moz-txt-link-abbreviated" href="http://www.linkedin.com/in/miconda">www.linkedin.com/in/miconda</a>
Kamailio Advanced Training - Online
Nov 7-10, 2022 (Europe Timezone)
* <a class="moz-txt-link-freetext" href="https://www.asipto.com/sw/kamailio-advanced-training-online/">https://www.asipto.com/sw/kamailio-advanced-training-online/</a></pre>
</body>
</html>