We use Kamilio as a proxy server to connect softphones to our PBX systems.
We have run into some TLS problems. These problems result in a shut down of the TLS connection after the error is encountered.
We have looked into serial numbers of certificates. The current code in kamailio seems to be broken due to changes in the world around... many certificates today do not adhere to the previously assumed behaviour of certificate serial numbers anymore.
The error which causes the connection to drop seems to be related to a comparison of the certificate serial numbers during renegotiation.
tls_err_ret(): TLS read:error:0D0E10DF:asn1 encoding routines:asn1_get_uint64:too large
Kamailio expects serial numbers to fit in a 64 bit unsigned, however during the last years, starting around 2003 more and more systems use automatically generated serial numbers, which are frequently 128 bit long.
The serialnumber of our own Auerswald root certificate looks to be only 64 bit long, but during the negotiation is presented as 9 bytes starting with 00h, which is interpreted as a 72bit value. Trying to put this serial number in a 64 bit long kills the connection.
Due to the different ways that are used to generate serial numbers now, there is no simple algorithm to condense the number into a 64bit value, and the whole number should be compared to see if it is same or higher.
We currently have disabled renegotiation to avoid the connection being dropped during renegotiation. Which however can lead to the connection being dropped by the other side during renegotiation, but this is not a good permanent workaround!
#### Reproduction
This issue happens infrequently
### Possible Solutions
No workaround possible on our side
### Additional Information
Kamailio Version 5.5.4
LibSSL 1.1.1.n
* **Operating System**:
Linux, Debian oldstable
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3168
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3168(a)github.com>
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [X] Commit message has the format required by CONTRIBUTING guide
- [X] Commits are split per component (core, individual modules, libs, utils, ...)
- [X] Each component has a single commit (if not, squash them into one commit)
- [X] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [X] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
- [X] PR should be backported to stable branches
- [X] Tested changes locally
- [X] Related to issue #3168
#### Description
Certificate serial numbers can be large integers (> 2^64). Parse then as BIGNUM and store the string
in pv; we cannot store as integer anymore. The original code handles 2^64 with a static buffer of 19.
We upsize to 2^256 with a static buffer of 80.
May break configurations that try to extract the sn pv as an integer (does anyone actually do this?)
Addresses #3168.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3171
-- Commit Summary --
* tls: cert serial number can exceed uint64
-- File Changes --
M src/modules/tls/tls_select.c (24)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3171.patchhttps://github.com/kamailio/kamailio/pull/3171.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3171
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3171(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [x] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
previously if an error was found we were bailing out and the value
was kept so at next round the value will be there and no more values
where removed
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3169
-- Commit Summary --
* presence: be more resilient doing clean up of presentity values
-- File Changes --
M src/modules/presence/publish.c (47)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3169.patchhttps://github.com/kamailio/kamailio/pull/3169.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3169
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3169(a)github.com>
### Description
This issue has already been reported in the past both on GitHub ( Issue #2659 ) and on the [mailing list](https://lists.kamailio.org/pipermail/sr-users/2022-April/114620.html).
We are experiencing some issues with UPDATE messages being sent by the PSTN after an early media announcement.
To reproduce the issue we can call a specific number that has an early media announcement, since it's a paid phone number it has to announce how much it would cost before picking up the call. In this initial part the call is being negotiated in g711a.
As soon as the announcement ends, the PSTN sends an UPDATE message containing the new desired codec (g729) for the actual call.
Kamailio doesn't route the UPDATE message to the destination and it instead replies with a 404 message.
If topos is disabled the update message gets routed correctly.
#### SIP Traffic
I've attached a pcap with anonymized IPs to make it harder for bots.
Here is a legend for the IPs:
- 12.34.123.123 is Kamailio
- 62.23.19.74 is the PSTN
- 1.2.130.40 is the client making the call
[errorupdate_anon.zip](https://github.com/kamailio/kamailio/files/8522365/er…
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
```
version: kamailio 5.5.4 (x86_64/linux)
flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED
ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown
compiled with gcc 10.2.1
```
* **Operating System**:
```
Linux 5.10.0-13-amd64 #1 SMP Debian 5.10.106-1 (2022-03-17) x86_64 GNU/Linux
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3090
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3090(a)github.com>
<!--
Kamailio Project uses GitHub Issues only for bugs in the code or feature requests. Please use this template only for bug reports.
If you have questions about using Kamailio or related to its configuration file, ask on sr-users mailing list:
* http://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
If you have questions about developing extensions to Kamailio or its existing C code, ask on sr-dev mailing list:
* http://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-dev
Please try to fill this template as much as possible for any issue. It helps the developers to troubleshoot the issue.
If there is no content to be filled in a section, the entire section can be removed.
You can delete the comments from the template sections when filling.
You can delete next line and everything above before submitting (it is a comment).
-->
### Description
i am setting **tos** core parameter to set TOS for sent IP messages but when they leave kamailio i dont the see IP TOS updated via wireshark.
(caller) 192.168.214.125:3030 <-----> (kamailio) 192.168.214.125:7070 <-----> (kamailio) 192.168.214.205:8080
<!--
Explain what you did, what you expected to happen, and what actually happened.
-->
### Troubleshooting
#### Reproduction
```
children=3
listen=udp:192.168.214.125:7070
debug=0
tos=184
```
<!--
If the issue can be reproduced, describe how it can be done.
-->
#### Debugging Data
<!--
If you got a core dump, use gdb to extract troubleshooting data - full backtrace,
local variables and the list of the code at the issue location.
gdb /path/to/kamailio /path/to/corefile
bt full
info locals
list
If you are familiar with gdb, feel free to attach more of what you consider to
be relevant.
-->
```
(paste your debugging data here)
```
#### Log Messages
<!--
Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
(paste your log messages here)
```
#### SIP Traffic
<!--
If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
(paste your sip traffic here)
```

### Possible Solutions
<!--
If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix.
-->
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
```
5.5.4
```
* **Operating System**:
<!--
Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...;
Kernel details (output of `lsb_release -a` and `uname -a`)
-->
```
(paste your output here)
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3167
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3167(a)github.com>