<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [x] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
In TLS WolfSSL, enable initialization of the cipher_list from the domain config.
Also from this setting kamailio exposes dangerous ciphers like RC4, NULL
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (secp256r1) - C
| TLS_ECDHE_ECDSA_WITH_AES_128_CCM (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256-draft (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_NULL_SHA (secp256r1) - F
| TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 - unknown
| TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
| TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 (secp256r1) - A
| TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_ECDHE_PSK_WITH_NULL_SHA256 (secp256r1) - F
| compressors:
| NULL
| cipher preference: server
| warnings:
| Broken cipher RC4 is deprecated by RFC 7465
| TLSv1.3:
| ciphers:
| TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
| TLS_AKE_WITH_AES_128_CCM_SHA256 (secp256r1) - A
| TLS_AKE_WITH_AES_128_CCM_8_SHA256 (secp256r1) - A
| TLS_AKE_WITH_NULL_SHA256 (secp256r1) - F
| TLS_AKE_WITH_NULL_SHA384 (secp256r1) - F
| cipher preference: server
|_ least strength: unknown
After apply patch:
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_ECDHE_ECDSA_WITH_AES_128_CCM (secp256r1) - A
| compressors:
| NULL
| cipher preference: server
| TLSv1.3:
| ciphers:
| TLS_AKE_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_AKE_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
| cipher preference: server
|_ least strength: A
version: kamailio 5.8.3 (x86_64/linux) 6f8a04-dirty
AlmaLinux release 8.10 (Cerulean Leopard)
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4012
-- Commit Summary --
* tls_wolfssl: Initialize cipher_list for domain #3920
-- File Changes --
M src/modules/tls_wolfssl/tls_domain.c (3)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4012.patchhttps://github.com/kamailio/kamailio/pull/4012.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4012
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4012(a)github.com>
<!--
Kamailio Project uses GitHub Issues only for bugs in the code or feature requests. Please use this template only for bug reports.
If you have questions about using Kamailio or related to its configuration file, ask on sr-users mailing list:
* https://lists.kamailio.org/mailman3/postorius/lists/sr-users.lists.kamailio…
If you have questions about developing extensions to Kamailio or its existing C code, ask on sr-dev mailing list:
* https://lists.kamailio.org/mailman3/postorius/lists/sr-dev.lists.kamailio.o…
Please try to fill this template as much as possible for any issue. It helps the developers to troubleshoot the issue.
Note that an issue report may be closed automatically after about 2 months
if there is no interest from developers or community users on pursuing it, being
considered expired. In such case, it can be reopened by writing a comment that includes
the token `/notexpired`. About two weeks before considered expired, the issue is
marked with the label `stale`, trying to notify the submitter and everyone else
that might be interested in it. To remove the label `stale`, write a comment that
includes the token `/notstale`. Also, any comment postpone the `expire` timeline,
being considered that there is interest in pursuing the issue.
If there is no content to be filled in a section, the entire section can be removed.
You can delete the comments from the template sections when filling.
You can delete next line and everything above before submitting (it is a comment).
-->
### Description
We are facing a hang issue with Kamailio for the get_profile_size method. Randomly, the Kamailio got hangs, and the CPU went 100%.
During the hanging time, we generated the TRAP and we could see that the hang happened on the get_profile_size method. We are getting this hang randomly in dlg_profile.c of the following lines:
The hang occurs, causing the CPU to spike to 100% at one of the following lines randomly:
1. if(value->len == ph->value.len && memcmp(value->s, ph->value.s, value->len) == 0) {
2. ph = ph->next;
3. while(ph != profile->entries[i].first);
During our analysis, we found that PROCESS ID 7608 gets a spike of 100% utilization.
We suspect there may be an issue with the processing of the 'ph' variable, but we couldn't identify the root cause. I've attached the Kamailio TRAP for further details. Could you please suggest what might be causing this problem and how we can resolve it?
<!--
Explain what you did, what you expected to happen, and what actually happened.
-->
### Troubleshooting
We have analysed the coredump and TRAP, And found that the issue could be from the following lines:
1. if(value->len == ph->value.len && memcmp(value->s, ph->value.s, value->len) == 0) {
2. ph = ph->next;
3. while(ph != profile->entries[i].first);
#### Reproduction
This issue is occurring randomly.
<!--
If the issue can be reproduced, describe how it can be done.
-->
#### Debugging Data
I have attached the TRAP data.
---start 7608 -----------------------------------------------------
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
get_profile_size (profile=0x7f7095698f50, value=0x7ffd5e21db20) at dlg_profile.c:860
860 }while( ph!=profile->entries[i].first );
#0 get_profile_size (profile=0x7f7095698f50, value=0x7ffd5e21db20) at dlg_profile.c:860
n = 0
i = 9
ph = 0x7f70958d3c98
#1 0x00007f7195585785 in w_get_profile_size_helper (msg=0x7f7198418558, profile=0x7f7095698f50, value=0x7ffd5e21db20, spd=0x7f71983a8cf0) at dialog.c:941
size = 32625
val = {rs = {s = 0x7ffd5e21da80 "\260\332!^\375\177", len = 591976160}, ri = xxxxxxxx77096, flags = 32765}
__func__ = "w_get_profile_size_helper"
#2 0x00007f7195585fd2 in w_get_profile_size3 (msg=0x7f7198418558, profile=0x7f7095698f50 "\200\220i\225p\177", value=0x7f71983b4b30 "80;\230q\177", result=0x7f71983a8cf0 "\004") at dialog.c:982
pve = 0x7f71983b4b30
val_s = {s = 0x7f7198346dd0 "2777995", len = 7}
spd = 0x7f71983a8cf0
__func__ = "w_get_profile_size3"
<!--
If you got a core dump, use gdb to extract troubleshooting data - full backtrace,
local variables and the list of the code at the issue location.
gdb /path/to/kamailio /path/to/corefile
bt full
info locals
list
If you are familiar with gdb, feel free to attach more of what you consider to
be relevant.
-->
#### Log Messages
When Kamailio hangs, the logs are not written to the kamailio.log file.
<!--
Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
#### SIP Traffic
I have attached the TRAP file.
<!--
If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
### Possible Solutions
We are expecting some kind of solution for it.
<!--
If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix.
-->
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
```
kamailio version is 5.5.5```
* **Operating System**:
[gdb_kamailio_trap.zip](https://github.com/user-attachments/files/16581474/g…
```
"Debian GNU/Linux 10 (buster)"```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3947
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3947(a)github.com>
<!--
Kamailio Project uses GitHub Issues only for bugs in the code or feature requests. Please use this template only for bug reports.
If you have questions about using Kamailio or related to its configuration file, ask on sr-users mailing list:
* https://lists.kamailio.org/mailman3/postorius/lists/sr-users.lists.kamailio…
If you have questions about developing extensions to Kamailio or its existing C code, ask on sr-dev mailing list:
* https://lists.kamailio.org/mailman3/postorius/lists/sr-dev.lists.kamailio.o…
Please try to fill this template as much as possible for any issue. It helps the developers to troubleshoot the issue.
Note that an issue report may be closed automatically after about 2 months
if there is no interest from developers or community users on pursuing it, being
considered expired. In such case, it can be reopened by writing a comment that includes
the token `/notexpired`. About two weeks before considered expired, the issue is
marked with the label `stale`, trying to notify the submitter and everyone else
that might be interested in it. To remove the label `stale`, write a comment that
includes the token `/notstale`. Also, any comment postpone the `expire` timeline,
being considered that there is interest in pursuing the issue.
If there is no content to be filled in a section, the entire section can be removed.
You can delete the comments from the template sections when filling.
You can delete next line and everything above before submitting (it is a comment).
-->
### Description
Hello, I am using ndb_redis module with TLS and redis-cluster. kamailio connects to the cluster endpoint when getting data, gets a 'MOVED' response and prints below error, it does not get data from the new host.
### Troubleshooting
I have verified that I can connect to the cluster endpoint and the host in 'MOVED' using redis-cli on the system that kamailio is running on. I tried to connect to a self hosted cluster without TLS, it works as expected. It also works as expected with TLS and a single redis host.
#### Reproduction
Connect to a redis-cluster over TLS
#### Log Messages
<!--
Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
2024-06-25T20:48:53.626708963Z 2024-06-25 20:48:53.626584 3(17) NOTICE: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:437]: redisc_get_server(): Hash 31807 (ra)
2024-06-25T20:48:53.626710053Z 2024-06-25 20:48:53.626600 3(17) DEBUG: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:440]: redisc_get_server(): Entry 31807 (ra)
2024-06-25T20:48:53.626711073Z 2024-06-25 20:48:53.626636 3(17) NOTICE: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:444]: redisc_get_server(): Using entry 31807 (ra)
2024-06-25T20:48:53.626712073Z 2024-06-25 20:48:53.626651 3(17) DEBUG: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:1030]: redisc_exec(): rsrv->ctxRedis = 0x556b4456dc20
2024-06-25T20:48:53.626713073Z 2024-06-25 20:48:53.626667 3(17) DEBUG: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:1036]: redisc_exec(): rsrv->ctxRedis = 0x556b4456dc20
2024-06-25T20:48:53.626810463Z 2024-06-25 20:48:53.626762 3(17) DEBUG: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:896]: check_cluster_reply(): Redis replied: "MOVED 3667 testdbredis-masked-hostname.00000000001110000000.130-characters-long.00000000000011111111100000000.availability-zone.amazonaws.com:6379"
2024-06-25T20:48:53.626811523Z 2024-06-25 20:48:53.626777 3(17) DEBUG: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:904]: check_cluster_reply(): Port "6379" [4] => 6379
2024-06-25T20:48:53.626816413Z 2024-06-25 20:48:53.626793 3(17) DEBUG: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:914]: check_cluster_reply(): Host "testdbredis-masked-hostname.00000000001110000000.130-characters-long.000000…" [130]
2024-06-25T20:48:53.626846113Z 2024-06-25 20:48:53.626810 3(17) NOTICE: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:925]: check_cluster_reply(): Name of new connection: testdbredis-masked-hostname.00000000001110000000.130-characters-long.00000000000011111111100000000.
2024-06-25T20:48:53.626851443Z 2024-06-25 20:48:53.626827 3(17) NOTICE: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:437]: redisc_get_server(): Hash 968070864 (testdbredis-masked-hostname.00000000001110000000.130-characters-long.00000000000011111111100000000.)
2024-06-25T20:48:53.626896173Z 2024-06-25 20:48:53.626844 3(17) DEBUG: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:440]: redisc_get_server(): Entry 31807 (ra)
2024-06-25T20:48:53.626897503Z 2024-06-25 20:48:53.626861 3(17) NOTICE: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:450]: redisc_get_server(): No entry found.
2024-06-25T20:48:53.626955363Z 2024-06-25 20:48:53.626877 3(17) ERROR: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:947]: check_cluster_reply(): failed to print server spec string
2024-06-25T20:48:53.626957263Z 2024-06-25 20:48:53.626893 3(17) DEBUG: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:1115]: redisc_exec(): rpl->rplRedis->type:6
2024-06-25T20:48:53.626958443Z 2024-06-25 20:48:53.626908 3(17) ERROR: {Kam 192.168.20.4 503874790_98536808 1 753067 INVITE}ndb_redis [redis_client.c:1117]: redisc_exec(): Redis error:MOVED 3667 testdbredis-masked-hostname.00000000001110000000.130-characters-long.00000000000011111111100000000.availability-zone.amazonaws.com:6379
```
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
```
version: kamailio 5.8.1 (x86_64/linux) 384843
flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, MEM_JOIN_FREE, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED
ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_SEND_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: 384843
compiled on 19:05:30 Jun 25 2024 with gcc 12.2.0
```
* Hiredis(v1.2.0) and hiredis-cluster(v0.13.0) are installed from source, both with ssl support.
* **Operating System**:
<!--
Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...;
Kernel details (output of `lsb_release -a` and `uname -a`)
-->
```
Debian 12
```
### Kamailio config snippet
```
loadmodule "ndb_redis.so"
.
.
# ----- ndb_redis params -----
modparam("ndb_redis", "server", "name=ra;addr=cluster.testdbredis-masked-hostname.0000000011111111100000.availability-zone.amazonaws.com;port=6379;tls=1")
modparam("ndb_redis", "init_without_redis", 1)
modparam("ndb_redis", "cluster", 1)
modparam("ndb_redis", "allow_dynamic_nodes", 1)
modparam("ndb_redis", "ca_path", "/etc/ssl/certs")
modparam("ndb_redis", "debug", 1)
.
.
redis_cmd("ra", "HMGET usr_preferences:entry::%s:%s blocked", "$rU", "$fU", "r");
if($redis(r=>value[0]) == 1) {
.
}
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3894
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3894(a)github.com>
Hi there,
I am currently using the tls_wolfssl module with kamailio and was wondering why the ability to set a cipher list was disabled.
From my own testing, uncommenting line 975 in tls_domain.c/ksr_tls_fix_domain adds the functionality and we haven't seen any issues with this so far.
Was there an issue with this when the module was first created? Should I be avoiding using this functionality? Thanks very much.
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3920
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3920(a)github.com>