[SR-Users] TLS Certificate Verification Issue

Klaus Darilion klaus.mailinglists at pernau.at
Wed Nov 7 16:07:05 CET 2012


Fixed in head and 3.3 branch.

regards
Klaus

On 29.10.2012 11:18, Kamal Palei wrote:
> Dear Klaus
> In tls_init.c file there is a function
> static void ser_free(void *ptr)
> {
>                  shm_free(ptr);
> }
> I modified it to
> static void ser_free(void *ptr)
> {
>          if(ptr)
>                  shm_free(ptr);
> }
> Just added a null check.
> During tls connection close it was close it was crashing.
> Incase you need to complete stack trace, please let me know, will revert
> back code chage, reproduce the issue and can get the backtrace.
> Best Regards
> kamal
>
>
> On Mon, Oct 29, 2012 at 3:26 PM, Klaus Darilion
> <klaus.mailinglists at pernau.at <mailto:klaus.mailinglists at pernau.at>> wrote:
>
>     Hi Kamal!
>
>     If the fix in standard Kamailio code or in code you have written
>     yourself (a proprietary module)?
>
>     If the problem is in the standard code please send us a diff so we
>     can fix Kamailio.
>
>     regards
>     Klaus
>
>
>     On 29.10.2012 10:53, Kamal Palei wrote:
>
>         Dear Klaus
>         Forgot to write you back otherday. I was able to trace the code
>         that was
>         crashing. It was trying to free a pointer that was null. I just
>         added a
>         null check. With this change, I am able to keep Kamailio up for
>         longer
>         duration, did not see the crash.
>         Thanks Klaus for your support.
>         kamal
>
>
>         On Mon, Oct 29, 2012 at 3:14 PM, Klaus Darilion
>         <klaus.mailinglists at pernau.at
>         <mailto:klaus.mailinglists at pernau.at>
>         <mailto:klaus.mailinglists at __pernau.at
>         <mailto:klaus.mailinglists at pernau.at>>> wrote:
>
>              See also:
>         http://www.kamailio.org/____dokuwiki/doku.php/____troubleshooting:corefiles
>         <http://www.kamailio.org/__dokuwiki/doku.php/__troubleshooting:corefiles>
>
>
>
>         <http://www.kamailio.org/__dokuwiki/doku.php/__troubleshooting:corefiles
>         <http://www.kamailio.org/dokuwiki/doku.php/troubleshooting:corefiles>>
>
>
>
>              On 26.10.2012 11:39, Kamal Palei wrote:
>
>                  Dear Klaus
>
>                  I am little bit new to linux debugging. Please let me
>         know below
>                  stuff.
>
>                  1. Whats the extension of core file.
>
>              The core file does not have an extension, it is usally just
>         called
>              "core.XXXX" with XXX is the process id of the crashed Kamailio
>              process. It will reside in the current working directory.
>
>
>                  2. Will the core files be generated in /home/user path
>         or some other
>                  default path
>
>
>              In the /etc/init.d/kamailio startup file you can configure
>         the core
>              pattern to be set before Kamailio is started. Then the core
>         files
>              will use the defined naming.
>
>              On Debian also activate core dumps by editing
>         /etc/default/kamailio
>
>
>                  3. Do I need to recompile Kamailio source with -g
>         option , or by
>                  default
>                  it is compiled with -g option
>
>
>               From your log file:
>
>                        0(9548) ALERT: <core> [main.c:745]: core was
>         generated
>
>              You see, your binaries already generate core files. Thus,
>         there is
>              no need to rebuild Kamailio.
>
>
>                  4. I hope we need to run "ulimit" before we start the
>         program or
>                  it is
>                  not required.
>
>
>              Usually you run "ulimit -c unlimited" before starting the
>         Kamailio
>              process to be sure that the core will not be truncated.
>
>
>                  My observation is if I run directly kamailio it is
>         crashing, if
>                  I run
>                  with gdb it is not crashing, not sure why this happens.
>
>
>              Strange. But once you have a core file, you can analyze it and
>              generate the backtrace.
>
>              Also make sure to not mix openssl libraries - this is often
>         a a problem.
>
>              regards
>              Klaus
>
>
>                  Best Regards
>                  kamal
>
>
>
>                  On Thu, Oct 25, 2012 at 8:01 PM, Klaus Darilion
>                  <klaus.mailinglists at pernau.at
>         <mailto:klaus.mailinglists at pernau.at>
>                  <mailto:klaus.mailinglists at __pernau.at
>         <mailto:klaus.mailinglists at pernau.at>>
>                  <mailto:klaus.mailinglists@
>         <mailto:klaus.mailinglists@>__p__ernau.at <http://pernau.at/>
>                  <mailto:klaus.mailinglists at __pernau.at
>         <mailto:klaus.mailinglists at pernau.at>>>> wrote:
>
>                       SIGABRT      6       Core    Abort signal from
>         abort(3)
>
>                       This means that there was an error condition
>         detected in the
>                       Kamailio code and the abort(3) function was
>         called. As you
>                  see in
>                       the logs a core file was generated. Find the core
>         file and
>                  load it
>                       into gdb and execute "backtrace". It will show you
>         were the
>                  problem
>                       happened and post it here.
>
>                       regards
>                       Klaus
>
>
>                       On 25.10.2012 16:23, Kamal Palei wrote:
>
>                           Dear Klaus
>                           The certificate verification I have disabled.
>
>                           Facing a new problem.
>                           When there is a connection reset, that time
>         Kamailio is
>                  crashing.
>                           During crash, I get below logs. Any idea why it is
>                  crashing and
>                           how can
>                           I avoid it.
>
>                           /oot at B2BUA:/usr/local/src/______scripts#
>           9(9557) : <core>
>
>
>
>                           [mem/q_malloc.c:431]: BUG: qm_free: bad
>         pointer (nil)
>                  (out of memory
>                           block!) - aborting
>                              0(9548) ALERT: <core> [main.c:742]: child
>         process
>                  9557 exited
>                           by a
>                           signal 6
>                              0(9548) ALERT: <core> [main.c:745]: core
>         was generated
>                              0(9548) INFO: <core> [main.c:757]: INFO:
>         terminating
>                  due to
>                           SIGCHLD
>                              6(9554) INFO: <core> [main.c:808]: INFO:
>         signal 15
>                  received
>                              8(9556) INFO: <core> [main.c:808]: INFO:
>         signal 15
>                  received
>                              4(9552) INFO: <core> [main.c:808]: INFO:
>         signal 15
>                  received
>                              5(9553) INFO: <core> [main.c:808]: INFO:
>         signal 15
>                  received
>                              3(9551) INFO: <core> [main.c:808]: INFO:
>         signal 15
>                  received
>                              7(9555) INFO: <core> [main.c:808]: INFO:
>         signal 15
>                  received
>                              1(9549) INFO: <core> [main.c:808]: INFO:
>         signal 15
>                  received
>                              2(9550) INFO: <core> [main.c:808]: INFO:
>         signal 15
>                  received
>                              0(9548) : <core> [mem/q_malloc.c:431]: BUG:
>         qm_free: bad
>                           pointer (nil)
>                           (out of memory block!) - aborting
>
>
>                           THANKS
>                           kamal
>                           /
>                           On Thu, Oct 25, 2012 at 7:43 PM, Klaus Darilion
>                           <klaus.mailinglists at pernau.at
>         <mailto:klaus.mailinglists at pernau.at>
>                  <mailto:klaus.mailinglists at __pernau.at
>         <mailto:klaus.mailinglists at pernau.at>>
>                           <mailto:klaus.mailinglists@
>         <mailto:klaus.mailinglists@>__p__ernau.at <http://pernau.at/>
>                  <mailto:klaus.mailinglists at __pernau.at
>         <mailto:klaus.mailinglists at pernau.at>>>
>                           <mailto:klaus.mailinglists@
>         <mailto:klaus.mailinglists@>
>                  <mailto:klaus.mailinglists@
>         <mailto:klaus.mailinglists@>>____p__ernau.at
>         <http://p__ernau.at/> <http://pernau.at/>
>
>
>                           <mailto:klaus.mailinglists@
>         <mailto:klaus.mailinglists@>__p__ernau.at <http://pernau.at/>
>                  <mailto:klaus.mailinglists at __pernau.at
>         <mailto:klaus.mailinglists at pernau.at>>>>> wrote:
>
>                                Hi Kamal!
>
>                                Are you familiar with SSL/TLS and
>         certificates?
>                  With TLS
>                           the trust
>                                between TLS server and TLS client is
>         usually via a
>                  trusted
>                                certification authority (CA). For
>         example, if the
>                           intermediate proxy
>                                uses a certificate which is issued by CA
>                  FOOBAR-XYZ, the
>                           you have to
>                                configure Kamailio to accept certificates
>         singed by
>                           FOOBAR-XYZ. This
>                                is done by copying the public root
>         certificate of
>                           FOOBAR-XYZ to the
>                                Kamailio server and configure Kamailio to
>         use the
>                  FOOBAR-XYZ
>                                certificate as trusted CA. Of course then you
>                  automatically
>                           also
>                                trust all others certificates issued by
>         FOOBAR-XYZ.
>
>                                To configure the trusted CAs use:
>         http://kamailio.org/docs/________modules/3.3.x/modules/tls.________html#ca_list
>         <http://kamailio.org/docs/______modules/3.3.x/modules/tls.______html#ca_list>
>
>         <http://kamailio.org/docs/______modules/3.3.x/modules/tls.______html#ca_list
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#ca_list>>
>
>
>
>
>         <http://kamailio.org/docs/______modules/3.3.x/modules/tls.______html#ca_list
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#ca_list>
>
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#ca_list
>         <http://kamailio.org/docs/__modules/3.3.x/modules/tls.__html#ca_list>>>
>
>
>
>
>
>
>         <http://kamailio.org/docs/______modules/3.3.x/modules/tls.______html#ca_list
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#ca_list>
>
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#ca_list
>         <http://kamailio.org/docs/__modules/3.3.x/modules/tls.__html#ca_list>>
>
>
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#ca_list
>         <http://kamailio.org/docs/__modules/3.3.x/modules/tls.__html#ca_list>
>
>         <http://kamailio.org/docs/__modules/3.3.x/modules/tls.__html#ca_list
>         <http://kamailio.org/docs/modules/3.3.x/modules/tls.html#ca_list>>>>
>
>                                You could also disable the certificate
>         validation
>                  with:
>         http://kamailio.org/docs/________modules/3.3.x/modules/tls.________html#verify_certificate
>         <http://kamailio.org/docs/______modules/3.3.x/modules/tls.______html#verify_certificate>
>
>         <http://kamailio.org/docs/______modules/3.3.x/modules/tls.______html#verify_certificate
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#verify_certificate>>
>
>
>
>
>         <http://kamailio.org/docs/______modules/3.3.x/modules/tls.______html#verify_certificate
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#verify_certificate>
>
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#verify_certificate
>         <http://kamailio.org/docs/__modules/3.3.x/modules/tls.__html#verify_certificate>>>
>
>
>
>
>
>
>         <http://kamailio.org/docs/______modules/3.3.x/modules/tls.______html#verify_certificate
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#verify_certificate>
>
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#verify_certificate
>         <http://kamailio.org/docs/__modules/3.3.x/modules/tls.__html#verify_certificate>>
>
>
>         <http://kamailio.org/docs/____modules/3.3.x/modules/tls.____html#verify_certificate
>         <http://kamailio.org/docs/__modules/3.3.x/modules/tls.__html#verify_certificate>
>
>         <http://kamailio.org/docs/__modules/3.3.x/modules/tls.__html#verify_certificate
>         <http://kamailio.org/docs/modules/3.3.x/modules/tls.html#verify_certificate>>>>
>
>                                But of course this reduces TLS benefits to
>                  encryption-only.
>
>                                regards
>                                Klaus
>
>
>                                On 22.10.2012 13:53, Kamal Palei wrote:
>
>                                    Dear All
>                                    I have modified kamailio,cfg and
>         compiled all the
>                           modules with TLS
>                                    enabled, and able to bring up the
>         kamailio
>                  proxy properly.
>
>                                    Kamailio proxy will receive the REGISTER
>                  message from
>                           endpoints
>                                    in UDP ,
>                                    and want to send this REGISTER
>         message to another
>                           intermediate
>                                    proxy in
>                                    TLS. For this purpose, I have added
>         few lines in
>                           kamailio.cfg
>                                    file as below.
>
>                                    I have created the certificates,
>         private keys as
>                           explained by README
>                                    file in kamailio-3.1.5/modules/tls/ path.
>
>                                              if(is_method("REGISTER"))
>                                              {
>
>         t_relay_to("tls:115.114.48.75
>                           <http://115.114.48.75 <http://115.114.48.75/>
>         <http://115.114.48.75/>>:______443
>
>                                    <http://115.114.48.75:443
>         <http://115.114.48.75:443/>
>                  <http://115.114.48.75:443/>>
>
>                                    <http://115.114.48.75:443
>         <http://115.114.48.75:443/>
>                  <http://115.114.48.75:443/>>")__;
>
>
>                                                      exit();
>                                              }
>
>                                    Looks like this is taking effect.
>         When Kamailio
>                           receives REGISTER
>                                    message it is trying to do handshake with
>                  intermediate
>                           proxy.
>                                    I used wireshark to see the handshake
>         messages.
>
>                                    1. From Kamailio proxy, a TCP SYNC
>         message is
>                  going to
>                                    intermediate proxy.
>                                    2. intermediate proxy sends SYNC + ACK
>                                    3. Kamailio sends CLIENT HELLO
>                                    4. intermediate proxy sends SERVER HELLO,
>                  CERTIFICATE
>                           and SERVER
>                                    HELLO DONE
>                                    5. The Kamailio sends ALERT (Level:
>         Fatal,
>                  Description:
>                           Unknown CA)
>                                    --->  IS something going wrong
>         here..............
>                                    6. Then Kamailio sends FIN + ACK
>
>                                    Can somebody please let me know why the
>                  certificate
>                           verification
>                                    fails
>                                    (I get this log in console).
>                                    How can I put a work around to avoid
>         certification
>                           verification
>                                    failure.
>
>                                    Best Regards
>                                    kamal
>
>
>
>
>
>                    _______________________________________________________
>
>
>
>                                    SIP Express Router (SER) and Kamailio
>                  (OpenSER) - sr-users
>                                    mailing list
>         sr-users at lists.sip-router.org
>         <mailto:sr-users at lists.sip-router.org>
>         <mailto:sr-users at lists.sip-__router.org
>         <mailto:sr-users at lists.sip-router.org>>
>                           <mailto:sr-users at lists.sip-____router.org
>         <mailto:sr-users at lists.sip-__router.org>
>                  <mailto:sr-users at lists.sip-__router.org
>         <mailto:sr-users at lists.sip-router.org>>>
>                           <mailto:sr-users at lists.sip-______router.org
>         <mailto:sr-users at lists.sip-____router.org>
>                  <mailto:sr-users at lists.sip-____router.org
>         <mailto:sr-users at lists.sip-__router.org>>
>                           <mailto:sr-users at lists.sip-____router.org
>         <mailto:sr-users at lists.sip-__router.org>
>                  <mailto:sr-users at lists.sip-__router.org
>         <mailto:sr-users at lists.sip-router.org>>>>
>         http://lists.sip-router.org/________cgi-bin/mailman/listinfo/__sr-______users
>         <http://lists.sip-router.org/______cgi-bin/mailman/listinfo/sr-______users>
>
>         <http://lists.sip-router.org/______cgi-bin/mailman/listinfo/__sr-____users
>         <http://lists.sip-router.org/____cgi-bin/mailman/listinfo/sr-____users>>
>
>
>
>
>         <http://lists.sip-router.org/______cgi-bin/mailman/listinfo/__sr-____users
>         <http://lists.sip-router.org/____cgi-bin/mailman/listinfo/sr-____users>
>
>         <http://lists.sip-router.org/____cgi-bin/mailman/listinfo/sr-____users
>         <http://lists.sip-router.org/__cgi-bin/mailman/listinfo/sr-__users>>>
>
>
>         <http://lists.sip-router.org/______cgi-bin/mailman/listinfo/__sr-____users
>         <http://lists.sip-router.org/____cgi-bin/mailman/listinfo/sr-____users>
>
>         <http://lists.sip-router.org/____cgi-bin/mailman/listinfo/sr-____users
>         <http://lists.sip-router.org/__cgi-bin/mailman/listinfo/sr-__users>>
>
>
>         <http://lists.sip-router.org/____cgi-bin/mailman/listinfo/sr-____users
>         <http://lists.sip-router.org/__cgi-bin/mailman/listinfo/sr-__users>
>
>         <http://lists.sip-router.org/__cgi-bin/mailman/listinfo/sr-__users
>         <http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users>>>>
>
>
>
>
>



More information about the sr-users mailing list