sr-dev July 2022

sr-dev@lists.kamailio.org

11 participants
232 discussions

[kamailio/kamailio] Errormessage TLS read:error:0D0E10DF:asn1 encoding routines:asn1_get_uint64:too large (Issue #3168)
by MartinPalmAGDS 04 Jul '22

04 Jul '22

We use Kamilio as a proxy server to connect softphones to our PBX systems. We have run into some TLS problems. These problems result in a shut down of the TLS connection after the error is encountered. We have looked into serial numbers of certificates. The current code in kamailio seems to be broken due to changes in the world around... many certificates today do not adhere to the previously assumed behaviour of certificate serial numbers anymore. The error which causes the connection to drop seems to be related to a comparison of the certificate serial numbers during renegotiation. tls_err_ret(): TLS read:error:0D0E10DF:asn1 encoding routines:asn1_get_uint64:too large Kamailio expects serial numbers to fit in a 64 bit unsigned, however during the last years, starting around 2003 more and more systems use automatically generated serial numbers, which are frequently 128 bit long. The serialnumber of our own Auerswald root certificate looks to be only 64 bit long, but during the negotiation is presented as 9 bytes starting with 00h, which is interpreted as a 72bit value. Trying to put this serial number in a 64 bit long kills the connection. Due to the different ways that are used to generate serial numbers now, there is no simple algorithm to condense the number into a 64bit value, and the whole number should be compared to see if it is same or higher. We currently have disabled renegotiation to avoid the connection being dropped during renegotiation. Which however can lead to the connection being dropped by the other side during renegotiation, but this is not a good permanent workaround! #### Reproduction This issue happens infrequently ### Possible Solutions No workaround possible on our side ### Additional Information Kamailio Version 5.5.4 LibSSL 1.1.1.n * **Operating System**: Linux, Debian oldstable -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/3168 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/issues/3168(a)github.com>

3 3

[kamailio/kamailio] tls: cert serial number can exceed uint64 (PR #3171)
by space88man 04 Jul '22

04 Jul '22

#### Pre-Submission Checklist    - [X] Commit message has the format required by CONTRIBUTING guide - [X] Commits are split per component (core, individual modules, libs, utils, ...) - [X] Each component has a single commit (if not, squash them into one commit) - [X] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated) #### Type Of Change - [ ] Small bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds new functionality) - [X] Breaking change (fix or feature that would change existing functionality) #### Checklist: - [X] PR should be backported to stable branches - [X] Tested changes locally - [X] Related to issue #3168 #### Description Certificate serial numbers can be large integers (> 2^64). Parse then as BIGNUM and store the string in pv; we cannot store as integer anymore. The original code handles 2^64 with a static buffer of 19. We upsize to 2^256 with a static buffer of 80. May break configurations that try to extract the sn pv as an integer (does anyone actually do this?) Addresses #3168. You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/3171 -- Commit Summary -- * tls: cert serial number can exceed uint64 -- File Changes -- M src/modules/tls/tls_select.c (24) -- Patch Links -- https://github.com/kamailio/kamailio/pull/3171.patch https://github.com/kamailio/kamailio/pull/3171.diff -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/3171 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/pull/3171(a)github.com>

2 10

git:master:996bf4ca: tls: cert serial number can exceed uint64
by Daniel-Constantin Mierla 04 Jul '22

04 Jul '22

Module: kamailio Branch: master Commit: 996bf4cad1d5645761fb80e66e435cedf29fa749 URL: https://github.com/kamailio/kamailio/commit/996bf4cad1d5645761fb80e66e435ce… Author: S-P Chan <shihping.chan(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2022-07-04T12:42:56+02:00 tls: cert serial number can exceed uint64 - GH #3168 --- Modified: src/modules/tls/tls_select.c --- Diff: https://github.com/kamailio/kamailio/commit/996bf4cad1d5645761fb80e66e435ce… Patch: https://github.com/kamailio/kamailio/commit/996bf4cad1d5645761fb80e66e435ce… --- diff --git a/src/modules/tls/tls_select.c b/src/modules/tls/tls_select.c index 985e6dcec1..9e597c1d78 100644 --- a/src/modules/tls/tls_select.c +++ b/src/modules/tls/tls_select.c @@ -630,24 +630,35 @@ static int pv_validity(sip_msg_t* msg, pv_param_t* param, pv_value_t* res) } -static int get_sn(str* res, int* ires, int local, sip_msg_t* msg) +static int get_sn(str* res, int local, sip_msg_t* msg) { - static char buf[INT2STR_MAX_LEN]; + static char buf[80]; // handle 256-bit > log(2^256,10) X509* cert; struct tcp_connection* c; - char* sn; - int num; + char* sn = NULL; + BIGNUM* bn = NULL; if (get_cert(&cert, &c, msg, local) < 0) return -1; - num = ASN1_INTEGER_get(X509_get_serialNumber(cert)); - sn = int2str(num, &res->len); + if (!(bn = BN_new())) goto error; + if (!ASN1_INTEGER_to_BN(X509_get_serialNumber(cert), bn)) goto error; + if (!(sn = BN_bn2dec(bn)) || strlen(sn) > 80) goto error; + + res->len = strlen(sn); memcpy(buf, sn, res->len); res->s = buf; - if (ires) *ires = num; + if (!local) X509_free(cert); tcpconn_put(c); + + BN_free(bn); + OPENSSL_free(sn); return 0; + + error: + if (sn) OPENSSL_free(sn); + if (bn) BN_free(bn); + return -1; } static int sel_sn(str* res, select_t* s, sip_msg_t* msg) @@ -662,7 +673,7 @@ static int sel_sn(str* res, select_t* s, sip_msg_t* msg) return -1; } - return get_sn(res, NULL, local, msg); + return get_sn(res, local, msg); } @@ -679,11 +690,11 @@ static int pv_sn(sip_msg_t* msg, pv_param_t* param, pv_value_t* res) return pv_get_null(msg, param, res); } - if (get_sn(&res->rs, &res->ri, local, msg) < 0) { + if (get_sn(&res->rs, local, msg) < 0) { return pv_get_null(msg, param, res); } - res->flags = PV_VAL_STR | PV_VAL_INT; + res->flags = PV_VAL_STR; return 0; }

1 0

git:5.6:09e9fa84: modules: readme files regenerated - modules ... [skip ci]
by Kamailio Dev 04 Jul '22

04 Jul '22

Module: kamailio Branch: 5.6 Commit: 09e9fa84bc550411c1840e5af325407ba4e25a7c URL: https://github.com/kamailio/kamailio/commit/09e9fa84bc550411c1840e5af325407… Author: Kamailio Dev <kamailio.dev(a)kamailio.org> Committer: Kamailio Dev <kamailio.dev(a)kamailio.org> Date: 2022-07-04T11:01:46+02:00 modules: readme files regenerated - modules ... [skip ci] --- Modified: src/modules/nats/README --- Diff: https://github.com/kamailio/kamailio/commit/09e9fa84bc550411c1840e5af325407… Patch: https://github.com/kamailio/kamailio/commit/09e9fa84bc550411c1840e5af325407… --- diff --git a/src/modules/nats/README b/src/modules/nats/README index f7f1ad7239..29cef171b7 100644 --- a/src/modules/nats/README +++ b/src/modules/nats/README @@ -35,6 +35,7 @@ Emmanuel Schmidbauer 4.1. nats_url (str) 4.2. num_publish_workers (int) 4.3. subject_queue_group (str) + 4.4. event_callback (str) 5. Functions @@ -48,9 +49,10 @@ Emmanuel Schmidbauer 1.1. Set nats_url parameter 1.2. Set num_publish_workers parameter 1.3. Set subject_queue_group parameter - 1.4. nats_publish usage - 1.5. Example usage of $natsData pseudo variable - 1.6. Define the event routes + 1.4. Set event_callback parameter + 1.5. nats_publish usage + 1.6. Example usage of $natsData pseudo variable + 1.7. Define the event routes Chapter 1. Admin Guide @@ -68,6 +70,7 @@ Chapter 1. Admin Guide 4.1. nats_url (str) 4.2. num_publish_workers (int) 4.3. subject_queue_group (str) + 4.4. event_callback (str) 5. Functions @@ -115,6 +118,7 @@ Chapter 1. Admin Guide 4.1. nats_url (str) 4.2. num_publish_workers (int) 4.3. subject_queue_group (str) + 4.4. event_callback (str) 4.1. nats_url (str) @@ -161,6 +165,24 @@ modparam("nats", "subject_queue_group", "MyQueue1:2021") modparam("nats", "subject_queue_group", "MyQueue2:2021") ... +4.4. event_callback (str) + + Name of the KEMI function to be executed instead of the event route. + + Default value is not set. + + Example 1.4. Set event_callback parameter +... +modparam("nats", "event_callback", "ksr_nats_event") + +-- event callback function implemented in Lua +function ksr_nats_event(evname) + KSR.info("===== nats module received event: " .. evname .. + ", data:" .. KSR.pv.gete('$natsData') .. "\n"); + return 1; +end +... + 5. Functions 5.1. nats_publish(subject, payload) @@ -169,7 +191,7 @@ modparam("nats", "subject_queue_group", "MyQueue2:2021") Publishes the payload to subject. - Example 1.4. nats_publish usage + Example 1.5. nats_publish usage ... $var(my_info) = "$ci=" + $ci + " $fU=" + $fU; nats_publish("mysubject", "$var(my_info)"); # publish $var(my_info) to "mysubjec @@ -178,7 +200,7 @@ t" 6. Pseudo Variables - Example 1.5. Example usage of $natsData pseudo variable + Example 1.6. Example usage of $natsData pseudo variable ... xlog("L_INFO", "received payload $natsData"); } @@ -191,7 +213,7 @@ t" received payload. The name of the event-route name must match the subject of the message. - Example 1.6. Define the event routes + Example 1.7. Define the event routes ... modparam("nats", "subject_queue_group", "Kamailio-World:2021") modparam("nats", "subject_queue_group", "MyQueue1:2021")

1 0

git:5.6:3839eed2: auth: coherent log message content with header parsing
by Daniel-Constantin Mierla 04 Jul '22

04 Jul '22

Module: kamailio Branch: 5.6 Commit: 3839eed219ab2da2e441cdfb82adbba24b03c035 URL: https://github.com/kamailio/kamailio/commit/3839eed219ab2da2e441cdfb82adbba… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2022-07-04T10:36:13+02:00 auth: coherent log message content with header parsing (cherry picked from commit 267d4ad48ac8426b3d5c53724281605a74d07999) --- Modified: src/modules/auth/auth_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/3839eed219ab2da2e441cdfb82adbba… Patch: https://github.com/kamailio/kamailio/commit/3839eed219ab2da2e441cdfb82adbba… --- diff --git a/src/modules/auth/auth_mod.c b/src/modules/auth/auth_mod.c index cc16643eb49..53e02f21056 100644 --- a/src/modules/auth/auth_mod.c +++ b/src/modules/auth/auth_mod.c @@ -450,12 +450,12 @@ int ki_has_credentials(sip_msg_t *msg, str* srealm) ret = find_credentials(msg, srealm, HDR_PROXYAUTH_T, &hdr); if(ret==0) { - LM_DBG("found www credentials with realm [%.*s]\n", srealm->len, srealm->s); + LM_DBG("found proxy credentials with realm [%.*s]\n", srealm->len, srealm->s); return 1; } ret = find_credentials(msg, srealm, HDR_AUTHORIZATION_T, &hdr); if(ret==0) { - LM_DBG("found proxy credentials with realm [%.*s]\n", srealm->len, srealm->s); + LM_DBG("found www credentials with realm [%.*s]\n", srealm->len, srealm->s); return 1; }

1 0

git:5.6:11a191e8: siptrace: lookup socket by name if not set for hep
by Daniel-Constantin Mierla 04 Jul '22

04 Jul '22

Module: kamailio Branch: 5.6 Commit: 11a191e837821c535832382ce9f0ed244e4d66b9 URL: https://github.com/kamailio/kamailio/commit/11a191e837821c535832382ce9f0ed2… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2022-07-04T10:36:01+02:00 siptrace: lookup socket by name if not set for hep - GH #3174 (cherry picked from commit 66f175f40e6145e895fa22952b40b372e4eff381) --- Modified: src/modules/siptrace/siptrace_hep.c --- Diff: https://github.com/kamailio/kamailio/commit/11a191e837821c535832382ce9f0ed2… Patch: https://github.com/kamailio/kamailio/commit/11a191e837821c535832382ce9f0ed2… --- diff --git a/src/modules/siptrace/siptrace_hep.c b/src/modules/siptrace/siptrace_hep.c index 412eb8abdc6..6a4fa1f25e4 100644 --- a/src/modules/siptrace/siptrace_hep.c +++ b/src/modules/siptrace/siptrace_hep.c @@ -588,6 +588,9 @@ int hlog(struct sip_msg *msg, str *correlationid, str *message) pkg_free(p); if(trace_send_sock_name_str.s) { + if(!trace_send_sock_info) { + trace_send_sock_info = ksr_get_socket_by_name(&trace_send_sock_name_str); + } dst.send_sock = trace_send_sock_info; } else if(trace_send_sock_str.s) { LM_DBG("send sock activated - find the sock info\n");

1 0

git:5.6:d83ec54b: kamctl: propagate DB_PATH to DBTEXT_PATH
by Daniel-Constantin Mierla 04 Jul '22

04 Jul '22

Module: kamailio Branch: 5.6 Commit: d83ec54bfc13ac1ddc5a6d39dfaa4f3313d976a9 URL: https://github.com/kamailio/kamailio/commit/d83ec54bfc13ac1ddc5a6d39dfaa4f3… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2022-07-04T10:35:48+02:00 kamctl: propagate DB_PATH to DBTEXT_PATH - GH #3170 (cherry picked from commit 1f6ec9022f2358441233e8b139e13cbdcf0947aa) --- Modified: utils/kamctl/kamctl.dbtext --- Diff: https://github.com/kamailio/kamailio/commit/d83ec54bfc13ac1ddc5a6d39dfaa4f3… Patch: https://github.com/kamailio/kamailio/commit/d83ec54bfc13ac1ddc5a6d39dfaa4f3… --- diff --git a/utils/kamctl/kamctl.dbtext b/utils/kamctl/kamctl.dbtext index 2198d30db2..0e5f9c424a 100644 --- a/utils/kamctl/kamctl.dbtext +++ b/utils/kamctl/kamctl.dbtext @@ -19,7 +19,11 @@ fi; # path to the dbtext database if [ -z "$DBTEXT_PATH" ] ; then - DBTEXT_PATH="/usr/local/share/kamailio/dbtext/kamailio" + if [ -z "$DB_PATH" ] ; then + DBTEXT_PATH="/usr/local/share/kamailio/dbtext/kamailio" + else + DBTEXT_PATH=$DB_PATH + fi fi export DBTEXT_PATH

1 0

git:5.6:bdd1c561: core: init pv buffers earlier to be avaialble for cli params
by Daniel-Constantin Mierla 04 Jul '22

04 Jul '22

Module: kamailio Branch: 5.6 Commit: bdd1c561ed640bc79a270532ed70346c5478001f URL: https://github.com/kamailio/kamailio/commit/bdd1c561ed640bc79a270532ed70346… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2022-07-04T10:35:38+02:00 core: init pv buffers earlier to be avaialble for cli params - GH #3152 (cherry picked from commit a78adb5340ae6cb57f756189d070c32c49bfa426) --- Modified: src/main.c --- Diff: https://github.com/kamailio/kamailio/commit/bdd1c561ed640bc79a270532ed70346… Patch: https://github.com/kamailio/kamailio/commit/bdd1c561ed640bc79a270532ed70346… --- diff --git a/src/main.c b/src/main.c index cb0c92e357..4ee5afe9d0 100644 --- a/src/main.c +++ b/src/main.c @@ -2172,6 +2172,10 @@ int main(int argc, char** argv) init_tcp_options(); /* set the defaults before the config */ #endif + if (pv_init_buffer()<0) { + goto error; + } + pp_define_core(); /* process command line (cfg. file path etc) */

1 0

git:5.6:73ff08bc: ipops: added fixup free functions and use of ANY_ROUTE
by Daniel-Constantin Mierla 04 Jul '22

04 Jul '22

Module: kamailio Branch: 5.6 Commit: 73ff08bc5aada525017766121342676058507638 URL: https://github.com/kamailio/kamailio/commit/73ff08bc5aada525017766121342676… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2022-07-04T10:35:23+02:00 ipops: added fixup free functions and use of ANY_ROUTE (cherry picked from commit fa6a2d79aca3bc4733276ce99a53efd8fe63ffd5) --- Modified: src/modules/ipops/ipops_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/73ff08bc5aada525017766121342676… Patch: https://github.com/kamailio/kamailio/commit/73ff08bc5aada525017766121342676…

1 0

git:5.6:0ac60f61: nats: add KEMI publish function and event_callback param (#3154)
by Daniel-Constantin Mierla 04 Jul '22

04 Jul '22

Module: kamailio Branch: 5.6 Commit: 0ac60f613674cd686e80aa3ab87a17bcc97ef44f URL: https://github.com/kamailio/kamailio/commit/0ac60f613674cd686e80aa3ab87a17b… Author: Seven Du <dujinfang(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2022-07-04T10:35:06+02:00 nats: add KEMI publish function and event_callback param (#3154) (cherry picked from commit 25d42b7e69cc6242c66887a2816499d841e3ba89) --- Modified: src/modules/nats/defs.h Modified: src/modules/nats/doc/nats_admin.xml Modified: src/modules/nats/nats_mod.c Modified: src/modules/nats/nats_mod.h Modified: src/modules/nats/nats_pub.c Modified: src/modules/nats/nats_pub.h --- Diff: https://github.com/kamailio/kamailio/commit/0ac60f613674cd686e80aa3ab87a17b… Patch: https://github.com/kamailio/kamailio/commit/0ac60f613674cd686e80aa3ab87a17b…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev July 2022