[asterisk-bugs] [JIRA] (ASTERISK-24711) DTLS handshake broken with latest OpenSSL versions

[Matt Jordan (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-24711?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=224613#comment-224613 ] 

Matt Jordan commented on ASTERISK-24711:
----------------------------------------

Some additional links:

* https://groups.google.com/forum/#!topic/discuss-webrtc/TqZ9N0eTn24
* https://mta.openssl.org/pipermail/openssl-dev/2015-January/000400.html

> DTLS handshake broken with latest OpenSSL versions
> --------------------------------------------------
>
>                 Key: ASTERISK-24711
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-24711
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>    Affects Versions: 13.1.0
>            Reporter: Jared Biel
>
> The latest versions of OpenSSL recently cleaned up some DTLS vulnerabilities and one of them (I believe it's CVE-2015-0206) caused RTP DTLS handshakes to stop working. This means that all WebRTC calls fail to negotiate audio. I came across this issue using a fully updated Ubuntu 14.04 server running OpenSSL 1.0.1f-1ubuntu2.8 and Asterisk 13.1.0.
> Upstream report: http://rt.openssl.org/Ticket/Display.html?id=3657
> The one-line workaround mentioned in the ticket worked for me. Patch:
> {code}
> --- a/res/res_rtp_asterisk.c
> +++ b/res/res_rtp_asterisk.c
> @@ -1320,6 +1320,8 @@
>  			return -1;
>  		}
>  
> +		SSL_CTX_set_read_ahead(rtp->ssl_ctx, 1);
> +
>  		if (!(certbio = BIO_new(BIO_s_file()))) {
>  			ast_log(LOG_ERROR, "Failed to allocate memory for certificate fingerprinting on RTP instance '%p'\n",
>  				instance);
> {code}



--
This message was sent by Atlassian JIRA
(v6.2#6252)