[asterisk-bugs] [JIRA] (ASTERISK-27031) res_pjsip: Unable to configure TLSv1.2 on TLS transport

[Bernhard Schmidt (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-27031?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=238342#comment-238342 ] 

Bernhard Schmidt commented on ASTERISK-27031:
---------------------------------------------

The corresponding Debian bug for this is https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=873798.

Setting it to "default" (or not setting it at all) should, as far as I can see, do the following

PJSIP_SSL_DEFAULT_METHOD -> PJ_SSL_SOCK_PROTO_DEFAULT

```
    if (ssock->param.proto == PJ_SSL_SOCK_PROTO_DEFAULT)
        ssock->param.proto = PJ_SSL_SOCK_PROTO_SSL23;

    /* Determine SSL method to use */
    switch (ssock->param.proto) {
    case PJ_SSL_SOCK_PROTO_TLS1:
        ssl_method = (SSL_METHOD*)TLSv1_method();
        break;
#ifndef OPENSSL_NO_SSL2
    case PJ_SSL_SOCK_PROTO_SSL2:
        ssl_method = (SSL_METHOD*)SSLv2_method();
        break;
#endif
#ifndef OPENSSL_NO_SSL3_METHOD
    case PJ_SSL_SOCK_PROTO_SSL3:
        ssl_method = (SSL_METHOD*)SSLv3_method();
#endif
        break;
    }

    if (!ssl_method) {
        ssl_method = (SSL_METHOD*)SSLv23_method();

#ifdef SSL_OP_NO_SSLv2
        /** Check if SSLv2 is enabled */
        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_SSL2)==0)?
                    SSL_OP_NO_SSLv2:0;
#endif

#ifdef SSL_OP_NO_SSLv3
        /** Check if SSLv3 is enabled */
        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_SSL3)==0)?
                    SSL_OP_NO_SSLv3:0;
#endif

#ifdef SSL_OP_NO_TLSv1
        /** Check if TLSv1 is enabled */
        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1)==0)?
                    SSL_OP_NO_TLSv1:0;
#endif

#ifdef SSL_OP_NO_TLSv1_1
        /** Check if TLSv1_1 is enabled */
        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1_1)==0)?
                    SSL_OP_NO_TLSv1_1:0;
#endif

#ifdef SSL_OP_NO_TLSv1_2
        /** Check if TLSv1_2 is enabled */
        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1_2)==0)?
                    SSL_OP_NO_TLSv1_2:0;

#endif

```

and

```
    /** 
     * Certain backend implementation e.g:OpenSSL, has feature to enable all
     * protocol. 
     */
    PJ_SSL_SOCK_PROTO_SSL23   = (1 << 16) - 1,
```

> res_pjsip: Unable to configure TLSv1.2 on TLS transport
> -------------------------------------------------------
>
>                 Key: ASTERISK-27031
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27031
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_pjsip
>    Affects Versions: 13.16.0
>         Environment: Centos 7
>            Reporter: delvar
>
> When setting up a transport i am unable to enforce TLS1.2, only TLS1.0.
> h3. My pjsip.conf
> {noformat}
> [transport-tls]
> type=transport
> protocol=tls
> bind=0.0.0.0:5061
> cert_file=/etc/asterisk/keys/cert.pem
> priv_key_file=/etc/asterisk/keys/privkey.pem
> method=tlsv1
> {noformat}
> h3. When testing tls1.2 with OpenSSL 
> {noformat}
> openssl s_client -tls1_2 -host gw03.dev -port 5061
> CONNECTED(00000003)
> 140260503979936:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
> {noformat}
> When testing with OpenSSL and not using the -tls1_2 option it works as expected and the TLS handshake completes. (not shown here)
> h3. Asterisk Code
> https://github.com/asterisk/asterisk/blob/13.16/res/res_pjsip/config_transport.c we see the list of allowed values and the mapped PJSIP Methods on line 885+
> {noformat}
> 	if (ast_strlen_zero(var->value) || !strcasecmp(var->value, "default")) {
> 		state->tls.method = PJSIP_SSL_DEFAULT_METHOD;
> 	} else if (!strcasecmp(var->value, "unspecified")) {
> 		state->tls.method = PJSIP_SSL_UNSPECIFIED_METHOD;
> 	} else if (!strcasecmp(var->value, "tlsv1")) {
> 		state->tls.method = PJSIP_TLSV1_METHOD;
> 	} else if (!strcasecmp(var->value, "sslv2")) {
> 		state->tls.method = PJSIP_SSLV2_METHOD;
> 	} else if (!strcasecmp(var->value, "sslv3")) {
> 		state->tls.method = PJSIP_SSLV3_METHOD;
> 	} else if (!strcasecmp(var->value, "sslv23")) {
> 		state->tls.method = PJSIP_SSLV23_METHOD;
> 	} else {
> 		return -1;
> 	}
> {noformat}
> As you can see there is no mapping for PJSIP_TLSV1_2_METHOD, 
>  
> h3. PJSIP Code
> http://svn.pjsip.org/repos/pjproject/trunk/pjsip/src/pjsip/sip_transport_tls.c
> {noformat}
>    switch(ssl_method) {
>     case PJSIP_SSLV2_METHOD:
> 	out_proto = PJ_SSL_SOCK_PROTO_SSL2;
> 	break;
>     case PJSIP_SSLV3_METHOD:
> 	out_proto = PJ_SSL_SOCK_PROTO_SSL3;
> 	break;
>     case PJSIP_TLSV1_METHOD:
> 	out_proto = PJ_SSL_SOCK_PROTO_TLS1;
> 	break;
>     case PJSIP_TLSV1_1_METHOD:
> 	out_proto = PJ_SSL_SOCK_PROTO_TLS1_1;
> 	break;
>     case PJSIP_TLSV1_2_METHOD:
> 	out_proto = PJ_SSL_SOCK_PROTO_TLS1_2;
> 	break;
>     case PJSIP_SSLV23_METHOD:
> 	out_proto = PJ_SSL_SOCK_PROTO_SSL23;
> 	break;
>     default:
> 	out_proto = PJ_SSL_SOCK_PROTO_DEFAULT;
> 	break;
>     }   
> {noformat}
> h3. Critical
> This is critical as TLS 1 and 1.1 are vulnerable to a range of exploits and should not be used.
> https://blog.varonis.com/ssl-and-tls-1-0-no-longer-acceptable-for-pci-compliance/



--
This message was sent by Atlassian JIRA
(v6.2#6252)