[asterisk-bugs] [JIRA] (ASTERISK-27031) res_pjsip: Unable to configure TLSv1.2 on TLS transport
Bernhard Schmidt (JIRA)
noreply at issues.asterisk.org
Thu Aug 31 05:26:09 CDT 2017
[ https://issues.asterisk.org/jira/browse/ASTERISK-27031?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=238342#comment-238342 ]
Bernhard Schmidt edited comment on ASTERISK-27031 at 8/31/17 5:25 AM:
----------------------------------------------------------------------
The corresponding Debian bug for this is https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=873798.
Setting it to "default" (or not setting it at all) should, as far as I can see, do the following
PJSIP_SSL_DEFAULT_METHOD -> PJ_SSL_SOCK_PROTO_DEFAULT
{{{
if (ssock->param.proto == PJ_SSL_SOCK_PROTO_DEFAULT)
ssock->param.proto = PJ_SSL_SOCK_PROTO_SSL23;
/* Determine SSL method to use */
switch (ssock->param.proto) {
case PJ_SSL_SOCK_PROTO_TLS1:
ssl_method = (SSL_METHOD*)TLSv1_method();
break;
#ifndef OPENSSL_NO_SSL2
case PJ_SSL_SOCK_PROTO_SSL2:
ssl_method = (SSL_METHOD*)SSLv2_method();
break;
#endif
#ifndef OPENSSL_NO_SSL3_METHOD
case PJ_SSL_SOCK_PROTO_SSL3:
ssl_method = (SSL_METHOD*)SSLv3_method();
#endif
break;
}
if (!ssl_method) {
ssl_method = (SSL_METHOD*)SSLv23_method();
#ifdef SSL_OP_NO_SSLv2
/** Check if SSLv2 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_SSL2)==0)?
SSL_OP_NO_SSLv2:0;
#endif
#ifdef SSL_OP_NO_SSLv3
/** Check if SSLv3 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_SSL3)==0)?
SSL_OP_NO_SSLv3:0;
#endif
#ifdef SSL_OP_NO_TLSv1
/** Check if TLSv1 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1)==0)?
SSL_OP_NO_TLSv1:0;
#endif
#ifdef SSL_OP_NO_TLSv1_1
/** Check if TLSv1_1 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1_1)==0)?
SSL_OP_NO_TLSv1_1:0;
#endif
#ifdef SSL_OP_NO_TLSv1_2
/** Check if TLSv1_2 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1_2)==0)?
SSL_OP_NO_TLSv1_2:0;
#endif
}}}
and
{{{
/**
* Certain backend implementation e.g:OpenSSL, has feature to enable all
* protocol.
*/
PJ_SSL_SOCK_PROTO_SSL23 = (1 << 16) - 1,
}}}
was (Author: bschmidt):
The corresponding Debian bug for this is https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=873798.
Setting it to "default" (or not setting it at all) should, as far as I can see, do the following
PJSIP_SSL_DEFAULT_METHOD -> PJ_SSL_SOCK_PROTO_DEFAULT
```
if (ssock->param.proto == PJ_SSL_SOCK_PROTO_DEFAULT)
ssock->param.proto = PJ_SSL_SOCK_PROTO_SSL23;
/* Determine SSL method to use */
switch (ssock->param.proto) {
case PJ_SSL_SOCK_PROTO_TLS1:
ssl_method = (SSL_METHOD*)TLSv1_method();
break;
#ifndef OPENSSL_NO_SSL2
case PJ_SSL_SOCK_PROTO_SSL2:
ssl_method = (SSL_METHOD*)SSLv2_method();
break;
#endif
#ifndef OPENSSL_NO_SSL3_METHOD
case PJ_SSL_SOCK_PROTO_SSL3:
ssl_method = (SSL_METHOD*)SSLv3_method();
#endif
break;
}
if (!ssl_method) {
ssl_method = (SSL_METHOD*)SSLv23_method();
#ifdef SSL_OP_NO_SSLv2
/** Check if SSLv2 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_SSL2)==0)?
SSL_OP_NO_SSLv2:0;
#endif
#ifdef SSL_OP_NO_SSLv3
/** Check if SSLv3 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_SSL3)==0)?
SSL_OP_NO_SSLv3:0;
#endif
#ifdef SSL_OP_NO_TLSv1
/** Check if TLSv1 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1)==0)?
SSL_OP_NO_TLSv1:0;
#endif
#ifdef SSL_OP_NO_TLSv1_1
/** Check if TLSv1_1 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1_1)==0)?
SSL_OP_NO_TLSv1_1:0;
#endif
#ifdef SSL_OP_NO_TLSv1_2
/** Check if TLSv1_2 is enabled */
ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1_2)==0)?
SSL_OP_NO_TLSv1_2:0;
#endif
```
and
```
/**
* Certain backend implementation e.g:OpenSSL, has feature to enable all
* protocol.
*/
PJ_SSL_SOCK_PROTO_SSL23 = (1 << 16) - 1,
```
> res_pjsip: Unable to configure TLSv1.2 on TLS transport
> -------------------------------------------------------
>
> Key: ASTERISK-27031
> URL: https://issues.asterisk.org/jira/browse/ASTERISK-27031
> Project: Asterisk
> Issue Type: Bug
> Security Level: None
> Components: Resources/res_pjsip
> Affects Versions: 13.16.0
> Environment: Centos 7
> Reporter: delvar
>
> When setting up a transport i am unable to enforce TLS1.2, only TLS1.0.
> h3. My pjsip.conf
> {noformat}
> [transport-tls]
> type=transport
> protocol=tls
> bind=0.0.0.0:5061
> cert_file=/etc/asterisk/keys/cert.pem
> priv_key_file=/etc/asterisk/keys/privkey.pem
> method=tlsv1
> {noformat}
> h3. When testing tls1.2 with OpenSSL
> {noformat}
> openssl s_client -tls1_2 -host gw03.dev -port 5061
> CONNECTED(00000003)
> 140260503979936:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
> {noformat}
> When testing with OpenSSL and not using the -tls1_2 option it works as expected and the TLS handshake completes. (not shown here)
> h3. Asterisk Code
> https://github.com/asterisk/asterisk/blob/13.16/res/res_pjsip/config_transport.c we see the list of allowed values and the mapped PJSIP Methods on line 885+
> {noformat}
> if (ast_strlen_zero(var->value) || !strcasecmp(var->value, "default")) {
> state->tls.method = PJSIP_SSL_DEFAULT_METHOD;
> } else if (!strcasecmp(var->value, "unspecified")) {
> state->tls.method = PJSIP_SSL_UNSPECIFIED_METHOD;
> } else if (!strcasecmp(var->value, "tlsv1")) {
> state->tls.method = PJSIP_TLSV1_METHOD;
> } else if (!strcasecmp(var->value, "sslv2")) {
> state->tls.method = PJSIP_SSLV2_METHOD;
> } else if (!strcasecmp(var->value, "sslv3")) {
> state->tls.method = PJSIP_SSLV3_METHOD;
> } else if (!strcasecmp(var->value, "sslv23")) {
> state->tls.method = PJSIP_SSLV23_METHOD;
> } else {
> return -1;
> }
> {noformat}
> As you can see there is no mapping for PJSIP_TLSV1_2_METHOD,
>
> h3. PJSIP Code
> http://svn.pjsip.org/repos/pjproject/trunk/pjsip/src/pjsip/sip_transport_tls.c
> {noformat}
> switch(ssl_method) {
> case PJSIP_SSLV2_METHOD:
> out_proto = PJ_SSL_SOCK_PROTO_SSL2;
> break;
> case PJSIP_SSLV3_METHOD:
> out_proto = PJ_SSL_SOCK_PROTO_SSL3;
> break;
> case PJSIP_TLSV1_METHOD:
> out_proto = PJ_SSL_SOCK_PROTO_TLS1;
> break;
> case PJSIP_TLSV1_1_METHOD:
> out_proto = PJ_SSL_SOCK_PROTO_TLS1_1;
> break;
> case PJSIP_TLSV1_2_METHOD:
> out_proto = PJ_SSL_SOCK_PROTO_TLS1_2;
> break;
> case PJSIP_SSLV23_METHOD:
> out_proto = PJ_SSL_SOCK_PROTO_SSL23;
> break;
> default:
> out_proto = PJ_SSL_SOCK_PROTO_DEFAULT;
> break;
> }
> {noformat}
> h3. Critical
> This is critical as TLS 1 and 1.1 are vulnerable to a range of exploits and should not be used.
> https://blog.varonis.com/ssl-and-tls-1-0-no-longer-acceptable-for-pci-compliance/
--
This message was sent by Atlassian JIRA
(v6.2#6252)
More information about the asterisk-bugs
mailing list