[asterisk-dev] SIP TLS handshake needs a timeout

[Klaus Darilion]

Olle E. Johansson wrote:
> 29 sep 2009 kl. 09.50 skrev Klaus Darilion:
> 
>>
>> David Vossel schrieb:
>>> Hello!
>>>
>>> Here's the problem.  Right now, if Asterisk attempts to initiate a
>>> SIP TLS client connection with another Asterisk box, but the
>>> receiving box only has TCP bound to the incoming connection's port, a
>>> TCP connection will be established between the two boxes, but the box
>>> initiating the connection will forever be stuck waiting for the
>>> receiving box to complete the TLS handshake.  This is a huge problem
>>> because TLS connection setup is done while the monitor lock is held.
>>> This patch aims at fixing that issue,
>>> https://reviewboard.asterisk.org/r/380/, but does not resolve the
>>> fact that a TLS connection will never go away if the TLS handshake
>>> does not complete.
>>>
>>> I've looked over the openssl toolkit and have not been able to find a
>>> successful method of doing this.  I've even attempted some rather
>>> unorthodox methods of scheduling the file descriptor's closure during
>>> the handshake after a period of time, and that did not work either.
>>> Note that this is not a timeout involving the setup of TCP socket, it
>>> occurs after that once the the TLS client initiates the TLS handshake
>>> and gets no response.
>>>
>>> Perhaps I am overlooking some obvious solution here.  Does anyone
>>> have any ideas?
>> sip-router tls module has several timeout values:
>>
>> send_timeout (int)
>> Sets the maximum interval of time after which sip-router will give up
>> trying to send a message over tls (time after a tls send will be  
>> aborted
>> and the corresponding tls connection closed). The value is in seconds.
>>
>> handshake_timeout (int)
>> Sets the maximum interval of time after which sip-router will give up
>> trying to accept a tls connection or connect to a tls peer. The  
>> value is
>> in seconds.
>>
>> connection_timeout (int)
>> Sets the amount of time after which an idle tls connection will be
>> closed. This is similar to tcp_connection_lifetime. The value is
>> expressed in seconds.
>>
>>
>> So, it should be doable. Maybe you get some ideas of his code:
>> http://git.sip-router.org/cgi-bin/gitweb.cgi?p=sip-router;a=tree;f=modules/tls;h=163532152dcbf9618212230a38d1f934d2bd2125;hb=HEAD
> 
> Due to licensing issues we can't copy source code from sip-router.org.
> 
> Thanks for the information though!
> 
> Any BSD licensed code that we can look at?

apache?