<html>
<body>
<div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
<table bgcolor="#f9f3c9" width="100%" cellpadding="8" style="border: 1px #c9c399 solid;">
<tr>
<td>
This is an automatically generated e-mail. To reply, visit:
<a href="https://reviewboard.asterisk.org/r/2783/">https://reviewboard.asterisk.org/r/2783/</a>
</td>
</tr>
</table>
<br />
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<p style="margin-top: 0;">On October 13th, 2014, 7:32 a.m. CDT, <b>Olle E Johansson</b> wrote:</p>
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">What's the status of this patch? Should it be closed?</pre>
</blockquote>
</blockquote>
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">I think it should be closed out. The long, tortuous history is as follows:
(1) Mark Michelson, under ASTERISK-20212 (https://reviewboard.asterisk.org/r/2123) - as part of fixing chan_sip's usage of a FILE handle in this portion of the code - also fixed chan_sip mangling partial packets received on a TCP read. The usage of an overflow buffer allows for portions of a SIP message that aren't part of the current read to be deferred until a subsequent read operation. While that worked for TCP, it didn't resolve Asterisk's invalid handling of the messages under a TLS read, which had larger issues - namely, our usage of OpenSSL in the TCP/TLS layer. This was largely addressed by...
(2) Richard Mudgett, under ASTERISK-23673 (which was a security vulnerability). Richard had to re-work substantial portions of the TCP/TLS code as part of this vulnerability. A portion of that included rewriting much of the TLS read/write routines to better follow David Lee's suggestions on this issue. Unfortunately, chan_sip still didn't perform the TLS read correctly, which led to...
(3) Alexander Traud, in https://reviewboard.asterisk.org/r/3653/, tweaking some of the polling issues in chan_sip's usage of the TLS read. That still left an issue where we would not read all of the bytes on a read attempt, in a similar fashion to what the TCP reads used to do prior to Mark's patch. That led to...
(4) Elazar Broad consolidating the TCP/TLS reads into a single function in chan_sip in https://reviewboard.asterisk.org/r/3882, which resolved the issue where we would fail to read all of the bytes waiting for us.
And we should now properly handle large packets received over a TLS connection.</pre>
<br />
<p>- Matt</p>
<br />
<p>On August 21st, 2013, 3:24 p.m. CDT, Tzafrir Cohen wrote:</p>
<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="8" style="background-image: url('https://reviewboard.asterisk.org/static/rb/images/review_request_box_top_bg.ab6f3b1072c9.png'); background-position: left top; background-repeat: repeat-x; border: 1px black solid;">
<tr>
<td>
<div>Review request for Asterisk Developers.</div>
<div>By Tzafrir Cohen.</div>
<p style="color: grey;"><i>Updated Aug. 21, 2013, 3:24 p.m.</i></p>
<div style="margin-top: 1.5em;">
<b style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Bugs: </b>
<a href="https://issues.asterisk.org/jira/browse/ASTERISK-18345">ASTERISK-18345</a>
</div>
<div style="margin-top: 1.5em;">
<b style="color: #575012; font-size: 10pt;">Repository: </b>
Asterisk
</div>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Symptom: Asterisk drops a SIP/TLS connection: debugging reports that it has failed to read it.
I can reproduce this on my system when the TLS client is Asterisk 11.5 (installed from the Debian package) set with 'allow=all' to get a long list of codecs.
Calling ast_wait_for_input before every fgets is not sufficient.
Function fgets internally calls read (=> SSL_read) until either "\n" or
eof is found. And because the socket is polled only before the first
SSL_read call, consequent calls can fail and return <=0 even though the
data are on the way.
This is fixed by adding a read() loop inside the ssl_read() hook.
I came accross this patch today and it looks like it fixes my problem (see my comment at the end). The patch I used is by Filip Jenicek. See the bug report for the full log.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Testing </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Work on trunk.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">
<li>/trunk/main/tcptls.c <span style="color: grey">(397346)</span></li>
</ul>
<p><a href="https://reviewboard.asterisk.org/r/2783/diff/" style="margin-left: 3em;">View Diff</a></p>
</td>
</tr>
</table>
</div>
</body>
</html>