[OpenSIPS-Users] opensips 1.7+tls problems

[Ian Buckner]

I just wanted to pick up on question 1 as I have the same problem and may have got slightly further in tracing this:

Using ssldump I see the following during the initial REGISTER operation:

On OpenSips 1.7.0
---------------------------
New TCP connection #8: 81.5.147.34(61584) <-> myserver(5672)
8 1  0.0996 (0.0996)  C>S  Handshake
     ClientHello
       Version 3.1 
       cipher suites
       Unknown value 0x39
       Unknown value 0x38
       Unknown value 0x35
       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
       TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
       TLS_RSA_WITH_3DES_EDE_CBC_SHA
       Unknown value 0x33
       Unknown value 0x32
       Unknown value 0x2f
       TLS_RSA_WITH_RC4_128_SHA
       TLS_RSA_WITH_RC4_128_MD5
       TLS_DHE_RSA_WITH_DES_CBC_SHA
       TLS_DHE_DSS_WITH_DES_CBC_SHA
       TLS_RSA_WITH_DES_CBC_SHA
       TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
       TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
       TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
       TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
       TLS_RSA_EXPORT_WITH_RC4_40_MD5
       compression methods
                 NULL
8 2  0.1001 (0.0005)  S>C  Handshake
     ServerHello
       Version 3.1 
       session_id[32]=
         0a 84 43 7a 4b 15 d9 11 f9 ca 51 f2 33 30 c3 07 
         12 dd 35 a1 33 e1 43 fc 14 84 f6 0d 98 67 93 97 
       cipherSuite         Unknown value 0x35
       compressionMethod                   NULL
8 3  0.1001 (0.0000)  S>C  Handshake
     Certificate
8 4  0.1001 (0.0000)  S>C  Handshake
     ServerHelloDone
8 5  0.1546 (0.0545)  C>S  Handshake
     ClientKeyExchange
8 6  0.1546 (0.0000)  C>S  ChangeCipherSpec
8 7  0.1546 (0.0000)  C>S  Handshake
8 8  0.1557 (0.0010)  S>C  ChangeCipherSpec
8 9  0.1557 (0.0000)  S>C  Handshake
8 10 0.2133 (0.0575)  C>S  application_data
8 11 0.2133 (0.0000)  C>S  application_data
8 12 0.2140 (0.0007)  S>C  application_data
Unknown SSL content type 83
8 13 0.2686 (0.0545)  C>S  Alert
8 14 0.2686 (0.0000)  S>CShort record
8 15 0.2686 (0.0000)  S>C  Alert
8 16 0.2688 (0.0002)  S>C  Alert
8    0.2689 (0.0000)  S>C  TCP RST

i.e. an error on the first piece of application data sent from OpenSips back to the client. In my case, the Blink 1.2.0 client shows as registered (confirmed by opensipsctl ul show) but the TLS socket has been torn down.

Rolling back to 1.6.4-2, using the same certificates and TLS configuration:

On OpenSips 1.6.4-2
----------------------------
New TCP connection #7: 81.5.147.34(61303) <-> myserver(5672)
7 1  0.0806 (0.0806)  C>S  Handshake
     ClientHello
       Version 3.1 
       cipher suites
       Unknown value 0x39
       Unknown value 0x38
       Unknown value 0x35
       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
       TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
       TLS_RSA_WITH_3DES_EDE_CBC_SHA
       Unknown value 0x33
       Unknown value 0x32
       Unknown value 0x2f
       TLS_RSA_WITH_RC4_128_SHA
       TLS_RSA_WITH_RC4_128_MD5
       TLS_DHE_RSA_WITH_DES_CBC_SHA
       TLS_DHE_DSS_WITH_DES_CBC_SHA
       TLS_RSA_WITH_DES_CBC_SHA
       TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
       TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
       TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
       TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
       TLS_RSA_EXPORT_WITH_RC4_40_MD5
       compression methods
                 NULL
7 2  0.0811 (0.0005)  S>C  Handshake
     ServerHello
       Version 3.1 
       session_id[32]=
         1b 63 c6 56 b0 aa 18 a0 57 3b 26 84 8a d8 5a d1 
         ae 71 b2 9f 87 ff 02 31 d3 33 4d 7f 51 71 73 2e 
       cipherSuite         Unknown value 0x35
       compressionMethod                   NULL
7 3  0.0811 (0.0000)  S>C  Handshake
     Certificate
7 4  0.0811 (0.0000)  S>C  Handshake
     ServerHelloDone
7 5  0.1364 (0.0552)  C>S  Handshake
     ClientKeyExchange
7 6  0.1364 (0.0000)  C>S  ChangeCipherSpec
7 7  0.1364 (0.0000)  C>S  Handshake
7 8  0.1375 (0.0010)  S>C  ChangeCipherSpec
7 9  0.1375 (0.0000)  S>C  Handshake
7 10 0.1934 (0.0559)  C>S  application_data
7 11 0.1934 (0.0000)  C>S  application_data
7 12 0.1942 (0.0007)  S>C  application_data
7 13 0.2565 (0.0623)  C>S  application_data
7 14 0.2565 (0.0000)  C>S  application_data
7 15 0.2587 (0.0022)  S>C  application_data

Register succeeds, no error in the TLS channel, socket connection remains open for subsequent interactions.

@Yufei - perhaps you are able to confirm the same behaviour using ssldump too.


best regards,

Ian