<p>Hi All.</p>
<p>After some try to configure kamailio 4.4.3 to act as SPI TLS client for Cisco SIP TLS gateways I have found one issue.</p>
<p>If I do client configuration for tls</p>
<p>[client:10.1.23.19:5061]<br>
verify_certificate = yes<br>
ca_list = /etc/kamailio/CAs/ca1.pem</p>
<p>[client:10.1.23.29:5061]<br>
verify_certificate = yes<br>
ca_list = /etc/kamailio/CAs/ca2.pem</p>
<p>[client:default]<br>
verify_certificate = no<br>
require_certificate = no</p>
<p>Kamailo always do default profile selection (I do configuration without server_name or server_id, with it kamailio works fine but there are some troubles to make selection of this parameters from<br>
config script, I need additional checks and queries)</p>
<p>after some research in tls module source code I have added some debug information in file tls_server.c:</p>
<pre><code> if (c->flags & F_CONN_PASSIVE) {
state=S_TLS_ACCEPTING;
dom = tls_lookup_cfg(cfg, TLS_DOMAIN_SRV,
&c->rcv.dst_ip, c->rcv.dst_port, 0, 0);
} else {
state=S_TLS_CONNECTING;
sname = tls_get_connect_server_name();
srvid = tls_get_connect_server_id();
// -------------------------------------------------------------
DBG("Entered client config loockup (c->rcv.dst_port %d)\n", c->rcv.dst_port);
DBG("Entered client config loockup (&c->rcv.dst_ip %s)\n", ip_addr2a(&c->rcv.dst_ip));
DBG("Entered client config loockup (c->rcv.src_port %d)\n", c->rcv.src_port);
DBG("Entered client config loockup (&c->rcv.src_ip %s)\n", ip_addr2a(&c->rcv.src_ip));
// -------------------------------------------------------------
dom = tls_lookup_cfg(cfg, TLS_DOMAIN_CLI,
&c->rcv.dst_ip, c->rcv.dst_port, sname, srvid);
}
</code></pre>
<p>After making a test call:<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: <core> [parser/msg_parser.c:597]: parse_msg(): method: <INVITE><br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: <core> [parser/msg_parser.c:599]: parse_msg(): uri: sip:9098@10.1.23.19:5061;transport=TLS<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: <core> [parser/msg_parser.c:601]: parse_msg(): version: <SIP/2.0></p>
<p>I see:</p>
<p>Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: <core> [ip_addr.c:229]: print_ip(): tcpconn_new: new tcp connection: 10.1.23.19<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: <core> [tcp_main.c:985]: tcpconn_new(): on port 5061, type 3<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: <core> [tcp_main.c:1295]: tcpconn_add(): hashes: 1394:0:0, 1<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_server.c:197]: tls_complete_init(): completing tls connection initialization<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_server.c:160]: tls_get_connect_server_name(): xavp with outbound server name not found<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_server.c:140]: tls_get_connect_server_id(): xavp with outbound server id not found<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_server.c:219]: tls_complete_init(): Entered client config loockup (c->rcv.dst_port 40123)<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_server.c:220]: tls_complete_init(): Entered client config loockup (&c->rcv.dst_ip 10.1.23.23)<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_server.c:221]: tls_complete_init(): Entered client config loockup (c->rcv.src_port 5061)<br>
Oct 26 09:23:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_server.c:222]: tls_complete_init(): Entered client config loockup (&c->rcv.src_ip 10.1.23.19)</p>
<p>Where:<br>
<strong>&c->rcv.dst_ip 10.1.23.23</strong> - it is my local kamailio tls socket ip address to make tls connect from<br>
<strong>c->rcv.dst_port 40123</strong> - it is my local kamailio tls socket port<br>
<strong>&c->rcv.src_ip 10.1.23.19</strong> - ip of my TLS device to make tls connection to<br>
<strong>c->rcv.src_port 5061</strong> - port of my TLS device to make tls connection to</p>
<p>so if I change line</p>
<pre><code> dom = tls_lookup_cfg(cfg, TLS_DOMAIN_CLI,
&c->rcv.dst_ip, c->rcv.dst_port, sname, srvid);
to
</code></pre>
<pre><code> dom = tls_lookup_cfg(cfg, TLS_DOMAIN_CLI,
&c->rcv.src_ip, c->rcv.src_port, sname, srvid);
</code></pre>
<p>I got correct client domain selection from tls.cfg:</p>
<p>Oct 26 09:33:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_server.c:233]: tls_complete_init(): Using initial TLS domain TLSc<10.1.23.19:5061> (dom 0x7fd2eefa3d68 ctx 0x7fd2ef7e70a8 sn [])<br>
Oct 26 09:33:56 sip1 /usr/sbin/kamailio[20712]: DEBUG: tls [tls_domain.c:703]: sr_ssl_ctx_info_callback(): SSL handshake started</p>
<hr>
<h4>You can view, comment on, or merge this pull request online at:</h4>
<p> <a href='https://github.com/kamailio/kamailio/pull/842'>https://github.com/kamailio/kamailio/pull/842</a></p>
<h4>Commit Summary</h4>
<ul>
<li>Merge pull request #3 from kamailio/master</li>
<li>modules/tls: fix TLS client config selection based on dst ip and port</li>
</ul>
<h4>File Changes</h4>
<ul>
<li>
<strong>M</strong>
<a href="https://github.com/kamailio/kamailio/pull/842/files#diff-0">modules/tls/tls_server.c</a>
(2)
</li>
</ul>
<h4>Patch Links:</h4>
<ul>
<li><a href='https://github.com/kamailio/kamailio/pull/842.patch'>https://github.com/kamailio/kamailio/pull/842.patch</a></li>
<li><a href='https://github.com/kamailio/kamailio/pull/842.diff'>https://github.com/kamailio/kamailio/pull/842.diff</a></li>
</ul>
<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/kamailio/kamailio/pull/842">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AF36Zc5V_yfeyRam2SBObBdTYf89kiPRks5q6C8XgaJpZM4Km55t">mute the thread</a>.<img alt="" height="1" src="https://github.com/notifications/beacon/AF36ZXlPdAYYYQjstXGH3jOgHnhGP_Ejks5q6C8XgaJpZM4Km55t.gif" width="1" /></p>
<div itemscope itemtype="http://schema.org/EmailMessage">
<div itemprop="action" itemscope itemtype="http://schema.org/ViewAction">
<link itemprop="url" href="https://github.com/kamailio/kamailio/pull/842"></link>
<meta itemprop="name" content="View Pull Request"></meta>
</div>
<meta itemprop="description" content="View this Pull Request on GitHub"></meta>
</div>
<script type="application/json" data-scope="inboxmarkup">{"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/kamailio/kamailio","title":"kamailio/kamailio","subtitle":"GitHub repository","main_image_url":"https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open in GitHub","url":"https://github.com/kamailio/kamailio"}},"updates":{"snippets":[{"icon":"DESCRIPTION","message":"fix TLS client config selection based on dst ip and port (#842)"}],"action":{"name":"View Pull Request","url":"https://github.com/kamailio/kamailio/pull/842"}}}</script>