Summary: | ASTERISK-24711: DTLS handshake broken with latest OpenSSL versions | ||
Reporter: | Jared Biel (jared.biel@bolderthinking.com) | Labels: | |
Date Opened: | 2015-01-22 11:13:36.000-0600 | Date Closed: | 2015-01-29 06:10:45.000-0600 |
Priority: | Major | Regression? | No |
Status: | Closed/Complete | Components: | |
Versions: | 13.1.0 | Frequency of Occurrence | Constant |
Related Issues: | |||
Environment: | Attachments: | ||
Description: | The latest versions of OpenSSL recently cleaned up some DTLS vulnerabilities and one of them (I believe it's CVE-2015-0206) caused RTP DTLS handshakes to stop working. This means that all WebRTC calls fail to negotiate audio. I came across this issue using a fully updated Ubuntu 14.04 server running OpenSSL 1.0.1f-1ubuntu2.8 and Asterisk 13.1.0.
Upstream report: http://rt.openssl.org/Ticket/Display.html?id=3657 The one-line workaround mentioned in the ticket worked for me. Patch: \[mjordan\]: Code redacted. *NOTE*: Unfortunately, we cannot accept even one-line patches in comment. If you'd like to contribute this patch to Asterisk, please sign a license contributor agreement and attach the patch in unified diff format. | ||
Comments: | By: Matt Jordan (mjordan) 2015-01-22 14:38:22.248-0600 Some additional links: * https://groups.google.com/forum/#!topic/discuss-webrtc/TqZ9N0eTn24 * https://mta.openssl.org/pipermail/openssl-dev/2015-January/000400.html By: Matt Jordan (mjordan) 2015-01-22 15:58:39.224-0600 More information: https://code.google.com/p/chromium/issues/detail?id=447431 By: Jared Biel (jared.biel@bolderthinking.com) 2015-01-22 16:06:15.765-0600 My appologies - I have signed the contributor agreement and will submit the patch again once it's been accepted on your side. Thanks! Edit: after reading some of the provided links, it seems that this problem may be deeper/have further things to patch up. I will leave the issue resolution/patching to the experts. By: Jared Biel (jared.biel@bolderthinking.com) 2015-01-28 16:17:12.715-0600 There have been commits against openssl that fix this issue (see [originally linked openssl rt ticket|http://rt.openssl.org/Ticket/Display.html?id=3657] for more details.) However, I'm unsure if these fixes are going to be considered for inclusion in the next round of security/regression fixes for every distribution ([debian discussion|https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775502].) By: Joshua C. Colp (jcolp) 2015-01-29 06:10:37.497-0600 Thanks for your comments! I've put the required change into 11, 13, and trunk. |