<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x
...'
- code is contributed under BSD for core and main components (tm, sl, auth,
tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the
checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING
guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on
sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils,
...)
- [ ] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook
files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [x] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the
checkboxes that apply -->
- [x] PR should be backported to stable branches
- [x] Tested changes locally
- [x] Related to issue [reported in
lists](https://lists.kamailio.org/mailman3/hyperkitty/list/sr-us...@lists.kamailio.org/thread/NJ3HM4UGBII2RN35PDD2SQSCUCZC2T3I/)
#### Description
<!-- Describe your changes in detail -->
This PR aims to fix a bug/security issue where data that was supposed to be
encrypted and transferred through TLS, were transferred instead with TCP
protocol.
More information and how to replicate can be found in the above
[issue](https://lists.kamailio.org/mailman3/hyperkitty/list/sr-us...@lists.kamailio.org/thread/NJ3HM4UGBII2RN35PDD2SQSCUCZC2T3I/)
in list.
This PR suggests using also the protocol to match if a TCP connection exists,
and when doing connection lookups, otherwise, it might return a wrong
connection, ie a TCP one when we are asking for a TLS one (a case when source
ip/port and dest IP are same but dest port is set 0 (wildcard) ).
`tcpconn_get` was left unchanged due to being used by some modules and not
wanting to break them. Please advise whether it should be beneficial to also
change it.
In some cases like, `tcpconn_add_alias` and `tcpconn_get` we used the
`PROTO_NONE` which preserves the original behavior. `tcpconn_add_alias` we do
have the protocol available, should it be also used?
`tcpconn_get` does not have the protocol available unless we pass it as an
argument.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3810
-- Commit Summary --
* tcp_main: Add protocol argument for searching tcp/tls connections
* tcp_main: Add proto argument to tcpconn_exists function
* tcp_main: Update comment docs
* core/forward: Match protocol when forwarding
* tcp_main: Match wss protocol
-- File Changes --
M src/core/forward.h (3)
M src/core/tcp_conn.h (3)
M src/core/tcp_main.c (43)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3810.patch
https://github.com/kamailio/kamailio/pull/3810.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3810
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3...@github.com>
_______________________________________________
Kamailio (SER) - Development Mailing List
To unsubscribe send an email to sr-dev-le...@lists.kamailio.org
