proto_tls module

The following modules must be loaded before this module:

The following libraries or applications must be installed before running OpenSIPS with this module loaded:

Not specific to TLS. Allows to specify the protocol (udp, tcp, tls), the IP address and the port where the listening server will be.

...
socket= tls:1.2.3.4:5061
...
				

The default port to be used for all TLS related operation. Be careful as the default port impacts both the SIP listening part (if no port is defined in the TLS listeners) and the SIP sending part (if the destination URI has no explicit port).

If you want to change only the listening port for TLS, use the port option in the SIP listener defintion.

Default value is 5061.

...
modparam("proto_tls", "tls_port", 5062)
...
				

Send CRLF pong (\r\n) to incoming CRLFCRLF ping messages over TLS. By default it is enabled (1).

Default value is 1 (enabled).

...
modparam("proto_tls", "tls_crlf_pingpong", 0)
...

Drop CRLF (\r\n) ping messages. When this parameter is enabled, the TLS layer drops packets that contains a single CRLF message. If a CRLFCRLF message is received, it is handled according to the tls_crlf_pingpong parameter.

Default value is 0 (disabled).

...
modparam("proto_tls", "tls_crlf_drop", 1)
...

The maximum number of chunks that a SIP message is expected to arrive via TLS. If a packet is received more fragmented than this, the connection is dropped (either the connection is very overloaded and this leads to high fragmentation - or we are the victim of an ongoing attack where the attacker is sending the traffic very fragmented in order to decrease server performance).

Default value is 4.

...
modparam("proto_tls", "tls_max_msg_chunks", 8)
...

This parameter turns on or off the extra checking/matching of the TLS domain (SSL certificate) when comes to reusing an existing TLS connection. Without this extra check, only IP and port of the connections will be check (in order to re-use an existing connection). With this extra check, the connection to be reused must have the same SSL certificate as the one set for the current signaling operation.

This checking is done only when comes to send SIP traffic via TLS and it is applied only against connections that were created / initiated by OpenSIPS (as TLS client). Any accepte connection (as TLS server) will automatically match (the extra test will be skipped).

Default value is 0 (disabled).

...
modparam("proto_tls", "cert_check_on_conn_reusage", 1)
...

Trace destination as defined in the tracing module. Currently the only tracing module is proto_hep. Network events such as connect, accept and connection closed events shall be traced along with errors that could appear in the process. For each connection that is created an event containing information about the client and server certificates, master key and network layer information shall be sent.

WARNING: A tracing module must be loaded in order for this parameter to work. (for example proto_hep).

Default value is none(not defined).

...
modparam("proto_hep", "hep_id", "[hep_dest]10.0.0.2;transport=tcp;version=3")

modparam("proto_tls", "trace_destination", "hep_dest")
...

This controls whether tracing for tls is on or not. You still need to define trace_destinationin order to work, but this value will be controlled using mi function tls_trace.

...
modparam("proto_tls", "trace_on", 1)
...

Define the name of a route in which you can filter which connections will be trace and which connections won't be. In this route you will have information regarding source and destination ips and ports for the current connection. To disable tracing for a specific connection the last call in this route must be drop, any other exit mode resulting in tracing the current connection ( of course you still have to define a trace_destination and trace must be on at the time this connection is opened.

IMPORTANT Filtering on ip addresses and ports can be made using $si and $sp for matching either the entity that is connecting to OpenSIPS or the entity to which OpenSIPS is connecting. The name might be misleading ( $si meaning the source ip if you read the docs) but in reality it is simply the socket other than the OpenSIPS socket. In order to match OpenSIPS interface (either the one that accepted the connection or the one that initiated a connection) $socket_in(ip) (ip) and $socket_in(port) (port) can be used.

WARNING: IF trace_on is set to 0 or tracing is deactived via the mi command tls_trace this route won't be called.

...
modparam("proto_tls", "trace_filter_route", "tls_filter")
...
/* all tls connections will go through this route if tracing is activated
 * and a trace destination is defined */
route[tls_filter] {
	...
	/* all connections opened from/by ip 1.1.1.1:8000 will be traced
	   on interface 1.1.1.10:5060(opensips listener)
	   all the other connections won't be */
	 if ( $si == "1.1.1.1" && $sp == 8000 &&
		$socket_in(ip) == "1.1.1.10"  && $socket_in(port) == 5060)
		exit;
	else
		drop;
}
...

Sets the timeout (in milliseconds) for the SSL handshake sequence to complete. It may be necessary to increase this value when using a CPU intensive cipher for the connection to allow time for keys to be generated and processed.

The timeout is invoked during acceptance of a new connection (inbound) and during the wait period when a new session is being initiated (outbound).

Default value is 100.

...
modparam("proto_tls", "tls_handshake_timeout", 200) # number of milliseconds
...

Sets the timeout (in milliseconds) for the send operations to complete

The send timeout is invoked for all TLS write operations, excluding the handshake process (see: tls_handshake_timeout)

Default value is 100.

...
modparam("proto_tls", "tls_send_timeout", 200) # number of milliseconds
...

If the TLS connect and write operations should be done in an asynchronous mode (non-blocking connect and write). If disabled, OpenSIPS will block and wait for TLS operations like connect and write.

Default value is 0 (disabled).

...
modparam("proto_tls", "tls_async", 1) # enable async TLS
...

If tls_async is enabled, this specifies the maximum number of SIP messages that can be stashed for later/async writing. If the connection pending writes exceed this number, the connection will be marked as broken and dropped.

Default value is 32.

...
modparam("proto_tls", "tls_async_max_postponed_chunks", 16)
...

If tls_async is enabled, this specifies the number of milliseconds that a connect will be tried in blocking mode (optimization). If the connect operation lasts more than this, the connect will go to async mode and will be passed to tls MAIN for polling.

Default value is 100 ms.

...
modparam("proto_tls", "tls_async_local_connect_timeout", 200)
...

If tls_async is enabled, this specifies the number of milliseconds that a TLS handshake should be tried in blocking mode (optimization). If the handshake operation lasts more than this, the write will go to async mode and will be passed to tls MAIN for polling.

Default value is 10 ms.

...
modparam("proto_tls", "tls_async_handshake_timeout", 100)
...

Name: tls_trace

Parameters:

MI FIFO Command Format:

			opensips-cli -x mi tls_trace on