{"action":"created","issue":{"url":"https://api.github.com/repos/kamailio/kamailio/issues/1581","repository_url":"https://api.github.com/repos/kamailio/kamailio","labels_url":"https://api.github.com/repos/kamailio/kamailio/issues/1581/labels{/name}","comments_url":"https://api.github.com/repos/kamailio/kamailio/issues/1581/comments","events_url":"https://api.github.com/repos/kamailio/kamailio/issues/1581/events","html_url":"https://github.com/kamailio/kamailio/issues/1581","id":338088218,"node_id":"MDU6SXNzdWUzMzgwODgyMTg=","number":1581,"title":"Problem with IPv6, TLS and advertise param ","user":{"login":"joelsdc","id":16212586,"node_id":"MDQ6VXNlcjE2MjEyNTg2","avatar_url":"https://avatars1.githubusercontent.com/u/16212586?v=4","gravatar_id":"","url":"https://api.github.com/users/joelsdc","html_url":"https://github.com/joelsdc","followers_url":"https://api.github.com/users/joelsdc/followers","following_url":"https://api.github.com/users/joelsdc/following{/other_user}","gists_url":"https://api.github.com/users/joelsdc/gists{/gist_id}","starred_url":"https://api.github.com/users/joelsdc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joelsdc/subscriptions","organizations_url":"https://api.github.com/users/joelsdc/orgs","repos_url":"https://api.github.com/users/joelsdc/repos","events_url":"https://api.github.com/users/joelsdc/events{/privacy}","received_events_url":"https://api.github.com/users/joelsdc/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-07-03T23:51:19Z","updated_at":"2018-07-11T22:12:27Z","closed_at":"2018-07-04T07:28:46Z","author_association":"NONE","body":"### Description\r\n\r\nWe want to be able to handle reINVITEs over TLS so calls can reconnect when they switch networks (for example from wifi to mobile data). \r\n\r\n\r\nWe have the following config in kamailio.cfg:\r\n\r\n```\r\nlisten=tls:1.1.1.1:443 advertise sbc01.domain.com:443\r\nlisten=tls:[AAAA:BBBB:CCCC:DDDD:EEEE:FFFF:GGGG:HHHH]:443 advertise sbc01.domain.com:443\r\nlisten=udp:1.1.1.1:5060\r\n```\r\nIn order to not break TLS validation (certs) we set the advertise to the FQDN so all headers are set with the FQDN and not the IP address, also notice no `[]` in the FQDN part of advertise IPv6 line. We do this, because we found that without the advertise, all headers have the IP address, which is also OK, but if the TCP connection breaks and the client reconnects, it will send the connection to the top request-route header, if it's an IP, the TLS validation will beak because the cn= doesn't match, having the FQDN there, the cn= will match and the request will continue.\r\n\r\n\r\nExample scenario:\r\n\r\n* IPv4 call:\r\n\r\nOur public domain is `sip.domain.com` that has SRV records pointing to `sbc01.domain.com` and `sbc02.domain.com`. For this example let's stick to `sbc01.domain.com`.\r\n\r\nKamailio: 1.1.1.1 / sbc01.domain.com\r\nMedia server: 2.2.2.2\r\n\r\nClient <---TLS 443---> Kamailio <---UDP 5060---> Media server\r\n\r\nExample call:\r\n\r\n![image](https://user-images.githubusercontent.com/16212586/42248688-cce7915c-7edb-11e8-84e8-f1917a6da7a4.png)\r\n\r\n\r\nLet's focus on the INVITE that Kamailio sends to the media server (the *blue* INVITE in the screenshot)\r\n\r\nThe headers look like this:\r\n\r\n```\r\nINVITE sip:test@2.2.2.2:5060 SIP/2.0\r\nRecord-Route: <sip:1.1.1.1;r2=on;lr=on;ftag=eTdR161Ub;did=916.2391;nat=yes>\r\nRecord-Route: <sip:sbc01.domain.com:443;transport=tls;r2=on;lr=on;ftag=eTdR161Ub;did=916.2391;nat=yes>\r\n...\r\n```\r\n\r\nWhich is correct, if the client has to send a reINVITE, it will do a DNS request to sbc01.domain.com and depending if it has AAAA and A records, and what the client's current transport is (ipv6/ipv4) it will select and use what it needs.\r\n\r\n..Now let's say the same scenario, but origin transport is IPv6 this time..\r\n\r\n* IPv6 call:\r\n\r\nSame scenario as above, same invite, this time the headers look like this:\r\n\r\n```\r\nINVITE sip:test@2.2.2.2:5060 SIP/2.0\r\nRecord-Route: <sip:1.1.1.1;r2=on;lr=on;ftag=iMwhZbnTA;did=fda.2803>\r\nRecord-Route: <sip:[sbc01.domain.com]:443;transport=tls;r2=on;lr=on;ftag=iMwhZbnTA;did=fda.2803>\r\n```\r\n(notice the FQDN surrounded by `[]`)\r\n\r\n\r\n#### Reproduction\r\n\r\nAdd the `advertise` option on a `listen=` param with transport tls and using an IPv6.\r\n\r\nObserve the format of the headers the `record_route()` function adds to the request.\r\n\r\n\r\n### Possible Solutions\r\n\r\nWhen setting a FQDN instead of an IP address (v4/v6) in the `advertise` option; never enclose it with `[]` ? It's a suggestion, maybe what I'm saying is completely nuts.\r\n\r\n\r\n### Additional Information\r\n\r\n  * **Kamailio Version** - output of `kamailio -v`\r\n\r\n```\r\n# kamailio -v\r\nversion: kamailio 5.1.4 (x86_64/linux)\r\nflags: STATS: Off, USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES\r\nADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB\r\npoll method support: poll, epoll_lt, epoll_et, sigio_rt, select.\r\nid: unknown\r\ncompiled with gcc 6.3.0\r\n```\r\n\r\n* **Operating System**:\r\n\r\n```\r\nOS: Debian stretch 9.4\r\n\r\nKernel: Linux kamailio 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/kamailio/kamailio/issues/comments/404327086","html_url":"https://github.com/kamailio/kamailio/issues/1581#issuecomment-404327086","issue_url":"https://api.github.com/repos/kamailio/kamailio/issues/1581","id":404327086,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNDMyNzA4Ng==","user":{"login":"joelsdc","id":16212586,"node_id":"MDQ6VXNlcjE2MjEyNTg2","avatar_url":"https://avatars1.githubusercontent.com/u/16212586?v=4","gravatar_id":"","url":"https://api.github.com/users/joelsdc","html_url":"https://github.com/joelsdc","followers_url":"https://api.github.com/users/joelsdc/followers","following_url":"https://api.github.com/users/joelsdc/following{/other_user}","gists_url":"https://api.github.com/users/joelsdc/gists{/gist_id}","starred_url":"https://api.github.com/users/joelsdc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joelsdc/subscriptions","organizations_url":"https://api.github.com/users/joelsdc/orgs","repos_url":"https://api.github.com/users/joelsdc/repos","events_url":"https://api.github.com/users/joelsdc/events{/privacy}","received_events_url":"https://api.github.com/users/joelsdc/received_events","type":"User","site_admin":false},"created_at":"2018-07-11T22:12:27Z","updated_at":"2018-07-11T22:12:27Z","author_association":"NONE","body":"Cherry-piked this commit into v5.1.4 and so far I can confirm it's working.\r\n\r\nI have deployed the fix to prod, I'll report back in a new ticket if something fails."}}
{"actor":{"display_login":"joelsdc"}}