-
-
Notifications
You must be signed in to change notification settings - Fork 149
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[FEATURE]: TLSv1.3 support #289
Comments
its possible to force "TLSv1.3" via securityContext:
via libs/server.bundle.js => so it has to be set to TLSv1.3 ONLY this is not clean, but acceptable. then it is loading TLS1.3 CIPHERs ... [INFO ] Starting Routr but finally on connect: javax.net.ssl|DEBUG|22|NioSelector-TLS-10.12.20.100/5061|2024-08-31 07:49:45.290 UTC|null:-1|No available cipher suite for TLSv1.3 => so it would be good to have the ciphers either defaulted jain sip allows overriding by "setEnabledCipherSuites" or set by config: jain-interface:
|
I found a way to hotfix this cipher part by adding some lines to libs/server.bundle.js:
It's important to mention that the CCM ciphers were causing some problems on my system, which is why I disabled them. enabledCiphers = config.spec.securityContext.client.chipers.join() |
First, a huge thanks for the level of detail and effort. Based on your comments, I propose the following changes:
For the environment variables, I propose using:
How does this sound? Let me know if you have additional feedback before I start working this. |
perfect. further thoughts: and please consider if also other parts are affected, f.i. outbound connect? its not the only part where jain is used. |
Is your feature request related to a problem?
TLSv1.2 is very vulnerable, especially this implementation because CBC RSA and SHA were statically programmed in.
Java supports TLS 1.3 even in backported way till Java 8.
Describe the solution you'd like
routr should support TLSv1.3 for sip. when set up in the list of protocols, it should accept incoming tls 1.3 connections.
the sip component (jain) could be upgraded or overriden with setup of TLSv1.3 context.
if the source is beeing touched, any static cipher config should be removed from the code. If its needed for proper initializing of the ssl context, it should be placed in the config files.
Describe alternatives you've considered
encryption is missing on application level.
Additional context
weak
https://ciphersuite.info/cs/TLS_RSA_WITH_AES_128_CBC_SHA/
https://ciphersuite.info/cs/TLS_RSA_WITH_3DES_EDE_CBC_SHA/
insecure
https://ciphersuite.info/cs/TLS_DH_anon_WITH_AES_128_CBC_SHA/
https://ciphersuite.info/cs/TLS_DH_anon_WITH_3DES_EDE_CBC_SHA/
https://ciphersuite.info/cs/SSL_DH_anon_WITH_3DES_EDE_CBC_SHA/
The text was updated successfully, but these errors were encountered: