Skip to content

fix: Disable TLS tickets for 1.2 and 1.3 in order to support reconnects after OpenSIPS restart#3673

Merged
razvancrainea merged 1 commit into
OpenSIPS:masterfrom
vladpaiu:wolfssl_disable_tickets
Jun 20, 2025
Merged

fix: Disable TLS tickets for 1.2 and 1.3 in order to support reconnects after OpenSIPS restart#3673
razvancrainea merged 1 commit into
OpenSIPS:masterfrom
vladpaiu:wolfssl_disable_tickets

Conversation

@vladpaiu
Copy link
Copy Markdown
Member

@vladpaiu vladpaiu commented Jun 19, 2025

Summary
Fix clients opening new SSL connections ( TLS, WSS, etc ) after an OpenSIPS restart

Details
We are not managing TLS 1.2 or 1.3 tickets server side
so in case a client will want to reconnect after an OpenSIPS
restart, it will provide a pre-shared ticket and this re-connection
will just fail, so take the lazy way out and disable tickets
https://datatracker.ietf.org/doc/html/rfc8446#section-2.2

Solution
Disable tickets support for TLS 1.2 and 1.3

Compatibility
Backwards compatible

@vladpaiu vladpaiu added the bug label Jun 19, 2025
@razvancrainea
Copy link
Copy Markdown
Member

I am going to merge this as a quick fix, but ideally we should sort out why tickets are not working - did you manage to troubleshoot why they were not working in the first place?

@razvancrainea razvancrainea merged commit 00305a4 into OpenSIPS:master Jun 20, 2025
86 checks passed
razvancrainea pushed a commit that referenced this pull request Jun 20, 2025
…ter OpenSIPS restarts (#3673)

(cherry picked from commit 00305a4)
razvancrainea pushed a commit that referenced this pull request Jun 20, 2025
…ter OpenSIPS restarts (#3673)

(cherry picked from commit 00305a4)
razvancrainea pushed a commit that referenced this pull request Jun 20, 2025
…ter OpenSIPS restarts (#3673)

(cherry picked from commit 00305a4)
@vladpaiu
Copy link
Copy Markdown
Member Author

vladpaiu commented Jun 20, 2025

I am going to merge this as a quick fix, but ideally we should sort out why tickets are not working - did you manage to troubleshoot why they were not working in the first place?

wolfssl was sometimes very 'misterious' as to why the failures was happening :

tls_wolfssl:_wolfssl_tls_accept: TLS accept error: -1, unknown error number

other times it was being more explicit :

ERROR:tls_wolfssl:_wolfssl_tls_accept: TLS accept error: -399, Bad session ticket message Size Error

which basically lead me down the path of disabling tickets entirely.

tls_openssl did not have this issue.

NormB pushed a commit to NormB/opensips that referenced this pull request May 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants