Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change default for tls_method from TLSv1 to TLSv1.2+ #3301

Closed
dilyanpalauzov opened this issue Dec 10, 2022 · 2 comments
Closed

Change default for tls_method from TLSv1 to TLSv1.2+ #3301

dilyanpalauzov opened this issue Dec 10, 2022 · 2 comments

Comments

@dilyanpalauzov
Copy link
Contributor

The default value for tls_method is TLSv1: https://kamailio.org/docs/modules/devel/modules/tls.html#tls.p.tls_method . This value is suboptimal as default.

Please change the default value to TLSv1.2+ and remove modparam("tls", "tls_method", …) from misc/examples/outbound/edge_websocket.cfg and misc/examples/webrtc/websocket.cfg .

@henningw
Copy link
Contributor

Yes, it make sense to change the default to not allow obselete/deprecate algorithms. Regarding the change in the examples, I think this can stay, it does not hurt and they are used from people also with older versions in the end.

@miconda
Copy link
Member

miconda commented Dec 11, 2022

Usually the default value is set to what's expected to be commonly available, as Kamailio can still be used on old distros such as centos 6/7, debian 9. Using ifdefs in the code based on availability of tls version will make it hard to present in documentation what would be default value. The reason of modparam is to offer the flexibility to set desired value and not depend on developer's default value.

I am not against on changing it, just to be in a way that does not result in compile failures for not-very-old distros and the documentation to be able to reflect easily the default value.

Regarding misc examples, many are very old, not really maintained, probably kamailio will not start with several of them. They are kept more as documentation/reference. But people are more that welcome to test and update them.

Overall, just made pull requests for the changes you think worth to be done.

@miconda miconda closed this as completed Dec 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants