| Subject: | Net::SIP sends plaintext over SSL socket in race condition |
| Date: | Wed, 3 May 2017 10:09:29 +0000 |
| To: | "bug-Net-SIP [...] rt.cpan.org" <bug-Net-SIP [...] rt.cpan.org> |
| From: | Richard Carver <richard.carver [...] cloudmont.co.uk> |
I have a scenario using StatelessProxy where at the end of a call one party sends SERVICE immediately followed by BYE, and TLS is being used to communicate with the destination. A connection is made to the destination, SSL fails to set up and the BYE message is transmitted plaintext. The remote end then closes the connection.
The root cause is that when the second message comes in it finds the existing socket created by the first message, but does not check that the socket is still connecting.
This patch appears to resolve the issue:
*** /usr/local/share/perl5/Net/SIP/SocketPool.pm.orig 2017-05-03 09:50:44.165508563 +0000
--- /usr/local/share/perl5/Net/SIP/SocketPool.pm 2017-05-03 09:53:49.561801386 +0000
*************** sub sendto {
*** 252 ****
! _tcp_send($self,$fo,$callback);
--- 252 ----
! _tcp_send($self,$fo,$callback) unless $fo->{inside_connect};