Module: sip-router
Branch: master
Commit: 5fe0d14745303c61d3fafe9decbb735d5424a442
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5fe0d14…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: Tue Oct 21 16:32:26 2014 +0200
tls: note that SSLv3 should not be used if high security is needed
- the note was already for SSLv2
---
modules/tls/README | 6 ++++--
modules/tls/doc/params.xml | 4 +++-
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/modules/tls/README b/modules/tls/README
index 09be2bf..713a65e 100644
--- a/modules/tls/README
+++ b/modules/tls/README
@@ -508,7 +508,8 @@ Revoking a certificate and using a CRL
with openssl/libssl v1.0.1)
* TLSv1 - only TLSv1 connections are accepted. This is the default
value.
- * SSLv3 - only SSLv3 connections are accepted
+ * SSLv3 - only SSLv3 connections are accepted. Note: you shouldn't
+ use SSLv3 for anything which should be highly secure.
* SSLv2 - only SSLv2 connections, for old clients. Note: you
shouldn't use SSLv2 for anything which should be highly secure.
Newer versions of libssl don't include support for it anymore.
@@ -517,7 +518,8 @@ Revoking a certificate and using a CRL
message must be V2 (in the initial hello all the supported
protocols are advertised enabling switching to a higher and more
secure version). This means connections from SSLv3 or TLSv1 clients
- will be accepted.
+ will be accepted. Note: you shouldn't use SSLv2 or SSLv3 for
+ anything which should be highly secure.
If rfc3261 conformance is desired, TLSv1 must be used. For
compatibility with older clients SSLv23 is a good option.
diff --git a/modules/tls/doc/params.xml b/modules/tls/doc/params.xml
index 46de16f..a6e5808 100644
--- a/modules/tls/doc/params.xml
+++ b/modules/tls/doc/params.xml
@@ -39,7 +39,8 @@
</listitem>
<listitem>
<para>
- <emphasis>SSLv3</emphasis> - only SSLv3 connections are accepted
+ <emphasis>SSLv3</emphasis> - only SSLv3 connections are accepted.
+ Note: you shouldn't use SSLv3 for anything which should be highly secure.
</para>
</listitem>
<listitem>
@@ -56,6 +57,7 @@
message must be V2 (in the initial hello all the supported protocols
are advertised enabling switching to a higher and more secure version).
This means connections from SSLv3 or TLSv1 clients will be accepted.
+ Note: you shouldn't use SSLv2 or SSLv3 for anything which should be highly secure.
</para>
</listitem>
</itemizedlist>
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
A new Flyspray task has been opened. Details are below.
User who did this - Savolainen Dmitri (snen)
Attached to Project - sip-router
Summary - UAC table locking
Task Type - Bug Report
Category - Module
Status - Unconfirmed
Assigned To -
Operating System - All
Severity - High
Priority - Normal
Reported Version - Development
Due in Version - Undecided
Due Date - Undecided
Details - uac module locking talbe
<code>
[root@sw4 sbin]# ./kamcmd core.info
{
version: kamailio 4.2.0
id: 6d89d2
compiler: gcc 4.4.7
compiled: 12:42:58 Oct 20 2014
flags: STATS: Off, USE_TCP, USE_TLS, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, F_MALLOC, DBG_F_MALLOC, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
}
[root@sw4 sbin]# ./kamcmd uac.reg_info l_uuid s:000105656
{
l_uuid: 000105656
l_username: 000105656
l_domain: sip.domain2.ru
r_username: 000105656
r_domain: sip.domain.com
realm: sip.domain.com
auth_username: 000105656
auth_password: xxxxxxxx
auth_proxy: sip:000105656@sip.domain.com
expires: 120
flags: 4
diff_expires: 1791
timer_expires: 1413880593
}
[root@sw4 sbin]# ./kamcmd uac.reg_dump
^C
</code>
so only Ctrl+C release me from waiting
this patch can help
<code>
diff --git a/modules/uac/uac_reg.c b/modules/uac/uac_reg.c
index 9b2abef..bd4eabb 100644
--- a/modules/uac/uac_reg.c
+++ b/modules/uac/uac_reg.c
@@ -1572,6 +1572,7 @@ static void rpc_uac_reg_info(rpc_t* rpc, void* ctx)
rpc->fault(ctx, 500, "Internal error adding item");
return;
}
+ lock_release(&_reg_htable->entries[i].lock);
return;
}
reg = reg->next;
</code>
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=484
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
A new Flyspray task has been opened. Details are below.
User who did this - Savolainen Dmitri (snen)
Attached to Project - sip-router
Summary - uac.reg_disable/uac.reg_enable missmatch
Task Type - Bug Report
Category - Module
Status - Unconfirmed
Assigned To -
Operating System - All
Severity - Medium
Priority - Normal
Reported Version - Development
Due in Version - Undecided
Due Date - Undecided
Details - There is a uac.reg_disable/uac.reg_enable fuction missmatch in UAC module
<code>
[root@sw4 sbin]# ./kamcmd uac.reg_dump
{
l_uuid: 000105656
l_username: 000105656
l_domain: sip.domain2.ru
r_username: 000105656
r_domain: sip.domain.com
realm: sip.domain.com
auth_username: 000105656
auth_password: xxxxxxxxxxx
auth_proxy: sip:000105656@sip.domain.com
expires: 120
flags: 4
diff_expires: 1780
timer_expires: 1413879087
}
[root@sw4 sbin]# ./kamcmd uac.reg_disable l_uuid s:000105656
[root@sw4 sbin]# ./kamcmd uac.reg_dump
{
l_uuid: 000105656
l_username: 000105656
l_domain: sip.domain2.ru
r_username: 000105656
r_domain: sip.domain.com
realm: sip.domain.com
auth_username: 000105656
auth_password: xxxxxxxxxxx
auth_proxy: sip:000105656@sip.domain.com
expires: 120
flags: 4
diff_expires: -3
timer_expires: 1413877502
}
</code>
so flag “#define UAC_REG_DISABLED (1<<0)” is not enabled, just diff_expires reset
but uac.reg_enable set this flag
<code>
[root@sw4 sbin]# ./kamcmd uac.reg_enable l_uuid s:000105656
[root@sw4 sbin]# ./kamcmd uac.reg_dump
{
l_uuid: 000105656
l_username: 000105656
l_domain: sip.domain2.ru
r_username: 000105656
r_domain: sip.domain.com
realm: sip.domain.com
auth_username: 000105656
auth_password: xxxxxxxxxxx
auth_proxy: sip:000105656@sip.domain.com
expires: 120
flags: 5
diff_expires: -1
timer_expires: 1413877709
}
</code>
I suggest this patch
<code>
diff --git a/modules/uac/uac_reg.c b/modules/uac/uac_reg.c
index 9b2abef..b81d633 100644
--- a/modules/uac/uac_reg.c
+++ b/modules/uac/uac_reg.c
@@ -1653,7 +1653,7 @@ static const char* rpc_uac_reg_enable_doc[2] = {
static void rpc_uac_reg_enable(rpc_t* rpc, void* ctx)
{
- rpc_uac_reg_update_flag(rpc, ctx, 1, UAC_REG_DISABLED);
+ rpc_uac_reg_update_flag(rpc, ctx, 0, UAC_REG_DISABLED);
}
static const char* rpc_uac_reg_disable_doc[2] = {
@@ -1663,7 +1663,7 @@ static const char* rpc_uac_reg_disable_doc[2] = {
static void rpc_uac_reg_disable(rpc_t* rpc, void* ctx)
{
- rpc_uac_reg_update_flag(rpc, ctx, 0, UAC_REG_DISABLED);
+ rpc_uac_reg_update_flag(rpc, ctx, 1, UAC_REG_DISABLED);
}
static const char* rpc_uac_reg_reload_doc[2] = {
</code>
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=483
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
Hi,
Are there any debian packages available for the new stable (4.2) yet?
The wiki still refers to 4.1 as stable.
http://www.kamailio.org/wiki/packages/debs
Cheers,
Peter
Dear all,
Greetings.
I am working on Kamailio for Linux environment. But, i don't have any idea
regarding usage of Kamailio in arm/embedded Linux environment.
Please help me in this regard, how can i port Kamailio into an embedded
linux device.
Kindly advice.
Regards
Sermj2012
Hi,
I was testing the new dynamic pipelimit instantiation functionality
heralded in 4.2, and, strangely enough, it doesn't seem to work at all.
Every time I call pl_check(), it just blocks the worker thread
indefinitely, until I--rather quickly--run out of available workers.
I've tried it with db_url (which I gathered to not be mandatory),
without a db_url, using every algorithm possible, with a static pipe
name, with a PV pipe name, etc. It all yields the same results. Here is
my current employment of it:
if($(xavp(call=>ingress_cps_limit){s.int}) > 0) {
xlog("L_INFO", "DEBUG: PRE PL CHECK $ci\n");
if(!pl_check("1", "RED", "2")) {
xlog("L_INFO", "DEBUG: AFTER PL CHECK $ci\n");
pl_drop();
xlog("L_INFO", "Ingress call setup rate limit
for this BG "
"$(xavp(call=>ingress_cps_limit){s.int}) has "
"been exceeded; rejecting call\n");
exit;
}
xlog("L_INFO", "DEBUG: AFTER PL CHECK $ci\n");
}
modparam("pipelimit", "hash_size", 12)
modparam("pipelimit", "timer_interval", 5)
modparam("pipelimit", "reply_code", 503)
modparam("pipelimit", "reply_reason", "Call Setup Rate Exceeded")
I never reach "AFTER PL CHECK".
Here's what I actually want to do:
if($(xavp(call=>ingress_cps_limit){s.int}) > 0) {
if(!pl_check("$avp(trunk_id)", "RED",
"$(xavp(call=>ingress_cps_limit){s.int})")) {
pl_drop();
xlog("L_INFO", "!> "
"Ingress call setup rate limit for this BG "
"$(xavp(call=>ingress_cps_limit){s.int}) has "
"been exceeded; rejecting call\n");
exit;
}
}
I tried upping debug to debug=3 but get nothing insightful that pertains
to pipelimit at all, as far as I can see.
This is on a stock CentOS 6.5 install,
sip-router:master:36e695453762b5ed15e5048fad2c559bb239dad5 compiled from
source.
Thanks!
--
Alex Balashov - Principal
Evariste Systems LLC
Tel: +1-678-954-0670
Web: http://www.evaristesys.com/, http://www.alexbalashov.com/
Please be kind to the English language:
http://www.entrepreneur.com/article/232906
please help
----- Forwarded by Piyush Bansal/RCOM/RelianceADA on 10/10/2013 10:51 AM
-----
From:
Piyush Bansal/RCOM/RelianceADA
To:
serusers(a)iptel.org, serdev(a)iptel.org
Date:
10/09/2013 12:14 PM
Subject:
query related to NOTIFY message size
Hi there,
I have certain queries regarding batch SUBSCRIBE and NOTIFY. I
have a user who has 100 buddies in his buddy list. If any of his buddy
changes his/her presence status, that user gets a NOTIFY message with
presence status of all the 100 buddies.
In that case, the message size is exceeding 500 KB. Thats quite a
higher value for a UDP packet.
Can anybody suggest-
1. If there is any way to restrict the size of the packet.
2. How to ensure that the packet is received correctly by the client.
Thanks and Regards,
--Piyush Bansal
The information contained in this electronic message (email) and any attachments to this email are intended for the exclusive use of the addressee(s) and access to this email by any one else is unauthorised. The email may contain proprietary, confidential or privileged information or information relating to Reliance Group. If you are not the intended recipient, please notify the sender by telephone, fax, or return email and delete this communication and any attachments thereto, immediately from your computer. Any dissemination, distribution, or copying of this communication and the attachments thereto (in whole or part), in any manner, is strictly prohibited and actionable at law. The recipient acknowledges that emails are susceptible to alteration and their integrity can not be guaranteed and that Company does not guarantee that any e-mail is virus-free and accept no liability for any damage caused by any virus transmitted by this email.