sr-dev March 2014

sr-dev@lists.kamailio.org

29 participants
298 discussions

git:master: db_unixodbc: free local variables in case of errors or no result

by Daniel-Constantin Mierla

Module: sip-router Branch: master Commit: edc78dfb148c22f0d256485193bbdb0185b76d2f URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=edc78df… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Mon Mar 24 10:12:26 2014 +0100 db_unixodbc: free local variables in case of errors or no result - reported by Alex Villacís Lasso --- modules/db_unixodbc/dbase.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/modules/db_unixodbc/dbase.c b/modules/db_unixodbc/dbase.c index 61300a3..c37253f 100644 --- a/modules/db_unixodbc/dbase.c +++ b/modules/db_unixodbc/dbase.c @@ -332,6 +332,7 @@ int db_unixodbc_fetch_result(const db1_con_t* _h, db1_res_t** _r, const int nrow len = sizeof(db_row_t) * nrows; RES_ROWS(*_r) = (struct db_row*)pkg_malloc(len); if (!RES_ROWS(*_r)) { + pkg_free(temp_row); LM_ERR("no memory left\n"); return -5; } @@ -359,6 +360,7 @@ int db_unixodbc_fetch_result(const db1_con_t* _h, db1_res_t** _r, const int nrow if (db_unixodbc_list_insert(&rowstart, &rows, columns, temp_row) < 0) { LM_ERR("SQL result row insert failed\n"); + pkg_free(RES_ROWS(*_r)); pkg_free(temp_row); temp_row= NULL; pkg_free(*_r); @@ -380,6 +382,7 @@ int db_unixodbc_fetch_result(const db1_con_t* _h, db1_res_t** _r, const int nrow RES_ROW_N(*_r) = row_n; if (!row_n) { LM_DBG("no more rows to process for db fetch"); + pkg_free(RES_ROWS(*_r)); RES_ROWS(*_r) = 0; return 0; }

10 years, 1 month

git:master: tls: Add support for Elliptic-Curve Diffie-Hellman Ciphers ( ECDH)

by Carsten Bock

Module: sip-router Branch: master Commit: 49d318720cec2d46ae28edff4a0bddb564d32d44 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=49d3187… Author: Carsten Bock <carsten(a)ng-voice.com> Committer: Carsten Bock <carsten(a)ng-voice.com> Date: Sat Mar 22 15:30:27 2014 +0100 tls: Add support for Elliptic-Curve Diffie-Hellman Ciphers (ECDH) --- modules/tls/tls_domain.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++ modules/tls/tls_mod.c | 8 +++- 2 files changed, 97 insertions(+), 2 deletions(-) diff --git a/modules/tls/tls_domain.c b/modules/tls/tls_domain.c index b832c63..a814818 100644 --- a/modules/tls/tls_domain.c +++ b/modules/tls/tls_domain.c @@ -42,6 +42,91 @@ #include "tls_domain.h" #include "tls_cfg.h" +/* + * ECDHE is enabled only on OpenSSL 1.0.0e and later. + * See http://www.openssl.org/news/secadv_20110906.txt + * for details. + */ +#ifndef OPENSSL_NO_ECDH +static void setup_ecdh(SSL_CTX *ctx) +{ + EC_KEY *ecdh; + + if (SSLeay() < 0x1000005fL) { + return; + } + + ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); + SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE); + SSL_CTX_set_tmp_ecdh(ctx, ecdh); + + EC_KEY_free(ecdh); +} +#endif + +#ifndef OPENSSL_NO_DH + +static unsigned char dh3072_p[] = { + 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, + 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, + 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, + 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, + 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, + 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, + 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, + 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, + 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, + 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D, + 0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36, + 0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, + 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56, + 0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D, + 0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08, + 0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, + 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2, + 0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9, + 0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C, + 0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, + 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D, + 0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64, + 0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57, + 0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, + 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0, + 0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B, + 0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73, + 0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, + 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0, + 0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31, + 0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20, + 0xA9,0x3A,0xD2,0xCA,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF + +}; + +static unsigned char dh3072_g[] = { 0x02 }; + +static void setup_dh(SSL_CTX *ctx) +{ + DH *dh; + + dh = DH_new(); + if (dh == NULL) { + return; + } + + dh->p = BN_bin2bn(dh3072_p, sizeof(dh3072_p), NULL); + dh->g = BN_bin2bn(dh3072_g, sizeof(dh3072_g), NULL); + if (dh->p == NULL || dh->g == NULL) { + DH_free(dh); + return; + } + + SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE); + SSL_CTX_set_tmp_dh(ctx, dh); + + DH_free(dh); +} +#endif + /** * @brief Create a new TLS domain structure @@ -543,6 +628,12 @@ static int set_cipher_list(tls_domain_t* d) tls_domain_str(d), cipher_list); return -1; } +#ifndef OPENSSL_NO_ECDH + setup_ecdh(d->ctx[i]); +#endif +#ifndef OPENSSL_NO_DH + setup_dh(d->ctx[i]); +#endif } return 0; } diff --git a/modules/tls/tls_mod.c b/modules/tls/tls_mod.c index b206bf6..c81a8e9 100644 --- a/modules/tls/tls_mod.c +++ b/modules/tls/tls_mod.c @@ -57,8 +57,6 @@ #error "conflict: CORE_TLS must _not_ be defined" #endif - - /* * FIXME: * - How do we ask for secret key password ? Mod_init is called after @@ -344,6 +342,12 @@ static int mod_init(void) if (tls_check_sockets(*tls_domains_cfg) < 0) goto error; +#ifndef OPENSSL_NO_ECDH + LM_INFO("With ECDH-Support!\n"); +#endif +#ifndef OPENSSL_NO_DH + LM_INFO("With Diffie Hellman\n"); +#endif return 0; error: destroy_tls_h();

10 years, 1 month

git:4.0: tls: Added note to docs about OpenSSL requirement for Elliptic Curve Diffie Hellman (ECDH)

by Carsten Bock

Module: sip-router Branch: 4.0 Commit: 3fb3c23fd9bd576ca8e2bcaaff059e021a4b3a37 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=3fb3c23… Author: Carsten Bock <carsten(a)ng-voice.com> Committer: Carsten Bock <carsten(a)ng-voice.com> Date: Sat Mar 22 16:49:20 2014 +0100 tls: Added note to docs about OpenSSL requirement for Elliptic Curve Diffie Hellman (ECDH) Conflicts: modules/tls/README --- modules/tls/README | 524 +++++++++++++++++++++++----------------------- modules/tls/doc/tls.xml | 15 ++ 2 files changed, 277 insertions(+), 262 deletions(-) Diff: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commitdiff;h=3fb…

10 years, 1 month

git:4.0: tls: Add support for Elliptic-Curve Diffie-Hellman Ciphers (ECDH)

by Carsten Bock

Module: sip-router Branch: 4.0 Commit: 70908767953fd7482737aa79c8a3a9fa8b53a17e URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=7090876… Author: Carsten Bock <carsten(a)ng-voice.com> Committer: Carsten Bock <carsten(a)ng-voice.com> Date: Sat Mar 22 15:30:27 2014 +0100 tls: Add support for Elliptic-Curve Diffie-Hellman Ciphers (ECDH) --- modules/tls/tls_domain.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++ modules/tls/tls_mod.c | 8 +++- 2 files changed, 97 insertions(+), 2 deletions(-) diff --git a/modules/tls/tls_domain.c b/modules/tls/tls_domain.c index c06892c..ec89829 100644 --- a/modules/tls/tls_domain.c +++ b/modules/tls/tls_domain.c @@ -41,6 +41,91 @@ #include "tls_domain.h" #include "tls_cfg.h" +/* + * ECDHE is enabled only on OpenSSL 1.0.0e and later. + * See http://www.openssl.org/news/secadv_20110906.txt + * for details. + */ +#ifndef OPENSSL_NO_ECDH +static void setup_ecdh(SSL_CTX *ctx) +{ + EC_KEY *ecdh; + + if (SSLeay() < 0x1000005fL) { + return; + } + + ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); + SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE); + SSL_CTX_set_tmp_ecdh(ctx, ecdh); + + EC_KEY_free(ecdh); +} +#endif + +#ifndef OPENSSL_NO_DH + +static unsigned char dh3072_p[] = { + 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, + 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, + 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, + 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, + 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, + 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, + 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, + 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, + 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, + 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D, + 0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36, + 0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, + 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56, + 0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D, + 0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08, + 0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, + 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2, + 0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9, + 0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C, + 0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, + 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D, + 0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64, + 0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57, + 0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, + 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0, + 0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B, + 0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73, + 0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, + 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0, + 0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31, + 0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20, + 0xA9,0x3A,0xD2,0xCA,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF + +}; + +static unsigned char dh3072_g[] = { 0x02 }; + +static void setup_dh(SSL_CTX *ctx) +{ + DH *dh; + + dh = DH_new(); + if (dh == NULL) { + return; + } + + dh->p = BN_bin2bn(dh3072_p, sizeof(dh3072_p), NULL); + dh->g = BN_bin2bn(dh3072_g, sizeof(dh3072_g), NULL); + if (dh->p == NULL || dh->g == NULL) { + DH_free(dh); + return; + } + + SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE); + SSL_CTX_set_tmp_dh(ctx, dh); + + DH_free(dh); +} +#endif + /** * @brief Create a new TLS domain structure @@ -542,6 +627,12 @@ static int set_cipher_list(tls_domain_t* d) tls_domain_str(d), cipher_list); return -1; } +#ifndef OPENSSL_NO_ECDH + setup_ecdh(d->ctx[i]); +#endif +#ifndef OPENSSL_NO_DH + setup_dh(d->ctx[i]); +#endif } return 0; } diff --git a/modules/tls/tls_mod.c b/modules/tls/tls_mod.c index bb5d3ad..45369ec 100644 --- a/modules/tls/tls_mod.c +++ b/modules/tls/tls_mod.c @@ -78,8 +78,6 @@ #error "conflict: CORE_TLS must _not_ be defined" #endif - - /* * FIXME: * - How do we ask for secret key password ? Mod_init is called after @@ -365,6 +363,12 @@ static int mod_init(void) if (tls_check_sockets(*tls_domains_cfg) < 0) goto error; +#ifndef OPENSSL_NO_ECDH + LM_INFO("With ECDH-Support!\n"); +#endif +#ifndef OPENSSL_NO_DH + LM_INFO("With Diffie Hellman\n"); +#endif return 0; error: destroy_tls_h();

10 years, 1 month

git:4.1: tls: Added note to docs about OpenSSL requirement for Elliptic Curve Diffie Hellman (ECDH)

by Carsten Bock

Module: sip-router Branch: 4.1 Commit: 73ea61efec6b97fac7e2117dcde969b2cd549291 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=73ea61e… Author: Carsten Bock <carsten(a)ng-voice.com> Committer: Carsten Bock <carsten(a)ng-voice.com> Date: Sat Mar 22 16:49:20 2014 +0100 tls: Added note to docs about OpenSSL requirement for Elliptic Curve Diffie Hellman (ECDH) --- modules/tls/README | 11 ++++++++++- modules/tls/doc/tls.xml | 15 +++++++++++++++ 2 files changed, 25 insertions(+), 1 deletions(-) diff --git a/modules/tls/README b/modules/tls/README index cdd3493..fbf1762 100644 --- a/modules/tls/README +++ b/modules/tls/README @@ -4,7 +4,13 @@ Andrei Pelinescu-Onciul iptelorg GmbH - Copyright � 2007 iptelorg GmbH +Carsten Bock + + ng-voice GmbH + + Copyright © 2007 iptelorg GmbH + + Copyright © 2014 ng-voice GmbH __________________________________________________________________ Table of Contents @@ -274,6 +280,9 @@ make TLS_EXTRA_LIBS="-lkrb5 -lz" all include_modules=tls when trying to load the tls module (check the log), it means some needed library was not linked and it must be added to TLS_EXTRA_LIBS + Elliptic Curve Diffie-Hellman (EDCH)-Ciphers are only supported in + OpenSSL 1.0.0e and later. + 5. TLS and Low Memory The openssl library doesn't handle very well low memory situations. If diff --git a/modules/tls/doc/tls.xml b/modules/tls/doc/tls.xml index 4f41780..4302cc5 100644 --- a/modules/tls/doc/tls.xml +++ b/modules/tls/doc/tls.xml @@ -20,11 +20,23 @@ <email>andrei(a)iptel.org</email> </address> </author> + <author> + <firstname>Carsten</firstname> + <surname>Bock</surname> + <affiliation><orgname>ng-voice GmbH</orgname></affiliation> + <address> + <email>carsten(a)ng-voice.com</email> + </address> + </author> </authorgroup> <copyright> <year>2007</year> <holder>iptelorg GmbH</holder> </copyright> + <copyright> + <year>2014</year> + <holder>ng-voice GmbH</holder> + </copyright> </bookinfo> <toc></toc> @@ -112,6 +124,9 @@ make TLS_EXTRA_LIBS="-lkrb5 -lz" all include_modules=tls <para> In general, if Kamailio fails to start with a symbol not found error when trying to load the tls module (check the log), it means some needed library was not linked and it must be added to <emphasis>TLS_EXTRA_LIBS</emphasis> </para> + <para> +<ulink url="http://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman">Elliptic Curve Diffie-Hellman (EDCH)</ulink>-Ciphers are only supported in OpenSSL 1.0.0e and later. + </para> </section> <section id="tls.low_memory">

10 years, 1 month

git:4.1: tls: Add support for Elliptic-Curve Diffie-Hellman Ciphers (ECDH)

by Carsten Bock

Module: sip-router Branch: 4.1 Commit: f8430785ec9c46b2535b2d29898853ee50cc76e0 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=f843078… Author: Carsten Bock <carsten(a)ng-voice.com> Committer: Carsten Bock <carsten(a)ng-voice.com> Date: Sat Mar 22 15:30:27 2014 +0100 tls: Add support for Elliptic-Curve Diffie-Hellman Ciphers (ECDH) --- modules/tls/tls_domain.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++ modules/tls/tls_mod.c | 8 +++- 2 files changed, 97 insertions(+), 2 deletions(-) diff --git a/modules/tls/tls_domain.c b/modules/tls/tls_domain.c index b832c63..a814818 100644 --- a/modules/tls/tls_domain.c +++ b/modules/tls/tls_domain.c @@ -42,6 +42,91 @@ #include "tls_domain.h" #include "tls_cfg.h" +/* + * ECDHE is enabled only on OpenSSL 1.0.0e and later. + * See http://www.openssl.org/news/secadv_20110906.txt + * for details. + */ +#ifndef OPENSSL_NO_ECDH +static void setup_ecdh(SSL_CTX *ctx) +{ + EC_KEY *ecdh; + + if (SSLeay() < 0x1000005fL) { + return; + } + + ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); + SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE); + SSL_CTX_set_tmp_ecdh(ctx, ecdh); + + EC_KEY_free(ecdh); +} +#endif + +#ifndef OPENSSL_NO_DH + +static unsigned char dh3072_p[] = { + 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xC9,0x0F,0xDA,0xA2, + 0x21,0x68,0xC2,0x34,0xC4,0xC6,0x62,0x8B,0x80,0xDC,0x1C,0xD1, + 0x29,0x02,0x4E,0x08,0x8A,0x67,0xCC,0x74,0x02,0x0B,0xBE,0xA6, + 0x3B,0x13,0x9B,0x22,0x51,0x4A,0x08,0x79,0x8E,0x34,0x04,0xDD, + 0xEF,0x95,0x19,0xB3,0xCD,0x3A,0x43,0x1B,0x30,0x2B,0x0A,0x6D, + 0xF2,0x5F,0x14,0x37,0x4F,0xE1,0x35,0x6D,0x6D,0x51,0xC2,0x45, + 0xE4,0x85,0xB5,0x76,0x62,0x5E,0x7E,0xC6,0xF4,0x4C,0x42,0xE9, + 0xA6,0x37,0xED,0x6B,0x0B,0xFF,0x5C,0xB6,0xF4,0x06,0xB7,0xED, + 0xEE,0x38,0x6B,0xFB,0x5A,0x89,0x9F,0xA5,0xAE,0x9F,0x24,0x11, + 0x7C,0x4B,0x1F,0xE6,0x49,0x28,0x66,0x51,0xEC,0xE4,0x5B,0x3D, + 0xC2,0x00,0x7C,0xB8,0xA1,0x63,0xBF,0x05,0x98,0xDA,0x48,0x36, + 0x1C,0x55,0xD3,0x9A,0x69,0x16,0x3F,0xA8,0xFD,0x24,0xCF,0x5F, + 0x83,0x65,0x5D,0x23,0xDC,0xA3,0xAD,0x96,0x1C,0x62,0xF3,0x56, + 0x20,0x85,0x52,0xBB,0x9E,0xD5,0x29,0x07,0x70,0x96,0x96,0x6D, + 0x67,0x0C,0x35,0x4E,0x4A,0xBC,0x98,0x04,0xF1,0x74,0x6C,0x08, + 0xCA,0x18,0x21,0x7C,0x32,0x90,0x5E,0x46,0x2E,0x36,0xCE,0x3B, + 0xE3,0x9E,0x77,0x2C,0x18,0x0E,0x86,0x03,0x9B,0x27,0x83,0xA2, + 0xEC,0x07,0xA2,0x8F,0xB5,0xC5,0x5D,0xF0,0x6F,0x4C,0x52,0xC9, + 0xDE,0x2B,0xCB,0xF6,0x95,0x58,0x17,0x18,0x39,0x95,0x49,0x7C, + 0xEA,0x95,0x6A,0xE5,0x15,0xD2,0x26,0x18,0x98,0xFA,0x05,0x10, + 0x15,0x72,0x8E,0x5A,0x8A,0xAA,0xC4,0x2D,0xAD,0x33,0x17,0x0D, + 0x04,0x50,0x7A,0x33,0xA8,0x55,0x21,0xAB,0xDF,0x1C,0xBA,0x64, + 0xEC,0xFB,0x85,0x04,0x58,0xDB,0xEF,0x0A,0x8A,0xEA,0x71,0x57, + 0x5D,0x06,0x0C,0x7D,0xB3,0x97,0x0F,0x85,0xA6,0xE1,0xE4,0xC7, + 0xAB,0xF5,0xAE,0x8C,0xDB,0x09,0x33,0xD7,0x1E,0x8C,0x94,0xE0, + 0x4A,0x25,0x61,0x9D,0xCE,0xE3,0xD2,0x26,0x1A,0xD2,0xEE,0x6B, + 0xF1,0x2F,0xFA,0x06,0xD9,0x8A,0x08,0x64,0xD8,0x76,0x02,0x73, + 0x3E,0xC8,0x6A,0x64,0x52,0x1F,0x2B,0x18,0x17,0x7B,0x20,0x0C, + 0xBB,0xE1,0x17,0x57,0x7A,0x61,0x5D,0x6C,0x77,0x09,0x88,0xC0, + 0xBA,0xD9,0x46,0xE2,0x08,0xE2,0x4F,0xA0,0x74,0xE5,0xAB,0x31, + 0x43,0xDB,0x5B,0xFC,0xE0,0xFD,0x10,0x8E,0x4B,0x82,0xD1,0x20, + 0xA9,0x3A,0xD2,0xCA,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF + +}; + +static unsigned char dh3072_g[] = { 0x02 }; + +static void setup_dh(SSL_CTX *ctx) +{ + DH *dh; + + dh = DH_new(); + if (dh == NULL) { + return; + } + + dh->p = BN_bin2bn(dh3072_p, sizeof(dh3072_p), NULL); + dh->g = BN_bin2bn(dh3072_g, sizeof(dh3072_g), NULL); + if (dh->p == NULL || dh->g == NULL) { + DH_free(dh); + return; + } + + SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE); + SSL_CTX_set_tmp_dh(ctx, dh); + + DH_free(dh); +} +#endif + /** * @brief Create a new TLS domain structure @@ -543,6 +628,12 @@ static int set_cipher_list(tls_domain_t* d) tls_domain_str(d), cipher_list); return -1; } +#ifndef OPENSSL_NO_ECDH + setup_ecdh(d->ctx[i]); +#endif +#ifndef OPENSSL_NO_DH + setup_dh(d->ctx[i]); +#endif } return 0; } diff --git a/modules/tls/tls_mod.c b/modules/tls/tls_mod.c index b206bf6..c81a8e9 100644 --- a/modules/tls/tls_mod.c +++ b/modules/tls/tls_mod.c @@ -57,8 +57,6 @@ #error "conflict: CORE_TLS must _not_ be defined" #endif - - /* * FIXME: * - How do we ask for secret key password ? Mod_init is called after @@ -344,6 +342,12 @@ static int mod_init(void) if (tls_check_sockets(*tls_domains_cfg) < 0) goto error; +#ifndef OPENSSL_NO_ECDH + LM_INFO("With ECDH-Support!\n"); +#endif +#ifndef OPENSSL_NO_DH + LM_INFO("With Diffie Hellman\n"); +#endif return 0; error: destroy_tls_h();

10 years, 1 month

git:master: tls: Added note to docs about OpenSSL requirement for Elliptic Curve Diffie Hellman (ECDH)

by Carsten Bock

Module: sip-router Branch: master Commit: b8aee4b00258044b9999d961765c8ab53406e5b7 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=b8aee4b… Author: Carsten Bock <carsten(a)ng-voice.com> Committer: Carsten Bock <carsten(a)ng-voice.com> Date: Sat Mar 22 16:49:20 2014 +0100 tls: Added note to docs about OpenSSL requirement for Elliptic Curve Diffie Hellman (ECDH) --- modules/tls/README | 11 ++++++++++- modules/tls/doc/tls.xml | 15 +++++++++++++++ 2 files changed, 25 insertions(+), 1 deletions(-) diff --git a/modules/tls/README b/modules/tls/README index cdd3493..fbf1762 100644 --- a/modules/tls/README +++ b/modules/tls/README @@ -4,7 +4,13 @@ Andrei Pelinescu-Onciul iptelorg GmbH - Copyright � 2007 iptelorg GmbH +Carsten Bock + + ng-voice GmbH + + Copyright © 2007 iptelorg GmbH + + Copyright © 2014 ng-voice GmbH __________________________________________________________________ Table of Contents @@ -274,6 +280,9 @@ make TLS_EXTRA_LIBS="-lkrb5 -lz" all include_modules=tls when trying to load the tls module (check the log), it means some needed library was not linked and it must be added to TLS_EXTRA_LIBS + Elliptic Curve Diffie-Hellman (EDCH)-Ciphers are only supported in + OpenSSL 1.0.0e and later. + 5. TLS and Low Memory The openssl library doesn't handle very well low memory situations. If diff --git a/modules/tls/doc/tls.xml b/modules/tls/doc/tls.xml index 4f41780..4302cc5 100644 --- a/modules/tls/doc/tls.xml +++ b/modules/tls/doc/tls.xml @@ -20,11 +20,23 @@ <email>andrei(a)iptel.org</email> </address> </author> + <author> + <firstname>Carsten</firstname> + <surname>Bock</surname> + <affiliation><orgname>ng-voice GmbH</orgname></affiliation> + <address> + <email>carsten(a)ng-voice.com</email> + </address> + </author> </authorgroup> <copyright> <year>2007</year> <holder>iptelorg GmbH</holder> </copyright> + <copyright> + <year>2014</year> + <holder>ng-voice GmbH</holder> + </copyright> </bookinfo> <toc></toc> @@ -112,6 +124,9 @@ make TLS_EXTRA_LIBS="-lkrb5 -lz" all include_modules=tls <para> In general, if Kamailio fails to start with a symbol not found error when trying to load the tls module (check the log), it means some needed library was not linked and it must be added to <emphasis>TLS_EXTRA_LIBS</emphasis> </para> + <para> +<ulink url="http://wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman">Elliptic Curve Diffie-Hellman (EDCH)</ulink>-Ciphers are only supported in OpenSSL 1.0.0e and later. + </para> </section> <section id="tls.low_memory">

10 years, 1 month

[tracker] Comment added: textops: add functions to convert and append multipart bodies. (Attachment added)

by sip-router

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#410 - textops: add functions to convert and append multipart bodies. User who did this - Víctor Seva (linuxmaniac) ---------- Crashes fixed. Flag version only added to build_req_buf_from_sip_req() for now. Documentation added. Any comments? Should I push this to a tmp branch? ---------- One or more files have been attached. More information can be found at the following URL: https://sip-router.org/tracker/index.php?do=details&task_id=410#comment1356 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

10 years, 1 month

[tracker] Comment added: textops: add functions to convert and append multipart bodies.

by sip-router

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#410 - textops: add functions to convert and append multipart bodies. User who did this - Víctor Seva (linuxmaniac) ---------- ups... fixing textops documentation already committed to master. ---------- More information can be found at the following URL: https://sip-router.org/tracker/index.php?do=details&task_id=410#comment1357 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

10 years, 1 month

git:master: textops: fix doc. insert_hf append_hf functions id are duplicated.

by Victor Seva

Module: sip-router Branch: master Commit: 3a56e12090fe7b614430947d8393e16a4fc91b92 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=3a56e12… Author: Victor Seva <linuxmaniac(a)torreviejawireless.org> Committer: Victor Seva <linuxmaniac(a)torreviejawireless.org> Date: Tue Mar 18 11:17:51 2014 +0100 textops: fix doc. insert_hf append_hf functions id are duplicated. --- modules/textops/doc/textops_admin.xml | 83 ++++----------------------------- 1 files changed, 9 insertions(+), 74 deletions(-) diff --git a/modules/textops/doc/textops_admin.xml b/modules/textops/doc/textops_admin.xml index a5e27bf..e76e921 100644 --- a/modules/textops/doc/textops_admin.xml +++ b/modules/textops/doc/textops_admin.xml @@ -749,47 +749,11 @@ append_to_reply("Foo: $rm at $Ts\r\n"); <section id="textops.f.append_hf"> <title> - <function moreinfo="none">append_hf(txt)</function> + <function moreinfo="none">append_hf(txt[, hdr])</function> </title> <para> - Appends 'txt' as header after the last header field. - </para> - <para>Meaning of the parameters is as follows:</para> - <itemizedlist> - <listitem> - <para><emphasis>txt</emphasis> - Header field to be appended. The - value can contain pseudo-variables which will be replaced at run - time. - </para> - </listitem> - </itemizedlist> - <para> - Note: Headers which are added in main route cannot be removed in further routes - (e.g. failure routes). So, the idea is not to add there any headers that you - might want to remove later. To add headers temporarely use the branch route - because the changes you do there are per-branch. - </para> - <para> - This function can be used from REQUEST_ROUTE, ONREPLY_ROUTE, - FAILURE_ROUTE, BRANCH_ROUTE. - </para> - <example> - <title><function>append_hf</function> usage</title> - <programlisting format="linespecific"> -... -append_hf("P-hint: VOICEMAIL\r\n"); -append_hf("From-username: $fU\r\n"); -... -</programlisting> - </example> - </section> - - <section id="textops.f.append_hf"> - <title> - <function moreinfo="none">append_hf(txt, hdr)</function> - </title> - <para> - Appends 'txt' as header after first 'hdr' header field. + Appends 'txt' as header after first header field or after + last 'hdr' header field. </para> <para>Meaning of the parameters is as follows:</para> <itemizedlist> @@ -813,7 +777,7 @@ append_hf("From-username: $fU\r\n"); <title><function>append_hf</function> usage</title> <programlisting format="linespecific"> ... -append_hf("P-hint: VOICEMAIL\r\n", "Call-ID"); +append_hf("P-hint: VOICEMAIL\r\n"); append_hf("From-username: $fU\r\n", "Call-ID"); ... </programlisting> @@ -822,42 +786,11 @@ append_hf("From-username: $fU\r\n", "Call-ID"); <section id="textops.f.insert_hf"> <title> - <function moreinfo="none">insert_hf(txt)</function> + <function moreinfo="none">insert_hf(txt[, hdr])</function> </title> <para> - Inserts 'txt' as header before the first header field. - </para> - <para>Meaning of the parameters is as follows:</para> - <itemizedlist> - <listitem> - <para><emphasis>txt</emphasis> - Header field to be inserted. The - value can contain pseudo-variables which will be replaced at run - time. - </para> - </listitem> - </itemizedlist> - <para> - This function can be used from REQUEST_ROUTE, ONREPLY_ROUTE, - FAILURE_ROUTE, BRANCH_ROUTE. - </para> - <example> - <title><function>insert_hf</function> usage</title> - <programlisting format="linespecific"> -... -insert_hf("P-hint: VOICEMAIL\r\n"); -insert_hf("To-username: $tU\r\n"); -... -</programlisting> - </example> - </section> - - - <section id="textops.f.insert_hf"> - <title> - <function moreinfo="none">insert_hf(txt, hdr)</function> - </title> - <para> - Inserts 'txt' as header before first 'hdr' header field. + Inserts 'txt' as header before the first header field or before + first 'hdr' header field if 'hdr' is given. </para> <para>Meaning of the parameters is as follows:</para> <itemizedlist> @@ -881,6 +814,8 @@ insert_hf("To-username: $tU\r\n"); <title><function>insert_hf</function> usage</title> <programlisting format="linespecific"> ... +insert_hf("P-hint: VOICEMAIL\r\n"); +insert_hf("To-username: $tU\r\n"); insert_hf("P-hint: VOICEMAIL\r\n", "Call-ID"); insert_hf("To-username: $tU\r\n", "Call-ID"); ...

10 years, 1 month

← Newer
1
...
5
6
7
8
9
10
11
...
30
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev March 2014