sr-dev December 2022

sr-dev@lists.kamailio.org

11 participants
264 discussions

git:5.5:e75897a1: stirshaken: Properly handle intermediary/chain certificates when caching certificates

by Henning Westerholt

Module: kamailio Branch: 5.5 Commit: e75897a1406a07f0376278ddc54188bce99ae6f5 URL: https://github.com/kamailio/kamailio/commit/e75897a1406a07f0376278ddc54188b… Author: Trevor Peirce <trev(a)acrovoice.ca> Committer: Henning Westerholt <hw(a)gilawa.com> Date: 2022-12-13T10:07:58Z stirshaken: Properly handle intermediary/chain certificates when caching certificates - requires patch to libstirshaken (PR 124) to do anything - if patched version of libstirshaken detected, uses new methods to store all intermediary certs - unrelated minor logging tweaks (cherry picked from commit 043ce0e75eae04f356cd539f2146df6846a169e2) (cherry picked from commit 7bb9cadb1cec146cc6f0b5dafb2d50920dc40bcf) --- Modified: src/modules/stirshaken/stirshaken_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/e75897a1406a07f0376278ddc54188b… Patch: https://github.com/kamailio/kamailio/commit/e75897a1406a07f0376278ddc54188b… --- diff --git a/src/modules/stirshaken/stirshaken_mod.c b/src/modules/stirshaken/stirshaken_mod.c index 88ec8812ab..156fdc9098 100644 --- a/src/modules/stirshaken/stirshaken_mod.c +++ b/src/modules/stirshaken/stirshaken_mod.c @@ -200,18 +200,21 @@ static stir_shaken_status_t shaken_callback(stir_shaken_callback_arg_t *arg) diff = now_s - attr.st_mtime; - LM_DBG("Checking cached certificate against expiration setting of %zus (now is: %zu, file modification timestamp is: %zu, difference is: %zu)\n", + LM_DBG("Checking cached certificate against expiration setting of %zus (now is: %lu, file modification timestamp is: %lu, difference is: %lu)\n", stirshaken_vs_cache_expire_s, now_s, attr.st_mtime, diff); if (diff > stirshaken_vs_cache_expire_s) { - LM_WARN("Cached certificate %s is behind expiration threshold (%zu > %zu). Need to download new certificate...\n", cert_full_path, diff, stirshaken_vs_cache_expire_s); + LM_NOTICE("Cached certificate %s is behind expiration threshold (%lu > %zu). Need to download new certificate...\n", cert_full_path, diff, stirshaken_vs_cache_expire_s); goto exit; } else { - LM_WARN("Cached certificate %s is valid for next %zus\n", cert_full_path, stirshaken_vs_cache_expire_s - diff); + LM_NOTICE("Cached certificate %s is valid for next %lus\n", cert_full_path, stirshaken_vs_cache_expire_s - diff); } } - +#ifdef STIR_SHAKEN_CAN_RW_X509_FULLCHAIN + if (STIR_SHAKEN_STATUS_OK != stir_shaken_load_x509_from_file_fullchain(&ss, &cache_copy, cert_full_path)) { +#else if (!(cache_copy.x = stir_shaken_load_x509_from_file(&ss, cert_full_path))) { +#endif LM_ERR("Cannot load X509 from file %s\n", cert_full_path); goto exit; } @@ -420,10 +423,14 @@ static int stirshaken_handle_cache(stir_shaken_context_t *ss, stir_shaken_passpo } } - LM_DBG("Saving fresh certificate %s in cache (with name: %s)...\n", x5u, cert_full_path); - +#ifdef STIR_SHAKEN_CAN_RW_X509_FULLCHAIN + LM_DBG("Saving fresh certificate+chain %s to cache as %s\n", x5u, cert_full_path); + if (STIR_SHAKEN_STATUS_OK != stir_shaken_x509_to_disk_fullchain(ss, cert->x, cert->xchain, cert_full_path)) { +#else + LM_DBG("Saving fresh certificate %s to cache as %s\n", x5u, cert_full_path); if (STIR_SHAKEN_STATUS_OK != stir_shaken_x509_to_disk(ss, cert->x, cert_full_path)) { - LM_ERR("Failed to write cert %s to disk (as: %s)", x5u, cert_full_path); +#endif + LM_ERR("Failed to cache certificate %s to disk", x5u); } } else { @@ -460,7 +467,8 @@ static int ki_stirshaken_check_identity(sip_msg_t *msg) ibody = hf->body; if (STIR_SHAKEN_STATUS_OK != stir_shaken_vs_sih_verify(&ss, vs, ibody.s, &cert_out, &passport_out)) { - LM_ERR("SIP Identity Header did not pass verification\n"); + LM_ERR("SIP Identity Header did not pass verification: %s", stir_shaken_get_error(&ss, NULL)); + stirshaken_print_error_details(&ss); goto fail; }

1 year, 4 months

git:5.6:7bb9cadb: stirshaken: Properly handle intermediary/chain certificates when caching certificates

by Henning Westerholt

Module: kamailio Branch: 5.6 Commit: 7bb9cadb1cec146cc6f0b5dafb2d50920dc40bcf URL: https://github.com/kamailio/kamailio/commit/7bb9cadb1cec146cc6f0b5dafb2d509… Author: Trevor Peirce <trev(a)acrovoice.ca> Committer: Henning Westerholt <hw(a)gilawa.com> Date: 2022-12-13T10:07:21Z stirshaken: Properly handle intermediary/chain certificates when caching certificates - requires patch to libstirshaken (PR 124) to do anything - if patched version of libstirshaken detected, uses new methods to store all intermediary certs - unrelated minor logging tweaks (cherry picked from commit 043ce0e75eae04f356cd539f2146df6846a169e2) --- Modified: src/modules/stirshaken/stirshaken_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/7bb9cadb1cec146cc6f0b5dafb2d509… Patch: https://github.com/kamailio/kamailio/commit/7bb9cadb1cec146cc6f0b5dafb2d509… --- diff --git a/src/modules/stirshaken/stirshaken_mod.c b/src/modules/stirshaken/stirshaken_mod.c index 6f2ec8fa03..b64396b0ab 100644 --- a/src/modules/stirshaken/stirshaken_mod.c +++ b/src/modules/stirshaken/stirshaken_mod.c @@ -207,18 +207,21 @@ static stir_shaken_status_t shaken_callback(stir_shaken_callback_arg_t *arg) diff = now_s - attr.st_mtime; - LM_DBG("Checking cached certificate against expiration setting of %zus (now is: %zu, file modification timestamp is: %zu, difference is: %zu)\n", + LM_DBG("Checking cached certificate against expiration setting of %zus (now is: %lu, file modification timestamp is: %lu, difference is: %lu)\n", stirshaken_vs_cache_expire_s, now_s, attr.st_mtime, diff); if (diff > stirshaken_vs_cache_expire_s) { - LM_WARN("Cached certificate %s is behind expiration threshold (%zu > %zu). Need to download new certificate...\n", cert_full_path, diff, stirshaken_vs_cache_expire_s); + LM_NOTICE("Cached certificate %s is behind expiration threshold (%lu > %zu). Need to download new certificate...\n", cert_full_path, diff, stirshaken_vs_cache_expire_s); goto exit; } else { - LM_WARN("Cached certificate %s is valid for next %zus\n", cert_full_path, stirshaken_vs_cache_expire_s - diff); + LM_NOTICE("Cached certificate %s is valid for next %lus\n", cert_full_path, stirshaken_vs_cache_expire_s - diff); } } - +#ifdef STIR_SHAKEN_CAN_RW_X509_FULLCHAIN + if (STIR_SHAKEN_STATUS_OK != stir_shaken_load_x509_from_file_fullchain(&ss, &cache_copy, cert_full_path)) { +#else if (!(cache_copy.x = stir_shaken_load_x509_from_file(&ss, cert_full_path))) { +#endif LM_ERR("Cannot load X509 from file %s\n", cert_full_path); goto exit; } @@ -443,10 +446,14 @@ static int stirshaken_handle_cache(stir_shaken_context_t *ss, stir_shaken_passpo } } - LM_DBG("Saving fresh certificate %s in cache (with name: %s)...\n", x5u, cert_full_path); - +#ifdef STIR_SHAKEN_CAN_RW_X509_FULLCHAIN + LM_DBG("Saving fresh certificate+chain %s to cache as %s\n", x5u, cert_full_path); + if (STIR_SHAKEN_STATUS_OK != stir_shaken_x509_to_disk_fullchain(ss, cert->x, cert->xchain, cert_full_path)) { +#else + LM_DBG("Saving fresh certificate %s to cache as %s\n", x5u, cert_full_path); if (STIR_SHAKEN_STATUS_OK != stir_shaken_x509_to_disk(ss, cert->x, cert_full_path)) { - LM_ERR("Failed to write cert %s to disk (as: %s)", x5u, cert_full_path); +#endif + LM_ERR("Failed to cache certificate %s to disk", x5u); } } else { @@ -485,7 +492,8 @@ static int ki_stirshaken_check_identity(sip_msg_t *msg) ibody = hf->body; if (STIR_SHAKEN_STATUS_OK != stir_shaken_vs_sih_verify(&ss, vs, ibody.s, &cert_out, &passport_out)) { - LM_ERR("SIP Identity Header did not pass verification\n"); + LM_ERR("SIP Identity Header did not pass verification: %s", stir_shaken_get_error(&ss, NULL)); + stirshaken_print_error_details(&ss); goto fail; }

1 year, 4 months

git:master:899b0f45: core: also print maximum branches parameter compile time value

by Henning Westerholt

Module: kamailio Branch: master Commit: 899b0f4518b768fd8184fb97b0c8c64cecf3a575 URL: https://github.com/kamailio/kamailio/commit/899b0f4518b768fd8184fb97b0c8c64… Author: Henning Westerholt <hw(a)gilawa.com> Committer: Henning Westerholt <hw(a)gilawa.com> Date: 2022-12-12T08:18:24Z core: also print maximum branches parameter compile time value --- Modified: src/core/dset.c --- Diff: https://github.com/kamailio/kamailio/commit/899b0f4518b768fd8184fb97b0c8c64… Patch: https://github.com/kamailio/kamailio/commit/899b0f4518b768fd8184fb97b0c8c64… --- diff --git a/src/core/dset.c b/src/core/dset.c index 26530c2769..3eb34f38ae 100644 --- a/src/core/dset.c +++ b/src/core/dset.c @@ -85,8 +85,8 @@ str _ksr_contact_salias = str_init(";alias="); int init_dst_set(void) { if(sr_dst_max_branches<=0 || sr_dst_max_branches>=MAX_BRANCHES_LIMIT) { - LM_ERR("invalid value for max branches parameter: %u\n", - sr_dst_max_branches); + LM_ERR("invalid value for max branches parameter: %u, maximum value: %u\n", + sr_dst_max_branches, MAX_BRANCHES_LIMIT); return -1; } /* sr_dst_max_branches - 1 : because of the default branch for r-uri, #0 in tm */

1 year, 4 months

app_python3s not included in module exclude list

by Henning Westerholt

Hi, the new module app_python3s is causing compilation issues, probably needs to be included in the exclude list: $ make cfg $ make all make[2]: python3.8-config: Command not found CC (gcc) [M app_python3s.so] apy3s_exception.o apy3s_exception.c:22:10: fatal error: Python.h: No such file or directory 22 | #include <Python.h> | ^~~~~~~~~~ compilation terminated. Thanks, Henning -- Henning Westerholt - https://skalatan.de/blog/ Kamailio services - https://gilawa.com<https://gilawa.com/>

1 year, 4 months

git:master:eb19c52d: Makefile.groups: added app_python3s to mod_list_python3

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: eb19c52d9b89f393d7336b4a9c6be991372e25c8 URL: https://github.com/kamailio/kamailio/commit/eb19c52d9b89f393d7336b4a9c6be99… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2022-12-12T09:06:36+01:00 Makefile.groups: added app_python3s to mod_list_python3 --- Modified: src/Makefile.groups --- Diff: https://github.com/kamailio/kamailio/commit/eb19c52d9b89f393d7336b4a9c6be99… Patch: https://github.com/kamailio/kamailio/commit/eb19c52d9b89f393d7336b4a9c6be99… --- diff --git a/src/Makefile.groups b/src/Makefile.groups index 4934ff0815..7c6bafff41 100644 --- a/src/Makefile.groups +++ b/src/Makefile.groups @@ -131,7 +131,7 @@ mod_list_perldeps=app_perl db_perlvdb mod_list_python=app_python # - modules depending on python3 library -mod_list_python3=app_python3 +mod_list_python3=app_python3 app_python3s # - modules depending on libm (math library - standard system library) mod_list_jsdt=app_jsdt

1 year, 4 months

git:master:043ce0e7: stirshaken: Properly handle intermediary/chain certificates when caching certificates

by Henning Westerholt

Module: kamailio Branch: master Commit: 043ce0e75eae04f356cd539f2146df6846a169e2 URL: https://github.com/kamailio/kamailio/commit/043ce0e75eae04f356cd539f2146df6… Author: Trevor Peirce <trev(a)acrovoice.ca> Committer: Henning Westerholt <hw(a)gilawa.com> Date: 2022-12-12T07:48:38+01:00 stirshaken: Properly handle intermediary/chain certificates when caching certificates - requires patch to libstirshaken (PR 124) to do anything - if patched version of libstirshaken detected, uses new methods to store all intermediary certs - unrelated minor logging tweaks --- Modified: src/modules/stirshaken/stirshaken_mod.c --- Diff: https://github.com/kamailio/kamailio/commit/043ce0e75eae04f356cd539f2146df6… Patch: https://github.com/kamailio/kamailio/commit/043ce0e75eae04f356cd539f2146df6… --- diff --git a/src/modules/stirshaken/stirshaken_mod.c b/src/modules/stirshaken/stirshaken_mod.c index 6f2ec8fa03e..b64396b0ab7 100644 --- a/src/modules/stirshaken/stirshaken_mod.c +++ b/src/modules/stirshaken/stirshaken_mod.c @@ -207,18 +207,21 @@ static stir_shaken_status_t shaken_callback(stir_shaken_callback_arg_t *arg) diff = now_s - attr.st_mtime; - LM_DBG("Checking cached certificate against expiration setting of %zus (now is: %zu, file modification timestamp is: %zu, difference is: %zu)\n", + LM_DBG("Checking cached certificate against expiration setting of %zus (now is: %lu, file modification timestamp is: %lu, difference is: %lu)\n", stirshaken_vs_cache_expire_s, now_s, attr.st_mtime, diff); if (diff > stirshaken_vs_cache_expire_s) { - LM_WARN("Cached certificate %s is behind expiration threshold (%zu > %zu). Need to download new certificate...\n", cert_full_path, diff, stirshaken_vs_cache_expire_s); + LM_NOTICE("Cached certificate %s is behind expiration threshold (%lu > %zu). Need to download new certificate...\n", cert_full_path, diff, stirshaken_vs_cache_expire_s); goto exit; } else { - LM_WARN("Cached certificate %s is valid for next %zus\n", cert_full_path, stirshaken_vs_cache_expire_s - diff); + LM_NOTICE("Cached certificate %s is valid for next %lus\n", cert_full_path, stirshaken_vs_cache_expire_s - diff); } } - +#ifdef STIR_SHAKEN_CAN_RW_X509_FULLCHAIN + if (STIR_SHAKEN_STATUS_OK != stir_shaken_load_x509_from_file_fullchain(&ss, &cache_copy, cert_full_path)) { +#else if (!(cache_copy.x = stir_shaken_load_x509_from_file(&ss, cert_full_path))) { +#endif LM_ERR("Cannot load X509 from file %s\n", cert_full_path); goto exit; } @@ -443,10 +446,14 @@ static int stirshaken_handle_cache(stir_shaken_context_t *ss, stir_shaken_passpo } } - LM_DBG("Saving fresh certificate %s in cache (with name: %s)...\n", x5u, cert_full_path); - +#ifdef STIR_SHAKEN_CAN_RW_X509_FULLCHAIN + LM_DBG("Saving fresh certificate+chain %s to cache as %s\n", x5u, cert_full_path); + if (STIR_SHAKEN_STATUS_OK != stir_shaken_x509_to_disk_fullchain(ss, cert->x, cert->xchain, cert_full_path)) { +#else + LM_DBG("Saving fresh certificate %s to cache as %s\n", x5u, cert_full_path); if (STIR_SHAKEN_STATUS_OK != stir_shaken_x509_to_disk(ss, cert->x, cert_full_path)) { - LM_ERR("Failed to write cert %s to disk (as: %s)", x5u, cert_full_path); +#endif + LM_ERR("Failed to cache certificate %s to disk", x5u); } } else { @@ -485,7 +492,8 @@ static int ki_stirshaken_check_identity(sip_msg_t *msg) ibody = hf->body; if (STIR_SHAKEN_STATUS_OK != stir_shaken_vs_sih_verify(&ss, vs, ibody.s, &cert_out, &passport_out)) { - LM_ERR("SIP Identity Header did not pass verification\n"); + LM_ERR("SIP Identity Header did not pass verification: %s", stir_shaken_get_error(&ss, NULL)); + stirshaken_print_error_details(&ss); goto fail; }

1 year, 4 months

git:master:a4fdac93: modules: readme files regenerated - websocket ... [skip ci]

by Kamailio Dev

Module: kamailio Branch: master Commit: a4fdac93c0eecff68f67f8d48f7d507ec6c7b0e9 URL: https://github.com/kamailio/kamailio/commit/a4fdac93c0eecff68f67f8d48f7d507… Author: Kamailio Dev <kamailio.dev(a)kamailio.org> Committer: Kamailio Dev <kamailio.dev(a)kamailio.org> Date: 2022-12-11T11:31:24+01:00 modules: readme files regenerated - websocket ... [skip ci] --- Modified: src/modules/websocket/README --- Diff: https://github.com/kamailio/kamailio/commit/a4fdac93c0eecff68f67f8d48f7d507… Patch: https://github.com/kamailio/kamailio/commit/a4fdac93c0eecff68f67f8d48f7d507… --- diff --git a/src/modules/websocket/README b/src/modules/websocket/README index cbe8fd98eb..32ccdfdd9a 100644 --- a/src/modules/websocket/README +++ b/src/modules/websocket/README @@ -278,7 +278,7 @@ request_route { # Handle requests within SIP dialogs route[WITHINDLG] { if (has_totag()) { - # sequential request withing a dialog should + # sequential request within a dialog should # take the path determined by record-routing if (loose_route()) { if ($du == "") {

1 year, 4 months

[kamailio/kamailio] Typos: withing → within (PR #3298)

by Дилян Палаузов

You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/3298 -- Commit Summary -- * Typos: withing → within -- File Changes -- M doc/tutorials/presence/cfg/full_ps.cfg (2) M doc/tutorials/presence/cfg/ps.cfg (2) M etc/kamailio.cfg (2) M etc/sip-router.cfg (2) M misc/examples/ims/pcscf/kamailio.cfg (2) M misc/examples/kamailio/acc-mysql.cfg (2) M misc/examples/kamailio/nathelper.cfg (2) M misc/examples/kemi/kamailio-basic-kemi-jsdt.js (2) M misc/examples/kemi/kamailio-basic-kemi-lua.lua (2) M misc/examples/kemi/kamailio-basic-kemi-native.cfg (2) M misc/examples/kemi/kamailio-basic-kemi-python.py (2) M misc/examples/kemi/kamailio-basic-kemi-python3s.py (2) M misc/examples/kemi/kamailio-basic-kemi-sqlang.sq (2) M misc/examples/mixed/kamailio-minimal-anycast.cfg (2) M misc/examples/mixed/kamailio-minimal-proxy.cfg (2) M misc/examples/mixed/nathelper.cfg (2) M misc/examples/pkg/kamailio-basic.cfg (2) M misc/examples/pkg/kamailio-oob.cfg (2) M misc/examples/pkg/sip-router-basic.cfg (2) M misc/examples/pkg/sip-router-oob.cfg (2) M misc/examples/presence/full-no-failover.cfg (2) M misc/examples/presence/no-db.cfg (2) M misc/examples/webrtc/kamailio-default-websocket.cfg (2) M misc/examples/webrtc/websocket.cfg (2) M src/modules/app_java/kamailio_java_folder/java-untested/Kamailio.java (2) M src/modules/cnxcc/example/kamailio-cnxcc.cfg (2) M src/modules/db_cassandra/kamailio_cassa.cfg (2) M src/modules/db_text/README (2) M src/modules/db_text/doc/db_text.cfg (2) M src/modules/dispatcher/README (2) M src/modules/dispatcher/doc/dispatcher.cfg (2) M src/modules/sca/README (2) M src/modules/sca/doc/sca.cfg (2) M src/modules/websocket/README (2) M src/modules/websocket/doc/websocket_admin.xml (2) M src/modules/xprint/xp_lib.c (2) M test/unit/5.cfg (2) -- Patch Links -- https://github.com/kamailio/kamailio/pull/3298.patch https://github.com/kamailio/kamailio/pull/3298.diff -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/3298 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/pull/3298(a)github.com>

1 year, 4 months

git:master:35f8935a: websocket: spelling fix withing -> within

by Henning Westerholt

Module: kamailio Branch: master Commit: 35f8935acebb32d80633570031fad4f7235fe68a URL: https://github.com/kamailio/kamailio/commit/35f8935acebb32d80633570031fad4f… Author: Henning Westerholt <hw(a)gilawa.com> Committer: Henning Westerholt <hw(a)gilawa.com> Date: 2022-12-11T10:19:55Z websocket: spelling fix withing -> within --- Modified: src/modules/websocket/doc/websocket_admin.xml --- Diff: https://github.com/kamailio/kamailio/commit/35f8935acebb32d80633570031fad4f… Patch: https://github.com/kamailio/kamailio/commit/35f8935acebb32d80633570031fad4f… --- diff --git a/src/modules/websocket/doc/websocket_admin.xml b/src/modules/websocket/doc/websocket_admin.xml index b4b5e2c8ce9..c9ec9f524b1 100644 --- a/src/modules/websocket/doc/websocket_admin.xml +++ b/src/modules/websocket/doc/websocket_admin.xml @@ -166,7 +166,7 @@ request_route { # Handle requests within SIP dialogs route[WITHINDLG] { if (has_totag()) { - # sequential request withing a dialog should + # sequential request within a dialog should # take the path determined by record-routing if (loose_route()) { if ($du == "") {

1 year, 4 months

git:master:ee739aa6: sca: spelling fix withing -> within

by Henning Westerholt

Module: kamailio Branch: master Commit: ee739aa6952b1ea0ce72d17524dbed60627374b7 URL: https://github.com/kamailio/kamailio/commit/ee739aa6952b1ea0ce72d17524dbed6… Author: Henning Westerholt <hw(a)gilawa.com> Committer: Henning Westerholt <hw(a)gilawa.com> Date: 2022-12-11T10:19:55Z sca: spelling fix withing -> within --- Modified: src/modules/sca/doc/sca.cfg --- Diff: https://github.com/kamailio/kamailio/commit/ee739aa6952b1ea0ce72d17524dbed6… Patch: https://github.com/kamailio/kamailio/commit/ee739aa6952b1ea0ce72d17524dbed6… --- diff --git a/src/modules/sca/doc/sca.cfg b/src/modules/sca/doc/sca.cfg index 06cba002b23..e159f103eca 100644 --- a/src/modules/sca/doc/sca.cfg +++ b/src/modules/sca/doc/sca.cfg @@ -230,7 +230,7 @@ route[REQINIT] { # Handle requests within SIP dialogs route[WITHINDLG] { if (has_totag()) { - # sequential request withing a dialog should + # sequential request within a dialog should # take the path determined by record-routing if (loose_route()) { if ( is_method("NOTIFY") ) {

1 year, 4 months

← Newer
1
...
17
18
19
20
21
22
23
...
27
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev December 2022