Module: sip-router
Branch: sr_3.0
Commit: e9c0d837dccb65c10895c41f42d8d2d82e944f7a
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=e9c0d83…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Fri Feb 26 13:39:55 2010 +0100
tls: TLS_MALLOC_DBG can now be set on make cfg
Enabling tls extra malloc debugging info, does not require anymore
editing tls_init.c. It can be enabled at cfg time
(make cfg extra_defs=-DTLS_MALLOC_DBG) or at compile/re-compile
time ( make -C modules/tls clean;
make -C modules/tls extra_defs=-DTLS_MALLOC_DBG).
When TLS_MALLOC_DBG is enabled, an extra warning will be printed
at compile time. NO_TLS_MALLOC_DBG takes precedence over
TLS_MALLOC_DBG.
(cherry picked from commit 9bc19d4994f20aa354092aba9ae784de91547fc6)
---
modules/tls/tls_init.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/modules/tls/tls_init.c b/modules/tls/tls_init.c
index b0f07f9..5c8e832 100644
--- a/modules/tls/tls_init.c
+++ b/modules/tls/tls_init.c
@@ -115,12 +115,16 @@ int tls_force_run = 0; /* ignore some start-up sanity checks, use it
const SSL_METHOD* ssl_methods[TLS_USE_SSLv23 + 1];
+#ifdef NO_TLS_MALLOC_DBG
#undef TLS_MALLOC_DBG /* extra malloc debug info from openssl */
+#endif /* NO_TLS_MALLOC_DBG */
+
/*
* Wrappers around SER shared memory functions
* (which can be macros)
*/
#ifdef TLS_MALLOC_DBG
+#warning "tls module compiled with malloc debugging info (extra overhead)"
#include <execinfo.h>
/*
Module: sip-router
Branch: sr_3.0
Commit: e061e1225873759d37ce3cd49f21a68e54684641
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=e061e12…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Tue Feb 23 16:10:21 2010 +0100
tls: disable kerberos more thoroughly [fix]
Older openssl versions (< 0.9.8e release) have a bug in the
kerberos code (it uses the wrong malloc, for more details see
openssl bug # 1467). While there is already a workaround for this
openssl bug in the sr code (see commits 36cb8f & 560a42), in some
situations this workaround causes another bug (crash on connection
opening when openssl is compiled with kerberos support and
kerberos is enabled for key exchange).
The current fix will disable automatically all the ciphers containing
KRB5 if the openssl version is < 0.9.8e beta1 or it is between
0.9.9-dev and 0.9.9-beta1.
It iss equivalent to setting cipher_list to "<prev. value>:!KRB5".
Impact: this fix is needed only if openssl is compiled with
kerberos support and the version is < 0.9.8e. It also affects at
least CentOS users with openssl-0.9.8e-12.el5_4.1 (in the centos
openssl package they play some strange games with the version and
report 0.9.8b via SSLeay).
Tested-by: Klaus Darilion klaus.mailinglists at pernau.at
Reported-by: Klaus Darilion klaus.mailinglists at pernau.at
Reported-by: Andreas Rehbein rehbein at e-technik.org
Reported-by: Martin Koenig koenig starface.de
(cherry picked from commit 51ee5da9ebf09447f71d4393f7c5b703305ff46d)
---
modules/tls/tls_domain.c | 35 +++++++++++++++++++++++++++++++----
1 files changed, 31 insertions(+), 4 deletions(-)
diff --git a/modules/tls/tls_domain.c b/modules/tls/tls_domain.c
index db35eda..628b3e2 100644
--- a/modules/tls/tls_domain.c
+++ b/modules/tls/tls_domain.c
@@ -269,6 +269,10 @@ static int load_ca_list(tls_domain_t* d)
return 0;
}
+#define C_DEF_NO_KRB5 "DEFAULT:!KRB5"
+#define C_DEF_NO_KRB5_LEN (sizeof(C_DEF_NO_KRB5)-1)
+#define C_NO_KRB5_SUFFIX ":!KRB5"
+#define C_NO_KRB5_SUFFIX_LEN (sizeof(C_NO_KRB5_SUFFIX)-1)
/*
* Configure cipher list
@@ -277,12 +281,35 @@ static int set_cipher_list(tls_domain_t* d)
{
int i;
int procs_no;
-
- if (!d->cipher_list.s) return 0;
+ char* cipher_list;
+
+ cipher_list=d->cipher_list.s;
+#ifdef TLS_KSSL_WORKARROUND
+ if (openssl_kssl_malloc_bug) { /* is openssl bug #1467 present ? */
+ if (d->cipher_list.s==0) {
+ /* use "DEFAULT:!KRB5" */
+ cipher_list="DEFAULT:!KRB5";
+ } else {
+ /* append ":!KRB5" */
+ cipher_list=shm_malloc(d->cipher_list.len+C_NO_KRB5_SUFFIX_LEN+1);
+ if (cipher_list) {
+ memcpy(cipher_list, d->cipher_list.s, d->cipher_list.len);
+ memcpy(cipher_list+d->cipher_list.len, C_NO_KRB5_SUFFIX,
+ C_NO_KRB5_SUFFIX_LEN);
+ cipher_list[d->cipher_list.len+C_NO_KRB5_SUFFIX_LEN]=0;
+ shm_free(d->cipher_list.s);
+ d->cipher_list.s=cipher_list;
+ d->cipher_list.len+=C_NO_KRB5_SUFFIX_LEN;
+ }
+ }
+ }
+#endif /* TLS_KSSL_WORKARROUND */
+ if (!cipher_list) return 0;
procs_no=get_max_procs();
for(i = 0; i < procs_no; i++) {
- if (SSL_CTX_set_cipher_list(d->ctx[i], d->cipher_list.s) == 0 ) {
- ERR("%s: Failure to set SSL context cipher list\n", tls_domain_str(d));
+ if (SSL_CTX_set_cipher_list(d->ctx[i], cipher_list) == 0 ) {
+ ERR("%s: Failure to set SSL context cipher list \"%s\"\n",
+ tls_domain_str(d), cipher_list);
return -1;
}
}
Module: sip-router
Branch: sr_3.0
Commit: af9cbb358ba104e12bd5f8cec2e5ff117d57f1b2
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=af9cbb3…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Mon Feb 22 18:01:26 2010 +0100
tm: onreply_route: fix cleanup after DROP
After a DROP in the onreply_route the avp lists where not restored
to their original values and the possible msg flags changes in the
script were dropped.
(cherry-picked from commit ba15378ef66a11d3cbd6862aa2bfb060d099ca03)
---
modules/tm/t_reply.c | 17 ++++++++++-------
1 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/modules/tm/t_reply.c b/modules/tm/t_reply.c
index ff89dd4..e13acbb 100644
--- a/modules/tm/t_reply.c
+++ b/modules/tm/t_reply.c
@@ -2020,13 +2020,6 @@ int reply_received( struct sip_msg *p_msg )
LOCK_REPLIES( t );
replies_locked=1;
run_top_route(onreply_rt.rlist[t->on_reply], p_msg, &ctx);
- if ((ctx.run_flags&DROP_R_F) && (msg_status<200)) {
- if (unlikely(replies_locked)) {
- replies_locked = 0;
- UNLOCK_REPLIES( t );
- }
- goto done;
- }
/* transfer current message context back to t */
if (t->uas.request) t->uas.request->flags=p_msg->flags;
getbflagsval(0, &uac->branch_flags);
@@ -2038,6 +2031,16 @@ int reply_received( struct sip_msg *p_msg )
set_avp_list( AVP_TRACK_TO | AVP_CLASS_USER, backup_user_to );
set_avp_list( AVP_TRACK_FROM | AVP_CLASS_DOMAIN, backup_domain_from );
set_avp_list( AVP_TRACK_TO | AVP_CLASS_DOMAIN, backup_domain_to );
+ /* handle a possible DROP in the script, but only if this
+ is not a final reply (final replies already stop the timers
+ and droping them might leave a transaction living forever) */
+ if ((ctx.run_flags&DROP_R_F) && (msg_status<200)) {
+ if (unlikely(replies_locked)) {
+ replies_locked = 0;
+ UNLOCK_REPLIES( t );
+ }
+ goto done;
+ }
}
#ifdef USE_DST_BLACKLIST
/* add temporary to the blacklist the source of a 503 reply */
Revision: 5991
http://openser.svn.sourceforge.net/openser/?rev=5991&view=rev
Author: juhe
Date: 2010-03-04 09:06:31 +0000 (Thu, 04 Mar 2010)
Log Message:
-----------
* permissions: allow_source_address_group() subnet matching fix
(backport from sr).
Modified Paths:
--------------
branches/1.5/modules/permissions/hash.c
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.