kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-14 16:33:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge 425987

Browse Source 
git-svn-id: https://origsvn.digium.com/svn/asterisk/tags/12.6.1@426064 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Asterisk Autobuilder
2014-10-20 15:36:23 +00:00
parent 37f2c8b953
commit 9cc6688589
5 changed files with 63 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
ChangeLog
View File

@@ -1,3 +1,29 @@
2014-10-20 Asterisk Development Team <asteriskteam@digium.com>
* Asterisk 12.6.1 Released.
* AST-2014-011: Fix POODLE security issues
There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module
to use TLSv1+. At this time, it does not refactor res_jabber/
res_xmpp to use the TCP/TLS core, which should be done as an
improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left
unspecified, will default to the OpenSSL SSLv23_method. This
method allows for all encryption methods, including SSLv2/SSLv3.
A MITM can exploit this by forcing a fallback to SSLv3, which
leaves the server vulnerable to POODLE. This patch adds WARNINGS
if a user uses SSLv2/SSLv3 in their configuration, and explicitly
disables SSLv2/SSLv3 if using SSLv23_method.
For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or
SSLv3 is explicitly chosen. For TLS servers, Asterisk will no longer
support SSLv2 or SSLv3.
Much thanks to abelbeck for reporting the vulnerability and providing
a patch for the res_jabber/res_xmpp modules.
2014-09-24 Asterisk Development Team <asteriskteam@digium.com>
* Asterisk 12.6.0 Released.

11
UPGRADE.txt
View File

@@ -21,6 +21,17 @@
===
===========================================================
From 12.6.0 to 12.6.1:
- Due to the POODLE vulnerability (see
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566), the
default TLS method for TLS clients will no longer allow SSLv3. As
SSLv2 was already deprecated, it is no longer allowed by default as
well. TLS servers no longer allow SSLv2 or SSLv3 connections. This
affects the chan_sip channel driver, AMI, and the Asterisk HTTP server.
- The res_jabber resource module no longer uses SSLv3 to connect to an
XMPP server. It will now only use TLSv1 or later methods.
From 12.5.0 to 12.6.0:
ConfBridge:

22
main/tcptls.c
View File

@@ -747,6 +747,8 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client)
cfg->enabled = 0;
return 0;
#else
int disable_ssl = 0;
if (!cfg->enabled) {
return 0;
}
@@ -762,22 +764,21 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client)
if (client) {
#ifndef OPENSSL_NO_SSL2
if (ast_test_flag(&cfg->flags, AST_SSL_SSLV2_CLIENT)) {
ast_log(LOG_WARNING, "Usage of SSLv2 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
cfg->ssl_ctx = SSL_CTX_new(SSLv2_client_method());
} else
#endif
if (ast_test_flag(&cfg->flags, AST_SSL_SSLV3_CLIENT)) {
ast_log(LOG_WARNING, "Usage of SSLv3 is discouraged due to known vulnerabilities. Please use 'tlsv1' or leave the TLS method unspecified!\n");
cfg->ssl_ctx = SSL_CTX_new(SSLv3_client_method());
} else if (ast_test_flag(&cfg->flags, AST_SSL_TLSV1_CLIENT)) {
cfg->ssl_ctx = SSL_CTX_new(TLSv1_client_method());
} else {
/* SSLv23_client_method() sends SSLv2, this was the original
* default for ssl clients before the option was given to
* pick what protocol a client should use. In order not
* to break expected behavior it remains the default. */
disable_ssl = 1;
cfg->ssl_ctx = SSL_CTX_new(SSLv23_client_method());
}
} else {
/* SSLv23_server_method() supports TLSv1, SSLv2, and SSLv3 inbound connections. */
disable_ssl = 1;
cfg->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
}
@@ -787,6 +788,17 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client)
return 0;
}
/* Due to the POODLE vulnerability, completely disable
* SSLv2 and SSLv3 if we are not explicitly told to use
* them. SSLv23_*_method supports TLSv1+.
*/
if (disable_ssl) {
long ssl_opts;
ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
SSL_CTX_set_options(cfg->ssl_ctx, ssl_opts);
}
SSL_CTX_set_verify(cfg->ssl_ctx,
ast_test_flag(&cfg->flags, AST_SSL_VERIFY_CLIENT) ? SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT : SSL_VERIFY_NONE,
NULL);

5
res/res_jabber.c
View File

@@ -1290,14 +1290,17 @@ static int aji_start_tls(struct aji_client *client)
static int aji_tls_handshake(struct aji_client *client)
{
int sock;
long ssl_opts;
ast_debug(1, "Starting TLS handshake\n");
/* Choose an SSL/TLS protocol version, create SSL_CTX */
client->ssl_method = SSLv3_method();
client->ssl_method = SSLv23_method();
if (!(client->ssl_context = SSL_CTX_new((SSL_METHOD *) client->ssl_method))) {
return IKS_NET_TLSFAIL;
}
ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
SSL_CTX_set_options(client->ssl_context, ssl_opts);
/* Create new SSL session */
if (!(client->ssl_session = SSL_new(client->ssl_context))) {

6
res/res_xmpp.c
View File

@@ -2637,6 +2637,7 @@ static int xmpp_client_requested_tls(struct ast_xmpp_client *client, struct ast_
{
#ifdef HAVE_OPENSSL
int sock;
long ssl_opts;
#endif
if (!strcmp(iks_name(node), "success")) {
@@ -2655,11 +2656,14 @@ static int xmpp_client_requested_tls(struct ast_xmpp_client *client, struct ast_
ast_log(LOG_ERROR, "Somehow we managed to try to start TLS negotiation on client '%s' without OpenSSL support, disconnecting\n", client->name);
return -1;
#else
client->ssl_method = SSLv3_method();
client->ssl_method = SSLv23_method();
if (!(client->ssl_context = SSL_CTX_new((SSL_METHOD *) client->ssl_method))) {
goto failure;
}
ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
SSL_CTX_set_options(client->ssl_context, ssl_opts);
if (!(client->ssl_session = SSL_new(client->ssl_context))) {
goto failure;
}