Matthew Jordan 8c96fa291c AST-2014-011: Fix POODLE security issues ...

There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
    TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
    TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
    will default to the OpenSSL SSLv23_method. This method allows for all
    encryption methods, including SSLv2/SSLv3. A MITM can exploit this by
    forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
    This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
    and explicitly disables SSLv2/SSLv3 if using SSLv23_method.

For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.

Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.

Review: https://reviewboard.asterisk.org/r/4096/

ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
  asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
  asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
  AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
  AST-2014-011-11.diff uploaded by mjordan (License 6283)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@425986 65c4cc65-6c06-0410-ace0-fbb531ad65f3

2014-10-20 14:10:28 +00:00

..

editline

cli.c: Fix tab completion "module load" when MALLOC_DEBUG is enabled.

2014-09-22 17:40:02 +00:00

stdtime

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

abstract_jb.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

acl.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

adsi.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

alaw.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

aoc.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

app.c

app_voicemail/app: Remove test events that were duplicated by r421059

2014-08-15 15:36:44 +00:00

ast_expr2.c

Allow the REALTIME() function to report errors back to the caller.

2012-07-11 17:16:50 +00:00

ast_expr2.fl

…

ast_expr2.h

Allow the REALTIME() function to report errors back to the caller.

2012-07-11 17:16:50 +00:00

ast_expr2.y

…

ast_expr2f.c

Allow the REALTIME() function to report errors back to the caller.

2012-07-11 17:16:50 +00:00

asterisk.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

asterisk.dynamics

…

asterisk.exports.in

Add _IO_stdin_used in version-script to fix SIGBUSes on Sparc.

2013-08-22 08:22:39 +00:00

astfd.c

Unregister CLI commands on exit

2013-08-20 15:27:16 +00:00

astmm.c

MALLOC_DEBUG: Change fence magic number to be completely different from the freed magic number.

2013-09-09 23:21:46 +00:00

astobj2.c

astobj2: Correct REF_DEBUG false leak report

2014-10-07 21:30:07 +00:00

audiohook.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

autochan.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

autoservice.c

autoservice: stop thread on graceful shutdown

2014-06-09 03:47:11 +00:00

bridging.c

Fix build warnings with TEST_FRAMEWORK enabled

2014-06-19 19:34:37 +00:00

buildinfo.c

…

callerid.c

CallerID: Fix parsing regression

2014-10-10 12:55:56 +00:00

ccss.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

cdr.c

Check result of ast_var_assign() calls for memory allocation failure.

2013-08-06 08:19:42 +00:00

cel.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

channel_internal_api.c

Prevent exhaustion of system resources through exploitation of event cache

2013-01-02 18:09:55 +00:00

channel.c

Bridging: Fix bouncing native bridge

2014-09-12 18:18:44 +00:00

chanvars.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

cli.c

cli.c: Fix tab completion of "module load" when MALLOC_DEBUG is enabled.

2014-08-20 22:17:44 +00:00

config_options.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

config.c

config: bug: Fix SEGV in ast_category_insert when matching category isn't found

2014-09-18 14:42:26 +00:00

cygload.c

…

data.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

datastore.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

db.c

We have faced situation when using CDR and CEL by sqlite3 modules. With system having high load (~100 concurrent calls created by sipp) we found many cdr and cel records missed. There is special finction in sqlite3, that make able to fix this situation - sqlite3_wait_timeout, that also can replace awful code cdr_sqlite3 ad cel_sqlite3 modules. Also this function can be used for aastdb and res_config_sqlite3 to avoid missed writes to sqlite db.

2014-06-16 09:00:18 +00:00

devicestate.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

dial.c

Separate option_types[] from the struct definition.

2013-02-05 18:10:46 +00:00

dns.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

dnsmgr.c

Cleanup dnsmgr on exit.

2012-12-11 00:34:46 +00:00

dsp.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

ecdisa.h

…

enum.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

event.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

features.c

features.c: Allow appliationmap to use Gosub.

2014-07-25 23:13:48 +00:00

file.c

main/file: Move test event to emit PLAYBACK event more consistently

2014-08-14 20:56:40 +00:00

fixedjitterbuf.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

fixedjitterbuf.h

…

format_cap.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

format_pref.c

Address uninitialized conditional that valgrind found

2013-03-27 19:51:29 +00:00

format.c

format.c: Add reason comments for the format_list ordering.

2014-08-05 18:23:59 +00:00

frame.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

framehook.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

fskmodem_float.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

fskmodem_int.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

fskmodem.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

global_datastores.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

hashtab.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

heap.c

Fix incorrect usages of ast_realloc().

2013-09-10 17:56:56 +00:00

http.c

AST-2014-007: Fix of fix to allow AMI and SIP TCP to send messages.

2014-06-13 05:06:02 +00:00

image.c

Cleanup CLI commands on exit for several files.

2012-12-11 22:01:13 +00:00

indications.c

Fix incorrect usages of ast_realloc().

2013-09-10 17:56:56 +00:00

io.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

jitterbuf.c

jitterbuf: Fix memory leak on jitter buffer reset

2013-10-24 19:41:07 +00:00

libasteriskssl.c

Resolve memory leaks in TLS initialization and TLS client connections

2012-09-14 19:50:40 +00:00

libasteriskssl.exports.in

…

loader.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

lock.c

Fix DEBUG_THREADS when lock is acquired in __constructor__

2013-09-09 20:02:32 +00:00

logger.c

logger: Don't store verbose-magic in the log files.

2014-08-13 07:47:32 +00:00

Makefile

main/Makefile: Fix build failure on SmartOS/Illumos/SunOS

2014-04-17 20:06:11 +00:00

manager.c

Release AMI connections on shutdown.

2014-10-05 00:41:16 +00:00

md5.c

…

message.c

message: Don't close an AMI connection on SendMessage action error

2014-10-06 18:36:48 +00:00

named_acl.c

Fix various memory leaks

2013-08-30 19:16:20 +00:00

netsock2.c

Fix NULL pointer segfault in ast_sockaddr_parse()

2012-06-20 02:07:00 +00:00

netsock.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

pbx.c

pbx_lua: fix regression with global sym export and context clash by pbx_config.

2014-08-06 16:08:07 +00:00

plc.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

poll.c

…

presencestate.c

Fix crash in PresenceState AMI action when specifying an invalid provider

2013-02-15 23:23:49 +00:00

privacy.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

rtp_engine.c

res_rtp_asterisk: Add SHA-256 support for DTLS and perform DTLS negotiation on RTCP.

2014-06-30 19:42:18 +00:00

say.c

say: Fix a bug where SayNumber in Polish tries to play incorrect sound.

2014-03-26 22:44:11 +00:00

sched.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

security_events.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

sha1.c

…

sip_api.c

Don't make chan_sip export global symbols.

2012-10-11 15:31:10 +00:00

slinfactory.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

srv.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

strcompat.c

Add builtin roundf() for systems lacking it.

2013-01-19 20:49:43 +00:00

strings.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

stun.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

syslog.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

taskprocessor.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

tcptls.c

AST-2014-011: Fix POODLE security issues

2014-10-20 14:10:28 +00:00

tdd.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

term.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

test.c

Fix build warnings with TEST_FRAMEWORK enabled

2014-06-19 19:34:37 +00:00

threadstorage.c

Unregister CLI commands on exit

2013-08-20 15:27:16 +00:00

timing.c

Cleanup CLI commands on exit for several files.

2012-12-11 22:01:13 +00:00

translate.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00

udptl.c

udptl: Correct FEC to not consider negative sequence numbers as missing

2014-06-26 12:22:22 +00:00

ulaw.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

utils.c

CallerID: Fix parsing of malformed callerid

2014-08-27 15:01:33 +00:00

xml.c

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

xmldoc.c

Allow Asterisk to compile under GCC 4.10

2014-05-09 22:28:40 +00:00