<div dir="ltr"><div><div>Well done guys.<br>This, to me, seems like a no brainer. If we want to use webRTC and if we care about security at all - which nowadays has become pretty important to more and more people - then we should definitely update to the latest openssl. Having FS limited to TLS 1.0 with all its inherent security weaknesses always seemed dodgy to me.<br>
</div>I for one welcome the security upgrade, even if it makes life a little harder while we all transition.<br><br></div>Just my 2 cents.<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Jan 30, 2014 at 6:19 PM, Anthony Minessale <span dir="ltr"><<a href="mailto:anthony.minessale@gmail.com" target="_blank">anthony.minessale@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Its a question of bundling the ones get get a benefit from bundling. We never bundled openssl, the problem was that we need certain features from a modern version of openssl and the older versions were not really working correctly even when they compiled properly.<div>
<br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Jan 30, 2014 at 12:06 PM, François <span dir="ltr"><<a href="mailto:fdelawarde@wirelessmundi.com" target="_blank">fdelawarde@wirelessmundi.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Mike,<br>
<br>
What happened with the arguments in:<br>
<a href="http://www.freeswitch.org/node/472" target="_blank">http://www.freeswitch.org/node/472</a><br>
<br>
I'm quite confused, you guys just convinced me of the benefits of<br>
bundling libs, and now I have to go back and say to everyone how system<br>
libs are better for FS?<br>
<br>
No way! :-)<br>
<br>
Regards,<br>
<span><font color="#888888">--<br>
François<br>
</font></span><div><div><br>
<br>
On Thu, 2014-01-30 at 10:07 -0500, Michael Jerris wrote:<br>
> The upside is the control, the downside is that it requires us to<br>
> maintain them for security issues and such. We are leaning towards<br>
> moving to system libs where its practical.<br>
><br>
> On Jan 30, 2014, at 4:07 AM, François <<a href="mailto:fdelawarde@wirelessmundi.com" target="_blank">fdelawarde@wirelessmundi.com</a>><br>
> wrote:<br>
><br>
> > Hi Anthony,<br>
> ><br>
> > Thanks for the tip, sounds like the best option!<br>
> ><br>
> > BTW, why isn't OpenSSL just bundled into FreeSWITCH source like many<br>
> > other libraries? Wouldn't it prevent all these issues and give you<br>
> guys<br>
> > more control to change versions or patch at will?<br>
> ><br>
> > Thanks,<br>
> > François.<br>
> ><br>
> ><br>
> > On Wed, 2014-01-29 at 16:19 -0600, Anthony Minessale wrote:<br>
> >> Here is a recipe for cent5 and probably other linux if someone<br>
> would<br>
> >> be so kind as to clean it up and document and maybe make into a<br>
> shell<br>
> >> script.<br>
> >><br>
> >><br>
> >> wget <a href="http://www.openssl.org/source/openssl-1.0.1f.tar.gz" target="_blank">http://www.openssl.org/source/openssl-1.0.1f.tar.gz</a><br>
> >> tar -zxvf openssl-1.0.1f.tar.gz<br>
> >> cd openssl-1.0.1f<br>
> >> ./config --prefix=/usr/openssl101f -fPIC<br>
> >><br>
> >> make<br>
> >> make install<br>
> >><br>
> >><br>
> >> then go over to FS build root (even on existing build that had<br>
> picked<br>
> >> up the dependency by a git pull)<br>
> >><br>
> >><br>
> >> ./configure CFLAGS="-I/usr/openssl101f/include"<br>
> >> LDFLAGS="-L/usr/openssl101f/lib"<br>
> >><br>
> >><br>
> >><br>
> >> Then build as normal<br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >> /usr/openssl101f can really be anywhere and its a static linking so<br>
> >> you don't need to distribute it.<br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >> On Wed, Jan 29, 2014 at 3:54 PM, Michael Jerris <<a href="mailto:mike@jerris.com" target="_blank">mike@jerris.com</a>><br>
> >> wrote:<br>
> >> Fair enough, I'm not actually a huge fan of homebrew either,<br>
> >> but one thing it does quite nicely is to install conflicting<br>
> >> libraries into a location that will not conflict with system<br>
> >> libraries for things that may conflict, specifically:<br>
> >><br>
> >> /usr/local/opt/openssl/<br>
> >><br>
> >> if you want to build your own, without having to change your<br>
> >> freeswitch build procedures, make sure the libs end up<br>
> >> in /usr/local/opt/openssl/lib and the headers get<br>
> >> into /usr/local/opt/openssl/include.<br>
> >><br>
> >> Alternatively, you can pick whatever directory you like to<br>
> >> build into, i would suggest something not part of the typical<br>
> >> lib chain, and specify to configure such as:<br>
> >><br>
> >> ./configure LDFLAGS=-L/usr/local/opt/openssl/lib<br>
> >> CFLAGS=-I/usr/local/opt/openssl/include<br>
> >><br>
> >> Mike<br>
> >><br>
> >> On Jan 29, 2014, at 4:41 PM, Michael Jerris <<a href="mailto:mike@jerris.com" target="_blank">mike@jerris.com</a>><br>
> >> wrote:<br>
> >><br>
> >>> We do not look at the version number, we look at support for<br>
> >> features that were added after 1.0.1c was released. I'm not<br>
> >> positive if they are in 1.0.1d or not, but for pretty much<br>
> >> everyone I would recommend you be on at least 1.0.1f or<br>
> >> equivalent security patches. The 1.0.1e latest package in<br>
> >> wheezy I think is effectively the same as 1.0.1f as 1.0.1f was<br>
> >> just 1.0.1e plus some security patches i know they pulled in.<br>
> >>><br>
> >>><br>
> >>> On Jan 29, 2014, at 3:21 PM, Tamas Jalsovszky<br>
> >> <<a href="mailto:jalsot@gmail.com" target="_blank">jalsot@gmail.com</a>> wrote:<br>
> >>><br>
> >>>> Hello,<br>
> >>>><br>
> >>>> As far as I know, on Ubuntu 12.04 the latest openssl<br>
> >> package is: 1.0.1-4ubuntu5.11<br>
> >>>> As you can see, there is no 'e' letter, however as we have<br>
> >> checked, ubuntu backported changes from 1.0.1 (incliding e<br>
> >> afaik) to this package. We have successful tests with webrtc<br>
> >> on 12.04.<br>
> >>>> Would it be possible to not hardcode that way 1.0.1e?<br>
> >>>><br>
> >>>> T.<br>
> >><br>
> >><br>
> >><br>
> _________________________________________________________________________<br>
> >> Professional FreeSWITCH Consulting Services:<br>
> >> <a href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a><br>
> >> <a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
> >><br>
> >> FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
> >> <a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
> >><br>
> >> Official FreeSWITCH Sites<br>
> >> <a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
> >> <a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
> >> <a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
> >><br>
> >> FreeSWITCH-users mailing list<br>
> >> <a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
> >> <a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
> >><br>
> UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
> >> <a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >> --<br>
> >> Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬<br>
> >><br>
> >> ☞ <a href="http://freeswitch.org/" target="_blank">http://freeswitch.org/</a> ☞ <a href="http://cluecon.com/" target="_blank">http://cluecon.com/</a> ☞<br>
> >> <a href="http://twitter.com/FreeSWITCH" target="_blank">http://twitter.com/FreeSWITCH</a><br>
> >> ☞ <a href="http://irc.freenode.net" target="_blank">irc.freenode.net</a> #freeswitch ☞ <a href="http://freeswitch.org/g+" target="_blank">http://freeswitch.org/g+</a><br>
> >><br>
> >><br>
> >> ClueCon Weekly Development Call<br>
> >><br>
> >> ☎ <a href="mailto:sip%3A888@conference.freeswitch.org" target="_blank">sip:888@conference.freeswitch.org</a> ☎ <a href="tel:%2B19193869900" value="+19193869900" target="_blank">+19193869900</a><br>
> >><br>
> >><br>
> >><br>
> _________________________________________________________________________<br>
> >> Professional FreeSWITCH Consulting Services:<br>
> >> <a href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a><br>
> >> <a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
> >><br>
> >> FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
> >> <a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
> >><br>
> >> Official FreeSWITCH Sites<br>
> >> <a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
> >> <a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
> >> <a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
> >><br>
> >> FreeSWITCH-users mailing list<br>
> >> <a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
> >> <a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
> >><br>
> UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
> >> <a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
> ><br>
> ><br>
> ><br>
> _________________________________________________________________________<br>
> > Professional FreeSWITCH Consulting Services:<br>
> > <a href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a><br>
> > <a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
> ><br>
> > FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
> > <a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
> ><br>
> > Official FreeSWITCH Sites<br>
> > <a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
> > <a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
> > <a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
> ><br>
> > FreeSWITCH-users mailing list<br>
> > <a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
> > <a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
> ><br>
> UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
> > <a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
><br>
><br>
> _________________________________________________________________________<br>
> Professional FreeSWITCH Consulting Services:<br>
> <a href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a><br>
> <a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
><br>
> FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
> <a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
><br>
> Official FreeSWITCH Sites<br>
> <a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
> <a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
> <a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
><br>
> FreeSWITCH-users mailing list<br>
> <a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
> <a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
> UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
> <a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<br>
<br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
<a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬<div><br><div>☞ <a href="http://freeswitch.org/" target="_blank">http://freeswitch.org/</a> ☞ <a href="http://cluecon.com/" target="_blank">http://cluecon.com/</a> ☞ <a href="http://twitter.com/FreeSWITCH" target="_blank">http://twitter.com/FreeSWITCH</a></div>
<div><div>☞ <a href="http://irc.freenode.net" target="_blank">irc.freenode.net</a> #freeswitch ☞ <u><a href="http://freeswitch.org/g+" target="_blank">http://freeswitch.org/g+</a></u><br><br></div><div>ClueCon Weekly Development Call <br>
</div><div>☎ <a href="mailto:sip%3A888@conference.freeswitch.org" target="_blank">sip:888@conference.freeswitch.org</a> ☎ <a href="tel:%2B19193869900" value="+19193869900" target="_blank">+19193869900</a> </div><div><br>
</div></div></div></div>
</div>
</div></div><br>_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
<a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<br></blockquote></div><br></div>