Freeswitch sslv3 support - FreeSWITCH-users - FreeSWITCH Mailing Lists

newer
Allison Prompts

Freeswitch sslv3 support

older
Non-commercial nature of this...

Agustí Ubalde Bellot

13 Jun 2017 13 Jun '17

11:24 a.m.

Hi all, Is there a FreeSWITCH update where sslv3 support is disabled? Thanks, Agustí

Attachments:

attachment.html (text/html — 418 bytes)

Reply

Sign in to reply online Use email software

Show replies by date

Brian West

13 Jun 13 Jun

1:55 p.m.

You can already disable it via config. Our vanilla config already ships with only 'tlsv1,tlsv1.1,tlsv1.2' enabled. /b On Tue, Jun 13, 2017 at 6:24 AM, Agustí Ubalde Bellot <agubbe@gmail.com> wrote:

Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Thanks, Agustí

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com Book a phone call (CST) <https://freeswitch.com/appointment> Allison prompts for FreeSWITCH: *https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch> Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest

Reply

Sign in to reply online Use email software

Agustí Ubalde Bellot

15 Jun 15 Jun

8:07 a.m.

Hi Brian, Is possible to disable for web socket secure connections too? Thanks, Agustí 2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Thanks, Agustí

Reply

Sign in to reply online Use email software

Michael Jerris

19 Jun 19 Jun

4:43 p.m.

our websocket code should already be limited to either tls 1.1 and tls 1.2 or just tls 1.2 (i can’t remember which)… if this isn’t the case, please open a Jira for this. There should be no browsers that support web sockets that don’t support at least tls 1.1.

On Jun 15, 2017, at 4:07 AM, Agustí Ubalde Bellot <agubbe@gmail.com> wrote:

Hi Brian,

Is possible to disable for web socket secure connections too?

Thanks, Agustí

2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Thanks, Agustí

Reply

Sign in to reply online Use email software

Agustí Ubalde Bellot

20 Jun 20 Jun

8:45 a.m.

Hi Michael, I have performed several connection tests forcing the sslv3 protocol over secure web sockets and the connection is established. Instead, the same test connecting to the TLS listening port, the connection is not set. The protocol is successfully disabled in the configuration. The version of FreeSWITCH I'm testing is 1.5.14. Is there any way to prove that the sslv3 protocol is actually disabled in this release? Thanks, Agustí 2017-06-15 10:07 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

Hi Brian,

Is possible to disable for web socket secure connections too?

Thanks, Agustí

2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Thanks, Agustí

Reply

Sign in to reply online Use email software

Michael Jerris

3:41 p.m.

Wait… you are testing against some ancient dev version and not current release? Is that a typo? If not, this makes no sense at all, please explain.

On Jun 20, 2017, at 4:45 AM, Agustí Ubalde Bellot <agubbe@gmail.com> wrote:

Hi Michael,

I have performed several connection tests forcing the sslv3 protocol over secure web sockets and the connection is established. Instead, the same test connecting to the TLS listening port, the connection is not set. The protocol is successfully disabled in the configuration. The version of FreeSWITCH I'm testing is 1.5.14. Is there any way to prove that the sslv3 protocol is actually disabled in this release?

Thanks, Agustí

2017-06-15 10:07 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi Brian,

Is possible to disable for web socket secure connections too?

Thanks, Agustí

2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Thanks, Agustí

Reply

Sign in to reply online Use email software

Agustí Ubalde Bellot

3:55 p.m.

Hi Michael, Yes, the version I am using is a development version (1.5.14). In any case, I have performed the same tests in version 1.6 and have the same behavior. Instead, the verto module does block the sslv3 protocol. Thanks, Agustí 2017-06-20 10:45 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

Hi Michael,

I have performed several connection tests forcing the sslv3 protocol over secure web sockets and the connection is established. Instead, the same test connecting to the TLS listening port, the connection is not set. The protocol is successfully disabled in the configuration. The version of FreeSWITCH I'm testing is 1.5.14. Is there any way to prove that the sslv3 protocol is actually disabled in this release?

Thanks, Agustí

2017-06-15 10:07 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi Brian,

Is possible to disable for web socket secure connections too?

Thanks, Agustí

2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Thanks, Agustí

Reply

Sign in to reply online Use email software

Michael Jerris

4:29 p.m.

I just reviewed the code. Looks like we disable it all on verto, but not on sofia. should get me a Jira on this (I was just told one just got made)… we should fix that. That being said, the sofia web socket support was basically a demo to prove we could do it before we finished verto, there is little reason to use sip over websockets and I never recommend it. Also, using years old development code should be considered a massive security vulnerability and I would STRONGLY recommend against it.

On Jun 20, 2017, at 11:55 AM, Agustí Ubalde Bellot <agubbe@gmail.com> wrote:

Hi Michael,

Yes, the version I am using is a development version (1.5.14). In any case, I have performed the same tests in version 1.6 and have the same behavior. Instead, the verto module does block the sslv3 protocol.

Thanks, Agustí

2017-06-20 10:45 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi Michael,

I have performed several connection tests forcing the sslv3 protocol over secure web sockets and the connection is established. Instead, the same test connecting to the TLS listening port, the connection is not set. The protocol is successfully disabled in the configuration. The version of FreeSWITCH I'm testing is 1.5.14. Is there any way to prove that the sslv3 protocol is actually disabled in this release?

Thanks, Agustí

2017-06-15 10:07 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi Brian,

Is possible to disable for web socket secure connections too?

Thanks, Agustí

2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Reply

Sign in to reply online Use email software

Agustí Ubalde Bellot

21 Jun 21 Jun

7:30 a.m.

Hi Michael, I've created this ISSUE: https://freeswitch.org/jira/browse/FS-10406. Regards, Agustí 2017-06-20 17:55 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

Hi Michael,

Yes, the version I am using is a development version (1.5.14). In any case, I have performed the same tests in version 1.6 and have the same behavior. Instead, the verto module does block the sslv3 protocol.

Thanks, Agustí

2017-06-20 10:45 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi Michael,

I have performed several connection tests forcing the sslv3 protocol over secure web sockets and the connection is established. Instead, the same test connecting to the TLS listening port, the connection is not set. The protocol is successfully disabled in the configuration. The version of FreeSWITCH I'm testing is 1.5.14. Is there any way to prove that the sslv3 protocol is actually disabled in this release?

Thanks, Agustí

2017-06-15 10:07 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi Brian,

Is possible to disable for web socket secure connections too?

Thanks, Agustí

2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Thanks, Agustí

Reply

Sign in to reply online Use email software

Agustí Ubalde Bellot

4:28 p.m.

Hi Michael, The issue has been closed without any patch attached. Will any solution be implemented? Thaks, Agustí 2017-06-21 9:30 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

Hi Michael,

I've created this ISSUE: https://freeswitch.org/jira/browse/FS-10406.

Regards, Agustí

2017-06-20 17:55 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi Michael,

Yes, the version I am using is a development version (1.5.14). In any case, I have performed the same tests in version 1.6 and have the same behavior. Instead, the verto module does block the sslv3 protocol.

Thanks, Agustí

2017-06-20 10:45 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi Michael,

I have performed several connection tests forcing the sslv3 protocol over secure web sockets and the connection is established. Instead, the same test connecting to the TLS listening port, the connection is not set. The protocol is successfully disabled in the configuration. The version of FreeSWITCH I'm testing is 1.5.14. Is there any way to prove that the sslv3 protocol is actually disabled in this release?

Thanks, Agustí

2017-06-15 10:07 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi Brian,

Is possible to disable for web socket secure connections too?

Thanks, Agustí

2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com>:

...
Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Thanks, Agustí

Reply

Sign in to reply online Use email software

Michael Jerris

4:35 p.m.

Brian pushed fix to tree this morning commit dcc0bf72ec77042acf38172af262a4a2f35c1f48 Author: Brian West <brian@freeswitch.org> Date: Wed Jun 21 08:51:50 2017 -0500 FS-10406: [mod_sofia] mod_sofia secure websocket connections SSLv3 and tls v1.0 is still not disabled #resolve

On Jun 21, 2017, at 12:28 PM, Agustí Ubalde Bellot <agubbe@gmail.com> wrote:

Hi Michael,

The issue has been closed without any patch attached. Will any solution be implemented?

2017-06-21 9:30 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi Michael,

I've created this ISSUE: https://freeswitch.org/jira/browse/FS-10406 <https://freeswitch.org/jira/browse/FS-10406>.

2017-06-20 17:55 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi Michael,

Yes, the version I am using is a development version (1.5.14). In any case, I have performed the same tests in version 1.6 and have the same behavior. Instead, the verto module does block the sslv3 protocol.

2017-06-20 10:45 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi Michael,

I have performed several connection tests forcing the sslv3 protocol over secure web sockets and the connection is established. Instead, the same test connecting to the TLS listening port, the connection is not set. The protocol is successfully disabled in the configuration. The version of FreeSWITCH I'm testing is 1.5.14. Is there any way to prove that the sslv3 protocol is actually disabled in this release?

2017-06-15 10:07 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi Brian,

Is possible to disable for web socket secure connections too?

2017-06-13 13:24 GMT+02:00 Agustí Ubalde Bellot <agubbe@gmail.com <mailto:agubbe@gmail.com>>: Hi all,

Is there a FreeSWITCH update where sslv3 support is disabled?

Reply

Sign in to reply online Use email software

3423

Age (days ago)

3431

Last active (days ago)

Download

10 comments

3 participants

tags

participants (3)

Agustí Ubalde Bellot
Brian West
Michael Jerris