| 01:32.28 | *** join/#asterisk-dev Sjors (~sgielen@foo.kassala.de) |
| 03:07.42 | *** join/#asterisk-dev mjordan (~mjordan@nat/digium/x-pmbiyjtvqlnzhbou) |
| 03:07.42 | *** mode/#asterisk-dev [+o mjordan] by ChanServ |
| 04:03.07 | *** join/#asterisk-dev Sjors (~sgielen@foo.kassala.de) |
| 04:28.24 | *** join/#asterisk-dev mjordan (~mjordan@75.76.55.191) |
| 04:28.24 | *** mode/#asterisk-dev [+o mjordan] by ChanServ |
| 04:36.00 | *** join/#asterisk-dev tuxd00d (~tuxd00d@ip70-162-151-19.ph.ph.cox.net) |
| 05:31.30 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 05:49.22 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 05:54.07 | *** join/#asterisk-dev Sjors (~sgielen@foo.kassala.de) |
| 06:23.12 | *** join/#asterisk-dev coreyfarrell (~coreyfarr@24-177-3-44.dhcp.nwtn.ct.charter.com) |
| 08:30.55 | *** join/#asterisk-dev fornax (~fornax@85.183.43.221) |
| 08:55.10 | *** join/#asterisk-dev Sjors (~sgielen@foo.kassala.de) |
| 09:11.45 | *** join/#asterisk-dev fornax (~fornax@85.183.43.221) |
| 09:46.15 | *** join/#asterisk-dev fornax (~fornax@85.183.43.221) |
| 10:05.14 | *** join/#asterisk-dev fornax (~fornax@85.183.43.221) |
| 10:46.10 | *** join/#asterisk-dev fornax (~fornax@85.183.43.221) |
| 11:26.29 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 11:43.31 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 11:52.04 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 13:34.09 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 14:11.22 | *** join/#asterisk-dev tzafrir (~tzafrir@81.218.177.19) |
| 14:11.22 | *** mode/#asterisk-dev [+o tzafrir] by ChanServ |
| 14:43.23 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 15:10.22 | *** join/#asterisk-dev [TK]D-Fender (~chatzilla@64.235.216.2) |
| 15:43.19 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 15:43.34 | *** join/#asterisk-dev gtjoseph (~gtj0@unaffiliated/gtj) |
| 15:58.21 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 16:32.59 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 16:40.38 | *** join/#asterisk-dev fornax (~fornax@85.183.43.221) |
| 16:45.05 | *** join/#asterisk-dev drmessano (~nonya@pdpc/supporter/active/drmessano) |
| 17:38.13 | *** join/#asterisk-dev tm1000 (tm1000@2600:3c00::f03c:91ff:fe6e:6894) |
| 18:39.58 | *** join/#asterisk-dev mjordan (~mjordan@75.76.55.191) |
| 18:39.58 | *** mode/#asterisk-dev [+o mjordan] by ChanServ |
| 19:10.22 | *** join/#asterisk-dev mjordan (~mjordan@nat/digium/x-byfvslbqcqzohytv) |
| 19:10.22 | *** mode/#asterisk-dev [+o mjordan] by ChanServ |
| 19:31.16 | mjordan | Poodle. |
| 19:31.19 | mjordan | :-( |
| 19:34.27 | file | Beagle. |
| 19:38.43 | mjordan | file: so. |
| 19:39.04 | mjordan | since it's already public, ASTERISK-24425 |
| 19:39.27 | mjordan | I think we'll have to push out a fix tomorrow. The question is, do we prevent the usage of SSLv3 in tcptls as well? |
| 19:39.39 | mjordan | particularly since TLS allows for fallback to SSLv3 |
| 19:40.44 | *** join/#asterisk-dev TazzNZ (~TazzNZ@office-nat1.ytechops.co.nz) |
| 19:40.44 | file | yes? |
| 19:41.02 | mjordan | basically, if someone doesn't specify tlsv1 in Asterisk's normal TLS parameters, then it allows for fallback. blech. |
| 19:51.19 | mjordan | PJSIP defaults to TLSv1, so that's nice. |
| 20:44.39 | *** join/#asterisk-dev tzafrir (~tzafrir@bzq-218-28-58.cablep.bezeqint.net) |
| 20:44.40 | *** mode/#asterisk-dev [+o tzafrir] by ChanServ |
| 20:44.51 | mjordan | (in fact, we even have October as the tentative month) |
| 20:45.10 | mjordan | (and every LTS (since we've had the alternating LTS/Standard release cycle) has been in October) |
| 20:45.16 | mjordan | (at AstriCon) |
| 20:45.30 | mjordan | (I'm not sure why I'm using parantheticals) |
| 20:46.40 | file | (hey!) |
| 20:54.31 | mjordan | hm. |
| 20:54.37 | mjordan | I typed all of that in the wrong IRC |
| 20:54.40 | mjordan | whoops. |
| 20:54.42 | file | yes |
| 20:54.47 | mjordan | it's been a long weekend. |
| 20:54.51 | file | I was waiting to see how long it would take you to catch that. |
| 20:54.58 | file | a long weekend before a long week? |
| 20:55.14 | mjordan | pretty much |
| 21:19.55 | gtjoseph | mjordan: is manager/https also vulnerable to POODLE? |
| 21:25.11 | gtjoseph | nm...tls only |
| 21:32.58 | mjordan | Yup, if using TLS. |
| 21:34.56 | gtjoseph | other way, right? |
| 22:30.39 | gtjoseph | mjordan: So with or without the patch I don't see a way to restrict the server side stuff from using SSLv3. Am I missing something? |
| 22:35.58 | mjordan | res_xmpp/res_jabber are clients only. If the server uses SSLv3, they will no longer connect to it. |
| 22:36.49 | gtjoseph | i get that but i'm looking at manager and http servers. |
| 22:37.25 | mjordan | they call ast_ssl_setup prior to calling ast_tcptls_server_start |
| 22:37.58 | mjordan | that uses the manager.conf/http.conf settings, which are parsed previously via ast_tls_read_conf |
| 22:38.21 | gtjoseph | yep i get that too. but there's no setting for selecting method |
| 22:38.29 | mjordan | what do you mean? |
| 22:38.35 | gtjoseph | i.e. there's no sslservermethod |
| 22:38.42 | gtjoseph | like sslclientmethod |
| 22:39.40 | gtjoseph | effectively, the patch turns SSL off altogether for manager and http. |
| 22:39.42 | mjordan | I'll admit I'm not an expert on OpenSSL, but my understanding is that you always end up in handle_tcptls_connection, which uses SSL_new and the provided SSL context |
| 22:39.51 | mjordan | how does it turn it off? |
| 22:39.55 | mjordan | I'm not following the conclusion |
| 22:40.06 | gtjoseph | there's no config mechanism to turn SSL on now |
| 22:40.44 | mjordan | if you specify "sslv2" or "sslv3", it will use that method |
| 22:40.50 | gtjoseph | nope |
| 22:40.54 | gtjoseph | i tried |
| 22:40.55 | mjordan | why do you think that? |
| 22:41.03 | mjordan | you didn't get the WARNING? |
| 22:41.11 | gtjoseph | nope |
| 22:41.15 | gtjoseph | this is on 12 |
| 22:41.24 | gtjoseph | let me explain... |
| 22:41.27 | mjordan | ah |
| 22:41.29 | mjordan | nevermind |
| 22:41.33 | mjordan | I followed it through. |
| 22:41.35 | mjordan | You are right. |
| 22:41.37 | gtjoseph | gotcha |
| 22:42.05 | mjordan | sorry, had to go back and look again at the methods used in __ssl_setup |
| 22:42.31 | mjordan | I'd rather note that in the UPGRADE. Firefox/chrome are planning on removing SSL2/SSL3, and I'm not sure why we'd want to support that as a server. |
| 22:42.44 | gtjoseph | yeah, i'm not complaining |
| 22:42.53 | gtjoseph | i just wanted to make sure i wasn't missing something |
| 22:43.06 | gtjoseph | and that you knew the side effect |
| 22:43.14 | mjordan | no, you're right. I'll add a note for that in the UPGRADE. Thanks! |
| 22:43.22 | gtjoseph | no problem |