<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">The general recommendation from TLS security experts is to never ever use TLS compression.<div><br></div><div>/O</div><div><br><div><div>On 06 May 2014, at 16:38, Daniel-Constantin Mierla <<a href="mailto:miconda@gmail.com">miconda@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="#FFFFFF" text="#000000" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Hello,<br><br>what libssl version do you have? Some of them have bugs related to compression and the feature is disabled if such case is discovered.<br><br>You can set debug=3 and send over the log messages from startup.<br><br>Cheers,<br>Daniel<br><br><br><div class="moz-cite-prefix">On 06/05/14 11:36, 刘日新 wrote:<br></div><blockquote cite="mid:000f01cf690e$b1b32500$15196f00$@linxun.com" type="cite"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-family: 宋体; color: rgb(31, 73, 125);">Hi, all.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">I has configure kamailio.cfg as below:<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">#!ifdef WITH_TLS<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">modparam("tls", "session_id", "vic22")<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">modparam("tls", "session_cache",1)<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">modparam("tls", "tls_disable_compression",0)<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">modparam("tls", "config", "/usr/cfg/tls.cfg")<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">#!endif<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">I was sure that this configure segment was included , in case that I set a wrong path to<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">modparam("tls", "config", "/wrong paths/tls.cfg")<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">the kamailio can`t boost and raised error.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">But, when I debug this configure with gdb, I found that, within method : init_tls_compression(),<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Line 384 of tls_init.c<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">384 } else if (cfg_get(tls, tls_cfg, disable_compression)){<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">385 LOG(L_INFO, "tls: init_tls: disabling compression...\n");<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">386 sk_SSL_COMP_zero(comp_methods);<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">The param value from cfg was always 1, namely:<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt 18pt; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -18pt;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Wingdings; color: rgb(31, 73, 125);"><span>Ø<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';"> <span class="Apple-converted-space"> </span></span></span></span><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">print ((struct cfg_group_tls *)tls_cfg)->disable_compression<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">1<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Why that? Are there something wrong?<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">B.R.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Rixin liu<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span lang="EN-GB" style="font-size: 10.5pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div></div><br><fieldset class="mimeAttachmentHeader"></fieldset><br><pre wrap="">_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sr-users@lists.sip-router.org" style="color: rgb(149, 79, 114); text-decoration: underline;">sr-users@lists.sip-router.org</a>
<a class="moz-txt-link-freetext" href="http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users" style="color: rgb(149, 79, 114); text-decoration: underline;">http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users</a>
</pre></blockquote><br><pre class="moz-signature" cols="72">--
Daniel-Constantin Mierla - <a class="moz-txt-link-freetext" href="http://www.asipto.com/" style="color: rgb(149, 79, 114); text-decoration: underline;">http://www.asipto.com</a>
<a class="moz-txt-link-freetext" href="http://twitter.com/#!/miconda" style="color: rgb(149, 79, 114); text-decoration: underline;">http://twitter.com/#!/miconda</a> - <a class="moz-txt-link-freetext" href="http://www.linkedin.com/in/miconda" style="color: rgb(149, 79, 114); text-decoration: underline;">http://www.linkedin.com/in/miconda</a></pre>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br><a href="mailto:sr-users@lists.sip-router.org" style="color: rgb(149, 79, 114); text-decoration: underline;">sr-users@lists.sip-router.org</a><br><a href="http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users" style="color: rgb(149, 79, 114); text-decoration: underline;">http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users</a><br></div></blockquote></div><br></div></body></html>