[asterisk-bugs] [JIRA] (ASTERISK-28933) res_pjsip.so fails to load when bundled pjproject is compiled without libssl

Walter Doekes (JIRA) noreply at issues.asterisk.org
Thu Jun 4 10:20:25 CDT 2020


Walter Doekes created ASTERISK-28933:
----------------------------------------

             Summary: res_pjsip.so fails to load when bundled pjproject is compiled without libssl
                 Key: ASTERISK-28933
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-28933
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Resources/res_pjsip
    Affects Versions: 13.33.0
            Reporter: Walter Doekes


Hi!

This is really a theoretical issue. I wasn't planning on running a machine without libssl. But because this machine was so clean, I happened to notice this:

If you compile libasteriskpj.so without libssl-dev, you get fewer symbols:
{noformat}
$ diff <(nm -D pj-13-with-ssl.so | awk '/ T /{print $3}') <(nm -D pj-13-without-ssl.so | awk '/ T /{print $3}') | awk '/^</{print $2}'
pjsip_tls_setting_wipe_keys
pjsip_tls_transport_lis_start
pjsip_tls_transport_restart
pjsip_tls_transport_start
pjsip_tls_transport_start2
pj_ssl_cert_info_dump
pj_ssl_cert_load_from_buffer
pj_ssl_cert_load_from_files
pj_ssl_cert_load_from_files2
pj_ssl_cert_wipe_keys
pj_ssl_cipher_get_availables
pj_ssl_cipher_id
pj_ssl_cipher_is_supported
pj_ssl_cipher_name
pj_ssl_curve_get_availables
pj_ssl_curve_id
pj_ssl_curve_is_supported
pj_ssl_curve_name
pj_ssl_sock_close
pj_ssl_sock_create
pj_ssl_sock_get_info
pj_ssl_sock_get_user_data
pj_ssl_sock_renegotiate
pj_ssl_sock_send
pj_ssl_sock_sendto
pj_ssl_sock_set_certificate
pj_ssl_sock_set_user_data
pj_ssl_sock_start_accept
pj_ssl_sock_start_accept2
pj_ssl_sock_start_connect
pj_ssl_sock_start_connect2
pj_ssl_sock_start_read
pj_ssl_sock_start_read2
pj_ssl_sock_start_recvfrom
pj_ssl_sock_start_recvfrom2
pj_turn_sock_tls_cfg_default
pj_turn_sock_tls_cfg_dup
pj_turn_sock_tls_cfg_wipe_keys
{noformat}
These are only built when:
{noformat}
#if defined(PJ_HAS_SSL_SOCK) && PJ_HAS_SSL_SOCK!=0                              
{noformat}
And that is not the case when there is no libssl-dev nor libgnutls-dev.

The relevant functions are (only) called here:
{noformat}
$ wgrep asterisk-rw-13.git/ -E '^pjsip_tls_setting_wipe_keys|pjsip_tls_transport_lis_start|pjsip_tls_transport_restart|pjsip_tls_transport_start|pjsip_tls_transport_start2|pj_ssl_cert_info_dump|pj_ssl_cert_load_from_buffer|pj_ssl_cert_load_from_files|pj_ssl_cert_load_from_files2|pj_ssl_cert_wipe_keys|pj_ssl_cipher_get_availables|pj_ssl_cipher_id|pj_ssl_cipher_is_supported|pj_ssl_cipher_name|pj_ssl_curve_get_availables|pj_ssl_curve_id|pj_ssl_curve_is_supported|pj_ssl_curve_name|pj_ssl_sock_close|pj_ssl_sock_create|pj_ssl_sock_get_info|pj_ssl_sock_get_user_data|pj_ssl_sock_renegotiate|pj_ssl_sock_send|pj_ssl_sock_sendto|pj_ssl_sock_set_certificate|pj_ssl_sock_set_user_data|pj_ssl_sock_start_accept|pj_ssl_sock_start_accept2|pj_ssl_sock_start_connect|pj_ssl_sock_start_connect2|pj_ssl_sock_start_read|pj_ssl_sock_start_read2|pj_ssl_sock_start_recvfrom|pj_ssl_sock_start_recvfrom2|pj_turn_sock_tls_cfg_default|pj_turn_sock_tls_cfg_dup|pj_turn_sock_tls_cfg_wipe_keys$' | grep -vF /third-party/

asterisk-rw-13.git/res/res_pjsip/config_transport.c:			res = pjsip_tls_transport_start2(ast_sip_get_pjsip_endpoint(), &temp_state->state->tls,
asterisk-rw-13.git/res/res_pjsip/config_transport.c:	if (pj_ssl_cipher_get_availables(ciphers, &cipher_num)) {
asterisk-rw-13.git/res/res_pjsip/config_transport.c:		const char *pos_name = pj_ssl_cipher_name(ciphers[pos]);
asterisk-rw-13.git/res/res_pjsip/config_transport.c:	if (pj_ssl_cipher_is_supported(cipher)) {
asterisk-rw-13.git/res/res_pjsip/config_transport.c:		ast_str_append(&str, 0, "%s", pj_ssl_cipher_name(ciphers[idx]));
asterisk-rw-13.git/res/res_pjsip/config_transport.c:	if (pj_ssl_cipher_get_availables(ciphers, &cipher_num) || !cipher_num) {
{noformat}
That is, only {{res/res_pjsip/config_transport.c}} and only:
{noformat}
pjsip_tls_transport_start2
pj_ssl_cipher_get_availables
pj_ssl_cipher_name
pj_ssl_cipher_is_supported
{noformat}
And could be fixed with something like:
{noformat}
diff --git a/res/res_pjsip/config_transport.c b/res/res_pjsip/config_transport.c
index d2993401fc..6596a87643 100644
--- a/res/res_pjsip/config_transport.c
+++ b/res/res_pjsip/config_transport.c
@@ -618,6 +618,7 @@ static int transport_apply(const struct ast_sorcery *sorcery, void *obj)
 			res = pjsip_tcp_transport_start3(ast_sip_get_pjsip_endpoint(), &cfg,
 				&temp_state->state->factory);
 		}
+#ifdef HAVE_OPENSSL
 	} else if (transport->type == AST_TRANSPORT_TLS) {
 		static int option = 1;
 
@@ -648,6 +649,7 @@ static int transport_apply(const struct ast_sorcery *sorcery, void *obj)
 				&temp_state->state->host, NULL, transport->async_operations,
 				&temp_state->state->factory);
 		}
+#endif
 	} else if ((transport->type == AST_TRANSPORT_WS) || (transport->type == AST_TRANSPORT_WSS)) {
 		if (transport->cos || transport->tos) {
 			ast_log(LOG_WARNING, "TOS and COS values ignored for websocket transport\n");
@@ -977,6 +979,7 @@ static int tls_method_to_str(const void *obj, const intptr_t *args, char **buf)
 	return 0;
 }
 
+#ifdef HAVE_OPENSSL
 /*! \brief Helper function which turns a cipher name into an identifier */
 static pj_ssl_cipher cipher_name_to_id(const char *name)
 {
@@ -997,6 +1000,7 @@ static pj_ssl_cipher cipher_name_to_id(const char *name)
 
 	return 0;
 }
+#endif
 
 /*!
  * \internal
@@ -1010,6 +1014,7 @@ static pj_ssl_cipher cipher_name_to_id(const char *name)
  */
 static int transport_cipher_add(struct ast_sip_transport_state *state, const char *name)
 {
+#ifdef HAVE_OPENSSL
 	pj_ssl_cipher cipher;
 	int idx;
 
@@ -1033,10 +1038,10 @@ static int transport_cipher_add(struct ast_sip_transport_state *state, const cha
 		}
 		state->ciphers[state->tls.ciphers_num++] = cipher;
 		return 0;
-	} else {
+	}
+#endif
 		ast_log(LOG_ERROR, "Cipher '%s' is unsupported\n", name);
 		return -1;
-	}
 }
 
 /*! \brief Custom handler for TLS cipher setting */
@@ -1079,7 +1084,13 @@ static void cipher_to_str(char **buf, const pj_ssl_cipher *ciphers, unsigned int
 	}
 
 	for (idx = 0; idx < cipher_num; ++idx) {
-		ast_str_append(&str, 0, "%s", pj_ssl_cipher_name(ciphers[idx]));
+		ast_str_append(&str, 0, "%s",
+#ifdef HAVE_OPENSSL
+                pj_ssl_cipher_name(ciphers[idx])
+#else
+                "<OPENSSL_MISSING>"
+#endif
+                );
 		if (idx < cipher_num - 1) {
 			ast_str_append(&str, 0, ", ");
 		}
@@ -1118,7 +1129,11 @@ static char *handle_pjsip_list_ciphers(struct ast_cli_entry *e, int cmd, struct
 		return NULL;
 	}
 
-	if (pj_ssl_cipher_get_availables(ciphers, &cipher_num) || !cipher_num) {
+	if (
+#ifdef HAVE_OPENSSL
+            pj_ssl_cipher_get_availables(ciphers, &cipher_num) ||
+#endif
+            !cipher_num) {
 		buf = NULL;
 	} else {
 		cipher_to_str(&buf, ciphers, cipher_num);
{noformat}
(Although that would break the possibility for someone to use gnutls; if that works, which I'm not sure does.)

In any case, without the above patch, res_pjsip.so fails to load because of the missing symbols.

So either we should mandate libssl-dev (or libgnutls-dev?) or apply something like above.



--
This message was sent by Atlassian JIRA
(v6.2#6252)



More information about the asterisk-bugs mailing list