Matthew Jordan [Thu, 15 Mar 2012 18:20:49 +0000 (18:20 +0000)]
Fix remotely exploitable stack overrun in Milliwatt
Milliwatt is vulnerable to a remotely exploitable stack overrun when using
the 'o' option. This occurs due to the milliwatt_generate function not
accounting for AST_FRIENDLY_OFFSET when calculating the maximum number of
samples it can put in the output buffer.
This patch resolves this issue by taking into account AST_FRIENDLY_OFFSET
when determining the maximum number of samples allowed. Note that at no
point is remote code execution possible. The data that is written into the
buffer is the pre-defined Milliwatt data, and not custom data.
(issue ASTERISK-19541)
Reported by: Russell Bryant
Tested by: Matt Jordan
Patches:
milliwatt_stack_overrun.rev1.txt by Russell Bryant (license 6283)
Note that this patch was written by Russell, even though Matt uploaded it
Leif Madsen [Thu, 8 Dec 2011 20:54:35 +0000 (20:54 +0000)]
Update svn:externals to use menuselect from 1.4.42 and not later.
This change is required because when making security releases, if you pull from menuselect/trunk
you'll get changes meant for later versions of Asterisk.
Terry Wilson [Mon, 21 Nov 2011 19:54:07 +0000 (19:54 +0000)]
Default to nat=yes; warn when nat in general and peer differ
It is possible to enumerate SIP usernames when the general and user/peer
nat settings differ in whether to respond to the port a request is sent
from or the port listed for responses in the Via header. In 1.4 and 1.6.2,
this would mean if one setting was nat=yes or nat=route and the other was
either nat=no or nat=never. In 1.8 and 10, this would mean when one was
nat=force_rport and the other was nat=no.
In order to address this problem, it was decided to switch the default
behavior to nat=yes/force_rport as it is the most commonly used option
and to strongly discourage setting nat per-peer/user when at all possible.
For more discussion of the issue, please see:
http://lists.digium.com/pipermail/asterisk-dev/2011-November/052191.html
Terry Wilson [Wed, 15 Jun 2011 18:06:24 +0000 (18:06 +0000)]
Fix DYNAMIC_FEATURES
DYNAMIC_FEATURES were broken by a recent DTMF change. This patch makes
sure that dynamic features are also checked when deciding whether or not
to pass DTMF through or store it for interpreting.
Sean Bright [Wed, 15 Jun 2011 15:15:30 +0000 (15:15 +0000)]
Resolve a segfault/bus error when we try to map memory that falls on a page
boundary.
The fix for ASTERISK-15359 was incorrect in that it added 1 to the length of the
mmap'd region. The problem with this is that reading/writing to that extra byte
outside of the bounds of the underlying fd causes a bus error.
The real issue is that we are working with both a FILE * and the raw fd
underneath it and not synchronizing between them. The code that was removed in
ASTERISK-15359 was correct, but we weren't flushing the FILE * before mapping
the fd.
Looking at the manager code in 1.4 reveals that the FILE * in 'struct
mansession' is never used except to create a temporary file that we immediately
fdopen. This means we just need to write a 0 byte to the fd and everything will
just work. The other branches require a call to fflush() which, while not a
guaranteed fix, should reduce the likelihood of a crash.
This all makes sense in my head.
(closes issue ASTERISK-16460)
Reported by: Ravelomanantsoa Hoby (hoby)
Patches:
issue17747_1.4_svn_markII.patch uploaded by Sean Bright (license #5060)
Richard Mudgett [Fri, 20 May 2011 20:38:22 +0000 (20:38 +0000)]
The meetme CLI command completion leaves conferences mutex locked.
When issuing a meetme kick CLI command and an invalid (non-existent)
conference number is specified, pressing Tab leaves the conferences mutex
locked and, therefore, all conferences deadlock.
Terry Wilson [Wed, 18 May 2011 23:04:35 +0000 (23:04 +0000)]
Make sure everyone gets an unhold when a transfer succeeds
Some phones, like the Snom phones, send a hold to the transfer target after
before sending the REFER. We need to make sure that we unhold the parties
that are being connected after the masquerade. If Local channels with the /nm
option are used when dialing the parties, hold music would still be playing on
the transfer target, even after being connected with the transferee.
Richard Mudgett [Fri, 13 May 2011 01:09:40 +0000 (01:09 +0000)]
Merged revisions 318671 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.8
* The applicable fixes for v1.4 are the SIP deadlock and the in progress
masquerade check for multiple parties trying to pickup the same call.
issue18654_v1.4.patch uploaded by rmudgett (license 664)
* Backported to v1.6.2.
issue18654_v1.6.2.patch uploaded by rmudgett (license 664)
Fix directed group pickup feature code *8 with pickupsounds enabled
Since 1.6.2, the new pickupsound and pickupfailsound in features.conf cause many issues.
1). chan_sip:handle_request_invite() shouldn't be playing out the fail/success audio, as it has 'netlock' locked.
2). dialplan applications for directed_pickups shouldn't beep.
3). feature code for directed pickup should beep on success/failure if configured.
Created a sip_pickup() thread to handle the pickup and playout the audio, spawned from handle_request_invite.
Moved app_directed:pickup_do() to features:ast_do_pickup().
Functions below, all now use the new ast_do_pickup()
app_directed_pickup.c:
pickup_by_channel()
pickup_by_exten()
pickup_by_mark()
pickup_by_part()
features.c:
ast_pickup_call()
Terry Wilson [Fri, 6 May 2011 07:55:21 +0000 (07:55 +0000)]
Re-fix queue round-robin
This part of the change for r315596 was incorrect. No bridge occurs
when doing a roundrobin dial and no one answers, so this code shouldn't
have been removed.
This change optimizes the free_via() function and removes some redundant null
checking. It also fixes compliance with RFC 3261 section 18.2.2 by always using
the port specified in the Via header for routing responses (even when maddr is
not set). Also the htons() function is now used when setting the port.
Additional documentation comments have been added in various places to make the
logic in the code clearer.
Terry Wilson [Tue, 26 Apr 2011 21:16:10 +0000 (21:16 +0000)]
Allow transfer loops without allowing forwarding loops
We try to avoid the situation where two phones may be forwarded to each other
causing an infinite loop by storing each dialed interface in a channel
datastore and checking the list before dialing out. This works, but currently
breaks situations like A calls B, A transfers B to C, B transfers C to A, and A
transfers C to B. Since human interaction is happening here and not an
automated forwarding loop, it should be allowed.
This patch removes the dialed_interfaces datastore when a call is bridged (a
suggestion from the brilliant mmichelson). If a call is being bridged, it
should be safe to assume that we aren't stuck in a loop.
Since we are now handling this is the bridge code, the previous attempts at
handling it in app_dial and app_queue are removed.
The code that set the bit within the select bitfield was correct, but the
bounds-checking code was not. The change to that line uses the new _bitsize
macro for clarity. Also, FD_ZERO macro did not zero-out anything but the
first word of the bitfield, so this could have caused problems with modules
using that macro with the expanded bitfield.
Reverted part of r314607, as it can introduce a regression.
Specifically, the security check for the "system" privilege was removed. If a user had the "call" privilege but not the "system" privilege, they would loose the ability to execute the system app and dialplan functions that run commands in a shell. This branch never used the "system" privilege for that purpose and did not need to be patched.
Russell Bryant [Fri, 22 Apr 2011 14:34:23 +0000 (14:34 +0000)]
Initialize buffers in getvar and getvarfull.
Initialize the buffers used to hold the result from GET VARIABLE or
GET VARIABLE FULL. The bug report shows func_read returning garbage in
the result. It assumed that the buffer passed in was initialized, like many
other functions do. In the more common code path (through the dialplan), it
is initialized, so just initialize it here too.
Added limits to the number of unauthenticated sessions TCP based protocols are allowed to have open simultaneously. Also added timeouts for unauthenticated sessions where it made sense to do so.
Unrelated, the manager interface now properly checks if the user has the "system" privilege before executing shell commands via the Originate action.
Richard Mudgett [Wed, 13 Apr 2011 16:21:24 +0000 (16:21 +0000)]
Asterisk does not hangup a channel after endpoint hangs up.
If the call that the dialplan started an AGI script for is hungup while
the AGI script is in the middle of a command then the AGI script is not
notified of the hangup. There are many AGI Exec commands that this can
happen with. The reported applications have been: Background, Wait, Read,
and Dial. Also the AGI Get Data command.
* Don't wait on the Asterisk channel after it has hung up. The channel is
likely to never need servicing again.
* Restored the AGI script's ability to return the AGI_RESULT_HANGUP value
in run_agi(). It previously only could return AGI_RESULT_SUCCESS or
AGI_RESULT_FAILURE after the DeadAGI and AGI applications were merged.
(closes issue #17954)
Reported by: mn3250
Patches:
issue17954_v1.8.patch uploaded by rmudgett (license 664)
issue17954_v1.6.2.patch uploaded by rmudgett (license 664)
issue17954_v1.4.patch uploaded by rmudgett (license 664)
Tested by: rmudgett
JIRA SWP-2171
Richard Mudgett [Mon, 11 Apr 2011 15:27:52 +0000 (15:27 +0000)]
Stuck channel using FEATD_MF if caller hangs up at the right time.
The cause was actually a caller hanging up just at the end of the Feature
Group D DTMF tones that setup the call. The reason for this is a "guard
timer" that's implemented using ast_safe_sleep(100). If the caller
happens to hang up AFTER the final tone of the DTMF string but BEFORE the
end of that ast_safe_sleep(), then ast_safe_sleep() will return non-zero.
This causes the code to bounce to the end of ss_thread(), but it does NOT
tear down the call properly.
This should be a rare occurrence because the caller has to hang up at
EXACTLY the right time. Nonetheless, it was happening quite regularly on
the reporter's system. It's not easily reproducible, unless you purposely
increase the guard-time to 2000 or more. Once you do that, you can
reproduce it every time by watching the DTMF debug and hanging up just as
it ends.
Richard Mudgett [Mon, 4 Apr 2011 15:49:30 +0000 (15:49 +0000)]
Issues with ISDN calls changing B channels during call negotiations.
The handling of the PROCEEDING message was not using the correct call
structure if the B channel was changed. (The same for PROGRESS.) The call
was also not hungup if the new B channel is not provisioned or is busy.
* Made all call connection messages (SETUP_ACKNOWLEDGE, PROCEEDING,
PROGRESS, ALERTING, CONNECT, CONNECT_ACKNOWLEDGE) ensure that they are
using the correct structure and B channel. If there is any problem with
the operations then the call is now hungup with an appropriate cause code.
* Made miscellaneous messages (INFORMATION, FACILITY, NOTIFY) find the
correct structure by looking for the call and not using the channel ID.
NOTIFY is an exception with versions of libpri before v1.4.11 because a
call pointer is not available for Asterisk to use.
* Made all hangup messages (DISCONNECT, RELEASE, RELEASE_COMPLETE) find
the correct structure by looking for the call and not using the channel
ID.
Alec L Davis [Fri, 1 Apr 2011 11:02:26 +0000 (11:02 +0000)]
app_voicemail: leave_vociemail doesn't use last_message_index to store next message
trivial change to bring inline with 1.6.2 1.8 and trunk.
The symptom was if msg0000 was missing, and the last was msg0004,
the next msgnum would be msg0000 when it should have been msg0005
Alec L Davis [Fri, 1 Apr 2011 08:29:49 +0000 (08:29 +0000)]
voicemail: get real last_message_index and count_messages, ODBC resequence
change last_message_index to read the max msgnum stored in the database
change count_messages to actually count the number of messages.
last_message_index change:
This fixed overwriting of the last message if msgnum=0 was missing.
Previously every incoming message would overwrite msgnum=1.
count_messages change:
allows us to detect when requencing is required in opneA_mailbox.
resequence enabled for ODBC storage:
Assists with fixing up corrupt databases with gaps, but only when
a user actively opens there mailboxes.
(closes issue #18692,#18582,#19032)
Reported by: elguero
Patches:
based on odbc_resequence_mailbox2.1.diff uploaded by elguero (license 37)
Tested by: elguero, nivek, alecdavis
Alec L Davis [Fri, 1 Apr 2011 06:46:56 +0000 (06:46 +0000)]
app_voicemail: close_mailbox needs to respect additional messages while mailbox is open.
close_mailbox leave gaps in message sequence if messages are deleted and new messages
arrive during this time, this is because the shuffle down to slot 0, only shuffles
the number of pre-existing messages when mailbox is opened, ignoring new arrivals.
Fix: in close_mailbox re-evaluate number of messages before the shuffle, this then includes new arrivals.
Terry Wilson [Wed, 16 Mar 2011 16:58:42 +0000 (16:58 +0000)]
Don't delay DTMF in core bridge while listening for DTMF features
This patch is mostly the work of Olle Johansson. I did some cleanup and
added the silence generating code if transmit_silence is set.
When a channel listens for DTMF in the core bridge, the outbound DTMF is not
sent until we have received DTMF_END. For a long DTMF, this is a disaster. We
send 4 seconds of DTMF to Asterisk, which sends no audio for those 4 seconds.
Some products see this delay and the time skew on RTP packets that results and
start ignoring the audio that is sent afterward.
With this change, the DTMF_BEGIN frame is inspected and checked. If it matches
a feature code, we wait for DTMF_END and activate the feature as before. If
transmit_silence=yes in asterisk.conf, silence is sent if we paritally match a
multi-digit feature. If it doesn't match a feature, the frame is forwarded
along with the DTMF_END without delay. By doing it this way, DTMF is not delayed.
(closes issue #15642)
Reported by: jasonshugart
Patches:
issue_15652_dtmf_ast-1.4.patch.txt uploaded by twilson (license 396)
Tested by: globalnetinc, jde
Richard Mudgett [Mon, 14 Mar 2011 16:38:24 +0000 (16:38 +0000)]
"Caller*ID failed checksum" on Wildcard TDM2400P and TDM410
The last character in the caller id message is getting a framing error.
The checksum is the last character in the message. A framing error in the
checksum could be because:
1) The sender did not send a full stop bit.
2) The sender cut off the FSK carrier too soon.
3) The sender opted to send zero of the specified zero to 10 trailing mark
bits and round-off errors in the code resulted in the code not being where
it thought it was in the demodulated bit stream.
Bit 8 of 'b' is set when parity error.
Bit 9 of 'b' is set when framing error.
Made ignore the framing and parity error bits if the errored character is
the checksum. We can tolerate a framing/parity error there. The checksum
character validates the message.
Tilghman Lesher [Sat, 12 Mar 2011 20:22:07 +0000 (20:22 +0000)]
Add AELSub, which provides a stable entry point into AEL subroutines.
This commit needs some explanation, given that we're adding a new application
into an existing release branch. This is generally a violation of our release
policy, except in very limited circumstances, and I believe this is one of
those circumstances.
The problem that this solves is one of the sanity of using multiple dialplan
languages to define a dialplan. In the case of the reporter, he or she is
using AEL is define subroutines, while using Realtime extensions to invoke
those subroutines. While you can do this, it's based upon the reality of AEL
using actual dialplan extensions; however, there is no guarantee that the
details of _how_ AEL is compiled into extensions will remain stable. In fact,
at the time of this commit, it has already changed twice, once in a
fundamental way.
Now normally, a new application would only be added to trunk. However, this
application is explicitly to create a stable user-level API between versions,
and adding it to trunk only will not solve the user's problem of switching
between 1.6.2 and 1.8, nor will it help anybody switching from 1.8 to 1.10.
Therefore, it needs to go into existing release branches. For the sake of
consistency, and also because one of the changes was between 1.4 and 1.6.x,
I am also electing to commit this to 1.4.
Terry Wilson [Thu, 24 Feb 2011 17:42:16 +0000 (17:42 +0000)]
Don't broadcast FullyBooted to every AMI connection
The FullyBooted event should not be sent to every AMI connection every
time someone connects via AMI. It should only be sent to the user who
just connected.
Properly check the bounds of arrays when decoding UDPTL packets. Also, remove broken support for receiving UDPTL packets larger than 16k. That shouldn't ever happen anyway.
Jason Parker [Tue, 15 Feb 2011 23:32:20 +0000 (23:32 +0000)]
Fix regression that changed behavior of queues when ringing a queue member.
This reverts r298596, which was to fix a highly bizarre and contrived issue
with a queue member that called into his own queue being transferred back
into his own queue. I couldn't reproduce that issue in any way. I think one
of the other recent transfer fixes actually fixed this.
Richard Mudgett [Fri, 11 Feb 2011 00:29:17 +0000 (00:29 +0000)]
Reentrancy problem if outgoing call gets different B channel than requested.
The chan_dahdi pri_fixup_principle() routine needs to protect the Asterisk
channel with the channel lock when it changes the technology private
pointer to a new private structure.
* Added lock protection while pri_fixup_principle() moves a call from one
private structure to another.
* Made some pri_fixup_principle() messages more meaningful.
Terry Wilson [Mon, 7 Feb 2011 22:35:20 +0000 (22:35 +0000)]
Don't try to pickup a call in the middle of a masquerade
If A calls B which doesn't answer and C & D both try to do a call pickup, it is
possible for ast_pickup_call to answer the call, then fail to masquerade one of
the calls because the other one is already in the process of masquerading. This
patch checks to see if the channel is in the process of masquerading before
call before selecting it for a pickup.
Terry Wilson [Mon, 7 Feb 2011 21:51:43 +0000 (21:51 +0000)]
Don't allow a REFER w/replaces to replace its own dialog
Asterisk currently accepts a REFER with a Refer-To with an embedded Replaces
header that matches the dialog of the REFER. This would be a situation like A
calls B, A calls C, A transfers B to A, which is just silly. This patch makes
the transfer fail instead of making Asterisk freak out and forget to hang other
channels up.
Terry Wilson [Thu, 3 Feb 2011 20:36:34 +0000 (20:36 +0000)]
Set hangup cause in local_hangup
When a call involves a local channel (like SIP -> Local -> SIP), the hangup
cause was not being set. This resulted in SIP channels sometimes getting a
503 error instead of a 486 when the far side sent a busy. In Asterisk 1.8+
this also can cause issues with CCSS that involve a local channel. This patch
sets the hangupcause for one side of the local channel to the other in
local_hangup for outbound calls.
Richard Mudgett [Thu, 3 Feb 2011 00:02:43 +0000 (00:02 +0000)]
Minor AST_FRAME_TEXT related issues.
* Include the null terminator in the buffer length. When the frame is
queued it is copied. If the null terminator is not part of the frame
buffer length, the receiver could see garbage appended onto it.
* Add channel lock protection with ast_sendtext().
Jason Parker [Mon, 31 Jan 2011 22:56:54 +0000 (22:56 +0000)]
Prevent a crash when dialing a technology with no destination (ex: Dial(SIP/))
chan_iax2 and other channel drivers already had code to prevent this. The
attempt that app_dial was making to prevent it was not correct, so I fixed that.
Jason Parker [Thu, 27 Jan 2011 16:57:46 +0000 (16:57 +0000)]
Fix default prefix=/usr regression on non-Linux systems.
This partially reverts a change made in branches/1.4/ r267759, which will
cause issue #17013 to be reopened. This issue was pointed out by a user
on #asterisk, who helpfully discovered that paths were being set incorrectly.
To truly understand what was wrong, one should run:
svn diff --force -c<this revision> configure
This patch modifies chan_sip to route responses to the address the request came from. It also modifies chan_sip to respect the maddr parameter in the Via header.
Richard Mudgett [Tue, 25 Jan 2011 23:21:09 +0000 (23:21 +0000)]
DTMF attended transfers sometimes fail for no apparent reason.
The loop in feature_request_and_dial() can exit when Party C has answered
without processing an AST_CONTROL_ANSWER. Also sometimes an
AST_CONTROL_ANSWER never happens even though Party C has answered.
Don't hangup Party C if he is up or we receive an AST_CONTROL_ANSWER.
Terry Wilson [Tue, 25 Jan 2011 20:50:59 +0000 (20:50 +0000)]
Guard against retransmitting BYEs indefinitely
In the case of an attended transfer (A calls B, A atxfers to C) where
A becomes unreachable before replying to Asterisk's BYE, Asterisk can
sometimes retransmit the BYE indefinitely. This is because
__sip_autodestruct tests p->refer && !ast_test_flag(&p->flags[0],
SIP_ALREADYGONE and will then transmit a BYE. When this BYE times out,
it will not ever be marked as ALREADYGONE, so when __sip_autodestruct
is called again, we end up starting the cycle over.
This patch adds a call to sip_alreadygone(pkt->owner) in retrans_pkt
in the case of a BYE that has timed out. This should prevent Asterisk
from trying to transmit new BYE messages in the future.
Richard Mudgett [Tue, 25 Jan 2011 17:36:50 +0000 (17:36 +0000)]
Sending out unnecessary PROCEEDING messages breaks overlap dialing.
Issue #16789 was a good idea. Unfortunately, it breaks overlap dialing
through Asterisk. There is not enough information available at this point
to know if dialing is complete. The ast_exists_extension(),
ast_matchmore_extension(), and ast_canmatch_extension() calls are not
adequate to detect a dial through extension pattern of "_9!".
Workaround is to use the dialplan Proceeding() application early in
non-dial through extensions.
* Effectively revert issue #16789.
* Allow outgoing overlap dialing to hear dialtone and other early media.
A PROGRESS "inband-information is now available" message is now sent after
the SETUP_ACKNOWLEDGE message for non-digital calls. An
AST_CONTROL_PROGRESS is now generated for incoming SETUP_ACKNOWLEDGE
messages for non-digital calls.
* Handling of the AST_CONTROL_CONGESTION in chan_dahdi/sig_pri was
inconsistent with the cause codes.
* Added better protection from sending out of sequence messages by
combining several flags into a single enum value representing call
progress level.
(closes issue #18509)
Reported by: wimpy
Patches:
issue18509_early_media_v1.8_v3.patch uploaded by rmudgett (license 664)
Expanded upon issue18509_early_media_v1.8_v3.patch to include analog
and SS7 because of backporting requirements.
Tested by: wimpy, rmudgett
Jeff Peeler [Tue, 25 Jan 2011 16:58:29 +0000 (16:58 +0000)]
Fix voicemail sequencing for file based storage.
A previous change was made to account for when the number of voicemail messages
exceeds the max limit to be handled properly, but it caused gaps in the messages
to not be properly handled. This has now been resolved.
In later non 1.4 branches, it appears that resequencing wasn't even occurring
due from what appears and accidental code removal.
Russell Bryant [Mon, 24 Jan 2011 20:32:21 +0000 (20:32 +0000)]
Fix channel redirect out of MeetMe() and other issues with channel softhangup.
Mantis issue #18585 reports that a channel redirect out of MeetMe() stopped
working properly. This issue includes a patch that resolves the issue by
removing a call to ast_check_hangup() from app_meetme.c. I left that in my
patch, as it doesn't need to be there. However, the rest of the patch fixes
this problem with or without the change to app_meetme.
The key difference between what happens before and after this patch is the
effect of the END_OF_Q control frame. After END_OF_Q is hit in ast_read(),
ast_read() will return NULL. With the ast_check_hangup() removed, app_meetme
sees this which causes it to exit as intended. Checking ast_check_hangup()
caused app_meetme to exit earlier in the process, and the target of the
redirect saw the condition where ast_read() returned NULL.
Removing ast_check_hangup() works around the issue in app_meetme, but doesn't
solve the issue if another application did the same thing. There are also
other edge cases where if an application finishes at the same time that a
redirect happens, the target of the redirect will think that the channel hung
up. So, I made some changes in pbx.c to resolve it at a deeper level. There
are already places that unset the SOFTHANGUP_ASYNCGOTO flag in an attempt to
abort the hangup process. My patch extends this to remove the END_OF_Q frame
from the channel's read queue, making the "abort hangup" more complete. This
same technique was used in every place where a softhangup flag was cleared.
Jason Parker [Fri, 21 Jan 2011 21:45:34 +0000 (21:45 +0000)]
Reset configuration before parsing users.conf.
Some values configured in chan_dahdi.conf were able to leak in to users.conf
configuration. This was surprising users, and potentially setting non-sane
"defaults".
Richard Mudgett [Wed, 19 Jan 2011 21:21:56 +0000 (21:21 +0000)]
DTMF transfer plays the wrong sounds for wrong number or other call failure.
* Set the default for features.conf.sample xferfailsound option to "beeperr"
as documented instead of "pbx-invalid" and corrected the use of it in DTMF
blind transfer (#1).
* Improved DTMF blind transfer handling of wrong numbers.
Most of the concerns in this issue were taken care of by the patch for
issue 17999: Issues with DTMF triggered attended transfers.
projects / thirdparty / asterisk.git / log
