The HTTP request processing in res_http_websocket allocates additional
space on the stack for various headers received during an Upgrade request.
An attacker could send a specially crafted request that causes this code
to overflow the stack, resulting in a crash.
* No longer allocate memory from the stack in a loop to parse the header
values. NOTE: There is a slight API change when using the passed in
strings as is. We now require the passed in strings to no longer have
leading or trailing whitespace. This isn't a problem as the only callers
have already done this before passing the strings to the affected
function.
George Joseph [Fri, 6 Jul 2018 14:04:56 +0000 (08:04 -0600)]
test.c: Make output jUnit compatible
Separate "name" into "classname" and "name".
Use '.' for classname separator instead of '/'.
Prefix reserved words with '_'.
Wrap output with a top-level "testsuites" element.
Richard Mudgett [Mon, 30 Apr 2018 22:38:58 +0000 (17:38 -0500)]
AST-2018-008: Fix enumeration of endpoints from ACL rejected addresses.
When endpoint specific ACL rules block a SIP request they respond with a
403 forbidden. However, if an endpoint is not identified then a 401
unauthorized response is sent. This vulnerability just discloses which
requests hit a defined endpoint. The ACL rules cannot be bypassed to gain
access to the disclosed endpoints.
* Made endpoint specific ACL rules now respond with a 401 unauthorized
which is the same as if an endpoint were not identified. The fix is
accomplished by replacing the found endpoint with the artificial endpoint
which always fails authentication.
Kevin Harwell [Wed, 31 Jan 2018 19:37:54 +0000 (13:37 -0600)]
AST-2018-003: Crash with an invalid SDP fmtp attribute
pjproject's fmtp retrieval function failed to catch invalid fmtp attributes.
Because of this Asterisk would crash if given an SDP with an invalid fmtp
attribute.
When retrieving the format this patch now makes sure the fmtp attribute is
available. If not available it now returns an error status.
Kevin Harwell [Wed, 31 Jan 2018 19:33:16 +0000 (13:33 -0600)]
AST-2018-002: Crash with an invalid SDP media format description
pjproject's media format parsing algorithm failed to catch invalid values.
Because of this Asterisk would crash if given an SDP with a invalid media
format description.
When parsing the media format description this patch now properly parses the
value and returns an error status if it can't successfully parse/convert the
value.
George Joseph [Tue, 6 Feb 2018 18:07:18 +0000 (11:07 -0700)]
AST-2018-005: res_pjsip_transport_management: Move to core
Since res_pjsip_transport_management provides several attack
mitigation features, its functionality moved to res_pjsip and
this module has been removed. This way the features will always
be available if res_pjsip is loaded.
George Joseph [Tue, 6 Feb 2018 17:28:49 +0000 (10:28 -0700)]
AST-2018-005: Fix tdata leaks when calling pjsip_endpt_send_response(2)
pjsip_distributor:
authenticate() creates a tdata and uses it to send a challenge or
failure response. When pjsip_endpt_send_response2() succeeds, it
automatically decrements the tdata ref count but when it fails, it
doesn't. Since we weren't checking for a return status, we weren't
decrementing the count ourselves on error and were therefore leaking
tdatas.
res_pjsip_session:
session_reinvite_on_rx_request wasn't decrementing the ref count
if an error happened while sending a 491 response.
pre_session_setup wasn't decrementing the ref count if
while sending an error after a pjsip_inv_verify_request failure.
res_pjsip:
ast_sip_send_response wasn't decrementing the ref count on error.
George Joseph [Tue, 6 Feb 2018 17:21:32 +0000 (10:21 -0700)]
AST-2018-005: Add a check for NULL tdata in ast_sip_failover_request
It was discovered that there are some corner cases where a pjsip tsx
might have no last_tx so calling ast_sip_failover_request with
a NULL last_tx as its tdata would cause a crash.
Joshua Colp [Wed, 7 Feb 2018 14:09:14 +0000 (14:09 +0000)]
AST-2018-004: Restrict the number of Accept headers in a SUBSCRIBE.
When receiving a SUBSCRIBE request the Accept headers from it are
stored locally. This operation has a fixed limit of 32 Accept headers
but this limit was not enforced. As a result it was possible for
memory outside of the allocated space to get written to resulting
in a crash.
This change enforces the limit so only 32 Accept headers are
processed.
Kevin Harwell [Wed, 20 Dec 2017 22:17:40 +0000 (16:17 -0600)]
AST-2017-014: res_pjsip - Missing contact header can cause crash
Those SIP messages that create dialogs require a contact header to be present.
If the contact header was missing from the message it could cause Asterisk to
crash.
This patch checks to make sure SIP messages that create a dialog contain the
contact header. If the message does not and it is required Asterisk now returns
a "400 Missing Contact header" response. Also added NULL checks when retrieving
the contact header that were missing as a "just in case".
Joshua Colp [Thu, 30 Nov 2017 16:12:55 +0000 (16:12 +0000)]
AST-2017-012: Place single RTCP report block at beginning of report.
When the RTCP code was transitioned over to Stasis a code change
was made to keep track of how many reports are present. This count
controlled where report blocks were placed in the RTCP report.
If a compound RTCP packet was received this logic would incorrectly
place a report block in the wrong location resulting in a write
to an invalid location.
This change removes this counting logic and always places the report
block at the first position. If in the future multiple reports are
supported the logic can be extended but for now keeping a count
serves no purpose.
George Joseph [Thu, 30 Nov 2017 20:38:50 +0000 (13:38 -0700)]
AST-2017-013: chan_skinny: Call pthread_detach when sess threads end
chan_skinny creates a new thread for each new session. In trying
to be a good cleanup citizen, the threads are joinable and the
unload_module function does a pthread_cancel() and a pthread_join()
on any sessions that are active at that time. This has an
unintended side effect though. Since you can call pthread_join on a
thread that's already terminated, pthreads keeps the thread's
storage around until you explicitly call pthread_join (or
pthread_detach()). Since only the module_unload function was
calling pthread_join, and even then only on the ones active at the
tme, the storage for every thread/session ever created sticks
around until asterisk exits.
* A thread can detach itself so the session_destroy() function
now calls pthread_detach() just before it frees the session
memory allocation. The module_unload function still takes care
of the ones that are still active should the module be unloaded.
George Joseph [Thu, 19 Oct 2017 18:53:32 +0000 (12:53 -0600)]
AST-2017-009: pjproject: Add validation of numeric header values
Parsing the numeric header fields like cseq, ttl, port, etc. all
had the potential to overflow, either causing unintended values to
be captured or, if the values were subsequently converted back to
strings, a buffer overrun. To address this, new "strto" functions
have been created that do range checking and those functions are
used wherever possible in the parser.
* Created pjlib/include/limits.h and pjlib/include/compat/limits.h
to either include the system limits.h or define common numeric
limits if there is no system limits.h.
* Created strto*_validate functions in sip_parser that take bounds
and on failure call the on_str_parse_error function which prints
an error message and calls PJ_THROW.
* Updated sip_parser to validate the numeric fields.
* Fixed an issue in sip_transport that prevented error messages
from being properly displayed.
* Added "volatile" to some variables referenced in PJ_CATCH blocks
as the optimizer was sometimes optimizing them away.
* Fixed length calculation in sip_transaction/create_tsx_key_2543
to account for signed ints being 11 characters, not 9.
ASTERISK-27319
Reported by: Youngsung Kim at LINE Corporation
Kevin Harwell [Thu, 19 Oct 2017 18:35:16 +0000 (13:35 -0500)]
AST-2017-011 - res_pjsip_session: session leak when a call is rejected
A previous commit made it so when an invite session transitioned into a
disconnected state destruction of the Asterisk pjsip session object was
postponed until either a transport error occurred or the event timer
expired. However, if a call was rejected (for instance a 488) before the
session was fully established the event timer may not have been initiated,
or it was canceled without triggering either of the session finalizing states
mentioned above.
Really the only time destruction of the session should be delayed is when a
BYE is being transacted. This is because it's possible in some cases for the
session to be disconnected, but the BYE is still transacting.
This patch makes it so the session object always gets released (no more
memory leak) when the pjsip session is in a disconnected state. Except when
the method is a BYE. Then it waits until a transport error occurs or an event
timeout.
cdr_object_update_party_b_userfield_cb() could overrun the fixed buffer if
the supplied string is too long. The long string could be supplied by
external means using the CDR(userfield) function.
This may seem reminiscent to AST-2017-001 (ASTERISK_26897) and it is. The
earlier patch fixed the buffer overrun for Party A's userfield while this
patch fixes the same thing for Party B's userfield.
Richard Mudgett [Mon, 6 Nov 2017 22:37:49 +0000 (16:37 -0600)]
res_pjsip_registrar.c: Fix AOR and pjproject group deadlock.
One of the patches for ASTERISK_27147 introduced a deadlock regression.
When the connection oriented transport shut down, the code attempted to
remove the associated contact. However, that same transport had just
requested a registration that we hadn't responded to yet. Depending
upon timing we could deadlock.
* Made send the REGISTER response after we completed processing the
request contacts and released the AOR lock to avoid the deadlock.
Ben Ford [Wed, 1 Nov 2017 16:12:45 +0000 (11:12 -0500)]
res_pjsip: Add to list of valid characters for from_user.
Fixes a regression where some characters were unable to be used in
the from_user field of an endpoint. Additionally, the backtick was
removed from the list of valid characters, since it is not valid,
and it was replaced with a single quote, which is a valid character.
Joshua Colp [Sun, 22 Oct 2017 22:32:20 +0000 (19:32 -0300)]
res_xmpp: Ensure the connection filter is available.
Users of the API that res_xmpp provides expect that a
filter be available on the client at all times. When
OAuth authentication support was added this requirement
was not maintained.
This change merely moves the OAuth authentication to
after the filter is created, ensuring users of res_xmpp
can add things to the filter as needed.
Ben Ford [Mon, 23 Oct 2017 18:42:27 +0000 (13:42 -0500)]
http.c: Fix http header send content.
Currently ast_http_send barricades a portion of the content that
needs to be sent in order to establish a connection for things
like the ARI client. The conditional and contents have been changed
to ensure that everything that needs to be sent, will be sent.
Daniel Tryba [Fri, 6 Oct 2017 09:55:38 +0000 (11:55 +0200)]
res_pjsip_session: Prevent user=phone being added to anonimized URIs.
Move ast_sip_add_usereqphone to be called after anonymization of URIs,
to prevent the user_eq_phone adding "user=phone" to URIs containing a
username that is not a phonenumber (RFC3261 19.1.1). An extra call to
ast_sip_add_usereqphone on the saved version before anonymization is
added to add user=phone" to the PAI.
George Joseph [Wed, 11 Oct 2017 12:03:41 +0000 (06:03 -0600)]
chan_vpb: Fix a gcc 7 out-of-bounds complaint
chan_vpb was trying to use sizeof(*p->play_dtmf), where
p->play_dtmf is defined as char[16], to get the length of the array
but since p->play_dtmf is an actual array, sizeof(*p->play_dtmf)
returns the size of the first array element, which is 1. gcc7
validly complains because the context in which it's used could
cause an out-of-bounds condition.
Sean Bright [Tue, 10 Oct 2017 17:01:05 +0000 (13:01 -0400)]
app_originate: Set ORIGINATE_STATUS correctly on failure
We were ignoring the return value from ast_pbx_outgoing_exten() and
ast_pbx_outgoing_app() which could fail before setting the reason code.
This resulted in failures being reported as success.
Richard Mudgett [Wed, 20 Sep 2017 23:36:15 +0000 (18:36 -0500)]
res_pjsip_registrar.c: Update remove_existing AOR contact handling.
When "rewrite_contact" is enabled, the "max_contacts" count option can
block re-registrations because the source port from the endpoint can be
random. When the re-registration is blocked, the endpoint may give up
re-registering and require manual intervention.
* The "remove_existing" option now allows a registration to succeed by
displacing any existing contacts that now exceed the "max_contacts" count.
Any removed contacts are the next to expire. The behaviour change is
beneficial when "rewrite_contact" is enabled and "max_contacts" is greater
than one. The removed contact is likely the old contact created by
"rewrite_contact" that the device is refreshing.
Corey Farrell [Wed, 4 Oct 2017 15:46:44 +0000 (11:46 -0400)]
res_pjsip: Fix issues that prevented shutdown of modules.
res_pjsip and res_pjsip_session had circular references, preventing both
modules from shutting down.
* Move session supplement registration to res_pjsip.
* Use create internal functions for use by pjsip_message_filter.c.
Alexander Traud [Sun, 8 Oct 2017 14:11:10 +0000 (16:11 +0200)]
tcptls: Do not re-bind to wildcard on client creation.
Since ASTERISK-26922, this issue affected only those chan_sip which were
* enabled for dual-stack (bindaddr=::), and
* enabled for TCP (tcpenable=yes) and/or TLS (tlsenable=yes), and
* tried to register and/or invite a IPv4-only service,
* via TCP and/or TLS.
Now, ast_tcptls_client_create does not re-bind to [::] anymore.
Daniel Tryba [Mon, 2 Oct 2017 12:48:41 +0000 (14:48 +0200)]
res_pjsip_caller_id chan_sip: Comply to RFC 3323 values for privacy
Currently privacy requests are only granted if the Privacy header
value is exactly "id" (defined in RFC 3325). It ignores any other
possible value (or a combination there of). This patch reverses the
logic from testing for "id" to grant privacy, to testing for "none" and
granting privacy for any other value. "none" must not be used in
combination with any other value (RFC 3323 section 4.2).
res_calendar_icalendar: Filter out occurrences superceded by another VEVENT
When we are loading the calendars, we call libical's
icalcomponent_foreach_recurrence method for each VEVENT component that
we have in our calendar.
That method has no knowledge concerning the existence of the other
VEVENT components and will feed our callback with all ocurrences
matching the requested time span.
The occurrences generated by icalcomponent_foreach_recurrence while
expanding a recurring VEVENT's RRULE and RDATE properties can be
superceded by an other VEVENT sharing the same UID.
I use an external iterator (in libical terminology) to avoid messing
with the internal ones from the calling function, and search for
VEVENTS which could supersede the current occurrence.
The event which can invalidate this occurence needs to have:
- the same UID as our recurrent component (comp)
- a RECURRENCE-ID property, which represents the start time of this
occurrence
Richard Mudgett [Thu, 28 Sep 2017 22:37:15 +0000 (17:37 -0500)]
app_queue.c: Fix announcements when announce-to-first-user not enabled.
The previous patch for ASTERISK-27216 made it so you wouldn't get any
position or periodic announcements unless you had announce-to-first-user
enabled. The announce-to-first-user feature was added by ASTERISK_21782
as a result of the patch which introduced the redundant announcements that
ASTERISK-27216 removes.
* By noting that the makeannouncement variable is used to suppresses the
first user announcement, we set its initial value to the
announce-to-first-user enable setting.
George Joseph [Wed, 27 Sep 2017 18:45:21 +0000 (12:45 -0600)]
logger: Bring back ability to turn debug on by source file
Somewhere along the way we lost the ability to debug individual
source files. For modules, this wasn't a big deal but all the
source files in ./main are in the one "core" module so debugging
individual core capabilities was almost impossible.
* Added a test to DEBUG_ATLEAST that also checks __FILE__ instead
of just module name. Any source file will work even if it's in
a module subdirectory.
The pjsip_publishc_init() call was referenced with a misplaced
parentheses. As a result, outbound publication messages went out with an
expiration of 1 second.
George Joseph [Tue, 26 Sep 2017 16:01:48 +0000 (10:01 -0600)]
pjsip_message_filter: Fix regression causing bad contact address
The "res_pjsip: Filter out non SIP(S) requests" commit moved the
filtering of messages to pjproject's PJSIP_MOD_PRIORITY_TRANSPORT_LAYER
in order to filter out incoming bad uri schemes as early as possible.
Since the change affected outgoing messages as well and the TRANSPORT
layer is the last to be run on outgoing messages, we were overwriting
the setting of external_signaling_address (which is set earlier by
res_pjsip_nat) with an internal address.
* pjsip_message_filter now registers itself as a pjproject module
twice. Once in the TSX layer for the outgoing messages (as it was
originally), then a second time in the TRANSPORT layer for the
incoming messages to catch the invalid uri schemes.
The bridge_p2p_rtp_write() has potential reentrancy problems.
* Accessing the bridged RTP members must be done with the instance1 lock
held. The DTMF and asymmetric codec checks must be split to be done with
the correct RTP instance struct locked. i.e., They must be done when
working on the appropriate side of the point to point bridge.
* Forcing the RTP mark bit was referencing the wrong side of the point to
point bridge. The set mark bit is used everywhere else to set the mark
bit when sending not receiving.
The patches for ASTERISK_26745 and ASTERISK_27158 did not take into
account that not everything carried by RTP uses a codec. The telephony
DTMF events are not exchanged with a codec. As a result when
RFC2833/RFC4733 sent digits you would crash if "core set debug 1" is
enabled, the DTMF digits would always get passed to the core even though
the local native RTP bridge is active, and the DTMF digits would go out
using the wrong SSRC id.
* Add protection for non-format payload types like DTMF when updating the
lastrxformat and lasttxformat. Also protect against non-format payload
types when checking for asymmetric codecs.
app_queue: Only do announcement logic between ringing cycles
This patch reverts the change by patch 2263 from old reviewboard.
Note that reverting that 2263-patch still preserves the behaviour that
the commit log of the 2263-patch claimed to add. The reason for this is:
The function wait_for_answer is only called from try_calling which
in turn is only called from the main for loop in queue_exec, and
earlier in that loop we already check the things that's removed by
this patch. There's no need to check those things twice each loop
iteration, and I think the proper place to check it is before each
ringing cycle. By checking it in wait_for_answer, you allow the issue
explained in the jira - that the head caller hears announcements while
the agents' sip phones are actively ringing.
Reported-by: Stefan Engström Tested-by: Stefan Engström
ASTERISK-27216 #close
projects / thirdparty / asterisk.git / log
