sanitize_tdata was assuming all URIs were SIP URIs so when a non
SIP uri was in the From, To or Contact headers, the unconditional
cast of a non-pjsip_sip_uri structure to pjsip_sip_uri caused
a segfault when trying to access uri->other_param.
* Added PJSIP_URI_SCHEME_IS_SIP(uri) || PJSIP_URI_SCHEME_IS_SIPS(uri)
checks before attempting to cast or use the returned uri.
ASTERISK-27152 Reported-by: Ross Beer
Change-Id: Id380df790e6622c8058a96035f8b8f4aa0b8551f
An admin can configure app_minivm with an externnotify program to be run
when a voicemail is received. The app_minivm application MinivmNotify
uses ast_safe_system() for this purpose which is vulnerable to command
injection since the Caller-ID name and number values given to externnotify
can come from an external untrusted source.
* Add ast_safe_execvp() function. This gives modules the ability to run
external commands with greater safety compared to ast_safe_system().
Specifically when some parameters are filled by untrusted sources the new
function does not allow malicious input to break argument encoding. This
may be of particular concern where CALLERID(name) or CALLERID(num) may be
used as a parameter to a script run by ast_safe_system() which could
potentially allow arbitrary command execution.
* Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp()
instead of ast_safe_system() to avoid command injection.
* Document code injection potential from untrusted data sources for other
shell commands that are under user control.
Joshua Colp [Mon, 22 May 2017 15:36:38 +0000 (15:36 +0000)]
res_rtp_asterisk: Only learn a new source in learn state.
This change moves the logic which learns a new source address
for RTP so it only occurs in the learning state. The learning
state is entered on initial allocation of RTP or if we are
told that the remote address for the media has changed. While
in the learning state if we continue to receive media from
the original source we restart the learning process. It is
only once we receive a sufficient number of RTP packets from
the new source that we will switch to it. Once this is done
the closed state is entered where all packets that do not
originate from the expected source are dropped.
The learning process has also been improved to take into
account the time between received packets so a flood of them
while in the learning state does not cause media to be switched.
Finally RTCP now drops packets which are not for the learned
SSRC if strict RTP is enabled.
Joshua Colp [Wed, 30 Aug 2017 12:28:58 +0000 (12:28 +0000)]
res_rtp_asterisk: Allow remote SSRC to change on an RTP instance.
When SDP renegotiation occurs it is possible for an RTP
instance to be reused for a new stream, resulting in the remote
SSRC changing if it is part of a bundle group. This change
allows this and updates its mapping in the current bundle
group.
Richard Mudgett [Tue, 29 Aug 2017 19:22:15 +0000 (14:22 -0500)]
bridge_native_rtp.c: Fixup native_rtp_framehook()
* Fix framehook to test frame type for control frame.
* Made framehook exit early if frame type is not a control frame.
* Eliminated RAII_VAR in framehook.
* Use switch instead of else-if ladder for control frame handling.
Joshua Colp [Thu, 24 Aug 2017 16:45:08 +0000 (13:45 -0300)]
core: Reduce video update queueing.
A video update frame is used to indicate that a channel
with video negotiated should provide a full frame so the
decoder decoding the stream is able to do so. In situations
where a queue is used to store frames it makes no sense
for the queue to contain multiple video update frames. One
is sufficient to have a full frame be sent.
Sean Bright [Fri, 25 Aug 2017 18:44:35 +0000 (14:44 -0400)]
voicemail: Fix various abuses of mkstemp
mkstemp() returns a unique filename, but appending an extension to that
filename does not guarantee uniqueness. Instead, use mkdtemp() and we
can put whatever extension we want on the files that we create inside
the directory.
In the case of app_minivm, we also now properly clean up any temporary
files that we create.
Sean Bright [Fri, 25 Aug 2017 17:20:16 +0000 (13:20 -0400)]
app_record: Resolve some absolute vs. relative filename bugs
If the Record() application is called with a relative filename that
includes directories, we were not properly creating the intermediate
directories and Record() would fail.
Secondarily, updated the documentation for RECORDED_FILE to mention
that it does not include a filename extension.
Finally, rewrote the '%d' functionality to be a bit more straight
forward and less noisy.
Torrey Searle [Mon, 21 Aug 2017 09:28:52 +0000 (11:28 +0200)]
res/res_pjsip_session: allow SDP answer to be regenerated
If an SDP answer hasn't been sent yet, it's legal to change it.
This is required for PJSIP_DTMF_MODE to work correctly, and can
also have use in the future for updating codecs too.
Richard Mudgett [Fri, 18 Aug 2017 22:37:12 +0000 (17:37 -0500)]
res_pjsip_session.c: Fix crash when declining an active stream.
If a previously active stream is declined we could crash because the
channel's thread is still using the stream while we are updating the
topology in the serializer thread.
* Defer removing any declined stream's handler until we have blocked the
channel's thread with the channel lock.
Richard Mudgett [Wed, 16 Aug 2017 22:50:18 +0000 (17:50 -0500)]
bridge_channel.c: Fix FRACK when mapping frames to the bridge.
* Add protection checks when mapping streams to the bridge. The channel
and bridge may be in the process of updating the stream mapping when a
media frame comes in so we may not be able to map the frame at the time.
* We need to map the streams to the bridge's stream numbers right before
they are written into the bridge. That way we don't have to keep
locking/unlocking the bridge and we won't have any synchronization
problems before the frames actually go into the bridge.
* Protect the deferred queue with the bridge_channel lock.
Richard Mudgett [Wed, 16 Aug 2017 20:22:04 +0000 (15:22 -0500)]
bridge: Fix softmix bridge deadlock.
* Fix deadlock in
bridge_softmix.c:softmix_bridge_stream_topology_changed() between
bridge_channel and channel locks.
* The new bridge technology topology change callbacks must be called with
the bridge locked. The callback references the bridge channel list, the
bridge technology could change, and the bridge stream mapping is updated.
Michael Kuron [Sun, 20 Aug 2017 13:15:37 +0000 (15:15 +0200)]
res_xmpp: fix inverted return code check in OAuth
fetch_access_token calls func_curl via ast_func_read. The latter returns 0 upon
success and -1 if the function is not available.
This commit inverts the return code check so that an error is printed if the
module is not loaded and not if it is loaded.
George Joseph [Wed, 16 Aug 2017 20:43:10 +0000 (14:43 -0600)]
Fix downloader not working with curl
The codec/dpma downloader wasn't handling curl correctly. The logic
that transforms makeopts into a bash-sourceable file wasn't
handling the make 'or' command in DOWNLOAD_TIMEOUT so bash was
looking for an 'or' command.
That logic has been eliminated. Instead of trying to transform
and source makeopts, the downloader now calls a make scriptlet
to print the value of a specific variable. This way, make handles
the ors (or any other make construct that happens to creep into
that file).
Kevin Harwell [Tue, 15 Aug 2017 18:12:10 +0000 (13:12 -0500)]
manager: hook event is not being raised
When the iostream code went in it introduced a conditional that made it so the
hook event was not being raised even if a hook is present. This patch adds a
check to see if a hook is present in astman_append. If so then call into the
send_string function, which in turn raises the even for specified hook.
Also updated the ami hooks unit test, so the test could be automated.
Richard Mudgett [Tue, 15 Aug 2017 20:15:58 +0000 (15:15 -0500)]
configure: Check cache for valid pjproject tarball before downloading.
On a fresh Asterisk source directory, the bundled pjproject tarball is
unconditionally downloaded even if the tarball is already in a specified
cache directory.
* Made check if the pjproject tarball is valid in the cache directory
before downloading the tarball on a fresh source directory.
Richard Mudgett [Tue, 15 Aug 2017 16:14:20 +0000 (11:14 -0500)]
res_pjsip: Fix prune_on_boot to remove only contacts for the host.
* Check that the contact's reg_server matches the host's name before
deleting any prune_on_boot contacts. We don't want to delete reliable
transport contacts made with other servers if the ps_contacts database
table is shared with other servers.
Thanks to Ross Beer for pointing out that the original prune logic would
delete reliable transport contacts from other servers.
Richard Mudgett [Thu, 10 Aug 2017 19:18:01 +0000 (14:18 -0500)]
STUN/netsock2: Fix some valgrind uninitialized memory findings.
* netsock2.c: Test the addr->len member first as it may be the only member
initialized in the struct.
* stun.c:ast_stun_handle_packet(): The combinded[] local array could get
used uninitialized by ast_stun_request(). The uninitialized string gets
copied to another location and could overflow the destination memory
buffer.
These valgrind findings were found for ASTERISK_27150 but are not
necessarily a fix for the issue.
Richard Mudgett [Wed, 2 Aug 2017 23:44:12 +0000 (18:44 -0500)]
res_pjsip_outbound_registration.c: Re-REGISTER on transport shutdown.
The fix for the issue is broken up into three parts.
This is part three which handles the client side of REGISTER requests.
The registered contact may no longer be valid on the server when the
transport used is reliable and the connection is broken.
* Re-REGISTER our contact if the reliable transport is broken after
registration completes. We attempt to re-REGISTER immediately to minimize
the time we are unreachable. Time may have already passed between the
connection being broken and the loss being detected.
* Reorder sip_outbound_registration_state_alloc() so the STATSD_GUAGE's
are still correct if an allocation failure happens.
Richard Mudgett [Mon, 31 Jul 2017 19:21:06 +0000 (14:21 -0500)]
res_pjsip: Remove ephemeral registered contacts on transport shutdown.
The fix for the issue is broken up into three parts.
This is part two which handles the server side of REGISTER requests when
rewrite_contact is enabled. Any registered reliable transport contact
becomes invalid when the transport connection becomes disconnected.
* Monitor the rewrite_contact's reliable transport REGISTER contact for
shutdown. If it is shutdown then the contact must be removed because it
is no longer valid. Otherwise, when the client attempts to re-REGISTER it
may be blocked because the invalid contact is there. Also if we try to
send a call to the endpoint using the invalid contact then the endpoint is
not likely to see the request. The endpoint either won't be listening on
that port for new connections or a NAT/firewall will block it.
* Prune any rewrite_contact's registered reliable transport contacts on
boot. The reliable transport no longer exists so the contact is invalid.
* Websockets always rewrite the REGISTER contact address and the transport
needs to be monitored for shutdown.
* Made the websocket transport set a unique name since that is what we use
as the ao2 container key. Otherwise, we would not know which transport we
find when one of them shuts down. The names are also used for PJPROJECT
debug logging.
* Made the websocket transport post the PJSIP_TP_STATE_CONNECTED state
event. Now the global keep_alive_interval option, initially idle shutdown
timer, and the server REGISTER contact monitor can work on wetsocket
transports.
* Made the websocket transport set the PJSIP_TP_DIR_INCOMING direction.
Now initially idle websockets will automatically shutdown.
Richard Mudgett [Fri, 28 Jul 2017 23:26:17 +0000 (18:26 -0500)]
res_pjsip: PJSIP Transport state monitor refactor.
The fix for the issue is broken up into three parts.
This is part one which refactors the transport state monitor code to allow
more modules to be able to monitor transports.
* Pull the management of PJPROJECT's transport state callback code from
res_pjsip_transport_management.c into res_pjsip. Now other modules can
dynamically add and remove themselves from transport monitoring without
worrying about breaking PJPROJECT's callback chain.
* Add the ability for other modules to get a callback whenever a specific
transport is shutdown.
When handling an incoming SIP MESSAGE, PJSIP
attaches the IP address that the message was
received from to the message in the variable
PJSIP_RECVADDR. When the IP address is IPv6
the :PORT appended results in an unparseable
mess. By using an additional bit flag on the
pj_sockaddr_print call, the conventional use
of brackets around the address is achieved.
res_rtp_asterisk: enable rtcp & QOS stats on native bridge
Asterisk wasn't generating or forwarding RTCP packets when native
bridge was activated. Also the stats weren't available via
CHANNEL(qos). Now the RTCP stats are always calculated.
res_rtp_asterisk: Make P2P bridge Asymmetric codec aware
Introduce a new property to rtp-engine to make it aware of
the desire for assymetric codecs or not. If asymmetric codecs
is not allowed, the bridge will compare read/write formats
and shut down the p2p bridge if needed
George Joseph [Tue, 8 Aug 2017 18:33:50 +0000 (12:33 -0600)]
Make --with-pjproject-bundled the default for Asterisk 15
'--with-pjproject-bundled' is now the default when running
./configure. It can be disabled with '--without-pjproject-bundled'.
To make building without an internet connection easier, a new
./configure option '--with-download-cache' was added that sets
the cache for externals (like pjproject, the codecs and the DPMA),
AND the sounds files. It can also be specified as an environment
variable named "AST_DOWNLOAD_CACHE". The existing
'--with-sounds-cache' option / SOUNDS_CACHE_DIR env variable and
'--with-externals-cache' option / EXTERNALS_CACHE_DIR env variable
remain and if specified, will override '--with-downloads-cache'.
Joshua Colp [Sat, 5 Aug 2017 11:36:49 +0000 (11:36 +0000)]
res_pjsip_session: Release media resources on session end quicker.
A change was made long ago where the session was kept around
until the underlying INVITE session had been destroyed. This
had the side effect of also keeping the underlying media resources
around for this time as well.
This change ensures that when we are told to terminate the
session we immediately release any media sessions associated
with it.
Joshua Colp [Sun, 6 Aug 2017 16:15:34 +0000 (16:15 +0000)]
bridge: Fix stream topology/participant locking and video misrouting.
This change fixes a few locking issues and some video misrouting.
1. When accessing the stream topology of a channel the channel lock
must be held to guarantee the topology remains valid.
2. When a channel was joined to a bridge the bridge specific
implementation for stream mapping was not invoked, causing video
to be misrouted for a brief period of time.
Kevin Harwell [Fri, 4 Aug 2017 21:47:30 +0000 (16:47 -0500)]
res_pjsip_session/_sdp_rtp: Handling of 'msid' is incorrect
Currently, the handling of the msid attribute is not quite right. According to
the spec the msid's between the offer/answer are not dependent upon one another.
Meaning the same msid's given in an offer do not have to be returned in the
answer for a given stream. And they probably shouldn't be (copied/reused) since
this can potentially cause some browser side confusion.
This patch generates new msids when both an offer and answer are sent from
Asterisk. However, Asterisk does reuse the original msid it sent out for a
reinvite. Also audio+video streams are paired together by sharing the same
stream id, but a different track id.
Corey Farrell [Fri, 4 Aug 2017 01:58:25 +0000 (21:58 -0400)]
Correct some leaks in unit tests.
* chan_sip: channel in test_sip_rtpqos_1.
* test_config: config hook, config info and global config holder.
* test_core_format: format in format_attribute_set_without_interface.
* test_stream: unneeded frame duplication.
* test_taskprocessor: task_data.
projects / thirdparty / asterisk.git / log
