3893 Commits

Author SHA1 Message Date
George Joseph
01dc630b8c GCC12: Fixes for 16+
Most issues were in stringfields and had to do with comparing
a pointer to an constant/interned string with NULL.  Since the
string was a constant, a pointer to it could never be NULL so
the comparison was always "true".  gcc now complains about that.

There were also a few issues where determining if there was
enough space for a memcpy or s(n)printf which were fixed
by defining some of the involved variables as "volatile".

There were also a few other miscellaneous fixes.

ASTERISK-30044

Change-Id: Ia081ca1bcfb329df6487c4660aaf1944309eb570
2022-05-09 07:51:58 -05:00
Mark Petersen
a107ee8616 chan_sip.c Session timers get removed on UPDATE
If Asterisk receives a SIP REFER with Session-Timers UAC
maintain Session-Timers when sending UPDATE"

ASTERISK-29843

Change-Id: I8e9a21c13bf757fa34d778f49ba3cf859b29ae5c
2022-04-27 03:02:57 -05:00
Mark Petersen
edaf12872b chan_sip: SIP route header is missing on UPDATE
if Asterisk need to send an UPDATE before answer
on a channel that uses Record-Route:
it will not include a Route header

ASTERISK-29955

Change-Id: Id1920ecbfea7739a038b14dc94487ecfe7b57eef
2022-04-26 16:46:31 -05:00
Mark Petersen
e03b313fe9 chan_sip.c Fix pickup on channel that are in AST_STATE_DOWN
resolve issue with pickup on device that uses "183" and not "180"

ASTERISK-29832

Change-Id: I4c7d223870f8ce9a7354e0f73d4e4cb2e8b58841
2022-02-01 08:13:44 -06:00
Alexander Traud
0398daf4cb progdocs: Fix grouping for latest Doxygen.
Since Doxygen 1.8.16, a special comment block is required. Otherwise
(pure C comment), the group command is ignored. Additionally, several
unbalanced group commands were fixed.

ASTERISK-29732

Change-Id: I780ed8e0e8acdbdd8f8b75fb7baf5ef657af7a3f
2021-12-02 10:25:37 -06:00
Naveen Albert
6296f645a2 documentation: Standardize examples
Most examples in the XML documentation use the
example tag to demonstrate examples, which gets
parsed specially in the Wiki to make it easier
to follow for users.

This fixes a few modules to use the example
tag instead of vanilla para tags to bring them
in line with the standard syntax.

ASTERISK-29777 #close

Change-Id: I9acb6cc5faf1d220e73c6dd28592371d768d279b
2021-11-30 11:49:38 -05:00
Alexander Traud
10a0e3d4d6 channels: Fix for Doxygen.
ASTERISK-29762

Change-Id: Ia8811ac12b93ff8c18164699c6fbc604cb0a23f7
2021-11-19 09:07:51 -06:00
Josh Soref
636d3dc4be channels: Spelling fixes
Correct typos of the following word families:

appease
permanently
overriding
residue
silliness
extension
channels
globally
reference
japanese
group
coordinate
registry
information
inconvenience
attempts
cadence
payloads
presence
provisioning
mimics
behavior
width
natively
syslabel
not owning
unquelch
mostly
constants
interesting
active
unequipped
brodmann
commanding
backlogged
without
bitstream
firmware
maintain
exclusive
practically
structs
appearance
range
retransmission
indication
provisional
associating
always
whether
cyrillic
distinctive
components
reinitialized
initialized
capability
switches
occurring
happened
outbound

ASTERISK-29714

Change-Id: Ife52ee89cd2170b684fa651ca72b1cb911a57339
2021-11-15 17:14:36 -06:00
Joshua C. Colp
68adc2304f policy: Add deprecation and removal versions to modules.
app_meetme is deprecated in 19, to be removed in 21.
app_osplookup is deprecated in 19, to be removed in 21.
chan_alsa is deprecated in 19, to be removed in 21.
chan_mgcp is deprecated in 19, to be removed in 21.
chan_skinny is deprecated in 19, to be removed in 21.
res_pktccops is deprecated in 19, to be removed in 21.
cdr_mysql was deprecated in 1.8, to be removed in 19.
app_mysql was deprecated in 1.8, to be removed in 19.
app_ices was deprecated in 16, to be removed in 19.
app_macro was deprecated in 16, to be removed in 21.
app_fax was deprecated in 16, to be removed in 19.
app_url was deprecated in 16, to be removed in 19.
app_image was deprecated in 16, to be removed in 19.
app_nbscat was deprecated in 16, to be removed in 19.
app_dahdiras was deprecated in 16, to be removed in 19.
cdr_syslog was deprecated in 16, to be removed in 19.
chan_oss was deprecated in 16, to be removed in 19.
chan_phone was deprecated in 16, to be removed in 19.
chan_sip was deprecated in 17, to be removed in 21.
chan_nbs was deprecated in 16, to be removed in 19.
chan_misdn was deprecated in 16, to be removed in 19.
chan_vpb was deprecated in 16, to be removed in 19.
res_config_sqlite was deprecated in 16, to be removed in 19.
res_monitor was deprecated in 16, to be removed in 21.
conf2ael was deprecated in 16, to be removed in 19.
muted was deprecated in 16, to be removed in 19.

ASTERISK-29548
ASTERISK-29549
ASTERISK-29550
ASTERISK-29551
ASTERISK-29552
ASTERISK-29553
ASTERISK-29554
ASTERISK-29555
ASTERISK-29557
ASTERISK-29558
ASTERISK-29559
ASTERISK-29560
ASTERISK-29561
ASTERISK-29562
ASTERISK-29563
ASTERISK-29564
ASTERISK-29565
ASTERISK-29566
ASTERISK-29567
ASTERISK-29568
ASTERISK-29569
ASTERISK-29570
ASTERISK-29571
ASTERISK-29572
ASTERISK-29573
ASTERISK-29574

Change-Id: Ic3bee31a10d42c4b3bbc913d893f7b2a28a27131
2021-08-16 11:48:40 -05:00
Naveen Albert
11e61217a0 chan_sip: Expand hook flash recognition.
Some ATAs send hook flash events as application/hook-flash, rather than a DTMF
event. Now, we also recognize hook-flash as a flash event.

ASTERISK-29370

Change-Id: I1c3b82a040dff3affcd94bad8ce33edc90c04725
2021-05-13 09:50:02 -04:00
George Joseph
63c25d3821 Updates for the MessageSend Dialplan App
Enhancements:

 * The MessageSend dialplan application now takes an optional
   third argument that can set the message's "To" field on
   outgoing messages.  It's an alternative to using the
   MESSAGE(to) dialplan function.

   NOTE: No channel driver currently implements this field.  A
   follow-on commit for res_pjsip_messaging will implement it for
   the chan_pjsip channel driver.

 * To prevent confusion with the first argument, currently named
   "to", it's been renamed to "destination". Its function,
   creating the request URI, hasn't changed.

 * The documentation for MessageSend was updated to be
   more clear about the parameters and how they interact
   the MESSAGE() dialplan function.

 * With the rename of MessageSend's first parameter, and the fact
   that message.c references <info> elements in chan_sip.c,
   res_pjsip_messaging.c and res_xmpp, they each needed
   documentation updates to use MessageDestinationInfo instead of
   MessageToInfo.

 * appdocsxml.dtd was updated to include a missing element
   declaration for "dataType".  This was showing up as an error
   in Eclipse's dtd editor.

 * Despite the changes in this commit, there should be
   no impact to current users of MessageSend.

Change-Id: I6fb5b569657a02866a66ea352fd53d30d8ac965a
2021-05-06 06:24:27 -05:00
Alexander Traud
99666117be chan_sip: Filter pass-through audio/video formats away, again.
Instead of looking for pass-through formats in the list of transcodable
formats (which is going to find nothing), go through the result which
is going to be the jointcaps of the tech_pvt of the channel. Finally,
only with that list, ast_format_cap_remove(.) is going to succeed.

This restores the behaviour of Asterisk 1.8. However, it does not fix
ASTERISK_29282 because that issue report is about chan_sip and PJSIP.
Here, only chan_sip is fixed because PJSIP does not even call
ast_rtp_instance_available_formats -> ast_translate_available_format.

Change-Id: Icade2366ac2b82935b95a9981678c987da2e8c34
2021-02-23 12:41:56 -06:00
Alexander Traud
2bcec10db8 chan_sip: Allow [peer] without audio (text+video).
Two previous commits, 620d9f4 and 6d980de, allow to set up a call
without audio, again. That was introduced originally with commit f04d5fb
but changed and broke over time. The original commit missed one
scenario: A [peer] section in sip.conf, which does not allow audio at
all. In that case, chan_sip rejected the call, although even when the
requester offered no audio. Now, chan_sip does not check whether there
is no audio format but checks whether there is no format in general. In
other words, if there is at least one format to offer, the call succeeds.

However, to prevent calls with no-audio, chan_sip still rejects calls
when both call parties (caller = requester of the call *and* callee =
[peer] section in sip.conf) included audio. In such a case, it is
expected that the call should have audio.

ASTERISK-29280

Change-Id: I0fb74faf51ef22a60c10b467df6a4d1c1943b73e
2021-02-12 07:18:50 -06:00
Alexander Traud
4a341f288d chan_sip: Set up calls without audio (text+video), again.
The previous commit 6d980de fixed this issue in the core of Asterisk.
With that, each channel technology can be used without audio
theoretically. Practically, the channel-technology driver chan_sip
turned out to have an invalid check preventing that. chan_sip tested
whether there is at least one audio format. However, chan_sip has to
test whether there is at least one format. More cannot be tested while
requesting chan_sip because only the [general] capabilities but not the
[peer] caps are known yet. And the [peer] caps might not be a subset or
show any intersection with the [general] caps. This change here fixes
this.

The original commit f04d5fb, thirteen years ago, contained a software
bug as it passed ANY audio capability to the channel-technology driver.
Instead, it should have passed NO audio format. Therefore, this
addressed issue here was not noticed in Asterisk 1.6.x and Asterisk 1.8.
Then, Asterisk 10 changed that from ANY to NO, but nobody reported since
then.

ASTERISK-29265

Change-Id: Ic16a3bf13cd1b5c4fc4041ed74961177d96b600f
2021-02-03 03:02:16 -06:00
Alexander Traud
7dc0cded86 chan_sip: SDP: Reject audio streams correctly.
This completes the fix for ASTERISK_24543. Only when the call is an
outgoing call, consult and append the configured format capabilities
(p->caps). When all audio formats got rejected the negotiated format
capabilities (p->jointcaps) contain no audio formats for incoming
calls. This is required when there are other accepted media streams.

ASTERISK-29258

Change-Id: I8bab31c7f3f3700dce204b429ad238a524efebb9
2021-01-27 10:14:43 -06:00
Alexander Traud
34b0960310 chan_sip: SDP: Sidestep stream parsing when its media is disabled.
Previously, chan_sip parsed all known media streams in an SDP offer
like video (and text) even when videosupport=no (and textsupport=no).
This wasted processor power. Furthermore, chan_sip accepted SDP offers,
including no audio but just video (or text) streams although
videosupport=no (or textsupport=no). Finally, chan_sip denied the whole
offer instead of individual streams when they had encryption (SDES-sRTP)
unexpectedly enabled.

ASTERISK-29238
ASTERISK-29237
ASTERISK-29222

Change-Id: Ie49e4e2a11f0265f914b684738348ba8c0f89755
2021-01-13 08:29:37 -06:00
Alexander Traud
f667c5a781 chan_sip: Remove unused sip_socket->port.
12 years ago, with ASTERISK_12115 the last four get/uses of socket.port
vanished. However, the struct member itself and all seven set/uses
remained as dead code.

ASTERISK-28798

Change-Id: Ib90516a49eca3d724a70191278aaf2144fb58c59
2020-11-19 15:36:58 -06:00
Alexander Traud
334661601a Compiler fixes for GCC when printf %s is NULL
ASTERISK-29146

Change-Id: Ib04bdad87d729f805f5fc620ef9952f58ea96d41
2020-11-03 15:46:44 -06:00
Alexander Traud
951ce0524d chan_sip: On authentication, pick MD5 for sure.
RFC 8760 added new digest-access-authentication schemes. Testing
revealed that chan_sip does not pick MD5 if several schemes are offered
by the User Agent Server (UAS). This change does not implement any of
the new schemes like SHA-256. This change makes sure, MD5 is picked so
UAS with SHA-2 enabled, like the service www.linphone.org/freesip, can
still be used. This should have worked since day one because SIP/2.0
already envisioned several schemes (see RFC 3261 and its augmented BNF
for 'algorithm' which includes 'token' as third alternative; note: if
'algorithm' was not present, MD5 is still assumed even in RFC 7616).

Change-Id: I61ca0b1f74b5ec2b5f3062c2d661cafeaf597fcd
2020-11-03 14:40:35 -06:00
Dennis Buteyn
9c6d14b26b chan_sip: Clear ToHost property on peer when changing to dynamic host
The ToHost parameter was not cleared when a peer's host value was
changed to dynamic. This causes invites to be sent to the original host.

ASTERISK-29011 #close

Change-Id: I9678d512741f71baca8f131a65b7523020b07d5c
2020-08-18 09:01:15 -05:00
Frederic LE FOLL
5415606846 chan_sip: chan_sip does not process 400 response to an INVITE.
chan_sip handle_response() function, for a 400 response to an INVITE,
calls handle_response_invite() and does not generate ACK.
handle_response_invite() does not recognize 400 response and has no
default response processing for unexpected responses, thus it does not
generate ACK either.
The ACK on response repetition comes from handle_response() mechanism
"We must re-send ACKs to re-transmitted final responses".

According to code history, 400 response specific processing was
introduced with commit
"channels/chan_sip: Add improved support for 4xx error codes"
This commit added support for :
- 400/414/493 in handle_response_subscribe() handle_response_register()
  and handle_response().
- 414/493 only in handle_response_invite().

This fix adds 400 response support in handle_response_invite().

ASTERISK-28957

Change-Id: Ic71a087e5398dfc7273946b9ec6f9a36960218ad
2020-06-25 09:22:39 -05:00
Alexander Traud
d53925c98a chan_sip: externhost/externaddr with non-default TCP/TLS ports.
ASTERISK-28372
Reported by: Anton Satskiy

ASTERISK-24428
Reported by: sstream

Change-Id: I2b7432a9bf3b09dc8515297ff955636db7a6224c
2020-04-20 13:44:17 -05:00
Alexander Traud
338990d973 chan_sip: DiffServ/ToS not only on UDP but also on TCP and TLS sockets.
ASTERISK-27195
Reported by: Joshua Roys

Change-Id: I6e72ecb874200dec7a3865c7babaf5ac0d3101de
2020-04-16 10:35:20 -05:00
traud
9e0995b1b7 chan_sip: TCP/TLS client without server.
It is possible to configure a TCP/TLS client without having a TCP/TLS
server. In that case, no error or warning was printed but the headers
Contact and Via in SIP REGISTER were "(null)".

ASTERISK-28798

Change-Id: I387ca5cb6a65f1eb675a29c5e41df8ec6c242ab2
2020-04-13 16:48:01 -05:00
Joshua C. Colp
ebe7749127 chan_sip: Send 403 when ACL fails.
Change-Id: I0910c79196f2b7c7e5ad6f1db95e83800ac737a2
2020-03-31 10:12:23 -05:00
Walter Doekes
34ce90a9e7 chan_sip: Return 503 if we're out of RTP ports
If you're for some reason out of RTP ports, chan_sip would previously
responde to an INVITE with a 403, which will fail the call.

Now, it returns a 503, allowing the device/proxy to retry the call on a
different machine.

ASTERISK-28718

Change-Id: I968dcf6c1e30ecddcce397dcda36db727c83ca90
2020-02-05 06:32:59 -06:00
Walter Doekes
ad9a40a539 chan_sip: Always process updated SDP on media source change
Fixes no-audio issues when the media source is changed and
strictrtp is enabled (default).

If the peer media source changes, the SDP session version also changes.
If it is lower than the one we had stored, chan_sip would ignore it.

This changeset keeps track of the remote media origin identifier,
comparing that as well. If it changes, the session version needn't be
higher for us to accept the SDP.

Common scenario where this would've caused problems: a separate media
gateway that informs the caller about premium rates before handing off
the call to the final destination.

(An alternative fix would be to set ignoresdpversion=yes on the peer.)

ASTERISK-28686

Change-Id: I88fdbc5aeb777b583e7738c084254c482a7776ee
2020-01-24 10:28:44 -06:00
Sean Bright
31027f33db chan_sip.c: Stop handling continuation lines after reading headers
lws2sws() does not stop trying to handle header continuation lines
even after all headers have been found. This is problematic if the
first character of a SIP message body is a space or tab character, so
we update to recognize the end of the message header.

ASTERISK-28693 #close
Reported by: Frank Matano

Change-Id: Idec8fa58545cd3fd898cbe0075d76c223f8d33df
2020-01-16 09:17:09 -06:00
Jean Aunis
82a870c8c7 chan_sip: voice frames are no longer transmitted after emitting a COLP
The SIP transaction state was reset when emitting an UPDATE or a re-INVITE
related to a COLP, preventing RTP packets to be emitted.

ASTERISK-28647

Change-Id: Ie7a30fa7a97f711e7ba6cc17f221a0993d48bd8b
2019-12-30 01:44:39 -06:00
Friendly Automation
7172230cd0 Merge "chan_sip: in case of tcp/tls, be less annoying about tx errors." into 16 2019-12-19 10:05:11 -06:00
Jaco Kroon
055737d645 chan_sip: in case of tcp/tls, be less annoying about tx errors.
chan_sip.c:3782 __sip_xmit: sip_xmit of 0x7f1478069230 (len 600) to
213.150.203.60:1492 returned -2: Interrupted system call

returned -2 implies this wasn't actually an OS error, so errno makes no
sense either.  Internal error was already logged higher up, and -2
generally means that either there isn't a valid connection available, or
the pipe notification failed, and that is already correctly logged.

ASTERISK-28651 #close

Change-Id: I46eb82924beeff9dfd86fa6c7eb87d2651b950f2
Signed-off-by: Jaco Kroon <jaco@uls.co.za>
2019-12-07 13:58:32 +02:00
Frederic LE FOLL
31173f6586 chan_sip+native_bridge_rtp: no directmedia for ptime other than default ptime.
During capabilities selection (joint capabilities of us and peer,
configured capability for this peer, or general configured
capabilities), if sip_new() does not keep framing information,
then directmedia activation will fail for any framing different
from default framing.

ASTERISK-28637

Change-Id: I99257502788653c2816fc991cac7946453082466
2019-11-27 19:16:59 +01:00
Ben Ford
8cdaa93e65 chan_sip.c: Prevent address change on unauthenticated SIP request.
If the name of a peer is known and a SIP request is sent using that
peer's name, the address of the peer will change even if the request
fails the authentication challenge. This means that an endpoint can
be altered and even rendered unusuable, even if it was in a working
state previously. This can only occur when the nat option is set to the
default, or auto_force_rport.

This change checks the result of authentication first to ensure it is
successful before setting the address and the nat option.

ASTERISK-28589 #close

Change-Id: I581c5ed1da60ca89f590bd70872de2b660de02df
2019-11-21 09:46:05 -06:00
Sean Bright
518b6bfb5c channels: Allow updating variable value
When modifying an already defined variable in some channel drivers they
add a new variable with the same name to the list, but that value is
never used, only the first one found.

Introduce ast_variable_list_replace() and use it where appropriate.

ASTERISK-23756 #close
Patches:
  setvar-multiplie.patch submitted by Michael Goryainov

Change-Id: Ie1897a96c82b8945e752733612ee963686f32839
2019-09-12 15:58:49 -05:00
Francesco Castellano
6c59df17a5 chan_sip: Handle invalid SDP answer to T.38 re-invite
The chan_sip module performs a T.38 re-invite using a single media
stream of udptl, and expects the SDP answer to be the same.

If an SDP answer is received instead that contains an additional
media stream with no joint codec a crash will occur as the code
assumes that at least one joint codec will exist in this
scenario.

This change removes this assumption.

ASTERISK-28465

Change-Id: I8b02845b53344c6babe867a3f0a5231045c7ac87
2019-07-11 11:22:07 -05:00
Kevin Harwell
e3a758975d mwi core: Move core MWI functionality into its own files
There is enough MWI functionality to warrant it having its own 'c' and header
files. This patch moves all current core MWI data structures, and functions
into the following files:

main/mwi.h
main/mwi.c

Note, code was simply moved, and not modified. However, this patch is also in
preparation for core MWI changes, and additions to come.

Change-Id: I9dde8bfae1e7ec254fa63166e090f77e4d3097e0
2019-04-23 17:39:57 -05:00
Ben Ford
8961d9ca8b build: Fix compiler warnings/errors.
The compiler complained about a couple of variables that weren't
initialized but were being used. Initializing them to NULL resolves the
warnings/errors.

ASTERISK-28362 #close

Change-Id: I6243afc5459b416edff6bbf571b0489f6b852e4b
2019-04-03 09:36:42 -06:00
Sean Bright
d905602a04 chan_sip: Ensure 'qualifygap' isn't negative
Passing negative intervals to the scheduler rips a hole in the
space-time continuum.

ASTERISK-25792 #close
Reported by: Paul Sandys

Change-Id: Ie706f21cee05f76ffb6f7d89e9c867930ee7bcd7
2019-03-25 13:32:38 -06:00
Sean Bright
4860954540 Replace calls to strtok() with strtok_r()
strtok() uses a static buffer, making it not thread safe.

Change-Id: Icce265153e1e65adafa8849334438ab6d190e541
2019-03-07 16:42:22 -06:00
Giuseppe Sucameli
6071ad77f5 chan_sip: Fix leak using contact ACL
Free old peer's contactacl before overwrite it within build_peer.

ASTERISK-28194

Change-Id: Ie580db6494e50cee0e2a44b38e568e34116ff54c
2018-12-05 17:17:11 -05:00
Corey Farrell
ed7a5664b6 astobj2: Eliminate usage of legacy ao2_container_alloc routine.
Replace usage of ao2_container_alloc with ao2_container_alloc_hash or
ao2_container_alloc_list.

ao2_container_alloc is now restricted to modules only and is being
removed from Asterisk 17.

Change-Id: I0907d78bc66efc775672df37c8faad00f2f6c088
2018-11-21 09:56:12 -05:00
Joshua Colp
8d436a95e7 stasis: Add internal filtering of messages.
This change adds the ability for subscriptions to indicate
which message types they are interested in accepting. By
doing so the filtering is done before being dispatched
to the subscriber, reducing the amount of work that has
to be done.

This is optional and if a subscriber does not add
message types they wish to accept and set the subscription
to selective filtering the previous behavior is preserved
and they receive all messages.

There is also the ability to explicitly force the reception
of all messages for cases such as AMI or ARI where a large
number of messages are expected that are then generically
converted into a different format.

ASTERISK-28103

Change-Id: I99bee23895baa0a117985d51683f7963b77aa190
2018-11-18 15:08:07 -05:00
Jasper Hafkenscheid
7f6ac5dc2f chan_sip: Attempt ast_do_pickup in handle_invite_replaces
When a call pickup is performed using and invite with replaces header
the ast_do_pickup method is attempted and a PICKUP stasis message is sent.

ASTERISK-28081 #close
Reported-by: Luit van Drongelen

Change-Id: Ieb1442027a3ce6ae55faca47bc095e53972f947a
2018-11-02 10:21:37 -05:00
Corey Farrell
dee1165d31 astobj2: Eliminate usage of legacy container allocation macros.
These macros have been documented as legacy for a long time but are
still used in new code because they exist.  Remove all references to:
* ao2_container_alloc_options
* ao2_t_container_alloc_options
* ao2_t_container_alloc

These macro's are still available for use but only in modules.  Only
ao2_container_alloc remains due to it's use in over 100 places.

Change-Id: I1a26258b5bf3deb081aaeed11a0baa175c933c7a
2018-10-19 17:33:02 -04:00
Corey Farrell
5ea517f80e chan_sip: Tell module loader that chan_sip is extended support.
Change-Id: I33508c134b1be888b8884f5dcfee19087634e415
2018-10-10 07:38:08 -04:00
pk16208
681e115ff1 chan_sip: SipNotify on Chan_Sip vi AMI behave different to CLI
With tls and udp enabled asterisk generates a warning about sending
message via udp instead of tls.
sip notify command via cli works as expected and without warning.

asterisk has to set the connection information accordingly to connection
and not on presumption

ASTERISK-28057 #close

Change-Id: Ib43315aba1f2c14ba077b52d8c5b00be0006656e
2018-09-26 07:27:58 -05:00
hajekd
8811ab1803 chan_sip.c: chan_sip unstable with TLS after asterisk start or reloads
Fixes random asterisk crash on start or reload with TLS phones.

ASTERISK-28034 #close
Reported-by: David Hajek

Change-Id: I2a859f97dc80c348e2fa56e918214ee29521c4ac
2018-09-20 09:00:46 -05:00
Jaco Kroon
46442aa9e5 chan_sip: improved ip:port finding of peers for non-UDP transports.
Also remove function peer_ipcmp_cb since it's not used (according to
rmudgett).

Prior to b2c4e8660a (ASTERISK_27457)
insecure=port was the defacto standard.  That commit also prevented
insecure=port from being applied for sip/tcp or sip/tls.

Into consideration there are three sets of behaviour:

1.  "previous" - before the above commit.
2.  "current" - post above commit, pre this one.
3.  "new" - post this commit.

The problem that the above commit tried to address was guests over TCP.
It succeeded in doing that but broke transport!=udp with host!=dynamic.

This commit attempts to restore sane behaviour with respect to
transport!=udp for host!=dynamic whilst still retaining the guest users
over tcp.

It should be noted that when looking for a peer, two passes are made, the
first pass doesn't have SIP_INSECURE_PORT set for the searched-for peer,
thus looking for full matches (IP + Port), the second pass sets
SIP_INSECURE_PORT, thus expecting matches on IP only where the matched
peer allows for that (in the author's opinion:  UDP with insecure=port,
or any TCP based, non-dynamic host).

In previous behaviour there was special handling for transport=tcp|tls
whereby a peer would match during the first pass if the utilized
transport was TCP|TLS (and the peer allowed that specific transport).

This behaviour was wrong, or dubious at best.  Consider two dynamic tcp
peers, both registering from the same IP (NAT), in this case either peer
could match for connections from an IP.  It's also this behaviour that
prevented SIP guests over tcp.

The above referenced commit removed this behaviour, but kept applying
the SIP_INSECURE_PORT only to WS|WSS|UDP.  Since WS and WSS is also TCP
based, the logic here should fall into the TCP category.

This patch updates things such that the previously non-explicit (TCP
behaviour) transport test gets performed explicitly (ie, matched peer
must allow for the used transport), as well as the indeterministic
source-port nature of the TCP protocol is taken into account.  The new
match algorithm now looks like:

1.  As per previous behaviour, IP address is matched first.

2.  Explicit filter with respect to transport protocol, previous
    behaviour was semi-implied in the test for TCP pure IP match - this now
    made explicit.

3.  During first pass (without SIP_INSECURE_PORT), always match on port.

4.  If doing UDP, match if matched against peer also has
    SIP_INSECURE_PORT, else don't match.

5.  Match if not a dynamic host (for non-UDP protocols)

6.  Don't match if this is WS|WSS, or we can't trust the Contact address
    (presumably due to NAT)

7.  Match (we have a valid Contact thus if the IP matches we have no
    choice, this will likely only apply to non-NAT).

To logic-test this we need a few different scenarios.  Towards this end,
I work with a set number of peers defined in sip.conf:

[peer1]
host=1.1.1.1
transport=tcp

[peer2]
host=1.1.1.1
transport=udp

[peer3]
host=1.1.1.1
port=5061
insecure=port
transport=udp

[peer4]
host=1.1.1.2
transport=udp,tcp

[peer5]
host=dynamic
transport=udp,tcp

Test cases for UDP:

1 - incoming UDP request from 1.1.1.1:
  - previous:
    - pass 1:
      * peer1 or peer2 if from port 5060 (indeterminate, depends on peer
        ordering)
      * peer3 if from port 5061
      * peer5 if registered from 1.1.1.1 and source port matches
    - pass 2:
      * peer3
  - current: as per previous.
  - new:
    - pass 1:
      * peer2 if from port 5060
      * peer3 if from port 5061
      * peer5 if registered from 1.1.1.1 and source port matches
    - pass 2:
      * peer3

2 - incoming UDP request from 1.1.1.2:
  - previous:
    - pass 1:
      * peer5 if registered from 1.1.1.2 and port matches
      * peer4 if source port is 5060
    - pass 2:
      * no match (guest)
  - current: as previous.
  - new as previous (with the variation that if peer5 didn't have udp as
          allowed transport it would not match peer5 whereas previous
          and current code could).

3 - incoming UDP request from anywhere else:
  - previous:
    - pass 1:
      * peer5 if registered from that address and source port matches.
    - pass 2:
      * peer5 if insecure=port is additionally set.
      * no match (guest)
  - current - as per previous
  - new - as per previous

Test cases for TCP based transports:

4 - incoming TCP request from 1.1.1.1
  - previous:
    - pass 1 (indeterministic, depends on ordering of peers in memory):
      * peer1; or
      * peer5 if peer5 registered from 1.1.1.1 (irrespective of source port); or
      * peer2 if the source port happens to be 5060; or
      * peer3 if the source port happens to be 5061.
    - pass 2: cannot happen since pass 1 will always find a peer.
  - current:
    - pass 1:
      * peer1 or peer2 if from source port 5060
      * peer3 if from source port 5060
      * peer5 if registered as 1.1.1.1 and source port matches
    - pass 2:
      * no match (guest)
  - new:
    - pass 1:
      * peer 1 if from port 5060
      * peer 5 if registered and source port matches
    - pass 2:
      * peer 1

5 - incoming TCP request from 1.1.1.2
  - previous (indeterminate, depends on ordering):
    - pass 1:
      * peer4; or
      * peer5 if peer5 registered from 1.1.1.2
    - pass 2: cannot happen since pass 1 will always find a peer.
  - current:
    - pass 1:
      * peer4 if source port is 5060
      * peer5 if peer5 registered as 1.1.1.2 and source port matches
    - pass 2:
      * no match (guest).
  - new:
    - pass 1:
      * peer4 if source port is 5060
      * peer5 if peer5 registered as 1.1.1.2 and source port matches
    - pass 2:
      * peer4

6 - incoming TCP request from anywhere else:
  - previous:
    - pass 1:
      * peer5 if registered from that address
    - pass 2: cannot happen since pass 1 will always find a peer.
  - current:
    - pass 1:
      * peer5 if registered from that address and port matches.
    - pass 2:
      * no match (guest)
  - new: as per current.

It should be noted the test cases don't make explicit mention of TLS, WS
or WSS.  WS and WSS previously followed UDP semantics, they will now
enforce source port matching.  TLS follow TCP semantics.

The previous commit specifically tried to address test-case 6, but broke
test-cases 4 and 5 in the process.

ASTERISK-27881 #close

Change-Id: I61a9804e4feba9c7224c481f7a10bf7eb7c7f2a2
2018-08-24 02:31:59 -05:00
Joshua Colp
25764691b0 Merge "netsock2: Add ast_sockaddr_resolve_first_af to netsock2 public API" 2018-05-23 12:10:13 -05:00
Matthew Fredrickson
9f9dce05b2 netsock2: Add ast_sockaddr_resolve_first_af to netsock2 public API
This function originally was used in chan_sip to enable some simplifying
assumptions and eventually was copy and pasted into res_pjsip_logger and
res_hep.  Since it's replicated in three places, it's probably best to
move it into the public netsock2 API for these modules to use.

Change-Id: Id52e23be885601c51d70259f62de1a5e59d38d04
2018-05-21 11:03:10 -05:00