The HTTP request processing in res_http_websocket allocates additional
space on the stack for various headers received during an Upgrade request.
An attacker could send a specially crafted request that causes this code
to overflow the stack, resulting in a crash.
* No longer allocate memory from the stack in a loop to parse the header
values. NOTE: There is a slight API change when using the passed in
strings as is. We now require the passed in strings to no longer have
leading or trailing whitespace. This isn't a problem as the only callers
have already done this before passing the strings to the affected
function.
ASTERISK-28013 #close
Change-Id: Ia564825a8a95e085fd17e658cb777fe1afa8091a
* Create the stasis message object without a lock as it is immutable.
* Create the stasis message type object without a lock as it is immutable.
* Creating the stasis message type could crash if the passed in type name
is NULL and REF_DEBUG is enabled. Added missing NULL check when passing
the ao2 object tag string.
Change-Id: I28763c58bb9f0b427c11971d0103bf94055e7b32
This change brings in PJSIP 2.8, removes all the patches
that were merged upstream, and makes a minor change to
support a breaking change that was done.
ASTERISK-28059
Change-Id: I5097772b11b0f95c3c1f52df6400158666f0a189
In the original commit introducing the feature the column in the alembic
script was called 'suppress_q850_reason_header'.
In the code however the option is called 'suppress_q850_reason_headers'
(trailing 's'). This leads to errors when ARI push configuration is used.
Change-Id: Ie84808adbca6fcc9136556e4f5d741adbef5d14f
app_voicemail was using the stasis cache to build and maintain a
list of mailboxes that had subscribers. It then used this list
to determine if a mailbox should be polled for new messages if
polling was enabled. For this to work, stasis had to cache every
subscription and unsubscription to the mailbox which caused a lot of
overhead, both cpu and memory related.
Since polling is only required when changes are being made to
mailboxes outside of app_voicemail and since the number of mailboxes
that don't have any subscribers is likely to be very low, all
mailboxes are now polled instead of just the ones with subscribers.
This paves the way for disabling the caching of stasis subscription
change messages.
Also fixed cleanup in some of the unit tests that not only left
test users in the users list but also caused segfaults if the tests
were run more than once.
ASTERISK-27121
Change-Id: I5cceb737246949f9782955c64425b8bd25a9e9ee
Given a scenario where a session refresh was done with a removed
stream we would always add a removed stream to the outgoing SDP
even if one did not already exist.
This change makes it so that a removed stream is only placed into
the SDP if one already exists.
ASTERISK-28047
Change-Id: Ibb97d21cdeb87a8acae0c720861b0ff255708442
This is removed in favor of ./configure --with-jansson-bundled. The
install-unpackaged command would only install jansson once, so once
installed it would never update, where the bundled copy will be kept up
to date.
Change-Id: Ideab1f65419608d3795aa608e9da873823cc42d3
Both pjsip_tx_data.tp_info.dst_name and pjsip_rx_data.pkt_info.src_name
store IPv6 addresses without enclosing brackets. This causes some log
output to be confusing because it is difficult to separate the IPv6
address from a port specification.
* Use pj_sockaddr_print() along with pjsip_tx_data.tp_info.dst_addr and
pjsip_rx_data.pkt_info.src_addr where possible for consistent IPv6
output.
* When a pj_sockaddr is not available, explicitly wrap IPv6 addresses
in brackets.
* When assigning pjsip_rx_data.pkt_info.src_name ourselves, make sure
to also set pjsip_rx_data.pkt_info.src_addr.
Change-Id: I5cfe997ced7883862a12b9c7d8551d76ae02fcf8
Can't do anonymous http checkout from Security-testsuite.
Need to use same credentials as the gerrit review checkout.
Change-Id: I87af68c995cb8926f5e87f9af245600d76984f05
Since app_voicemail no longer uses the cache to maintain its state
there is no longer a need to cache these messages.
ASTERISK-27121
Change-Id: I321c708505f5ad8d00e1b0afc4c27dc2ac12ecb4
As they're not actively used, they only grow stale. The moduleinfo field itself
is kept in Asterisk 13/15 for ABI compatibility.
ASTERISK-28046 #close
Change-Id: I8df66a7007f807840414bb348511a8c14c05a9fc
The documentation already specified EVENT_FLAG_DIALPLAN for this
event, but the implementation was using EVENT_FLAG_CALL.
Using EVENT_FLAG_DIALPLAN allows AMI clients to opt out of receiving
this highly verbose event.
ASTERISK-28033
Change-Id: I45b3119f30e4dbc17b49831f2b1a4f2c1beadafe
The bundled version of pjproject has a patch for Solaris compatability
that changes the definition of various socket structures which we need
to account for when compiling against a non-bundled version.
ASTERISK-28049 #close
Change-Id: Ia1ea47c433fc2d915115193ee889a752373925f0
If Asterisk is built using a DESTDIR this will cause the bundled jansson
to be installed to an unexpected location and we will fail to find it.
Change-Id: Id033e2813261e0d45232383d44c6391122169548
On MOH activation, moh_files_readframe() is called while the current
stream attached to the channel is NULL and it calls ast_moh_files_next()
immediately. However, it won't call ast_moh_files_next() again if sample
reading fails. The failure may occur because res_musiconhold retains the
last sample reading position in the channel data and MOH during the
previous hold/retrieve just reached EOF. Obviously, a bit of bad luck is
required here.
* Restructured moh_files_readframe() to try a second time to start MOH if
there was no stream setup and the saved position was at EOF. Also added
comments describing what is going on for each step.
ASTERISK-28029
Change-Id: I1508cf2c094f8feca22d6f76deaa9fdfa9944860
Generators provide such functionality as tone generation or
silence generation. RTCP frames provide RTCP information and
should not stop generators from operating.
ASTERISK-28005
Change-Id: Ieadada07b068a7aa426e8763f1b73a18e1ac34a9
Currently, to convert from a pj_sockaddr to an ast_sockaddr, the address
needs to be rendered to a string and then parsed into the correct
structure. This also involves a call to getaddrinfo(3). The same is true
for the inverse operation.
Instead, because we know the internal structure of both ast_sockaddr and
pj_sockaddr, we can translate directly between the two without the
need for an intermediate string.
Change-Id: If0fc4bba9643f755604c6ffbb0d7cc46020bc761
The stasis cache provides a way to reconstruct the current state
of topic subscribers. Unfortunately, since every subscribe and
unsubscribe is cached, the cache continues to grow unabated while
asterisk is running. This patch removes subscribe messages from
the cache when the corresponding unsubscribe is received.
This patch also registers the cache containers with ao2 so that if
AO2_DEBUG is turned on, you can list the container and get its
stats from the CLI.
ASTERISK-27121
Change-Id: I3d18905e477f3721815da91f30da8d3fbb2d4f56
Added decline if extensions.conf file not available
when loading pbx_config, and also made sure everything
gets properly unregistered and/or destroyed on unload.
Change-Id: Ib00665106043b1be5148ffa7a477396038915854
Added a check when we receive a HTTP request line or header line that is
too long. We now return an error response to the sender because we are
not able to process the request.
Change-Id: I6df2705435fd7dde4d5d3bdf7acec859cfb7c12d
