Compare commits

...

3 Commits

Author SHA1 Message Date
George Joseph
9e5d6d7eb2 Update for certified/13.13-cert9 2017-12-13 09:34:09 -05:00
Joshua Colp
3eea735a39 AST-2017-012: Place single RTCP report block at beginning of report.
When the RTCP code was transitioned over to Stasis a code change
was made to keep track of how many reports are present. This count
controlled where report blocks were placed in the RTCP report.

If a compound RTCP packet was received this logic would incorrectly
place a report block in the wrong location resulting in a write
to an invalid location.

This change removes this counting logic and always places the report
block at the first position. If in the future multiple reports are
supported the logic can be extended but for now keeping a count
serves no purpose.

ASTERISK-27382
ASTERISK-27429

Change-Id: Iad6c8a9985c4b608ef493e19c421211615485116
2017-12-13 07:12:14 -06:00
Richard Mudgett
7c0bc72972 CDR: Fix deadlock setting some CDR values.
Setting channel variables with the AMI Originate action caused a deadlock
when you set CDR(amaflags) or CDR(accountcode).  This path has the channel
locked when the CDR function is called.  The CDR function then
synchronously passes the job to a stasis thread.  The stasis handling
function then attempts to lock the channel.  Deadlock results.

* Avoid deadlock by making the CDR function handle setting amaflags and
accountcode directly on the channel rather than passing it off to the CDR
processing code under a stasis thread to do it.

* Made the CHANNEL function and the CDR function process amaflags the same
way.

* Fixed referencing the wrong message type in cdr_prop_write().

ASTERISK-27460

Change-Id: I5eacb47586bc0b8f8ff76a19bd92d1dc38b75e8f
2017-12-06 16:05:34 -06:00
7 changed files with 183 additions and 90 deletions

View File

@@ -1 +1 @@
certified/13.13-cert8
certified/13.13-cert9

View File

@@ -1,3 +1,52 @@
2017-12-13 14:34 +0000 Asterisk Development Team <asteriskteam@digium.com>
* asterisk certified/13.13-cert9 Released.
2017-11-30 10:12 +0000 [3eea735a39] Joshua Colp <jcolp@digium.com>
* AST-2017-012: Place single RTCP report block at beginning of report.
When the RTCP code was transitioned over to Stasis a code change
was made to keep track of how many reports are present. This count
controlled where report blocks were placed in the RTCP report.
If a compound RTCP packet was received this logic would incorrectly
place a report block in the wrong location resulting in a write
to an invalid location.
This change removes this counting logic and always places the report
block at the first position. If in the future multiple reports are
supported the logic can be extended but for now keeping a count
serves no purpose.
ASTERISK-27382
ASTERISK-27429
Change-Id: Iad6c8a9985c4b608ef493e19c421211615485116
2017-12-05 18:04 +0000 [7c0bc72972] Richard Mudgett <rmudgett@digium.com>
* CDR: Fix deadlock setting some CDR values.
Setting channel variables with the AMI Originate action caused a deadlock
when you set CDR(amaflags) or CDR(accountcode). This path has the channel
locked when the CDR function is called. The CDR function then
synchronously passes the job to a stasis thread. The stasis handling
function then attempts to lock the channel. Deadlock results.
* Avoid deadlock by making the CDR function handle setting amaflags and
accountcode directly on the channel rather than passing it off to the CDR
processing code under a stasis thread to do it.
* Made the CHANNEL function and the CDR function process amaflags the same
way.
* Fixed referencing the wrong message type in cdr_prop_write().
ASTERISK-27460
Change-Id: I5eacb47586bc0b8f8ff76a19bd92d1dc38b75e8f
2017-12-01 19:42 +0000 Asterisk Development Team <asteriskteam@digium.com>
* asterisk certified/13.13-cert8 Released.

View File

@@ -1,15 +1,19 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><title>Release Summary - asterisk-certified/13.13-cert8</title><h1 align="center"><a name="top">Release Summary</a></h1><h3 align="center">asterisk-certified/13.13-cert8</h3><h3 align="center">Date: 2017-12-01</h3><h3 align="center">&lt;asteriskteam@digium.com&gt;</h3><hr><h2 align="center">Table of Contents</h2><ol>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><title>Release Summary - asterisk-certified/13.13-cert9</title><h1 align="center"><a name="top">Release Summary</a></h1><h3 align="center">asterisk-certified/13.13-cert9</h3><h3 align="center">Date: 2017-12-13</h3><h3 align="center">&lt;asteriskteam@digium.com&gt;</h3><hr><h2 align="center">Table of Contents</h2><ol>
<li><a href="#summary">Summary</a></li>
<li><a href="#contributors">Contributors</a></li>
<li><a href="#closed_issues">Closed Issues</a></li>
<li><a href="#diffstat">Diffstat</a></li>
</ol><hr><a name="summary"><h2 align="center">Summary</h2></a><center><a href="#top">[Back to Top]</a></center><p>This release has been made to address one or more security vulnerabilities that have been identified. A security advisory document has been published for each vulnerability that includes additional information. Users of versions of Asterisk that are affected are strongly encouraged to review the advisories and determine what action they should take to protect their systems from these issues.</p><p>Security Advisories:</p><ul>
<li><a href="http://downloads.asterisk.org/pub/security/AST-2017-013.html">AST-2017-013</a></li>
</ul><p>The data in this summary reflects changes that have been made since the previous release, asterisk-certified/13.13-cert7.</p><hr><a name="contributors"><h2 align="center">Contributors</h2></a><center><a href="#top">[Back to Top]</a></center><p>This table lists the people who have submitted code, those that have tested patches, as well as those that reported issues on the issue tracker that were resolved in this release. For coders, the number is how many of their patches (of any size) were committed into this release. For testers, the number is the number of times their name was listed as assisting with testing a patch. Finally, for reporters, the number is the number of issues that they reported that were affected by commits that went into this release.</p><table width="100%" border="0">
<li><a href="http://downloads.asterisk.org/pub/security/AST-2017-012.html">AST-2017-012</a></li>
</ul><p>The data in this summary reflects changes that have been made since the previous release, asterisk-certified/13.13-cert8.</p><hr><a name="contributors"><h2 align="center">Contributors</h2></a><center><a href="#top">[Back to Top]</a></center><p>This table lists the people who have submitted code, those that have tested patches, as well as those that reported issues on the issue tracker that were resolved in this release. For coders, the number is how many of their patches (of any size) were committed into this release. For testers, the number is the number of times their name was listed as assisting with testing a patch. Finally, for reporters, the number is the number of issues that they reported that were affected by commits that went into this release.</p><table width="100%" border="0">
<tr><th width="33%">Coders</th><th width="33%">Testers</th><th width="33%">Reporters</th></tr>
<tr valign="top"><td width="33%">1 Joshua Colp <jcolp@digium.com><br/>1 George Joseph <gjoseph@digium.com><br/></td><td width="33%"><td width="33%">1 Joshua Colp <jcolp@digium.com><br/>1 Juan Sacco<br/>1 George Joseph <gjoseph@digium.com><br/></td></tr>
</table><hr><a name="closed_issues"><h2 align="center">Closed Issues</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a list of all issues from the issue tracker that were closed by changes that went into this release.</p><h3>Bug</h3><h4>Category: Channels/chan_skinny</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27452">ASTERISK-27452</a>: Security: chan_skinny: Memory exhaustion if flooded with unauthenticated requests<br/>Reported by: George Joseph<ul>
<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=efeb9da0e762be0782d7b420ead90e03422f548b">[efeb9da0e7]</a> George Joseph -- AST-2017-013: chan_skinny: Call pthread_detach when sess threads end</li>
</ul><br><h4>Category: Resources/res_pjsip/Bundling</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27411">ASTERISK-27411</a>: pjsip: TCP connections may not be destroyed<br/>Reported by: Joshua Colp<ul>
<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=191190a9821e99aaedac9c8e0e4929179329f771">[191190a982]</a> Joshua Colp -- pjsip: Add patch to allow all transports to be destroyed.</li>
</ul><br><hr><a name="diffstat"><h2 align="center">Diffstat Results</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a summary of the changes to the source code that went into this release that was generated using the diffstat utility.</p><pre>0 files changed</pre><br></html>
<tr valign="top"><td width="33%">1 Richard Mudgett <rmudgett@digium.com><br/>1 Joshua Colp <jcolp@digium.com><br/></td><td width="33%"><td width="33%">1 Richard Mudgett <rmudgett@digium.com><br/>1 Tzafrir Cohen <tzafrir.cohen@xorcom.com><br/>1 Vitezslav Novy <a1@vnovy.net><br/></td></tr>
</table><hr><a name="closed_issues"><h2 align="center">Closed Issues</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a list of all issues from the issue tracker that were closed by changes that went into this release.</p><h3>Bug</h3><h4>Category: Functions/func_cdr</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27460">ASTERISK-27460</a>: CDR: Deadlock using AMI Originate with Variable CDR(amaflags)=...<br/>Reported by: Richard Mudgett<ul>
<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=7c0bc7297295291b09fa4396c6ee2bca80cddecb">[7c0bc72972]</a> Richard Mudgett -- CDR: Fix deadlock setting some CDR values.</li>
</ul><br><h4>Category: General</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27382">ASTERISK-27382</a>: crash after an invalid rtcp packet from GT48 FXS gateway<br/>Reported by: Tzafrir Cohen<ul>
<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=3eea735a3948551b547bbfe964dcb49216e17e14">[3eea735a39]</a> Joshua Colp -- AST-2017-012: Place single RTCP report block at beginning of report.</li>
</ul><br><h4>Category: Resources/res_rtp_asterisk</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27429">ASTERISK-27429</a>: res_rtp_asterisk: Multiple reports in an RTCP packet will write past where it should<br/>Reported by: Vitezslav Novy<ul>
<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=3eea735a3948551b547bbfe964dcb49216e17e14">[3eea735a39]</a> Joshua Colp -- AST-2017-012: Place single RTCP report block at beginning of report.</li>
</ul><br><hr><a name="diffstat"><h2 align="center">Diffstat Results</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a summary of the changes to the source code that went into this release that was generated using the diffstat utility.</p><pre>func_cdr.c | 127 +++++++++++++++++++++++++++++++++++----------------------
func_channel.c | 11 ----
2 files changed, 82 insertions(+), 56 deletions(-)</pre><br></html>

View File

@@ -1,8 +1,8 @@
Release Summary
asterisk-certified/13.13-cert8
asterisk-certified/13.13-cert9
Date: 2017-12-01
Date: 2017-12-13
<asteriskteam@digium.com>
@@ -30,10 +30,10 @@
Security Advisories:
* AST-2017-013
* AST-2017-012
The data in this summary reflects changes that have been made since the
previous release, asterisk-certified/13.13-cert7.
previous release, asterisk-certified/13.13-cert8.
----------------------------------------------------------------------
@@ -51,9 +51,9 @@
this release.
Coders Testers Reporters
1 Joshua Colp 1 Joshua Colp
1 George Joseph 1 Juan Sacco
1 George Joseph
1 Richard Mudgett 1 Richard Mudgett
1 Joshua Colp 1 Tzafrir Cohen
1 Vitezslav Novy
----------------------------------------------------------------------
@@ -66,20 +66,28 @@
Bug
Category: Channels/chan_skinny
Category: Functions/func_cdr
ASTERISK-27452: Security: chan_skinny: Memory exhaustion if flooded with
unauthenticated requests
Reported by: George Joseph
* [efeb9da0e7] George Joseph -- AST-2017-013: chan_skinny: Call
pthread_detach when sess threads end
ASTERISK-27460: CDR: Deadlock using AMI Originate with Variable
CDR(amaflags)=...
Reported by: Richard Mudgett
* [7c0bc72972] Richard Mudgett -- CDR: Fix deadlock setting some CDR
values.
Category: Resources/res_pjsip/Bundling
Category: General
ASTERISK-27411: pjsip: TCP connections may not be destroyed
Reported by: Joshua Colp
* [191190a982] Joshua Colp -- pjsip: Add patch to allow all transports
to be destroyed.
ASTERISK-27382: crash after an invalid rtcp packet from GT48 FXS gateway
Reported by: Tzafrir Cohen
* [3eea735a39] Joshua Colp -- AST-2017-012: Place single RTCP report
block at beginning of report.
Category: Resources/res_rtp_asterisk
ASTERISK-27429: res_rtp_asterisk: Multiple reports in an RTCP packet will
write past where it should
Reported by: Vitezslav Novy
* [3eea735a39] Joshua Colp -- AST-2017-012: Place single RTCP report
block at beginning of report.
----------------------------------------------------------------------
@@ -90,4 +98,6 @@
This is a summary of the changes to the source code that went into this
release that was generated using the diffstat utility.
0 files changed
func_cdr.c | 127 +++++++++++++++++++++++++++++++++++----------------------
func_channel.c | 11 ----
2 files changed, 82 insertions(+), 56 deletions(-)

View File

@@ -358,7 +358,7 @@ static void cdr_read_callback(void *data, struct stasis_subscription *sub, struc
static void cdr_write_callback(void *data, struct stasis_subscription *sub, struct stasis_message *message)
{
struct cdr_func_payload *payload = stasis_message_data(message);
struct cdr_func_payload *payload;
struct ast_flags flags = { 0 };
AST_DECLARE_APP_ARGS(args,
AST_APP_ARG(variable);
@@ -369,21 +369,17 @@ static void cdr_write_callback(void *data, struct stasis_subscription *sub, stru
if (cdr_write_message_type() != stasis_message_type(message)) {
return;
}
payload = stasis_message_data(message);
if (!payload) {
return;
}
if (ast_strlen_zero(payload->arguments)
|| !payload->value) {
/* Sanity check. cdr_write() could never send these bad messages */
ast_assert(0);
return;
}
if (ast_strlen_zero(payload->arguments)) {
ast_log(AST_LOG_WARNING, "%s requires a variable (%s(variable)=value)\n)",
payload->cmd, payload->cmd);
return;
}
if (ast_strlen_zero(payload->value)) {
ast_log(AST_LOG_WARNING, "%s requires a value (%s(variable)=value)\n)",
payload->cmd, payload->cmd);
return;
}
parse = ast_strdupa(payload->arguments);
AST_STANDARD_APP_ARGS(args, parse);
@@ -391,32 +387,16 @@ static void cdr_write_callback(void *data, struct stasis_subscription *sub, stru
ast_app_parse_options(cdr_func_options, &flags, NULL, args.options);
}
if (!strcasecmp(args.variable, "accountcode")) {
ast_log(AST_LOG_WARNING, "Using the CDR function to set 'accountcode' is deprecated. Please use the CHANNEL function instead.\n");
ast_channel_lock(payload->chan);
ast_channel_accountcode_set(payload->chan, payload->value);
ast_channel_unlock(payload->chan);
} else if (!strcasecmp(args.variable, "peeraccount")) {
ast_log(AST_LOG_WARNING, "The 'peeraccount' setting is not supported. Please set the 'accountcode' on the appropriate channel using the CHANNEL function.\n");
} else if (!strcasecmp(args.variable, "userfield")) {
/* These are already handled by cdr_write() */
ast_assert(strcasecmp(args.variable, "accountcode")
&& strcasecmp(args.variable, "peeraccount")
&& strcasecmp(args.variable, "amaflags"));
if (!strcasecmp(args.variable, "userfield")) {
ast_cdr_setuserfield(ast_channel_name(payload->chan), payload->value);
} else if (!strcasecmp(args.variable, "amaflags")) {
ast_log(AST_LOG_WARNING, "Using the CDR function to set 'amaflags' is deprecated. Please use the CHANNEL function instead.\n");
if (isdigit(*payload->value)) {
int amaflags;
sscanf(payload->value, "%30d", &amaflags);
ast_channel_lock(payload->chan);
ast_channel_amaflags_set(payload->chan, amaflags);
ast_channel_unlock(payload->chan);
} else {
ast_channel_lock(payload->chan);
ast_channel_amaflags_set(payload->chan, ast_channel_string2amaflag(payload->value));
ast_channel_unlock(payload->chan);
}
} else {
ast_cdr_setvar(ast_channel_name(payload->chan), args.variable, payload->value);
}
return;
}
static void cdr_prop_write_callback(void *data, struct stasis_subscription *sub, struct stasis_message *message)
@@ -525,27 +505,70 @@ static int cdr_read(struct ast_channel *chan, const char *cmd, char *parse,
return 0;
}
static int cdr_write(struct ast_channel *chan, const char *cmd, char *parse,
const char *value)
static int cdr_write(struct ast_channel *chan, const char *cmd, char *arguments,
const char *value)
{
RAII_VAR(struct stasis_message *, message, NULL, ao2_cleanup);
RAII_VAR(struct cdr_func_payload *, payload, NULL, ao2_cleanup);
RAII_VAR(struct stasis_message_router *, router,
ast_cdr_message_router(), ao2_cleanup);
struct stasis_message *message;
struct cdr_func_payload *payload;
struct stasis_message_router *router;
AST_DECLARE_APP_ARGS(args,
AST_APP_ARG(variable);
AST_APP_ARG(options);
);
char *parse;
if (!chan) {
ast_log(LOG_WARNING, "No channel was provided to %s function.\n", cmd);
return -1;
}
if (!router) {
ast_log(AST_LOG_WARNING, "Failed to manipulate CDR for channel %s: no message router\n",
ast_channel_name(chan));
if (ast_strlen_zero(arguments)) {
ast_log(LOG_WARNING, "%s requires a variable (%s(variable)=value)\n)",
cmd, cmd);
return -1;
}
if (!value) {
ast_log(LOG_WARNING, "%s requires a value (%s(variable)=value)\n)",
cmd, cmd);
return -1;
}
parse = ast_strdupa(arguments);
AST_STANDARD_APP_ARGS(args, parse);
/* These CDR variables are no longer supported or set directly on the channel */
if (!strcasecmp(args.variable, "accountcode")) {
ast_log(LOG_WARNING, "Using the %s function to set 'accountcode' is deprecated. Please use the CHANNEL function instead.\n",
cmd);
ast_channel_lock(chan);
ast_channel_accountcode_set(chan, value);
ast_channel_unlock(chan);
return 0;
}
if (!strcasecmp(args.variable, "amaflags")) {
int amaflags;
ast_log(LOG_WARNING, "Using the %s function to set 'amaflags' is deprecated. Please use the CHANNEL function instead.\n",
cmd);
if (isdigit(*value)) {
if (sscanf(value, "%30d", &amaflags) != 1) {
amaflags = AST_AMA_NONE;
}
} else {
amaflags = ast_channel_string2amaflag(value);
}
ast_channel_lock(chan);
ast_channel_amaflags_set(chan, amaflags);
ast_channel_unlock(chan);
return 0;
}
if (!strcasecmp(args.variable, "peeraccount")) {
ast_log(LOG_WARNING, "The 'peeraccount' setting is not supported. Please set the 'accountcode' on the appropriate channel using the CHANNEL function.\n");
return 0;
}
/* The remaining CDR variables are handled by CDR processing code */
if (!cdr_write_message_type()) {
ast_log(AST_LOG_WARNING, "Failed to manipulate CDR for channel %s: message type not available\n",
ast_log(LOG_WARNING, "Failed to manipulate CDR for channel %s: message type not available\n",
ast_channel_name(chan));
return -1;
}
@@ -556,16 +579,26 @@ static int cdr_write(struct ast_channel *chan, const char *cmd, char *parse,
}
payload->chan = chan;
payload->cmd = cmd;
payload->arguments = parse;
payload->arguments = arguments;
payload->value = value;
message = stasis_message_create(cdr_write_message_type(), payload);
ao2_ref(payload, -1);
if (!message) {
ast_log(AST_LOG_WARNING, "Failed to manipulate CDR for channel %s: unable to create message\n",
ast_log(LOG_WARNING, "Failed to manipulate CDR for channel %s: unable to create message\n",
ast_channel_name(chan));
return -1;
}
router = ast_cdr_message_router();
if (!router) {
ast_log(LOG_WARNING, "Failed to manipulate CDR for channel %s: no message router\n",
ast_channel_name(chan));
ao2_ref(message, -1);
return -1;
}
stasis_message_router_publish_sync(router, message);
ao2_ref(router, -1);
ao2_ref(message, -1);
return 0;
}
@@ -588,7 +621,7 @@ static int cdr_prop_write(struct ast_channel *chan, const char *cmd, char *parse
return -1;
}
if (!cdr_write_message_type()) {
if (!cdr_prop_write_message_type()) {
ast_log(AST_LOG_WARNING, "Failed to manipulate CDR for channel %s: message type not available\n",
ast_channel_name(chan));
return -1;

View File

@@ -477,18 +477,17 @@ static int func_channel_write_real(struct ast_channel *chan, const char *functio
ast_bridge_set_after_go_on(chan, ast_channel_context(chan), ast_channel_exten(chan), ast_channel_priority(chan), value);
}
} else if (!strcasecmp(data, "amaflags")) {
ast_channel_lock(chan);
int amaflags;
if (isdigit(*value)) {
int amaflags;
sscanf(value, "%30d", &amaflags);
ast_channel_amaflags_set(chan, amaflags);
} else if (!strcasecmp(value,"OMIT")){
ast_channel_amaflags_set(chan, 1);
} else if (!strcasecmp(value,"BILLING")){
ast_channel_amaflags_set(chan, 2);
} else if (!strcasecmp(value,"DOCUMENTATION")){
ast_channel_amaflags_set(chan, 3);
if (sscanf(value, "%30d", &amaflags) != 1) {
amaflags = AST_AMA_NONE;
}
} else {
amaflags = ast_channel_string2amaflag(value);
}
ast_channel_lock(chan);
ast_channel_amaflags_set(chan, amaflags);
ast_channel_unlock(chan);
} else if (!strcasecmp(data, "peeraccount"))
locked_string_field_set(chan, peeraccount, value);

View File

@@ -4217,7 +4217,6 @@ static struct ast_frame *ast_rtcp_read(struct ast_rtp_instance *instance)
unsigned int first_word;
/*! True if we have seen an acceptable SSRC to learn the remote RTCP address */
unsigned int ssrc_seen;
int report_counter = 0;
struct ast_rtp_rtcp_report_block *report_block;
struct ast_frame *f = &ast_null_frame;
@@ -4471,7 +4470,7 @@ static struct ast_frame *ast_rtcp_read(struct ast_rtp_instance *instance)
if (!report_block) {
return &ast_null_frame;
}
rtcp_report->report_block[report_counter] = report_block;
rtcp_report->report_block[0] = report_block;
report_block->source_ssrc = ntohl(rtcpheader[i]);
report_block->lost_count.packets = ntohl(rtcpheader[i + 1]) & 0x00ffffff;
report_block->lost_count.fraction = ((ntohl(rtcpheader[i + 1]) & 0xff000000) >> 24);
@@ -4508,7 +4507,6 @@ static struct ast_frame *ast_rtcp_read(struct ast_rtp_instance *instance)
ast_verbose(" DLSR: %4.4f (sec)\n",(double)report_block->dlsr / 65536.0);
ast_verbose(" RTT: %4.4f(sec)\n", rtp->rtcp->rtt);
}
report_counter++;
}
/* If and when we handle more than one report block, this should occur outside
* this loop.