11 Commits (11)

Author	SHA1	Message	Date
Kevin Harwell	430db4333e	chan_sip.c: wrong peer searched in sip_report_security_event ... In chan_sip, after handling an incoming invite a security event is raised describing authorization (success, failure, etc...). However, it was doing a lookup of the peer by extension. This is fine for register messages, but in the case of an invite it may search and find the wrong peer, or a non existent one (for instance, in the case of call pickup). Also, if the peers are configured through realtime this may cause an unnecessary database lookup when caching is enabled. This patch makes it so that sip_report_security_event searches by IP address when looking for a peer instead of by extension after an invite is processed. ASTERISK-25320 #close Change-Id: I9b3f11549efb475b6561c64f0e6da1a481d98bc4	10 years ago
Richard Mudgett	094eeade6e	ast_str: Fix improper member access to struct ast_str members. ... Accessing members of struct ast_str outside of the string manipulation API routines is invalid since struct ast_str is supposed to be treated as opaque. Review: https://reviewboard.asterisk.org/r/4194/ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@428244 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Matthew Jordan	33d1220bee	main/astobj2: Make REF_DEBUG a menuselect item; improve REF_DEBUG output ... This patch does the following: (1) It makes REF_DEBUG a meneselect item. Enabling REF_DEBUG now enables REF_DEBUG globally throughout Asterisk. (2) The ref debug log file is now created in the AST_LOG_DIR directory. Every run will now blow away the previous run (as large ref files sometimes caused issues). We now also no longer open/close the file on each write, instead relying on fflush to make sure data gets written to the file (in case the ao2 call being performed is about to cause a crash) (3) It goes with a comma delineated format for the ref debug file. This makes parsing much easier. This also now includes the thread ID of the thread that caused ref change. (4) A new python script instead for refcounting has been added in the contrib/scripts folder. Review: https://reviewboard.asterisk.org/r/3377/ ........ Merged revisions 412114 from http://svn.asterisk.org/svn/asterisk/branches/1.8 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@412115 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Matthew Jordan	b984d78c5c	AST-2013-003: Prevent username disclosure in SIP channel driver ... When authenticating a SIP request with alwaysauthreject enabled, allowguest disabled, and autocreatepeer disabled, Asterisk discloses whether a user exists for INVITE, SUBSCRIBE, and REGISTER transactions in multiple ways. The information is disclosed when: * A "407 Proxy Authentication Required" response is sent instead of a "401 Unauthorized" response * The presence or absence of additional tags occurs at the end of "403 Forbidden" (such as "(Bad Auth)") * A "401 Unauthorized" response is sent instead of "403 Forbidden" response after a retransmission * Retransmission are sent when a matching peer did not exist, but not when a matching peer did exist. This patch resolves these various vectors by ensuring that the responses sent in all scenarios is the same, regardless of the presence of a matching peer. This issue was reported by Walter Doekes, OSSO B.V. A substantial portion of the testing and the solution to this problem was done by Walter as well - a huge thanks to his tireless efforts in finding all the ways in which this setting didn't work, providing automated tests, and working with Kinsey on getting this fixed. (closes issue ASTERISK-21013) Reported by: wdoekes Tested by: wdoekes, kmoore patches: AST-2013-003-1.8 uploaded by kmoore, wdoekes (License 6273, 5674) AST-2013-003-10 uploaded by kmoore, wdoekes (License 6273, 5674) AST-2013-003-11 uploaded by kmoore, wdoekes (License 6273, 5674) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@384003 65c4cc65-6c06-0410-ace0-fbb531ad65f3	12 years ago
Kinsey Moore	8fa605d4cc	Fix some more REF_DEBUG-related build errors ... When sip_ref_peer and sip_unref_peer were exported to be usable in channels/sip/security_events.c, modifications to those functions when building under REF_DEBUG were not taken into account. This change moves the necessary defines into sip.h to make them accessible to other parts of chan_sip that need them. git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@381282 65c4cc65-6c06-0410-ace0-fbb531ad65f3	12 years ago
Kinsey Moore	e5210366e4	Clean up chan_sip ... This clean up was broken out from https://reviewboard.asterisk.org/r/1976/ and addresses the following: - struct sip_refer converted to use the stringfields API. - sip_{refer|notify}_allocate -> sip_{notify|refer}_alloc to match other *alloc functions. - Replace get_msg_text, get_msg_text2 and get_pidf_body -> No, not get_pidf_msg_text_body3 but get_content, to match add_content. - get_body doesn't get the request body, renamed to get_content_line. - get_body_by_line doesn't get the body line, and is just a simple if test. Moved code inline and removed function. - Remove camelCase in struct sip_peer peer state variables, onHold -> onhold, inUse -> inuse, inRinging -> ringing. - Remove camelCase in struct sip_request rlPart1 -> rlpart1, rlPart2 -> rlpart2. - Rename instances of pvt->randdata to pvt->nonce because that is what it is, no need to update struct sip_pvt because _it already has a nonce field_. - Removed struct sip_pvt randdata stringfield. - Remove useless (and inconsistent) 'header' suffix on variables in handle_request_subscribe. - Use ast_strdupa on Event header in handle_request_subscribe to avoid overly complicated strncmp calls to find the event package. - Move get_destination check in handle_request_subscribe to avoid duplicate checking for packages that don't need it. - Move extension state callback management in handle_request_subscribe to avoid duplicate checking for packages that don't need it. - Remove duplicate append_date prototype. - Rename append_date -> add_date to match other add_xxx functions. - Added add_expires helper function, removed code that manually added expires header. - Remove _header suffix on add_diversion_header (no other header adding functions have this). - Don't pass req->debug to request handle_request_XXXXX handlers if req is also being passed. - Don't pass req->ignore to check_auth as req is already being passed. - Don't create a subscription in handle_request_subscribe if p->expiry == 0. - Don't walk of the back of referred_by_name when splitting string in get_refer_info - Remove duplicate check for no dialog in handle_incoming when sipmethod == SIP_REFER, handle_request_refer checks for that. Review: https://reviewboard.asterisk.org/r/1993/ Patch-by: gareth git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@370636 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Joshua Colp	e938737570	Add support for SIP over WebSocket. ... This allows SIP traffic to be exchanged over a WebSocket connection which is useful for rtcweb. Review: https://reviewboard.asterisk.org/r/2008 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@370072 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Kevin P. Fleming	166b4e2b30	Multiple revisions 369001-369002 ... ........ r369001 | kpfleming | 2012-06-15 10:56:08 -0500 (Fri, 15 Jun 2012) | 11 lines Add support-level indications to many more source files. Since we now have tools that scan through the source tree looking for files with specific support levels, we need to ensure that every file that is a component of a 'core' or 'extended' module (or the main Asterisk binary) is explicitly marked with its support level. This patch adds support-level indications to many more source files in tree, but avoids adding them to third-party libraries that are included in the tree and to source files that don't end up involved in Asterisk itself. ........ r369002 | kpfleming | 2012-06-15 10:57:14 -0500 (Fri, 15 Jun 2012) | 3 lines Add a script to enable finding source files without support-levels defined. ........ Merged revisions 369001-369002 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 369005 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@369013 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Michael L. Young	abf40d9b28	Add IPv6 address support to security events framework. ... The current Security Events Framework API only supports IPv4 when it comes to generating security events. This patch does the following: * Changes the Security Events Framework API to support IPV6 and updates the components that use this API. * Eliminates an error message that was being generated since the current implementation was treating an IPv6 socket address as if it was IPv4. * Some copyright dates were updated on files touched by this patch. (closes issue ASTERISK-19447) Reported by: Michael L. Young Tested by: Michael L. Young Patches: security_events_ipv6v3.diff uploaded by Michael L. Young (license 5026) Review: https://reviewboard.asterisk.org/r/1777/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@362200 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Mark Michelson	1bef7695ce	Add a security event for the case where fake authentication challenge is sent. ... ........ Merged revisions 357318 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@357319 65c4cc65-6c06-0410-ace0-fbb531ad65f3	13 years ago
Jonathan Rose	5982bdcb7c	Merged revisions 337595,337597 via svnmerge from ... https://origsvn.digium.com/svn/asterisk/branches/10 ........ r337595 | jrose | 2011-09-22 10:35:50 -0500 (Thu, 22 Sep 2011) | 12 lines Generate Security events in chan_sip using new Security Events Framework Security Events Framework was added in 1.8 and support was added for AMI to generate events at that time. This patch adds support for chan_sip to generate security events. (closes issue ASTERISK-18264) Reported by: Michael L. Young Patches: security_events_chan_sip_v4.patch (license #5026) by Michael L. Young Review: https://reviewboard.asterisk.org/r/1362/ ........ r337597 | jrose | 2011-09-22 10:47:05 -0500 (Thu, 22 Sep 2011) | 10 lines Forgot to svn add new files to r337595 Part of Generating security events for chan_sip (issue ASTERISK-18264) Reported by: Michael L. Young Patches: security_events_chan_sip_v4.patch (License #5026) by Michael L. Young Reviewboard: https://reviewboard.asterisk.org/r/1362/ ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@337600 65c4cc65-6c06-0410-ace0-fbb531ad65f3	14 years ago