20 Commits (3148dfbd11bd9b77424ea9ea2b5464d7d4ab760a)

Author	SHA1	Message	Date
Richard Mudgett	4ca5745dbe	AST-2014-007: Fix DOS by consuming the number of allowed HTTP connections. ... Simply establishing a TCP connection and never sending anything to the configured HTTP port in http.conf will tie up a HTTP connection. Since there is a maximum number of open HTTP sessions allowed at a time you can block legitimate connections. A similar problem exists if a HTTP request is started but never finished. * Added http.conf session_inactivity timer option to close HTTP connections that aren't doing anything. Defaults to 30000 ms. * Removed the undocumented manager.conf block-sockets option. It interferes with TCP/TLS inactivity timeouts. * AMI and SIP TLS connections now have better authentication timeout protection. Though I didn't remove the bizzare TLS timeout polling code from chan_sip. * chan_sip can now handle SSL certificate renegotiations in the middle of a session. It couldn't do that before because the socket was non-blocking and the SSL calls were not restarted as documented by the OpenSSL documentation. * Fixed an off nominal leak of the ssl struct in handle_tcptls_connection() if the FILE stream failed to open and the SSL certificate negotiations failed. The patch creates a custom FILE stream handler to give the created FILE streams inactivity timeout and timeout after a specific moment in time capability. This approach eliminates the need for code using the FILE stream to be redesigned to deal with the timeouts. This patch indirectly fixes most of ASTERISK-18345 by fixing the usage of the SSL_read/SSL_write operations. ASTERISK-23673 #close Reported by: Richard Mudgett ........ Merged revisions 415841 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 415854 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 415896 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@415907 65c4cc65-6c06-0410-ace0-fbb531ad65f3	12 years ago
Mark Michelson	0f4489dc0f	Fix TLS port binding behavior as well as reload behavior: ... * Removes references to tlsbindport from http.conf.sample and manager.conf.sample * Properly bind to port specified in tlsbindaddr, using the default port if specified. * On a reload, properly close socket if the service has been disabled. A note has been added to UPGRADE.txt to indicate how ports must be set for TLS. (closes issue ASTERISK-16959) reported by Olaf Holthausen (closes issue ASTERISK-19201) reported by Chris Mylonas (closes issue ASTERISK-19204) reported by Chris Mylonas Review: https://reviewboard.asterisk.org/r/1709 ........ Merged revisions 353770 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 353820 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@353821 65c4cc65-6c06-0410-ace0-fbb531ad65f3	14 years ago
Matthew Nicholson	079e794b1c	Merged revisions 314628 via svnmerge from ... https://origsvn.digium.com/svn/asterisk/branches/1.8 ................ r314628 | mnicholson | 2011-04-21 13:24:05 -0500 (Thu, 21 Apr 2011) | 27 lines Merged revisions 314620 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.6.2 ................ r314620 | mnicholson | 2011-04-21 13:22:19 -0500 (Thu, 21 Apr 2011) | 20 lines Merged revisions 314607 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r314607 | mnicholson | 2011-04-21 13:19:21 -0500 (Thu, 21 Apr 2011) | 14 lines Added limits to the number of unauthenticated sessions TCP based protocols are allowed to have open simultaneously. Also added timeouts for unauthenticated sessions where it made sense to do so. Unrelated, the manager interface now properly checks if the user has the "system" privilege before executing shell commands via the Originate action. AST-2011-005 AST-2011-006 (closes issue #18787) Reported by: kobaz (related to issue #18996) Reported by: tzafrir ........ ................ ................ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@314666 65c4cc65-6c06-0410-ace0-fbb531ad65f3	15 years ago
Mark Michelson	3162a8e558	Enable IPv6 for the built-in HTTP server. ... Review: https://reviewboard.asterisk.org/r/986 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@293273 65c4cc65-6c06-0410-ace0-fbb531ad65f3	15 years ago
Ryan Brindley	d92d4d21d6	- cfgbasic.html has been replaced by index.html in the GUI for some time now ...	17 years ago
Sean Bright	f22962a0c1	Remove a bunch of trailing whitespace in preparation for reformatting/cleanup. ... Let's try that again, this time removing trailing whitespace and not leading whitespace. I can't believe no one noticed. git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@197535 65c4cc65-6c06-0410-ace0-fbb531ad65f3	17 years ago
David Vossel	ca138fc807	Consistent SSL/TLS options across conf files ... ast_tls_read_conf() is a new api call for handling SSL/TLS options across all conf files. Before this change, SSL/TLS options were not consistent. http.conf and manager.conf required the 'ssl' prefix while sip.conf used options with the 'tls' prefix. While the options had different names in different conf files, they all did the exact same thing. Now, instead of mixing 'ssl' or 'tls' prefixes to do the same thing depending on what conf file you're in, all SSL/TLS options use the 'tls' prefix. For example. 'sslenable' in http.conf and manager.conf is now 'tlsenable' which matches what already existed in sip.conf. Since this has the potential to break backwards compatibility, previous options containing the 'ssl' prefix still work, but they are no longer documented in the sample.conf files. The change is noted in the CHANGES file though. Review: http://reviewboard.digium.com/r/237/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@191028 65c4cc65-6c06-0410-ace0-fbb531ad65f3	17 years ago
David Vossel	8f0b88c8c8	TLS/SSL private key option ... Adds option to specify a private key .pem file when configuring TLS or SSL in AMI, HTTP, and SIP. Before this, the certificate file was used for both the public and private key. It is possible for this file to hold both, but most configurations allow for a separate private key file to be specified. Clarified in .conf files how these options are to be used. The current conf files do not explain how the private key is handled at all, so without knowledge of Asterisk's TLS implementation, it would be hard to know for sure what was going on or how to set it up. Review: http://reviewboard.digium.com/r/234/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@190545 65c4cc65-6c06-0410-ace0-fbb531ad65f3	17 years ago
Tilghman Lesher	4da51cf496	Update sample configuration to match what are now the defaults for the prefix. ... (closes issue #12838, related to issue #12198) Reported by: pabelanger Patches: http.conf.diff2 uploaded by pabelanger (license 224) git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@125191 65c4cc65-6c06-0410-ace0-fbb531ad65f3	18 years ago
Russell Bryant	d27b5d9648	Add a note about viewing the default set of documentation using the built-in http server ... git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@96888 65c4cc65-6c06-0410-ace0-fbb531ad65f3	18 years ago
Joshua Colp	fd4f9d55e8	Remove second prefix line. Only need it documented once in the same file. ... (closes issue #11472) Reported by: eserra Patches: http.conf.sample.diff uploaded by eserra (license 45) git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@91171 65c4cc65-6c06-0410-ace0-fbb531ad65f3	18 years ago
Jason Parker	cb8c4122bc	Fix the sample redirect to point to a valid file in the Asterisk GUI. ... Closes issue #10748, patch by bkruse git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@82710 65c4cc65-6c06-0410-ace0-fbb531ad65f3	18 years ago
Russell Bryant	0a9750ef9f	Merged revisions 60603 via svnmerge from ... https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r60603 | russell | 2007-04-06 15:58:43 -0500 (Fri, 06 Apr 2007) | 13 lines To be able to achieve the things that we would like to achieve with the Asterisk GUI project, we need a fully functional HTTP interface with access to the Asterisk manager interface. One of the things that was intended to be a part of this system, but was never actually implemented, was the ability for the GUI to be able to upload files to Asterisk. So, this commit adds this in the most minimally invasive way that we could come up with. A lot of work on minimime was done by Steve Murphy. He fixed a lot of bugs in the parser, and updated it to be thread-safe. The ability to check permissions of active manager sessions was added by Dwayne Hubbard. Then, hacking this all together and do doing the modifications necessary to the HTTP interface was done by me. ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@60604 65c4cc65-6c06-0410-ace0-fbb531ad65f3	19 years ago
Russell Bryant	850dd4ea61	Use spaces as a separator for the redirect option to improve readability ... git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@48947 65c4cc65-6c06-0410-ace0-fbb531ad65f3	19 years ago
Russell Bryant	2c5071a006	- Convert the list of URI handlers to use the linked list macros. While doing ... this, implementing locking of this list to make it thread-safe. - Add a "redirect" option to http.conf that allows redirecting one URI to another. I was inspired to do this while playing with the Asterisk GUI. I got tired of typing this URL to get to the GUI: http://localhost:8088/asterisk/static/config/cfgadvanced.html So, now I have the following line in http.conf: redirect=/=/asterisk/static/config/cfgadvanced.html Now, I can type the following into my browser and go to the GUI: http://localhost:8088 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@48930 65c4cc65-6c06-0410-ace0-fbb531ad65f3	19 years ago
Luigi Rizzo	2e7fd7cbdb	add a new http.conf option, sslbindaddr. ... Because https is more secure than http, it usually makes sense to keep this service more open than the one on the unencrypted port. git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@48071 65c4cc65-6c06-0410-ace0-fbb531ad65f3	19 years ago
Luigi Rizzo	c15f7953c8	Fix a few issues in the previous (disabled) HTTPS code, ... and support linux as well (using fopencookie(), which should be available in glibc). Update configure.ac to check for funopen (BSD) and fopencookie(glibc), and while we are at it also for gethostbyname_r (the generated files need to be updated, or you need to run bootstrap.sh yourself). Document the new options in http.conf.sample (names are only tentative, better ones are welcome). At this point we can safely enable the option. Anyone willing to try this on Sun and Apple platforms ? git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@45892 65c4cc65-6c06-0410-ace0-fbb531ad65f3	19 years ago
Mark Spencer	bfba044b5f	Flesh out the remainder of the manager + http changes and create a sample application to partially ... demonstrate the capability of manager over http. git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@16850 65c4cc65-6c06-0410-ace0-fbb531ad65f3	20 years ago
Russell Bryant	41f8e3728e	disable the http server by default at the request of people on IRC ... git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@15518 65c4cc65-6c06-0410-ace0-fbb531ad65f3	20 years ago
Mark Spencer	9164eac21a	Add micro-http server and abstract manager interface, make snmp not die ... on reload. git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@14953 65c4cc65-6c06-0410-ace0-fbb531ad65f3	20 years ago