asterisk

Commit Graph

Author	SHA1	Message	Date
Ivan Poddubny	8af6c9cf6b	res_pjsip_transport_websocket: Fix use-after-free bugs. This patch fixes use-after-free bugs caught by AddressSanitizer. 1. PJSIP transport manager may decide to destroy transport on its own. For example, when the contact registered via websocket has not renewed its registration in time. The transport was destoyed, but the websocket listener thread was still active until the socket closes, and then tried to call transport_shutdown on transport that has been freed. Also, the transport destructor accessed wstransport->rdata.tp_info.pool right after freeing memory that contained wstransport itself. This patch converts transport to an ao2 object, allowing it to be refcounted, so that it is available until both websocket listener and pjsip transport manager are finished with it. 2. The websocket listener deletes the last reference on websocket session when the tcp connection is closed, and it gets destroyed, but the transport manager may still use it, for example when disconnect happens in the middle of a SIP transaction. A new reference to websocket session has been added that is released with the transport to prevent this. ASTERISK-25096 #close Reported by: Josh Kitchens ASTERISK-24963 #close Reported by: Badalian Vyacheslav Change-Id: Idc0b63eb6e459c1ddfb2430127d34b3c4d8d373b	10 years ago
Ivan Poddubny	554bd1e39c	res_pjsip_transport_websocket: Fix crash on receiving large SIP packets Incoming SIP packets larger than PJSIP_MAX_PKT_LEN were themselves truncated before passing to pjsip_tpmgr_receive_packet, but the length was passed unaltered, thus causing memory corruption and segfault. ASTERISK-25122 #close Change-Id: I608a6b6b7f229eacc33a0a7d771d18e27e5b08ab	10 years ago
Matthew Jordan	1995baad71	ARI/PJSIP: Add the ability to redirect (transfer) a channel in a Stasis app This patch adds a new feature to ARI to redirect a channel to another server, and fixes a few bugs in PJSIP's handling of the Transfer dialplan application/ARI redirect capability. New Feature A new operation has been added to the ARI channels resource, redirect. With this, a channel in a Stasis application can be redirected to another endpoint of the same underlying channel technology. Bug fixes In the process of writing this new feature, two bugs were fixed in the PJSIP stack: (1) The existing .transfer channel callback had the limitation that it could only transfer channels to a SIP URI, i.e., you had to pass 'PJSIP/sip:foo@my_provider.com' to the dialplan application. While this is still supported, it is somewhat unintuitive - particularly in a world full of endpoints. As such, we now also support specifying the PJSIP endpoint to transfer to. (2) res_pjsip_multihomed was, unfortunately, trying to 'help' a 302 redirect by updating its Contact header. Alas, that resulted in the forwarding destination set by the dialplan application/ARI resource/whatever being rewritten with very incorrect information. Hence, we now don't bother updating an outgoing response if it is a 302. Since this took a looong time to find, some additional debug statements have been added to those modules that update the Contact headers. Review: https://reviewboard.asterisk.org/r/4316/ ASTERISK-24015 #close Reported by: Private Name ASTERISK-24703 #close Reported by: Matt Jordan git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@431717 65c4cc65-6c06-0410-ace0-fbb531ad65f3	10 years ago
Joshua Colp	fb768ec33a	res_http_websocket: Fix crash due to double freeing memory when receiving a payload length of zero. Frames with a payload length of 0 were incorrectly handled in res_http_websocket. Provided a frame with a payload had been received prior it was possible for a double free to occur. The realloc operation would succeed (thus freeing the payload) but be treated as an error. When the session was then torn down the payload would be freed again causing a crash. The read function now takes this into account. This change also fixes assumptions made by users of res_http_websocket. There is no guarantee that a frame received from it will be NULL terminated. ASTERISK-24472 #close Reported by: Badalian Vyacheslav Review: https://reviewboard.asterisk.org/r/4220/ Review: https://reviewboard.asterisk.org/r/4219/ ........ Merged revisions 429270 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 429272 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@429273 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Kinsey Moore	289830cdc6	PJSIP: Enforce module load dependencies This enforces that res_pjsip, res_pjsip_session, and res_pjsip_pubsub have loaded properly before attempting to load any modules that depend on them since the module loader system is not currently capable of resolving module dependencies on its own. ASTERISK-24312 #close Reported by: Dafi Ni Review: https://reviewboard.asterisk.org/r/4062/ ........ Merged revisions 425690 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@425691 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Joshua Colp	1bcb46c578	res_pjsip_transport_websocket: Fix crash when the Contact header is not a URI. The code for changing the Contact header wrongly assumed that the Contact would always contain a URI. This is incorrect. ASTERISK-24271 Reported by: Dafi Ni ........ Merged revisions 422557 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@422558 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Joshua Colp	42fe127009	res_pjsip_transport_websocket: Attach the Websocket module on outgoing INVITEs. In order to alter the Contact header on in-dialog requests and responses the Websocket module must be attached on outgoing INVITEs. The Contact header is modified so that the PJSIP transport layer can find and use the existing Websocket connection based on the source IP address, port, and transport. ASTERISK-24143 #close Reported by: Aleksei Kulakov ........ Merged revisions 421955 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@421956 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Joshua Colp	e86ee8e76b	res_pjsip_transport_websocket: Fix a progressive memory growth. The packet structure used to receive messages was using the transport pool. This meant that for each parsing the pool would grow accordingly. Since memory can not be reclaimed without resetting it this would cause the memory pool to grow and grow. This change uses a specific memory pool for the packet structure and resets it to a fresh state after the message has been received and handled. ........ Merged revisions 421939 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@421945 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Joshua Colp	3592d4b398	res_pjsip_transport_websocket: Ensure secure Websocket clients can be called. This change enforces the transport in the Contact header for Websocket clients. Previously a client may provide a transport of 'ws' when it is actually using a transport of 'wss'. This would cause outgoing calls to fail as the existing connection could not be found. ........ Merged revisions 421931 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@421932 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Mark Michelson	dcf1ad14da	Add module support level to ast_module_info structure. Print it in CLI "module show" . ASTERISK-23919 #close Reported by Malcolm Davenport Review: https://reviewboard.asterisk.org/r/3802 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@419592 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Matthew Jordan	365ae7523b	res_http_websocket: Close websocket correctly and use careful fwrite When a client takes a long time to process information received from Asterisk, a write operation using fwrite may fail to write all information. This causes the underlying file stream to be in an unknown state, such that the socket must be disconnected. Unfortunately, there are two problems with this in Asterisk's existing websocket code: 1. Periodically, during the read loop, Asterisk must write to the connected websocket to respond to pings. As such, Asterisk maintains a reference to the session during the loop. When ast_http_websocket_write fails, it may cause the session to decrement its ref count, but this in and of itself does not break the read loop. The read loop's write, on the other hand, does not break the loop if it fails. This causes the socket to get in a 'stuck' state, preventing the client from reconnecting to the server. 2. More importantly, however, is that the fwrite in ast_http_websocket_write fails with a large volume of data when the client takes awhile to process the information. When it does fail, it fails writing only a portion of the bytes. With some debugging, it was shown that this was failing in a similar fashion to ASTERISK-12767. Switching this over to ast_careful_fwrite with a long enough timeout solved the problem. Note that this version of the patch, unlike r417310 in Asterisk 11, exposes configuration options beyond just chan_sip's sip.conf. Configuration options to configure the write timeout have also been added to pjsip.conf and ari.conf. #ASTERISK-23917 #close Reported by: Matt Jordan Review: https://reviewboard.asterisk.org/r/3624/ ........ Merged revisions 417310 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 417311 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@417317 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago
Joshua Colp	0620cc0c00	res_pjsip_transport_websocket: Fix security events and simplify implementation. Transport type determination for security events has been simplified to use the type present on the message itself instead of searching through configured transports to find the transport used. The actual WebSocket transport has also been simplified. It now leverages the existing PJSIP transport manager for finding the active WebSocket transport for outgoing messages. This removes the need for res_pjsip_transport_websocket to store a mapping itself. (closes issue ASTERISK-22897) Reported by: Max E. Reyes Vera J. Review: https://reviewboard.asterisk.org/r/3036/ ........ Merged revisions 403256 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@403257 65c4cc65-6c06-0410-ace0-fbb531ad65f3	12 years ago
Mark Michelson	735b30ad71	The large GULP->PJSIP renaming effort. The general gist is to have a clear boundary between old SIP stuff and new SIP stuff by having the word "SIP" for old stuff and "PJSIP" for new stuff. Here's a brief rundown of the changes: * The word "Gulp" in dialstrings, functions, and CLI commands is now "PJSIP" * chan_gulp.c is now chan_pjsip.c * Function names in chan_gulp.c that were "gulp_" are now "chan_pjsip_" * All files that were "res_sip" are now "res_pjsip" * The "res_sip" directory is now "res_pjsip" * Files in the "res_pjsip" directory that began with "sip_" are now "pjsip_" * The configuration file is now "pjsip.conf" instead of "res_sip.conf" * The module info for all PJSIP-related files now uses "PJSIP" instead of "SIP" * CLI and AMI commands created by Asterisk's PJSIP modules now have "pjsip" as the starting word instead of "sip" git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@395764 65c4cc65-6c06-0410-ace0-fbb531ad65f3	12 years ago

13 Commits (ca65ddcd199dca4681055b51fc63b906e48f1950)