Following the Encrypt-all-the-things paradigm:
The user enters his SIP-URI and password. Thanks to DNS-NAPTR, the phone
determines SIP-over-TLS as preferred transport. In SIP/SDP, the phone starts
the call with a crypto attribute, but not as RTP/sAVP but the RTP/AVP profile
(sRTP is preferred aka optional; not mandatory). If the VoIP server does not
support sRTP and TLS, the phone shows an open padlock icon.
This paradigm is supported by several VoIP/SIP clients on default. Some
implementations even cannot be changed to RTP/sAVP. Therefore here, this
change allows Preferred sRTP for ingress. For egress, please, create a dial
plan which starts with RTP/SAVP, and when rejected tries again with RTP/AVP.
ASTERISK-20234 #close
Reported by: tootai
Tested by: tootai, Alexander Traud
patches:
srtp_patches.diff submitted by Matt Jordan
Change-Id: I42cb779df3a9c7b3dd03a629fb3a296aa4ceb0fd
The DPMA and g729a, silk, siren7 and siren14 codecs hosted at
http://downloads.digium.com/pub/telephony/ are now listed in the
"External" sections of the "Resource Modules" and "Codec Translators"
pages in menuselect. Any that are selected will automatically be
downloaded and installed when "make install" is run. Their LICENSE and
README (if avaialble) files will be installed to
ASTVARLIBDIR/documentation/thirdparty/<product_name>.
Example use with codecs:
The codecs/codecs.xml file is a menuselect style xml file that lists
the codecs to be included. Their support levels are 'external', which
triggers the download and install, and defaultenabled is no. Also
because codec_g729a is actually in a directory named codec_g729 on the
download server, the newly added 'member_data' element is used to
override the default of the directory name being the package name. You
can use the 'directory_name' attribute to keep default base URL
(http://downloads.digium.com/pub/telephony/) but use the new directory,
or you use the 'remote_url' attribute to specify a full URL to the
download directory. In this case, you must still follow the same
subdirectory naming conventions as that used for the packages located
at 'http://downloads.digium.com/pub/telephony'.
A new configure option '--with-externals-cache' was added and like
'--with-sounds-cache' it allows the installer to cache tarballs so
they're not downloaded every time.
To assist with the download and install process, each external package
now has a manifest.xml file that, among other things, contains a package
version and checksums for each file in the tarball. The manifest is
saved to both the cache directory and ASTMODDIR and together with the
manifest.xml on the downloads site, tells the install scripts whether
a download and/or update is needed.
bash and xmlstarlet are required for downloader operation. If they're
not installed, the external items in menuselect will be unavailable.
Change-Id: Id3dcf1289ffd3cb0bbd7dfab3cafbb87be60323a
On heavy loaded system the TCP/TLS incoming calls could be
disconnected by pjproject while these calls are being
processed by asterisk which could use the session's memory pools.
If the session in the disconnected state then the session memory
pools were already freed, so we get segfault.
This patch adds a lifetime control on an INVITE session to pjproject.
The lifetime of the session is manipulated by calling
pjsip_inv_add_ref/pjsip_inv_dec_ref.
This patch uses these functions to inform pjproject that the
session is in use.
This patch adds check if the session state is not disconnected
and also checks if the memory pool is not NULL.
This patch also places tasks 'session_end' and 'session_end_completion'
into session's serializer to avoid race condition.
ASTERISK-26291 #close
Change-Id: I4d28b1fb3b91f0492a911d110049d670fdc3c8d7
Certain SNOM phones send so-called "optional crypto" in their SDP body.
Regular SRTP setup looks like this:
m=audio 64620 RTP/SAVP 8 0 9 99 3 18 4 101
a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:...
SNOM-style "optional crypto" looks like this:
m=audio 61438 RTP/AVP 8 0 9 99 3 18 4 101
a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:...
A crypto line is supplied, but the m-line does not have SAVP.
When res_srtp.so is *not* loaded, then chan_sip.so treats the optional
crypto as regular RTP, but when res_srtp.so *is* loaded, it refuses the
incoming call with the following message:
WARNING: process_sdp: Failed to receive SDP offer/answer with
required SRTP crypto attributes for audio
For platforms that want to start providing SRTP this presents a
compatibility problem.
This changeset lets chan_sip handle the SDP as if no crypto-line was
supplied: i.e. accept the call as regular RTP, just like it did before
res_srtp was loaded.
Now you'll get this informative warning instead:
WARNING: Ignoring crypto attribute in SDP because RTP transport is
insecure
ASTERISK-23989 #close
Reported by: Olle Johansson
Change-Id: I91a15ae05a0296e398d6b65f53bb11afde1d80e2
If the callee selects option '5' using the Dial application's privacy
(P) option, the DIALSTATUS is erroneously set to ANSWER. This option
reflects the callee sending the caller to VoiceMail one time; the call
is definitely *not* ANSWERed in such a scenario. With this patch, the
DIALSTATUS is instead set to NOANSWER, which is the same DIALSTATUS that
is set when the 'send to VoiceMail every time' option is set.
ASTERISK-25691
Change-Id: Iaf0c9f0fa00545e7366443875e2bb7d9a89a1358
Create an alternative to ast_sorcery_generic_alloc which uses astobj2
shared locking. Use this new method for the 'struct ast_sip_aor' allocator.
Change-Id: I3f62f2ada64b622571950278fbb6ad57395b5d6f
This allows standard ao2 functions to be used to release references to
an ast_named_lock. This change can cause less frequent locking of the
global named_locks container. The container is no longer locked when a
named_lock reference is being release except when this causes the
named_lock to be destroyed.
Change-Id: I644e39c6d83a153d71b3fae77ec05599d725e7e6
Previously, the buffer used for MP3 streamed from HTTP servers had a size of
1 MB. For 8 kHz mono audio at 16 bit resolution, such a buffer covers about 1
minute. Only when the buffer is full does audio start to play.
For MP3 files streamed from a server, that is usually not a big deal as long as
the connection to the server is fast enough to supply that much data within a
second or two. For MP3 live streams however, it takes 1 minute to download 1
minute of audio, so without this change, app_mp3 wasn't really usable for MP3
live streams.
This commit changes the buffer size so that it covers 6 seconds of an MP3 file
streamed from a server and 0.5 seconds of an MP3 live stream. The latter is
identified by the use of a .m3u file extension.
app_mp3 so far only supported 8 kHz audio.
Now it always runs at the sample rate of the channel.
ASTERISK-26085 #close
Change-Id: Id1ee274733cd804a0edecf7450329b72f1235af0
In ARI, the channels API allows to hangup a channel with a hangup reason.
This commit adds a new reason "answered_elsewhere".
When using a SIP channel, this will eventually allow Asterisk to add a proper
"Reason" header to a CANCEL message.
ASTERISK-26321
Change-Id: Ia97675bd4acd6a7f58eb467953dfb94559f6583d
If the PJSIP endpoint's AOR with the permanent contact
was deleted from the realtime storage the res_pjsip module
continues trying to qualify this contact.
The error 'Unable to find an endpoint to qualify contact'
appeares every 'qualify_frequency' seconds.
This patch deletes this contact in this case.
The PJSIP endpoint's AOR with the permanent contact
is never qualified if it is added to realtime storage
after asterisk started.
This patch adds qualifying for the AOR's permanent contacts
on the first handling of this AOR.
ASTERISK-26319 #close
Change-Id: Ib93dded9121edb113076903d1aa95402f799f8fe
A recent change attempted to optimize startup by not updating contact
status. Instead, code responsible for qualifying contacts updates the
status as it becomes known. The code even accounts for contacts/AORs
that are not set to be qualified.
The problem, though, is when there are no contacts associated with an
endpoint. A common case is when an endpoint is set to register its
contacts but has not done so yet. In this case, prior to registration,
the endpoint's device state will appear to be "not in use" and hints
associated with that device will appear to be "idle". In actuality, the
device state and hint should both appear as "unavailable". The reason
for the failure is that the optimization change made all persistent
endpoint states set to "unknown".
The fix here is to change the hard-coded "unknown" to be "offline"
instead. The default state will be offline until the qualifying code
determines that the contact is actually online. This way, if there are
no contacts at all, then the state stays as offline, and device state
and hints appear correctly.
ASTERISK-26269 #close
Reported by nappsoft
Change-Id: Ie99b84169393983453076f5e9c0d35ff313a456a
Previously, if context A was including context B and context B was including
context A, i.e. if there was a circular dependency between contexts, then
calling manager_show_dialplan_helper could lead to an infinite recursion,
resulting in a crash.
This commit applies the same solution as the one implemented in the
show_dialplan_helper function. The manager_show_dialplan_helper and
show_dialplan_helper functions contain lots of code in common, but the former
was missing the "infinite recursion avoidance" code.
ASTERISK-26226 #close
Change-Id: I1aea85133c21787226f4f8442253a93000aa0897
When dialing channels it is possible that they may not ever
leave the not in use state (Local channels in particular) by
the time we cancel them. If this occurs but we know they were
dialed we explicitly remove them from the pending members
container so that subsequent call attempts occur.
ASTERISK-26299 #close
Change-Id: I6ad0d17c36480c92cebf840626228ce3f7e4bd65
The reason for the disable is that while Asterisk works fine with older
libsrtp versions, newer versions of pjproject won't compile with them.
Debian 6 for instance, has libsrtp 1.4.4 which is older than what
pjproject is expecting.
We don't use most of pjmedia but we DO use it for SDP negotiation.
Luckily disabling srtp in pjmedia doesn't interfere with it's ability
to negitiate a secure channel. The proper crypto attributes are
negotiated in both directions.
ASTERISK-26279 #close
Change-Id: Id25a92cdf3df97a26c53cffae65b6b82de33c8e2
zuul
Alexander Traud
Joshua Colp
George Joseph
Alexei Gradinari
Walter Doekes
Matt Jordan
Richard Mudgett
Corey Farrell
Michael Kuron
Jean Aunis
Mark Michelson
Etienne Lessard