This patch adds a new features to the endpoint identifier module,
'match_header'. When set, inbound requests are matched by a provided SIP
header: value pair. This option works in conjunction with the existing
'match' configuration option, such that if any 'match*' attribute
matches an inbound request, the request is associated with the specified
endpoint.
Since this module now identifies by more than just IP address,
appropriate renaming of the module and/or variables can be done in a
non-release branch.
ASTERISK-26863 #close
Change-Id: Icfc14835c962f92e35e67bbdb235cf0589de5453
(cherry picked from commit 30f52d79d7)
This change adds a PJSIP patch (which has been contributed upstream)
to allow the registration of IPv6 transport types.
Using this the res_pjsip_transport_websocket module now registers
an IPv6 Websocket transport and uses it for the corresponding
traffic.
ASTERISK-26685
Change-Id: Id1f9126f995b31dc38db8fdb58afd289b4ad1647
According to the RFC[1] WSS should only be used in the Via header
for secure Websockets.
* Use WSS in Via for secure transport.
* Only register one transport with the WS name because it would be
ambiguous. Outgoing requests may try to find the transport by name and
pjproject only finds the first one registered. This may mess up unsecure
websockets but the impact should be minimal. Firefox and Chrome do not
support anything other than secure websockets anymore.
* Added and updated some debug messages concerning websockets.
* security_events.c: Relax case restriction when determining security
transport type.
* The res_pjsip_nat module has been updated to not touch the transport
on Websocket originating messages.
[1] https://tools.ietf.org/html/rfc7118
ASTERISK-26796 #close
Change-Id: Ie3a0fb1a41101a4c1e49d875a8aa87b189e7ab12
res_config_pgsql should match the behavior of other realtime backend
drivers so that queue_log can disable adaptive logging.
ASTERISK-25628 #close
Reported by: Dmitry Wagin
Change-Id: Ic1fb1600c7ce10fdfb1bcdc43c5576b7e0014372
The find_table() functions NULL or a locked table pointer. We are
not consistently calling release_table() in failure paths.
Change-Id: I6f665b455799c84b036e5b34904b82b05eab9544
When a subscription was being recreated and the endpoint wasn't
found, we were trying to unref the endpoint. This was causing
FRACKs. Removed the unref.
ASTERISK-26823 #close
Change-Id: If86d2aecff8fe853c7f38a1bfde721fcef3cd164
This change fixes an assumption in res_pjsip that a contact will
always have a status. There is a race condition where this is
not true and would crash. The status will now be unknown when
this situation occurs.
ASTERISK-26623 #close
Change-Id: Id52d3ca4d788562d236da49990a319118f8d22b5
Outbound registration now subscribes to network change events
published by res_stun_monitor and refreshes all registrations
when an event happens.
The 'pjsip send (un)register' CLI commands were updated to accept
'*all' as an argument to operate on all registrations.
The 'PJSIP(Un)Register' AMI commands were also updated to
accept '*all'.
ASTERISK-26808 #close
Change-Id: Iad58a9e0aa5d340477fca200bf293187a6ca5a25
This change updates the documentation for the outbound_proxy option
to ensure it is consistently stated that a full SIP URI must be
provided for the option.
The res_pjsip_outbound_registration module has also been changed so
that the provided outbound_proxy value is checked to ensure it is a
URI and if not an error is output stating so.
ASTERISK-26782
Change-Id: I6c239a32274846fd44e65b44ad9bf6373479b593
* Removed all 2.5.5 functional patches.
* Updated usages of pj_release_pool to be "safe".
* Updated configure options to disable webrtc.
* Updated config_site.h to disable webrtc in pjmedia.
* Added Richard Mudgett's recent resolver patches.
Change-Id: Ib400cc4dfca68b3d07ce14d314e829bfddc252c7
* A missing AST_LIST_UNLOCK() in find_table()
* The ESCAPE_STRING() macro uses pgsqlConn under the hood and we were
not consistently locking before calling it.
* There were a handful of other places where pgsqlConn was accessed
directly without appropriate locking.
Change-Id: Iea63f0728f76985a01e95b9912c3c5c6065836ed
The initial motivation for this patch was to properly handle memory
allocation failures - we weren't checking the return values from the
various LDAP library allocation functions.
In the process, because update_ldap() and update2_ldap() were
substantially the same code, they've been consolidated.
Change-Id: Iebcfe404177cc6860ee5087976fe97812221b822
* changes:
res_config_ldap: Don't try to delete non-existent attributes
res_config_ldap: Remove extraneous line numbers from log messages
res_config_ldap: Make memory allocation more consistent
res_config_ldap: Fix configuration inheritance from _general
All of the realtime backends create artificial ast_categorys to pass
back into the core as query results. These categories have no filename
or line number information associated with them and the backends differ
slightly on how they create them. So create a couple helper macros to
help make things more consistent.
Also updated the call sites to remove redundant error messages about
memory allocation failure.
Note that res_config_ldap sets the category filename to the 'table name'
but that is not read by anything in the core, so I've dropped it.
Change-Id: I3a1fd91e0c807dea1ce3b643b0a6fe5be9002897
The inbound authentication object is supposed to be immutable when it is
stored in sorcery. However, the immutable property is violated if the
authentication object does not have a realm set.
The immutable contract violation has a different effect depending upon
what sorcery back end is used. If it is the config file back end you
would get the same object back until res_pjsip is reloaded. If it is the
real-time or AstDB back end you would get a new object on each query. If
it is cached you would get the same object back until it is refreshed from
the database.
Once an inbound authentication object has its realm set it may or may not
get updated again if the default_realm changes.
If the same authentication object is used for inbound and outbound
authentication then the immutable violation can make it very hard to
determine why the outbound authentication now fails. The only diagnostic
message is a complaint about no realms matching when it had worked
earlier. It fails because of the difference in behaviour for an empty
realm setting between inbound and outbound authentication objects.
* Fixed the sorcery object immutable violation by creating a new object
and setting the default_realm on it instead. The new object is a shallow
copy for speed.
* The auth_store thread storage no longer holds an auth ref. It
interferes with the shallow copy and never needed a ref anyway.
ASTERISK-26799 #close
Change-Id: I2328a52f61b78ed5fbba38180b7f183ee7e08956
There was code attempting to update the artificial authentication object
whenever the default_realm changed. However, once the artificial
authentication object was created it would never get updated. The
artificial authentication object would require a system restart for a
change to the default_realm to take effect.
ASTERISK-26799
Change-Id: Id59036e9529c2d3ed728af2ed904dc36e7094802
Using the same auth section for inbound and outbound authentication is not
recommended. There is a difference in meaning for an empty realm setting
between inbound and outbound authentication uses.
An empty inbound auth realm represents the global section's default_realm
value when the authentication object is used to challenge an incoming
request. An empty outgoing auth realm is treated as a don't care wildcard
when the authentication object is used to respond to an incoming
authentication challenge.
ASTERISK-26799
Change-Id: Id3952f7cfa1b6683b9954f2c5d2352d2f11059ce
* Removed overloaded unmatched response ignore. We obviously sent the
request so we shouldn't ignore it because it isn't new work.
ASTERISK-26669
ASTERISK-26738
Change-Id: I55fb5cadc83a8e6699b347c6dc7fa32c5a617d37
When PJPROJECT needs to do a DNS resolution and there is not a cached
entry available, the SIP request message goes out on the PJSIP monitor
thread instead of the original serializer thread. Thus when the response
comes back it does not get processed by the original sending serializer.
This patch records the serializer on tdata before passing a request
message to PJPROJECT where it can in Asterisk code. There are several
places in PJPROJECT for outbound registration and publishing support that
would need to record the serializer. Unfortunately, without replacing the
PJPROJECT DNS resolver as was done in v14 we cannot fix those without
modifying PJPROJECT.
Even if we backported the DNS resolver from v14, the outbound registration
refresh timer does not go out on a serializer thread but the PJSIP monitor
thread. Fortunately, Asterisk's outbound publish support doesn't use the
auto refresh timer that would also not go out under the serializer thread.
This patch is v13 only.
ASTERISK-26669
ASTERISK-26738
Change-Id: I9997b9ed6dbcebd2c37d6a67dc6dcee9c78914a4
When listing a container, we now print the number of objects
in the container at the end of the list.
Change-Id: I791cbc3ee9da9a2af9adc655164b5d32953df812
OpenLDAP will raise an error when we try to delete an LDAP attribute
that doesn't exist. We need to filter out LDAP_MOD_DELETE requests
based on which attributes the current LDAP entry actually has. There
is of course a small window of opportunity for this to still fail,
but it is much less likely now.
Change-Id: I3fe1b04472733e43151563aaf9f8b49980273e6b
The code in update_ldap() and update2_ldap() was using both Asterisk's
memory allocation routines as well as OpenLDAP's. I've changed it so
that everything that is passed to OpenLDAP's functions are allocated
with their routines.
Change-Id: Iafec9c1fd8ea49ccc496d6316769a6a426daa804
The "_general" configuration section allows administrators to provide
both general configuration options (host, port, url, etc.) as well as a
global realtime-to-LDAP-attribute mapping that is a fallback if one of
the later sections do not override it. This neglected to exclude the
general configuration options from the mapping. As an example, during
my testing, chan_sip requested 'port' from realtime, and because I did
not have it defined, it pulled in the 'port' configuration option from
"_general." We now filter those out explicitly.
Change-Id: I1fc61560bf96b8ba623063cfb7e0a49c4690d778
We always treat the first change of our modification batch as a
replacement when it sometimes is actually a delete. So we have to pass
the correct arguments to the OpenLDAP library.
ASTERISK-26580 #close
Reported by: Nicholas John Koch
Patches:
res_config_ldap.c-11.24.1.patch (license #6833) patch uploaded
by Nicholas John Koch
Change-Id: I0741d25de07c9539f1edc6eff3696165dfb64fbe
When ast_config_load() fails with CONFIG_STATUS_FILEINVALID, it has
already destroyed the ast_config struct for us. Trying to do it again
results in a crash.
Change-Id: If6a5c0ca718ad428e01a1fb25beb209a9ac18bc6
The realtime framework allows for components to look up values using a
LIKE clause with similar syntax to SQL's. pbx_realtime uses this
functionality to search for pattern matching extensions that start with
an underscore (_).
When passing an underscore to SQL's LIKE clause, it will be interpreted
as a wildcard matching a single character and therefore needs to be
escaped. It is (for better or for worse) the responsibility of the
component that is querying realtime to escape it with a backslash before
passing it in. Some RDBMs support escape characters by default, but the
SQL92 standard explicitly says that there are no escape characters
unless they are specified with an ESCAPE clause, e.g.
SELECT * FROM table WHERE column LIKE '\_%' ESCAPE '\'
This patch instructs 3 backends - res_config_mysql, res_config_pgsql,
and res_config_sqlite3 - to use the ESCAPE clause where appropriate.
Looking through documentation and source tarballs, I was able to
determine that the ESCAPE clause is supported in:
MySQL 5.0.15 (released 2005-10-22 - earliest version available from
archives)
PostgreSQL 7.1 (released 2001-04-13)
SQLite 3.1.0 (released 2005-01-21)
The versions of the relevant libraries that we depend on to access MySQL
and PostgreSQL will not work on versions that old, and I've added an
explicit check in res_config_sqlite3 to only use the ESCAPE clause when
we have a sufficiently new version of SQLite3.
res_config_odbc already handles the escape characters appropriately, so
no changes were required there.
ASTERISK-15858 #close
Reported by: Humberto Figuera
ASTERISK-26057 #close
Reported by: Stepan
Change-Id: I93117fbb874189ae819f4a31222df7c82cd20efa
There were two specific issues resolved here:
1) The code that iterated over the required fields
(via ast_realtime_require) was broken for the RQ_INTEGER1 field
type. Iteration would stop when the first RQ_INTEGER1 (0) field
was encountered.
2) sqlite3_changes() was used to try and count the number of rows
returned by a SELECT statement. sqlite3_changes() only counts
affected rows, so this was always returning the value from the
most recent data modification statement. We now separate read-only
queries from data modification queries and count rows appropriately
in both cases.
ASTERISK-23457 #close
Reported by: Scott Griepentrog
Change-Id: I91ed20494efc3fcfbc2a96ac7646999a49814884
This patch fixes 2 original issues and more that those 2 exposed.
* When we send a NOTIFY, and the client either doesn't respond or
responds with a non OK, pjproject only calls our
pubsub_on_evsub_state callback, no others. Since
pubsub_on_evsub_state (which does the sub_tree cleanup) does not
expect to be called back without the other callbacks being called
first, it just returns leaving the sub_tree orphaned. Now
pubsub_on_evsub_state checks the event for PJSIP_EVENT_TSX_STATE
which is what pjproject will set to tell us that it was the
transaction that timed out or failed and not the subscription
itself timing our or being terminated by the client. If is
TSX_STATE, pubsub_on_evsub_state now does the proper cleanup
regardless of the state of the subscription.
* When a client renews a subscription, we don't update the
persisted subscription with the new expires timestamp. This causes
subscription_persistence_recreate to prune the subscription if/when
asterisk restarts. Now, pubsub_on_rx_refresh calls
subscription_persistence_update to apply the new expires timestamp.
This exposed other issues however...
* When creating a dialog from rdata (which sub_persistence_recreate
does from the packet buffer) there must NOT be a tag on the To
header (which there will be when a client refreshes a
subscription). If there is one, pjsip_dlg_create_uas will fail.
To address this, subscription_persistence_update now accepts a flag
that indicates that the original packet buffer must not be updated.
New subscribes don't set the flag and renews do. This makes sure
that when the rdata is recreated on asterisk startup, it's done
from the original subscribe packet which won't have the tag on To.
* When creating a dialog from rdata, we were setting the dialog's
remote (SUBSCRIBE) cseq to be the same as the local (NOTIFY) cseq.
When the client tried to resubscribe after a restart with the
correct cseq, we'd reject the request with an Invalid CSeq error.
* The acts of creating a dialog and evsub by themselves when
recreating a subscription does NOT restart pjproject's subscription
timer. The result was that even if we did correctly recreate the
subscription, we never removed it if the client happened to go away
or send a non-OK response to a NOTIFY. However, there is no
pjproject function exposed to just set the timer on an evsub that
wasn't created by an incoming subscribe request. To address this,
we create our own timer using ast_sip_schedule_task. This timer is
used only for re-establishing subscriptions after a restart.
An earlier approach was to add support for setting pjproject's
timer (via a pjproject patch) and while that patch is still included
here, we don't use that call at the moment.
While addressing these issues, additional debugging was added and
some existing messages made more useful. A few formatting changes
were also made to 'pjsip show scheduled tasks' to make displaying
the subscription timers a little more friendly.
ASTERISK-26696
ASTERISK-26756
Change-Id: I8c605fc1e3923f466a74db087d5ab6f90abce68e
pjsip limits the total number of ICE candidates to PJ_ICE_MAX_CAND,
which is a compile-time constant. Instead of hard-coding 16 when we
enumerate local interfaces, use PJ_ICE_MAX_CAND so that we can
potentially collect more interfaces if the compile time options are
changed.
Tangentially related to ASTERISK~24464
Change-Id: I1b85509e39e33b1fed63c86261fc229ba14bbabd
