Difuse/telephony
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

asterisk-15.x: update to 15.6.1

Browse source 
Update to the current 15.x release, see [0].
Drop merged patches and refresh the rest.

Get rid of the unknown --without-pwlib configure switch.
Drop the direct ncurses dependency, it's unused in case of an external
libedit [1].

[0] http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-15-current
[1] https://issues.asterisk.org/jira/browse/ASTERISK-27761

Signed-off-by: Andre Heider <a.heider@gmail.com>
This commit is contained in:
Andre Heider 2018-09-27 11:46:13 +02:00
parent ef17798ecf
commit 7a9a78a398
9 changed files with 10 additions and 251 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
net/asterisk-15.x/Makefile
View file

@ -8,12 +8,12 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=asterisk15
PKG_VERSION:=15.3.0
PKG_RELEASE:=4
PKG_VERSION:=15.6.1
PKG_RELEASE:=1
PKG_SOURCE:=asterisk-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://downloads.asterisk.org/pub/telephony/asterisk/releases
PKG_HASH:=f424f89f23b72f267ff9baab82d449bebbbf00c54e54fcd06b8fca13788b012c
PKG_HASH:=9cb86585fb4efcd86423fa7586e55d9d3c74fda43a2e0b1b9c9eb3742df73155
PKG_BUILD_DIR:=$(BUILD_DIR)/asterisk-$(PKG_VERSION)
PKG_BUILD_DEPENDS:=libxml2/host
@ -430,7 +430,7 @@ define Package/asterisk15
$(call Package/asterisk15/Default)
TITLE:=Complete open source PBX, v$(PKG_VERSION)
MENU:=1
DEPENDS:=$(CXX_DEPENDS) +jansson +libcap +libedit +libncurses +libopenssl +libsqlite3 +libuuid +libxml2 +zlib
DEPENDS:=$(CXX_DEPENDS) +jansson +libcap +libedit +libopenssl +libsqlite3 +libuuid +libxml2 +zlib
endef
define Package/asterisk15/description
@ -538,7 +538,6 @@ CONFIGURE_ARGS+= \
--without-pjproject-bundled \
--with-libedit="$(STAGING_DIR)/usr" \
--with-libxml2 \
--with-ncurses="$(STAGING_DIR)/usr" \
$(if $(CONFIG_PACKAGE_$(PKG_NAME)-res-snmp),--with-netsnmp="$(STAGING_DIR)/usr",--without-netsnmp) \
--without-newt \
--without-osptk \
@ -546,7 +545,6 @@ CONFIGURE_ARGS+= \
$(if $(CONFIG_PACKAGE_$(PKG_NAME)-pgsql),--with-postgres="$(STAGING_DIR)/usr",--without-postgres) \
$(if $(CONFIG_PACKAGE_$(PKG_NAME)-util-smsq),--with-popt="$(STAGING_DIR)/usr",--without-popt) \
$(if $(CONFIG_PACKAGE_$(PKG_NAME)-chan-console),--with-portaudio="$(STAGING_DIR)/usr",--without-portaudio) \
--without-pwlib \
--without-radius \
$(if $(CONFIG_PACKAGE_$(PKG_NAME)-res-fax-spandsp),--with-spandsp="$(STAGING_DIR)/usr",--without-spandsp) \
--without-sdl \

2
net/asterisk-15.x/patches/001-disable-semaphores-check.patch
View file

@ -1,6 +1,6 @@
--- a/configure.ac
+++ b/configure.ac
@@ -985,19 +985,6 @@ AC_LINK_IFELSE(
@@ -1048,19 +1048,6 @@ AC_LINK_IFELSE(
]
)

2
net/asterisk-15.x/patches/002-undef-res-ninit.patch
View file

@ -1,6 +1,6 @@
--- a/configure.ac
+++ b/configure.ac
@@ -1319,7 +1319,6 @@ AC_LINK_IFELSE(
@@ -1395,7 +1395,6 @@ AC_LINK_IFELSE(
#include <resolv.h>],
[int foo = res_ninit(NULL);])],
AC_MSG_RESULT(yes)

2
net/asterisk-15.x/patches/004-disable-check-for-hrirs.patch
View file

@ -1,6 +1,6 @@
--- a/configure.ac
+++ b/configure.ac
@@ -2709,7 +2709,7 @@ else
@@ -2790,7 +2790,7 @@ else
fi
# conf_bridge (binaural rendering): check if HRIRs are available

4
net/asterisk-15.x/patches/056-fix-check_expr2-build.patch
View file

@ -1,7 +1,7 @@
--- a/utils/Makefile
+++ b/utils/Makefile
@@ -182,7 +182,6 @@ check_expr2: $(ASTTOPDIR)/main/ast_expr2
$(CC) -g -o check_expr2 ast_expr2fz.o ast_expr2z.o -lm
@@ -183,7 +183,6 @@ check_expr2: $(ASTTOPDIR)/main/ast_expr2
$(CC) -g -o check_expr2 ast_expr2fz.o ast_expr2z.o -lm $(_ASTLDFLAGS)
$(ECHO_PREFIX) echo " [RM] ast_expr2fz.o ast_expr2z.o"
rm ast_expr2z.o ast_expr2fz.o
- ./check_expr2 expr2.testinput

2
net/asterisk-15.x/patches/100-build-reproducibly.patch
View file

@ -17,7 +17,7 @@
* build.h
--- a/Makefile
+++ b/Makefile
@@ -479,7 +479,7 @@ doc/core-en_US.xml: makeopts .lastclean
@@ -487,7 +487,7 @@ doc/core-en_US.xml: makeopts .lastclean
@echo "<docs xmlns:xi=\"http://www.w3.org/2001/XInclude\">" >> $@
@for x in $(MOD_SUBDIRS); do \
printf "$$x " ; \

49
net/asterisk-15.x/patches/110-AST-2018-007-15.diff
View file

@ -1,49 +0,0 @@
From 380b5ae0a1e4a68bfb098319a7ab86d3d34c2fcb Mon Sep 17 00:00:00 2001
From: Sean Bright <sean.bright@gmail.com>
Date: Mon, 16 Apr 2018 15:13:58 -0400
Subject: [PATCH] AST-2018-007: iostreams potential DoS when client connection closed prematurely
Before Asterisk sends an HTTP response (at least in the case of errors),
it attempts to read & discard the content of the request. If the client
lies about the Content-Length, or the connection is closed from the
client side before "Content-Length" bytes are sent, the request handling
thread will busy loop.
ASTERISK-27807
Change-Id: I945c5fc888ed92be625b8c35039fc6d2aa89c762
---
diff --git a/main/iostream.c b/main/iostream.c
index 4cddd43..20188cb 100644
--- a/main/iostream.c
+++ b/main/iostream.c
@@ -197,11 +197,18 @@
}
}
break;
+ case SSL_ERROR_SYSCALL:
+ /* Some non-recoverable I/O error occurred. The OpenSSL error queue may
+ * contain more information on the error. For socket I/O on Unix systems,
+ * consult errno for details. */
+ ast_debug(1, "TLS non-recoverable I/O error occurred: %s, %s\n", ERR_error_string(sslerr, err),
+ ssl_error_to_string(sslerr, res));
+ return -1;
default:
/* Report EOF for an undecoded SSL or transport error. */
ast_debug(1, "TLS transport or SSL error reading data: %s, %s\n", ERR_error_string(sslerr, err),
ssl_error_to_string(sslerr, res));
- return 0;
+ return -1;
}
if (!ms) {
/* Report EOF for a timeout */
@@ -317,7 +324,7 @@
while (remaining) {
ret = ast_iostream_read(stream, buf, remaining > sizeof(buf) ? sizeof(buf) : remaining);
- if (ret < 0) {
+ if (ret <= 0) {
return ret;
}
remaining -= ret;

101
net/asterisk-15.x/patches/120-AST-2018-008-15.diff
View file

@ -1,101 +0,0 @@
From f597032e833a4d3e8e710e5b1416ba780f002b8b Mon Sep 17 00:00:00 2001
From: Richard Mudgett <rmudgett@digium.com>
Date: Mon, 30 Apr 2018 17:38:58 -0500
Subject: [PATCH] AST-2018-008: Fix enumeration of endpoints from ACL rejected addresses.
When endpoint specific ACL rules block a SIP request they respond with a
403 forbidden. However, if an endpoint is not identified then a 401
unauthorized response is sent. This vulnerability just discloses which
requests hit a defined endpoint. The ACL rules cannot be bypassed to gain
access to the disclosed endpoints.
* Made endpoint specific ACL rules now respond with a 401 unauthorized
which is the same as if an endpoint were not identified. The fix is
accomplished by replacing the found endpoint with the artificial endpoint
which always fails authentication.
ASTERISK-27818
Change-Id: Icb275a54ff8e2df6c671a6d9bda37b5d732b3b32
---
diff --git a/res/res_pjsip/pjsip_distributor.c b/res/res_pjsip/pjsip_distributor.c
index 51b95a2..0af447d 100644
--- a/res/res_pjsip/pjsip_distributor.c
+++ b/res/res_pjsip/pjsip_distributor.c
@@ -676,6 +676,26 @@
ao2_unlock(unid);
}
+static int apply_endpoint_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint);
+static int apply_endpoint_contact_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint);
+
+static void apply_acls(pjsip_rx_data *rdata)
+{
+ struct ast_sip_endpoint *endpoint;
+
+ /* Is the endpoint allowed with the source or contact address? */
+ endpoint = rdata->endpt_info.mod_data[endpoint_mod.id];
+ if (endpoint != artificial_endpoint
+ && (apply_endpoint_acl(rdata, endpoint)
+ || apply_endpoint_contact_acl(rdata, endpoint))) {
+ ast_debug(1, "Endpoint '%s' not allowed by ACL\n",
+ ast_sorcery_object_get_id(endpoint));
+
+ /* Replace the rdata endpoint with the artificial endpoint. */
+ ao2_replace(rdata->endpt_info.mod_data[endpoint_mod.id], artificial_endpoint);
+ }
+}
+
static pj_bool_t endpoint_lookup(pjsip_rx_data *rdata)
{
struct ast_sip_endpoint *endpoint;
@@ -695,6 +715,7 @@
ao2_unlink(unidentified_requests, unid);
ao2_ref(unid, -1);
}
+ apply_acls(rdata);
return PJ_FALSE;
}
@@ -759,6 +780,8 @@
ast_sip_report_invalid_endpoint(name, rdata);
}
}
+
+ apply_acls(rdata);
return PJ_FALSE;
}
@@ -842,16 +865,11 @@
ast_assert(endpoint != NULL);
- if (endpoint!=artificial_endpoint) {
- if (apply_endpoint_acl(rdata, endpoint) || apply_endpoint_contact_acl(rdata, endpoint)) {
- if (!is_ack) {
- pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 403, NULL, NULL, NULL);
- }
- return PJ_TRUE;
- }
+ if (is_ack) {
+ return PJ_FALSE;
}
- if (!is_ack && ast_sip_requires_authentication(endpoint, rdata)) {
+ if (ast_sip_requires_authentication(endpoint, rdata)) {
pjsip_tx_data *tdata;
struct unidentified_request *unid;
@@ -888,6 +906,10 @@
return PJ_TRUE;
}
pjsip_tx_data_dec_ref(tdata);
+ } else if (endpoint == artificial_endpoint) {
+ /* Uh. Oh. The artificial endpoint couldn't challenge so block the request. */
+ pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 500, NULL, NULL, NULL);
+ return PJ_TRUE;
}
return PJ_FALSE;

89
net/asterisk-15.x/patches/130-AST-2018-009-15.diff
View file

@ -1,89 +0,0 @@
From 7d964e4b2e689f0dd7353e96d1782e92f59e9be6 Mon Sep 17 00:00:00 2001
From: Sean Bright <sean.bright@gmail.com>
Date: Thu, 16 Aug 2018 11:45:53 -0400
Subject: [PATCH] AST-2018-009: Fix crash processing websocket HTTP Upgrade
requests
The HTTP request processing in res_http_websocket allocates additional
space on the stack for various headers received during an Upgrade request.
An attacker could send a specially crafted request that causes this code
to overflow the stack, resulting in a crash.
* No longer allocate memory from the stack in a loop to parse the header
values. NOTE: There is a slight API change when using the passed in
strings as is. We now require the passed in strings to no longer have
leading or trailing whitespace. This isn't a problem as the only callers
have already done this before passing the strings to the affected
function.
ASTERISK-28013 #close
Change-Id: Ia564825a8a95e085fd17e658cb777fe1afa8091a
---
res/res_http_websocket.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/res/res_http_websocket.c b/res/res_http_websocket.c
index aaaba7d..e7ce830 100644
--- a/res/res_http_websocket.c
+++ b/res/res_http_websocket.c
@@ -758,7 +758,8 @@ static void websocket_bad_request(struct ast_tcptls_session_instance *ser)
int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instance *ser, const struct ast_http_uri *urih, const char *uri, enum ast_http_method method, struct ast_variable *get_vars, struct ast_variable *headers)
{
struct ast_variable *v;
- char *upgrade = NULL, *key = NULL, *key1 = NULL, *key2 = NULL, *protos = NULL, *requested_protocols = NULL, *protocol = NULL;
+ const char *upgrade = NULL, *key = NULL, *key1 = NULL, *key2 = NULL, *protos = NULL;
+ char *requested_protocols = NULL, *protocol = NULL;
int version = 0, flags = 1;
struct ast_websocket_protocol *protocol_handler = NULL;
struct ast_websocket *session;
@@ -777,16 +778,15 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
/* Get the minimum headers required to satisfy our needs */
for (v = headers; v; v = v->next) {
if (!strcasecmp(v->name, "Upgrade")) {
- upgrade = ast_strip(ast_strdupa(v->value));
+ upgrade = v->value;
} else if (!strcasecmp(v->name, "Sec-WebSocket-Key")) {
- key = ast_strip(ast_strdupa(v->value));
+ key = v->value;
} else if (!strcasecmp(v->name, "Sec-WebSocket-Key1")) {
- key1 = ast_strip(ast_strdupa(v->value));
+ key1 = v->value;
} else if (!strcasecmp(v->name, "Sec-WebSocket-Key2")) {
- key2 = ast_strip(ast_strdupa(v->value));
+ key2 = v->value;
} else if (!strcasecmp(v->name, "Sec-WebSocket-Protocol")) {
- requested_protocols = ast_strip(ast_strdupa(v->value));
- protos = ast_strdupa(requested_protocols);
+ protos = v->value;
} else if (!strcasecmp(v->name, "Sec-WebSocket-Version")) {
if (sscanf(v->value, "%30d", &version) != 1) {
version = 0;
@@ -800,7 +800,7 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
ast_sockaddr_stringify(&ser->remote_address));
ast_http_error(ser, 426, "Upgrade Required", NULL);
return 0;
- } else if (ast_strlen_zero(requested_protocols)) {
+ } else if (ast_strlen_zero(protos)) {
/* If there's only a single protocol registered, and the
* client doesn't specify what protocol it's using, go ahead
* and accept the connection */
@@ -821,9 +821,12 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
return 0;
}
- /* Iterate through the requested protocols trying to find one that we have a handler for */
- while (!protocol_handler && (protocol = strsep(&requested_protocols, ","))) {
- protocol_handler = ao2_find(server->protocols, ast_strip(protocol), OBJ_KEY);
+ if (!protocol_handler && protos) {
+ requested_protocols = ast_strdupa(protos);
+ /* Iterate through the requested protocols trying to find one that we have a handler for */
+ while (!protocol_handler && (protocol = strsep(&requested_protocols, ","))) {
+ protocol_handler = ao2_find(server->protocols, ast_strip(protocol), OBJ_KEY);
+ }
}
/* If no protocol handler exists bump this back to the requester */
--
2.7.4