summaryrefslogtreecommitdiff
path: root/main/tcptls.c
AgeCommit message (Collapse)Author
2014-07-03HTTP: Add persistent connection support.Richard Mudgett
Persistent HTTP connection support is needed due to the increased usage of the Asterisk core HTTP transport and the frequency at which REST API calls are going to be issued. * Add http.conf session_keep_alive option to enable persistent connections. * Parse and discard optional chunked body extension information and trailing request headers. * Increased the maximum application/json and application/x-www-form-urlencoded body size allowed to 4k. The previous 1k was kind of small. * Removed a couple inlined versions of ast_http_manid_from_vars() by calling the function. manager.c:generic_http_callback() and res_http_post.c:http_post_callback() * Add missing va_end() in ast_ari_response_error(). * Eliminated unnecessary RAII_VAR() use in http.c:auth_create(). ASTERISK-23552 #close Reported by: Scott Griepentrog Review: https://reviewboard.asterisk.org/r/3691/ ........ Merged revisions 417880 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@417901 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-07-03main/tcptls: Add checks for OpenSSL Elliptic Curve supportMatthew Jordan
The patch for ASTERISK-23905 that added PFS support in Asterisk depends on the elliptic curve library support being present in OpenSSL. As it turns out, some versions of OpenSSL don't have this library - notably the version running on our build agents. This patch fixes the build by providing a configure check for the specific library calls that the PFS patch relies on. Review: https://reviewboard.asterisk.org/r/3709/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@417900 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-07-03main/tcptls: Add support for Perfect Forward SecrecyMatthew Jordan
This patch enables Perfect Forward Secrecy (PFS) in Asterisk's core TLS API. Modules that wish to enable PFS should consider the following: - Ephemeral ECDH (ECDHE) is enabled by default. To disable it, do not specify a ECDHE cipher suite in a module's configuration, for example: tlscipher=AES128-SHA:DES-CBC3-SHA - Ephemeral DH (DHE) is disabled by default. To enable it, add DH parameters into the private key file, i.e., tlsprivatekey. For an example, see the default dh2048.pem at http://www.opensource.apple.com/source/OpenSSL098/OpenSSL098-35.1/src/apps/dh2048.pem?txt - Because clients expect the server to prefer PFS, and because OpenSSL sorts its cipher suites by bit strength, (see "openssl ciphers -v DEFAULT") consider re-ordering your cipher suites in the conf file. For example: tlscipher=AES128+kEECDH:AES128+kEDH:3DES+kEDH:AES128-SHA:DES-CBC3-SHA:-ADH:-AECDH will use PFS when offered by the client. Clients which do not offer PFS fall-back to AES-128 (or even 3DES as recommend by RFC 3261). Review: https://reviewboard.asterisk.org/r/3647/ ASTERISK-23905 #close Reported by: Alexander Traud patches: tlsPFS_for_HEAD.patch uploaded by Alexander Traud (License 6520) tlsPFS.patch uploaded by Alexander Traud (License 6520) git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@417803 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-06-13AST-2014-007: Fix of fix to allow AMI and SIP TCP to send messages.Richard Mudgett
ASTERISK-23673 #close Reported by: Richard Mudgett Review: https://reviewboard.asterisk.org/r/3617/ ........ Merged revisions 416066 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 416067 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 416070 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@416071 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-06-12AST-2014-007: Fix DOS by consuming the number of allowed HTTP connections.Richard Mudgett
Simply establishing a TCP connection and never sending anything to the configured HTTP port in http.conf will tie up a HTTP connection. Since there is a maximum number of open HTTP sessions allowed at a time you can block legitimate connections. A similar problem exists if a HTTP request is started but never finished. * Added http.conf session_inactivity timer option to close HTTP connections that aren't doing anything. Defaults to 30000 ms. * Removed the undocumented manager.conf block-sockets option. It interferes with TCP/TLS inactivity timeouts. * AMI and SIP TLS connections now have better authentication timeout protection. Though I didn't remove the bizzare TLS timeout polling code from chan_sip. * chan_sip can now handle SSL certificate renegotiations in the middle of a session. It couldn't do that before because the socket was non-blocking and the SSL calls were not restarted as documented by the OpenSSL documentation. * Fixed an off nominal leak of the ssl struct in handle_tcptls_connection() if the FILE stream failed to open and the SSL certificate negotiations failed. The patch creates a custom FILE stream handler to give the created FILE streams inactivity timeout and timeout after a specific moment in time capability. This approach eliminates the need for code using the FILE stream to be redesigned to deal with the timeouts. This patch indirectly fixes most of ASTERISK-18345 by fixing the usage of the SSL_read/SSL_write operations. ASTERISK-23673 #close Reported by: Richard Mudgett ........ Merged revisions 415841 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 415854 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 415896 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@415907 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-04-27tcptls.c : Log errors as ERROR, not warning or something else.Olle Johansson
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@413036 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-03-28http: response body often missing after specific requestScott Griepentrog
This patch works around a problem with the HTTP body being dropped from the response to a specific client and under specific circumstances: a) Client request comes from node.js user agent "Shred" via use of swagger-client library. b) Asterisk and Client are *not* on the same host or TCP/IP stack In testing this problem, it has been determined that the write of the HTTP body is lost, even if the data is written using low level write function. The only solution found is to instruct the TCP stack with the shutdown function to flush the last write and finish the transmission. See review for more details. ASTERISK-23548 #close (closes issue ASTERISK-23548) Reported by: Sam Galarneau Review: https://reviewboard.asterisk.org/r/3402/ ........ Merged revisions 411462 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 411463 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 411465 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@411469 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-02-04tcptls.c: Made TLS handle a certificate chain file.Richard Mudgett
Thanks to Guillaume Martres for doing the necessary research to validate the change. (closes issue ASTERISK-17727) Reported by: LN Patches: use_certificate_chain.patch (license #5864) patch uploaded by st documente_certificate_chain.patch (license #6576) patch uploaded by Guillaume Martres ........ Merged revisions 407272 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 407273 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 407274 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@407275 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2014-01-26tcptls.c: Add missing cleanup on off nominal path.Richard Mudgett
........ Merged revisions 406514 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 406515 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 406516 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@406517 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2013-12-16security: Inhibit execution of privilege escalating functionsDavid M. Lee
This patch allows individual dialplan functions to be marked as 'dangerous', to inhibit their execution from external sources. A 'dangerous' function is one which results in a privilege escalation. For example, if one were to read the channel variable SHELL(rm -rf /) Bad Things(TM) could happen; even if the external source has only read permissions. Execution from external sources may be enabled by setting 'live_dangerously' to 'yes' in the [options] section of asterisk.conf. Although doing so is not recommended. Also, the ABI was changed to something more reasonable, since Asterisk 12 does not yet have a public release. (closes issue ASTERISK-22905) Review: http://reviewboard.digium.internal/r/432/ ........ Merged revisions 403913 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 403917 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 403959 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@403960 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2013-03-15tcptls: Prevent unsupported options from being setKinsey Moore
AMI, HTTP, and chan_sip all support TLS in some way, but none of them support all the options that Asterisk's TLS core is capable of interpreting. This prevents consumers of the TLS/SSL layer from setting TLS/SSL options that they do not support. This also gets tlsverifyclient closer to a working state by requesting the client certificate when tlsverifyclient is set. Currently, there is no consumer of main/tcptls.c in Asterisk that supports this feature and so it can not be properly tested. Review: https://reviewboard.asterisk.org/r/2370/ Reported-by: John Bigelow Patch-by: Kinsey Moore (closes issue AST-1093) ........ Merged revisions 383165 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 383166 from http://svn.asterisk.org/svn/asterisk/branches/11 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@383167 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-10-17Ensure Asterisk fails TCP/TLS SIP calls when certificate checking failsKinsey Moore
When placing a call to a TCP/TLS SIP endpoint whose certificate is not signed by a configured CA certificate, Asterisk would issue a warning and continue to process the call as if there was not an issue with the certificate. Asterisk now properly fails the call if the certificate fails verification or if the certificate does not exist when certificate checking is enabled (the default behavior). (closes issue ASTERISK-20559) Reported by: kmoore Review: https://reviewboard.asterisk.org/r/2163/ ........ Merged revisions 375146 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 375147 from http://svn.asterisk.org/svn/asterisk/branches/10 ........ Merged revisions 375148 from http://svn.asterisk.org/svn/asterisk/branches/11 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@375149 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-10-12Do not use a FILE handle when doing SIP TCP reads.Mark Michelson
This is used to solve an issue where a poll on a file descriptor does not necessarily correspond to the readiness of a FILE handle to be read. This change makes it so that for TCP connections, we do a recv() on the file descriptor instead. Because TCP does not guarantee that an entire message or even just one single message will arrive during a read, a loop has been introduced to ensure that we only attempt to handle a single message at a time. The tcptls_session_instance structure has also had an overflow buffer added to it so that if more than one TCP message arrives in one go, there is a place to throw the excess. Huge thanks goes out to Walter Doekes for doing extensive review on this change and finding edge cases where code could fail. (closes issue ASTERISK-20212) reported by Phil Ciccone Review: https://reviewboard.asterisk.org/r/2123 ........ Merged revisions 374905 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 374906 from http://svn.asterisk.org/svn/asterisk/branches/10 ........ Merged revisions 374914 from http://svn.asterisk.org/svn/asterisk/branches/11 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@374924 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-09-14Resolve memory leaks in TLS initialization and TLS client connectionsMatthew Jordan
This patch resolves two sources of memory leaks when using TLS in Asterisk: 1) It removes improper initialization (and multiple re-initializations) of portions of the SSL library. Asterisk calls SSL_library_init and SSL_load_error_strings during SSL initialization; collectively this obviates the need for calling any of the following during initialization or client connection handling: * ERR_load_crypto_strings (handled by SSL_load_error_strings) * OpenSSL_add_all_algorithms (synonym for SSL_library_init) * SSLeay_add_ssl_algorithms (synonym for SSL_library_init) 2) Failure to completely clean up all memory allocated by Asterisk and by the SSL library for TLS clients. This included not freeing the SSL_CTX object in the SIP channel driver, as well as not clearing the error stack when the TLS client exited. Note that these memory leaks were found by Thomas Arimont, and this patch was essentially written by him with some minor tweaks. (closes issue AST-889) Reported by: Thomas Arimont Tested by: Thomas Arimont patches: (bugAST-889.patch) by Thomas Arimont (license 5525) Review: https://reviewboard.asterisk.org/r/2105 ........ Merged revisions 373061 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 373062 from http://svn.asterisk.org/svn/asterisk/branches/10 ........ Merged revisions 373079 from http://svn.asterisk.org/svn/asterisk/branches/11 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@373080 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-07-31Clean up and ensure proper usage of alloca()Kinsey Moore
This replaces all calls to alloca() with ast_alloca() which calls gcc's __builtin_alloca() to avoid BSD semantics and removes all NULL checks on memory allocated via ast_alloca() and ast_strdupa(). (closes issue ASTERISK-20125) Review: https://reviewboard.asterisk.org/r/2032/ Patch-by: Walter Doekes (wdoekes) ........ Merged revisions 370642 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 370643 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@370655 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-07-06Remove a superfluous and dangerous freeing of an SSL_CTX.Mark Michelson
The problem here is that multiple server sessions share a SSL_CTX. When one session ended, the SSL_CTX would be freed and set NULL, leaving the other sessions unable to function. The code being removed is superfluous because the SSL_CTX structures for servers will be properly freed when ast_ssl_teardown is called. (closes issue ASTERISK-20074) Reported by Trevor Helmsley Patches: ASTERISK-20074.diff uploaded by Mark Michelson (license #5049) Testers: Trevor Helmsley ........ Merged revisions 369731 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 369732 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@369733 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-06-15Multiple revisions 369001-369002Kevin P. Fleming
........ r369001 | kpfleming | 2012-06-15 10:56:08 -0500 (Fri, 15 Jun 2012) | 11 lines Add support-level indications to many more source files. Since we now have tools that scan through the source tree looking for files with specific support levels, we need to ensure that every file that is a component of a 'core' or 'extended' module (or the main Asterisk binary) is explicitly marked with its support level. This patch adds support-level indications to many more source files in tree, but avoids adding them to third-party libraries that are included in the tree and to source files that don't end up involved in Asterisk itself. ........ r369002 | kpfleming | 2012-06-15 10:57:14 -0500 (Fri, 15 Jun 2012) | 3 lines Add a script to enable finding source files without support-levels defined. ........ Merged revisions 369001-369002 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 369005 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@369013 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-05-31Coverity Report: Fix issues for error type REVERSE_INULL (core modules)Richard Mudgett
* Fixes findings: 0-2,5,7-15,24-26,28-31 (issue ASTERISK-19648) Reported by: Matt Jordan ........ Merged revisions 368039 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 368042 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@368052 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-05-23Only call SSL_CTX_free if DO_SSL is defined.Mark Michelson
Thanks to Paul Belanger for pointing out this error. ........ Merged revisions 367416 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 367417 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@367418 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-05-18Fix memory leak of SSL_CTX structures in TLS core.Mark Michelson
SSL_CTX structures were allocated but never freed. This was a bigger issue for clients than servers since new SSL_CTX structures could be allocated for each connection. Servers, on the other hand, typically set up a single SSL_CTX for their lifetime. This is solved in two ways: 1. In __ssl_setup(), if a tcptls_cfg has an ssl_ctx on it, it is freed so that a new one can take its place. 2. A companion to ast_ssl_setup() called ast_ssl_teardown() has been added so that servers can properly free their SSL_CTXs. (issue ASTERISK-19278) ........ Merged revisions 367002 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 367003 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@367010 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-05-10Resolve FORWARD_NULL static analysis warningsKinsey Moore
This resolves core findings from ASTERISK-19650 numbers 0-2, 6, 7, 9-11, 14-20, 22-24, 28, 30-32, 34-36, 42-56, 82-84, 87, 89-90, 93-102, 104, 105, 109-111, and 115. Finding numbers 26, 33, and 29 were already resolved. Those skipped were either extended/deprecated or in areas of code that shouldn't be disturbed. (Closes issue ASTERISK-19650) ........ Merged revisions 366167 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 366168 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@366169 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-04-06Add missing newlines to CLI loggingKinsey Moore
........ Merged revisions 361471 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 361472 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@361476 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2012-02-28Convert struct ast_tcptls_session_instance to finally use the ao2 object lock.Richard Mudgett
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@357317 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-11-30Remove the few places where we try to ast_verbose() without a newline.Tilghman Lesher
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@346655 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-11-30r346525 | jrose | 2011-11-30 15:10:38 -0600 (Wed, 30 Nov 2011) | 18 linesJonathan Rose
Cleaning up chan_sip/tcptls file descriptor closing. This patch attempts to eliminate various possible instances of undefined behavior caused by invoking close/fclose in situations where fclose may have already been issued on a tcptls_session_instance and/or closing file descriptors that don't have a valid index for fd (-1). Thanks for more than a little help from wdoekes. (closes issue ASTERISK-18700) Reported by: Erik Wallin (issue ASTERISK-18345) Reported by: Stephane Cazelas (issue ASTERISK-18342) Reported by: Stephane Chazelas Review: https://reviewboard.asterisk.org/r/1576/ ........ Merged revisions 346564 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 346565 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@346566 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-11-30Reverting 346525 due to accidental patch against trunk instead of 1.8Jonathan Rose
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@346563 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-11-30Cleaning up chan_sip/tcptls file descriptor closing.Jonathan Rose
This patch attempts to eliminate various possible instances of undefined behavior caused by invoking close/fclose in situations where fclose may have already been issued on a tcptls_session_instance and/or closing file descriptors that don't have a valid index for fd (-1). Thanks for more than a little help from wdoekes. (closes issue ASTERISK-18700) Reported by: Erik Wallin (issue ASTERISK-18345) Reported by: Stephane Cazelas (issue ASTERISK-18342) Reported by: Stephane Chazelas Review: https://reviewboard.asterisk.org/r/1576/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@346525 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-11-06Formatting and doxygen improvementsOlle Johansson
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@343492 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-05-23Merged revisions 320568 via svnmerge from David Vossel
https://origsvn.digium.com/svn/asterisk/branches/1.8 ................ r320568 | dvossel | 2011-05-23 11:18:33 -0500 (Mon, 23 May 2011) | 14 lines Merged revisions 320562 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.6.2 ........ r320562 | dvossel | 2011-05-23 11:15:18 -0500 (Mon, 23 May 2011) | 9 lines Adds missing part to the ast_tcptls_server_start fails second attempt to bind patch. (closes issue #19289) Reported by: wdoekes Patches: issue19289_delay_old_address_setting_tcptls_2.patch uploaded by wdoekes (license 717) ........ ................ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@320606 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-05-20Merged revisions 320338 via svnmerge from David Vossel
https://origsvn.digium.com/svn/asterisk/branches/1.8 ................ r320338 | dvossel | 2011-05-20 16:39:36 -0500 (Fri, 20 May 2011) | 14 lines Merged revisions 320271 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.6.2 ........ r320271 | dvossel | 2011-05-20 16:24:48 -0500 (Fri, 20 May 2011) | 8 lines Fixes issue with ast_tcptls_server_start failing on second attempt to bind. (closes issue #19289) Reported by: wdoekes Patches: issue19289_delay_old_address_setting_tcptls.patch uploaded by wdoekes (license 717) ........ ................ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@320340 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-04-19Merged revisions 314251 via svnmerge from Leif Madsen
https://origsvn.digium.com/svn/asterisk/branches/1.8 ........ r314251 | lmadsen | 2011-04-19 10:42:10 -0500 (Tue, 19 Apr 2011) | 8 lines Use SSLv23_client_method instead of old SSLv2 only. (closes issue #19095) (closes issue #19138) Reported by: tzafrir Patches: no_ssl2.diff uploaded by tzafrir (license 46) Tested by: russell, chazzam ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@314252 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-03-16Merged revisions 310999 via svnmerge from Terry Wilson
https://origsvn.digium.com/svn/asterisk/branches/1.8 ................ r310999 | twilson | 2011-03-16 14:47:59 -0500 (Wed, 16 Mar 2011) | 18 lines Merged revisions 310998 via svnmerge from https://origsvn.digium.com/svn/asterisk/branches/1.6.2 ........ r310998 | twilson | 2011-03-16 14:46:36 -0500 (Wed, 16 Mar 2011) | 11 lines Fix crash on fdopen failure See security advisory AST-2011-004 (closes issue #18845) Reported by: cmaj Patches: patch-main-tcptls-1.8.3-rc2-open-session-crash-take2.diff.txt uploaded by cmaj (license 830) patch-main-tcptls-1.8.3-rc2-open-session-crash-take3.diff.txt uploaded by cmaj (license 830) Tested by: cmaj, twilson ........ ................ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@311001 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2011-01-31Merged revisions 305247 via svnmerge from Jason Parker
https://origsvn.digium.com/svn/asterisk/branches/1.8 ........ r305247 | qwell | 2011-01-31 16:25:23 -0600 (Mon, 31 Jan 2011) | 7 lines Add alternative name for config option. The SIP sample configuration had "tlscadir" as the option name, but chan_sip used the more correct "tlscapath". Now both are accepted. Discovered (sort of) by a user on IRC in #asterisk ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@305248 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2010-07-08Add IPv6 to Asterisk.Mark Michelson
This adds a generic API for accommodating IPv6 and IPv4 addresses within Asterisk. While many files have been updated to make use of the API, chan_sip and the RTP code are the files which actually support IPv6 addresses at the time of this commit. The way has been paved for easier upgrading for other files in the near future, though. Big thanks go to Simon Perrault, Marc Blanchet, and Jean-Philippe Dionne for their hard work on this. (closes issue #17565) Reported by: russell Patches: asteriskv6-test-report.pdf uploaded by russell (license 2) Review: https://reviewboard.asterisk.org/r/743 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@274783 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2010-03-20Resolve more compiler warnings on FreeBSD.Russell Bryant
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@253540 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2010-02-16swap openssl with OpenSSL in warning message.David Vossel
(issue #16673) git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@246981 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2010-02-16warning message if openssl support is missing while attempting tls connectionDavid Vossel
(closes issue #16673) Reported by: michaesc Patches: tls_error_msg.diff uploaded by dvossel (license 671) git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@246980 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-10-22SIP TCP/TLS: move client connection setup/write into tcp helper thread, ↵David Vossel
various related locking/memory fixes. What this patch fixes 1.Moves sip TCP/TLS connection setup into the TCP helper thread: Connection setup takes awhile and before this it was being done while holding the monitor lock. 2.Moves TCP/TLS writing to the TCP helper thread: Through the use of a packet queue and an alert pipe, the TCP helper thread can now be woken up to write data as well as read data. 3.Locking error: sip_xmit returned an XMIT_ERROR without giving up the tcptls_session lock. This lock has been completely removed from sip_xmit and placed in the new sip_tcptls_write() function. 4.Memory leak: When creating a tcptls_client the tls_cfg was alloced but never freed unless the tcptls_session failed to start. Now the session_args for a sip client are an ao2 object which frees the tls_cfg on destruction. 5.Pointer to stack variable: During sip_prepare_socket the creation of a client's ast_tcptls_session_args was done on the stack and stored as a pointer in the newly created tcptls_session. Depending on the events that followed, there was a slight possibility that pointer could have been accessed after the stack returned. Given the new changes, it is always accessed after the stack returns which is why I found it. Notable code changes 1.I broke tcptls.c's ast_tcptls_client_start() function into two functions. One for creating and allocating the new tcptls_session, and a separate one for starting and handling the new connection. This allowed me to create the tcptls_session, launch the helper thread, and then establish the connection within the helper thread. 2.Writes to a tcptls_session are now done within the helper thread. This is done by using an alert pipe to wake up the thread if new data needs to be sent. The thread's sip_threadinfo object contains the alert pipe as well as the packet queue. 3.Since the threadinfo object contains the alert pipe, it must now be accessed outside of the helper thread for every write (queuing of a packet). For easy lookup, I moved the threadinfo objects from a linked list to an ao2_container. (closes issue #13136) Reported by: pabelanger Tested by: dvossel, whys (closes issue #15894) Reported by: dvossel Tested by: dvossel Review: https://reviewboard.asterisk.org/r/380/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@225445 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-09-24fixes tcptls_session memory leak caused by ref count errorDavid Vossel
(closes issue #15939) Reported by: dvossel Review: https://reviewboard.asterisk.org/r/375/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@220365 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-04-29SIP option to specify outbound TLS/SSL client protocol.David Vossel
chan_sip allows for outbound TLS connections, but does not allow the user to specify what protocol to use (default was SSLv2, and still is if this new option is not specified). This patch lets the user pick the SSL/TLS client method for outbound connections in sip. (closes issue #14770) Reported by: TheOldSaint (closes issue #14768) Reported by: TheOldSaint Review: http://reviewboard.digium.com/r/240/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@191177 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-04-29Consistent SSL/TLS options across conf filesDavid Vossel
ast_tls_read_conf() is a new api call for handling SSL/TLS options across all conf files. Before this change, SSL/TLS options were not consistent. http.conf and manager.conf required the 'ssl' prefix while sip.conf used options with the 'tls' prefix. While the options had different names in different conf files, they all did the exact same thing. Now, instead of mixing 'ssl' or 'tls' prefixes to do the same thing depending on what conf file you're in, all SSL/TLS options use the 'tls' prefix. For example. 'sslenable' in http.conf and manager.conf is now 'tlsenable' which matches what already existed in sip.conf. Since this has the potential to break backwards compatibility, previous options containing the 'ssl' prefix still work, but they are no longer documented in the sample.conf files. The change is noted in the CHANGES file though. Review: http://reviewboard.digium.com/r/237/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@191028 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-04-24TLS/SSL private key optionDavid Vossel
Adds option to specify a private key .pem file when configuring TLS or SSL in AMI, HTTP, and SIP. Before this, the certificate file was used for both the public and private key. It is possible for this file to hold both, but most configurations allow for a separate private key file to be specified. Clarified in .conf files how these options are to be used. The current conf files do not explain how the private key is handled at all, so without knowledge of Asterisk's TLS implementation, it would be hard to know for sure what was going on or how to set it up. Review: http://reviewboard.digium.com/r/234/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@190545 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-03-09Add Doxygen documentation for API changes from 1.6.0 to 1.6.1Jeff Peeler
Copied from my review board description: This is a continuation of the API changes documentation started for describing changes between releases. Most of the API changes were pretty simple needing only to be brought to attention via the new "Asterisk API Changes" list. However, if you see anything that needs further explanation feel free to supplement what is there. The current method of documenting is to add (in the header file): \version <ver number> <description of changes> and then to add the function to the change list in doxyref.h on the AstAPIChanges page. I also made sure all the functions that were newly added were tagged with \since 1.6.1. I think this is a good habit to start both for the historical aspect as well as for the future ability to easily add a "New Asterisk API" page. Review: http://reviewboard.digium.com/r/190/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@180719 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-02-04When using a socket as a FILE *, the stdio functions will sometimes try to doTilghman Lesher
an fseek() on the stream, which is an invalid operation for a socket. Turning off buffering explicitly lets the stdio functions know they cannot do this, thus avoiding a potential error. (closes issue #14400) Reported by: fnordian Patches: tcptls.patch uploaded by fnordian (license 110) git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@173458 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-01-21Fix a regression in TCP support.Russell Bryant
This patch fixes a problem that caused chan_sip to think that every open TCP session was to a remote address of 0.0.0.0:0. (closes issue #14287) Reported by: jamesgolovich Patches: bug-14287.diff.txt uploaded by jamesgolovich (license 176) git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@169620 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2009-01-17Fix qualify for TCP peerTerry Wilson
(closes issue #14192) Reported by: pabelanger Patches: asterisk-bug14192.diff.txt uploaded by jamesgolovich (license 176) Tested by: jamesgolovich git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@169080 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2008-12-13Merge ast_str_opaque branch (discontinue usage of ast_str internals)Tilghman Lesher
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@163991 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2008-12-12Rename a number of tcptls_session variables. There are no functional ↵Russell Bryant
changes here. The name "ser" was used in a lot of places. However, it is a relic from when the struct was a server_instance, not a session_instance. It was renamed since it represents both a server or client connection. git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@163670 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2008-10-19cleaup of the TCP/TLS socket API:Kevin P. Fleming
1) rename 'struct server_args' to 'struct ast_tcptls_session_args', to follow coding guidelines 2) make ast_make_file_from_fd() static and rename it to something that indicates what it really is for (again coding guidelines) 3) rename address variables inside 'struct ast_tcptls_session_args' to be more descriptive (dare i say it... coding guidelines) 4) change ast_tcptls_client_start() to use the new 'remote_address' field of the session args for the destination of the connection, and use the 'local_address' field to bind() the socket to the proper source address, if one is supplied 5) in chan_sip, ensure that we pass in the PP address we are bound to when creating outbound (client) connections, so that our connections will appear from the correct address git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@151101 65c4cc65-6c06-0410-ace0-fbb531ad65f3
2008-10-13Highlightning even more bugs in the current tcp/tls implementation.Olle Johansson
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@148473 65c4cc65-6c06-0410-ace0-fbb531ad65f3
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-02 17:11:35 +0000