lp:asterisk-snap

Owned by vidasov
Get this repository:
git clone https://git.launchpad.net/asterisk-snap

Import details

Import Status: Failed

This repository is an import of the Git repository at http://gerrit.asterisk.org/asterisk.

The import has been suspended because it failed 5 or more times in succession.

Last successful import was .

Import started on juju-1e3bde-prod-lp-code-import-16 and finished taking 1 hour 40 minutes — see the log
Import started on alnitak and finished taking 33 minutes — see the log
Import started on izar and finished taking 36 minutes — see the log
Import started on alnitak and finished taking 33 minutes — see the log

Branches

Name Last Modified Last Commit
master 2022-03-29 17:39:35 UTC
Makefile: Disable XML doc validation

Author: George Joseph
Author Date: 2022-03-25 19:00:48 UTC

Makefile: Disable XML doc validation

make_xml_documentation was being called with the --validate
flag set when it shouldn't have been. This was causing
build failures if neither xmllint nor xmlstarlet were installed.
The correct behavior is to simply print a message that either
one of those tools should be installed for validation and
continue with the build.

ASTERISK-29988

Change-Id: Idc6c44114e7dd3fadae183a4e22f4fdba0b8a645

13 2019-08-07 16:19:22 UTC
Merge "CI: Make node labels job-specific" into 13

Author: Friendly Automation
Author Date: 2019-08-07 16:19:22 UTC

Merge "CI: Make node labels job-specific" into 13

16 2019-08-07 16:19:20 UTC
Merge "CI: Make node labels job-specific" into 16

Author: Friendly Automation
Author Date: 2019-08-07 16:19:20 UTC

Merge "CI: Make node labels job-specific" into 16

17 2019-08-07 16:19:18 UTC
Merge "CI: Make node labels job-specific" into 17

Author: Friendly Automation
Author Date: 2019-08-07 16:19:18 UTC

Merge "CI: Make node labels job-specific" into 17

17.0 2019-08-06 15:52:43 UTC
CI: Make node labels job-specific

Author: George Joseph
Author Date: 2019-08-06 15:40:54 UTC

CI: Make node labels job-specific

Originally, the eligible nodes for a job were labelled only by
"swdev-docker". So basically any node could run any job. We had
found that allowing a node to run more than 1 gate at a time was
problematic so we limited the nodes to processing 1 job at a time.
With the creation of the Asterisk 17 branches however, we now have
so many active branches that getting checks and gates through in
a timely manner is problematic when a node can run only 1 job
at a time.

Now the nodes are also labelled by the job type they can run.
For instance: "asterisk-check", "asterisk-gate", etc. With the
"Throttle Concurrent Builds" plugin, we can now allow a node to
run more than 1 job BUT throttle by job type. For instance:
  Allow 2 jobs but only 1 asterisk-gate at a time.
Now a node can run 2 checks or 1 check and 1 gate or 1 gate but
not 2 gates at a time.

Change-Id: I2032bf6afbcec5c341d9b852214c0c812d3d6db5

certified/16.3 2019-08-06 15:51:19 UTC
CI: Make node labels job-specific

Author: George Joseph
Author Date: 2019-08-06 15:40:54 UTC

CI: Make node labels job-specific

Originally, the eligible nodes for a job were labelled only by
"swdev-docker". So basically any node could run any job. We had
found that allowing a node to run more than 1 gate at a time was
problematic so we limited the nodes to processing 1 job at a time.
With the creation of the Asterisk 17 branches however, we now have
so many active branches that getting checks and gates through in
a timely manner is problematic when a node can run only 1 job
at a time.

Now the nodes are also labelled by the job type they can run.
For instance: "asterisk-check", "asterisk-gate", etc. With the
"Throttle Concurrent Builds" plugin, we can now allow a node to
run more than 1 job BUT throttle by job type. For instance:
  Allow 2 jobs but only 1 asterisk-gate at a time.
Now a node can run 2 checks or 1 check and 1 gate or 1 gate but
not 2 gates at a time.

Change-Id: I2032bf6afbcec5c341d9b852214c0c812d3d6db5

certified/13.21 2019-08-06 15:50:52 UTC
CI: Make node labels job-specific

Author: George Joseph
Author Date: 2019-08-06 15:40:54 UTC

CI: Make node labels job-specific

Originally, the eligible nodes for a job were labelled only by
"swdev-docker". So basically any node could run any job. We had
found that allowing a node to run more than 1 gate at a time was
problematic so we limited the nodes to processing 1 job at a time.
With the creation of the Asterisk 17 branches however, we now have
so many active branches that getting checks and gates through in
a timely manner is problematic when a node can run only 1 job
at a time.

Now the nodes are also labelled by the job type they can run.
For instance: "asterisk-check", "asterisk-gate", etc. With the
"Throttle Concurrent Builds" plugin, we can now allow a node to
run more than 1 job BUT throttle by job type. For instance:
  Allow 2 jobs but only 1 asterisk-gate at a time.
Now a node can run 2 checks or 1 check and 1 gate or 1 gate but
not 2 gates at a time.

Change-Id: I2032bf6afbcec5c341d9b852214c0c812d3d6db5

16.5 2019-07-25 09:38:14 UTC
Update for 16.5.0

Author: Asterisk Development Team
Author Date: 2019-07-25 09:38:14 UTC

Update for 16.5.0

13.28 2019-07-25 09:35:13 UTC
Update for 13.28.0

Author: Asterisk Development Team
Author Date: 2019-07-25 09:35:13 UTC

Update for 13.28.0

15 2019-07-12 17:45:39 UTC
Merge "res_pjsip_messaging: Check for body in in-dialog message" into 15

Author: Kevin Harwell
Author Date: 2019-07-12 17:45:39 UTC

Merge "res_pjsip_messaging: Check for body in in-dialog message" into 15

16.4 2019-07-11 19:25:15 UTC
Update for 16.4.1

Author: Asterisk Development Team
Author Date: 2019-07-11 19:25:15 UTC

Update for 16.4.1

15.7 2019-07-11 19:22:48 UTC
Update for 15.7.3

Author: Asterisk Development Team
Author Date: 2019-07-11 19:22:48 UTC

Update for 15.7.3

13.27 2019-07-11 19:20:31 UTC
Update for 13.27.1

Author: Asterisk Development Team
Author Date: 2019-07-11 19:20:31 UTC

Update for 13.27.1

team/mjordan/res_prometheus 2019-05-10 14:36:01 UTC
res_prometheus: Add metrics for PJSIP outbound registrations

Author: Matthew Jordan
Author Date: 2019-05-10 14:36:01 UTC

res_prometheus: Add metrics for PJSIP outbound registrations

When monitoring Asterisk instances, it's often useful to know when an
outbound registration fails, as this often maps to the notion of a trunk
and having a trunk fail is usually a "bad thing". As such, this patch
adds monitoring metrics that track the state of PJSIP outbound registrations.
It does this by looking for the Registry events coming across the Stasis
system topic, and publishing those as metrics to Prometheus. Note that
while this may support other outbound registration types (IAX2, SIP, etc.)
those haven't been tested. Your mileage may vary.

(And why are you still using IAX2 and SIP? It's 2019 folks. Get with the
program.)

This patch also adds Sorcery observers to handle modifications to the
underlying PJSIP outbound registration objects. This is useful when a
reload is triggered that modifies the properties of an outbound registration,
or when ARI push configuration is used and an object is updated or
deleted. Because we rely on properties of the registration object to
define the metric (label key/value pairs), we delete the relevant metric when
we notice that something has changed and wait for a new Stasis message to
arrive to re-create the metric.

ASTERISK-28403

Change-Id: If01420e38530fc20b6dd4aa15cd281d94cd2b87e

16.3 2019-04-04 14:49:57 UTC
Update for 16.3.0

Author: Asterisk Development Team
Author Date: 2019-04-04 14:49:57 UTC

Update for 16.3.0

13.26 2019-04-04 14:46:29 UTC
Update for 13.26.0

Author: Asterisk Development Team
Author Date: 2019-04-04 14:46:29 UTC

Update for 13.26.0

16.2 2019-02-28 18:41:32 UTC
Update for 16.2.1

Author: Asterisk Development Team
Author Date: 2019-02-28 18:41:32 UTC

Update for 16.2.1

13.25 2019-02-14 16:55:14 UTC
Revert "Test_cel: Fails when DONT_OPTIMIZE is off"

Author: Chris Savinovich
Author Date: 2019-02-14 16:53:42 UTC

Revert "Test_cel: Fails when DONT_OPTIMIZE is off"

This reverts commit 9b85882f04ed4b48e7bb318dbbb969d90159f13a.

Change-Id: I36cf159abb103502e48d6f8fd70d560d7f0bda56

16.1 2018-12-26 16:30:05 UTC
Revert "stasis_cache: Stop caching stasis subscription change messages"

Author: George Joseph
Author Date: 2018-12-26 16:24:57 UTC

Revert "stasis_cache: Stop caching stasis subscription change messages"

This commit caused issues with polling when combined with
the revert commit "Revert "app_voicemail: Remove need to subscribe to stasis"

This reverts commit 17d6d9e1e7d0db04ebd8d2e0cd9e087ec5462e2f.

ASTERISK-28222
Reported by: abelbeck

Change-Id: Ib6a16cbe2c0b74c76c64264f525ab647959c1483

13.24 2018-12-26 16:28:06 UTC
Revert "stasis_cache: Stop caching stasis subscription change messages"

Author: George Joseph
Author Date: 2018-12-26 16:23:05 UTC

Revert "stasis_cache: Stop caching stasis subscription change messages"

This commit caused issues with polling when combined with
the revert commit "Revert "app_voicemail: Remove need to subscribe
to stasis"

This reverts commit 94a4eea7f6e486368b35585ea867479f248095c2.

ASTERISK-28222
Reported by: abelbeck

Change-Id: I0aaab5218a282706dfc6fcbbaeead228d599b99b

16.0 2018-11-14 14:26:23 UTC
AST-2018-010: Fix length of buffer needed for SRV and NAPTR results

Author: George Joseph
Author Date: 2018-10-25 15:25:58 UTC

AST-2018-010: Fix length of buffer needed for SRV and NAPTR results

When dn_expand was being called on SRV and NAPTR results, the
return value was being used to calculate the size of the buffer
needed to store the host names. Since dn_expand returns the
length of the COMPRESSED name the buffer could be too short
to hold the EXPANDED name. The expanded name is NULL terminated
so using strlen() is the correct way to determine the length
actually needed for the buffer.

ASTERISK-28127
Reported by: Jan Hoffmann

patches:
  patch.diff submitted by janhoffmann (license 6986)

Change-Id: I4d35d6c431c6c6836cb61d37b1378cc47f0b414d

15.6 2018-11-14 14:26:12 UTC
AST-2018-010: Fix length of buffer needed for SRV and NAPTR results

Author: George Joseph
Author Date: 2018-10-25 15:25:58 UTC

AST-2018-010: Fix length of buffer needed for SRV and NAPTR results

When dn_expand was being called on SRV and NAPTR results, the
return value was being used to calculate the size of the buffer
needed to store the host names. Since dn_expand returns the
length of the COMPRESSED name the buffer could be too short
to hold the EXPANDED name. The expanded name is NULL terminated
so using strlen() is the correct way to determine the length
actually needed for the buffer.

ASTERISK-28127
Reported by: Jan Hoffmann

patches:
  patch.diff submitted by janhoffmann (license 6986)

Change-Id: I4d35d6c431c6c6836cb61d37b1378cc47f0b414d

13.23 2018-09-26 13:14:18 UTC
CI: Add --test-timeout option to runTestsuite.sh

Author: George Joseph
Author Date: 2018-09-26 13:12:28 UTC

CI: Add --test-timeout option to runTestsuite.sh

The default is 600 seconds.
Also added timeouts to the *TestGroups.json files.

Change-Id: I8ab6a69e704b6a10f06a0e52ede02312a2b72fe0

14.7 2018-09-20 16:19:42 UTC
AST-2018-009: Fix crash processing websocket HTTP Upgrade requests

Author: Sean Bright
Author Date: 2018-08-16 15:45:53 UTC

AST-2018-009: Fix crash processing websocket HTTP Upgrade requests

The HTTP request processing in res_http_websocket allocates additional
space on the stack for various headers received during an Upgrade request.
An attacker could send a specially crafted request that causes this code
to overflow the stack, resulting in a crash.

* No longer allocate memory from the stack in a loop to parse the header
values. NOTE: There is a slight API change when using the passed in
strings as is. We now require the passed in strings to no longer have
leading or trailing whitespace. This isn't a problem as the only callers
have already done this before passing the strings to the affected
function.

ASTERISK-28013 #close

Change-Id: Ia564825a8a95e085fd17e658cb777fe1afa8091a

14 2018-09-20 16:18:44 UTC
AST-2018-009: Fix crash processing websocket HTTP Upgrade requests

Author: Sean Bright
Author Date: 2018-08-16 15:45:53 UTC

AST-2018-009: Fix crash processing websocket HTTP Upgrade requests

The HTTP request processing in res_http_websocket allocates additional
space on the stack for various headers received during an Upgrade request.
An attacker could send a specially crafted request that causes this code
to overflow the stack, resulting in a crash.

* No longer allocate memory from the stack in a loop to parse the header
values. NOTE: There is a slight API change when using the passed in
strings as is. We now require the passed in strings to no longer have
leading or trailing whitespace. This isn't a problem as the only callers
have already done this before passing the strings to the affected
function.

ASTERISK-28013 #close

Change-Id: Ia564825a8a95e085fd17e658cb777fe1afa8091a

team/neutrino88/13-packaging 2018-07-19 15:03:29 UTC
tuning of .spec

Author: neutrino88
Author Date: 2018-07-19 15:03:29 UTC

tuning of .spec

Change-Id: Ifdebd1b17f23f076d96fcf6a7a1a4929ab71a1f4

certified/13.18 2018-06-11 16:18:42 UTC
AST-2018-008: Fix enumeration of endpoints from ACL rejected addresses.

Author: Richard Mudgett
Author Date: 2018-04-30 22:38:58 UTC

AST-2018-008: Fix enumeration of endpoints from ACL rejected addresses.

When endpoint specific ACL rules block a SIP request they respond with a
403 forbidden. However, if an endpoint is not identified then a 401
unauthorized response is sent. This vulnerability just discloses which
requests hit a defined endpoint. The ACL rules cannot be bypassed to gain
access to the disclosed endpoints.

* Made endpoint specific ACL rules now respond with a 401 unauthorized
which is the same as if an endpoint were not identified. The fix is
accomplished by replacing the found endpoint with the artificial endpoint
which always fails authentication.

ASTERISK-27818

Change-Id: Icb275a54ff8e2df6c671a6d9bda37b5d732b3b32

certified/13.13 2017-12-13 14:34:09 UTC
Update for certified/13.13-cert9

Author: George Joseph
Author Date: 2017-12-13 14:34:09 UTC

Update for certified/13.13-cert9

certified/11.6 2017-09-19 16:08:19 UTC
Update for certified/11.6-cert18

Author: Joshua Colp
Author Date: 2017-09-19 16:08:19 UTC

Update for certified/11.6-cert18

11 2017-09-15 20:28:35 UTC
AST-2017-008: Improve RTP and RTCP packet processing.

Author: Richard Mudgett
Author Date: 2017-09-13 17:07:42 UTC

AST-2017-008: Improve RTP and RTCP packet processing.

Validate RTCP packets before processing them.

* Validate that the received packet is of a minimum length and apply the
RFC3550 RTCP packet validation checks.

* Fixed potentially reading garbage beyond the received RTCP record data.

* Fixed rtp->themssrc only being set once when the remote could change
the SSRC. We would effectively stop handling the RTCP statistic records.

* Fixed rtp->themssrc to not treat a zero value as special by adding
rtp->themssrc_valid to indicate if rtp->themssrc is available.

ASTERISK-27274

Make strict RTP learning more flexible.

Direct media can cause strict RTP to attempt to learn a remote address
again before it has had a chance to learn the remote address the first
time. Because of the rapid relearn requests, strict RTP could latch onto
the first remote address and fail to latch onto the direct media remote
address. As a result, you have one way audio until the call is placed on
and off hold.

The new algorithm learns remote addresses for a set time (1.5 seconds)
before locking the remote address. In addition, we must see a configured
number of remote packets from the same address in a row before switching.

* Fixed strict RTP learning from always accepting the first new address
packet as the new stream.

* Fixed strict RTP to initialize the expected sequence number with the
last received sequence number instead of the last transmitted sequence
number.

* Fixed the predicted next sequence number calculation in
rtp_learning_rtp_seq_update() to handle overflow.

ASTERISK-27252

Change-Id: Ia2d3aa6e0f22906c25971e74f10027d96525f31c

team/seanbright/iksemel 2017-03-18 11:53:08 UTC
Merge "app_queue: Fix locking behavior in stasis message handlers"

Author: Joshua Colp
Author Date: 2017-03-18 11:53:08 UTC

Merge "app_queue: Fix locking behavior in stasis message handlers"

certified/13.8 2017-01-29 21:35:55 UTC
Merge "app_queue: Ensure member is removed from pending when hanging up." int...

Author: George Joseph
Author Date: 2017-01-29 21:35:55 UTC

Merge "app_queue: Ensure member is removed from pending when hanging up." into certified/13.8

certified/13.1 2016-08-17 16:42:44 UTC
res_pjsip: Add contact_user to endpoint

Author: George Joseph
Author Date: 2016-08-16 20:36:10 UTC

res_pjsip: Add contact_user to endpoint

contact_user, when specified on an endpoint, will override the user
portion of the Contact header on outgoing requests. This may not work
on scheduled qualify requests where we haven't looked up the endpoint.

Change-Id: I7ce6b6c6678f66807885da1d42fb5fd6909ae55a

1.8 2015-05-08 04:22:10 UTC
doc: Make progdocs play nice with git

Author: George Joseph
Author Date: 2015-05-07 19:54:35 UTC

doc: Make progdocs play nice with git

Moved contrib/asterisk-ng-doxygen to doc/asterisk-ng-doxygen.in

Changed /Makefile to copy asterisk-ng-doxygen.in to
asterisk-ng-doxygen then modify it with version instead of
modifying asterisk-ng-doxygen directly. Updated clean
targets as well.

Updated /.gitignore and doc/.gitignore.

Change-Id: I38712d3e334fa4baec19d30d05de8c6f28137622

certified/1.8.28 2015-04-22 19:36:40 UTC
More .gitignore updates

Author: George Joseph
Author Date: 2015-04-15 21:08:09 UTC

More .gitignore updates

Added .pyc and .sha1 to the top-level .gitignore.

Change-Id: I7dfc4f554d54d22947b38140d3305007503cc16a
Tested-by: George Joseph <george.joseph@fairview5.com>

12 2015-04-19 04:50:52 UTC
UPGRADE: Fix upgrade notes

Author: Matthew Jordan
Author Date: 2015-04-19 04:50:52 UTC

UPGRADE: Fix upgrade notes

The next expected release from the 12 branch is 12.8.3. This patch
updates the UPGRADE notes to reflect that.

Change-Id: Ie3f8f989a3eccc28357bbf8f53949a6518f0ffb4

certified/1.8.15 2014-07-26 00:40:18 UTC
features.c: Allow appliationmap to use Gosub.

Author: Richard Mudgett
Author Date: 2014-07-26 00:40:18 UTC

features.c: Allow appliationmap to use Gosub.

Using DYNAMIC_FEATURES with a Gosub application as the mapped application
does not work. It does not work because Gosub just pushes the current
dialplan context, exten, and priority onto a stack and sets the specified
Gosub location. Gosub does not have a dialplan execution loop to run
dialplan like Macro.

* Made the DYNAMIC_FEATURES application mapping feature call
ast_app_exec_macro() and ast_app_exec_sub() for the Macro and Gosub
applications respectively.

* Backported ast_app_exec_macro() and ast_app_exec_sub() from v11 to
execute dialplan routines from the DYNAMIC_FEATURES application mapping
feature.

NOTE: This issue does not affect v12+ because it already does what this
patch implements.

AST-1391 #close
Reported by: Guenther Kelleter

Review: https://reviewboard.asterisk.org/r/3844/
........

Merged revisions 419630 from http://svn.asterisk.org/svn/asterisk/branches/1.8

git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/1.8.15@419679 65c4cc65-6c06-0410-ace0-fbb531ad65f3

certified/11.2 2014-02-07 19:20:43 UTC
chan_iax2: Block unnecessary control frames to/from the wire.

Author: Richard Mudgett
Author Date: 2014-02-07 19:20:43 UTC

chan_iax2: Block unnecessary control frames to/from the wire.

Establishing an IAX2 call between Asterisk v1.4 and v1.8 (or later)
results in an unexpected call disconnect. The problem happens because
newer values in the enum ast_control_frame_type are not consistent between
the branch versions of Asterisk.

For example:
1) v1.4 calls v1.8 (or later) using IAX2

2) v1.8 answers and sends a connected line update control frame. (on v1.8
AST_CONTROL_CONNECTED_LINE = 22)

3) v1.4 receives the control frame as an end-of-q (on v1.4
AST_CONTROL_END_OF_Q = 22)

4) v1.4 disconnects the call once the receive queue becomes empty.

Several things are done by this patch to fix the problem and attempt to
prevent it from happening again in the future:

* Added a warning at the definition of enum ast_control_frame_type about
how to add new control frame values.

* Made block sending and receiving control frames that have no reason to
go over the wire.

* Extended the connectedline iax.conf parameter to also include the
redirecting information updates.

* Updated the connectedline iax.conf parameter documentation to include a
notice that the parameter must be "no" when the peer is an Asterisk v1.4
instance.

(closes issue AST-1302)

Review: https://reviewboard.asterisk.org/r/3174/
........

Merged revisions 407678 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 407727 from http://svn.asterisk.org/svn/asterisk/branches/11

git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/11.2@407741 65c4cc65-6c06-0410-ace0-fbb531ad65f3

10-digiumphones 2013-12-16 17:07:35 UTC
security: Inhibit execution of privilege escalating functions

Author: David M. Lee
Author Date: 2013-12-16 17:07:35 UTC

security: Inhibit execution of privilege escalating functions

This patch allows individual dialplan functions to be marked as
'dangerous', to inhibit their execution from external sources.

A 'dangerous' function is one which results in a privilege escalation.
For example, if one were to read the channel variable SHELL(rm -rf /)
Bad Things(TM) could happen; even if the external source has only read
permissions.

Execution from external sources may be enabled by setting
'live_dangerously' to 'yes' in the [options] section of asterisk.conf.
Although doing so is not recommended.

(closes issue ASTERISK-22905)
Review: http://reviewboard.digium.internal/r/432/
........

Merged revisions 403913 from http://svn.asterisk.org/svn/asterisk/branches/1.8

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10-digiumphones@403916 65c4cc65-6c06-0410-ace0-fbb531ad65f3

10 2013-12-16 17:02:01 UTC
security: Inhibit execution of privilege escalating functions

Author: David M. Lee
Author Date: 2013-12-16 17:02:01 UTC

security: Inhibit execution of privilege escalating functions

This patch allows individual dialplan functions to be marked as
'dangerous', to inhibit their execution from external sources.

A 'dangerous' function is one which results in a privilege escalation.
For example, if one were to read the channel variable SHELL(rm -rf /)
Bad Things(TM) could happen; even if the external source has only read
permissions.

Execution from external sources may be enabled by setting
'live_dangerously' to 'yes' in the [options] section of asterisk.conf.
Although doing so is not recommended.

(closes issue ASTERISK-22905)
Review: http://reviewboard.digium.internal/r/432/
........

Merged revisions 403913 from http://svn.asterisk.org/svn/asterisk/branches/1.8

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@403915 65c4cc65-6c06-0410-ace0-fbb531ad65f3

certified/1.8.11 2013-01-02 18:17:26 UTC
Prevent exhaustion of system resources through exploitation of event cache

Author: Matthew Jordan
Author Date: 2013-01-02 18:17:26 UTC

Prevent exhaustion of system resources through exploitation of event cache

Asterisk maintains an internal cache for devices in the event subsystem. The
device state cache holds the state of each device known to Asterisk, such that
consumers of device state information can query for the last known state for
a particular device, even if it is not part of an active call. The concept of
a device in Asterisk can include entities that do not have a physical
representation. One way that this occurred was when anonymous calls are allowed
in Asterisk. A device was automatically created and stored in the cache for
each anonymous call that occurred; this was possible in the SIP and IAX2
channel drivers and through channel drivers that utilized the
res_jabber/res_xmpp resource modules (Gtalk, Jingle, and Motif). These devices
are never removed from the system, allowing anonymous calls to potentially
exhaust a system's resources.

This patch changes the event cache subsystem and device state management to
no longer cache devices that are not associated with a physical entity.

(issue ASTERISK-20175)
Reported by: Russell Bryant, Leif Madsen, Joshua Colp
Tested by: kmoore
patches:
  event-cachability-3.diff uploaded by jcolp (license 5000)
........

Merged revisions 378303 from http://svn.asterisk.org/svn/asterisk/branches/1.8

git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/1.8.11@378323 65c4cc65-6c06-0410-ace0-fbb531ad65f3

certified/1.8.6 2012-06-06 17:28:14 UTC
Add feature modifier to versions produced from branches

Author: Matthew Jordan
Author Date: 2012-06-06 17:28:14 UTC

Add feature modifier to versions produced from branches

Certain branches, such as Certified Asterisk, may have a modifier added to
them that specifies the features available in that branch. For branches, this
modifier is expected to be reflected in the location of the branch in
subversion. For example, a subversion of URL of /certified/branches/1.8.11
would have a feature modifier of 'certified'. This is slightly different then
how features are determined for tags, where the feature is part of the actual
tag name, e.g., "10.5.0-digiumphones".

In keeping with the nomenclature used for tags, the feature specifier for
branches is translated and placed after the revision numbers. For the example
given previously, this would result in a branch version of
"Asterisk SVN-branch-1.8.11-cert-rXXXXXX".

git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/1.8.6@368607 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1.6.2 2012-04-23 14:21:30 UTC
AST-2012-004: Fix an error that allows AMI users to run shell commands sans a...

Author: Jonathan Rose
Author Date: 2012-04-23 14:21:30 UTC

AST-2012-004: Fix an error that allows AMI users to run shell commands sans authorization.

As detailed in the advisory, AMI users without write authorization for SYSTEM class AMI
actions were able to run system commands by going through other AMI commands which did
not require that authorization. Specifically, GetVar and Status allowed users to do this
by setting their variable/s options to the SHELL or EVAL functions.
Also, within 1.8, 10, and trunk there was a similar flaw with the Originate action that
allowed users with originate permission to run MixMonitor and supply a shell command
in the Data argument. That flaw is fixed in those versions of this patch.

(closes issue ASTERISK-17465)
Reported By: David Woolley
Patches:
 162_ami_readfunc_security_r2.diff uploaded by jrose (license 6182)
 18_ami_readfunc_security_r2.diff uploaded by jrose (license 6182)
 10_ami_readfunc_security_r2.diff uploaded by jrose (license 6182)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.2@363117 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1.4 2012-03-15 18:20:49 UTC
Fix remotely exploitable stack overrun in Milliwatt

Author: Matthew Jordan
Author Date: 2012-03-15 18:20:49 UTC

Fix remotely exploitable stack overrun in Milliwatt

Milliwatt is vulnerable to a remotely exploitable stack overrun when using
the 'o' option. This occurs due to the milliwatt_generate function not
accounting for AST_FRIENDLY_OFFSET when calculating the maximum number of
samples it can put in the output buffer.

This patch resolves this issue by taking into account AST_FRIENDLY_OFFSET
when determining the maximum number of samples allowed. Note that at no
point is remote code execution possible. The data that is written into the
buffer is the pre-defined Milliwatt data, and not custom data.

(issue ASTERISK-19541)
Reported by: Russell Bryant
Tested by: Matt Jordan
Patches:
  milliwatt_stack_overrun.rev1.txt by Russell Bryant (license 6283)
  Note that this patch was written by Russell, even though Matt uploaded it

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@359615 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1.6.1 2011-12-08 21:10:29 UTC
Update svn:externals to checkout last version of menuselect for the 1.6.1 bra...

Author: Leif Madsen
Author Date: 2011-12-08 21:10:29 UTC

Update svn:externals to checkout last version of menuselect for the 1.6.1 branch.

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.1@347661 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1.6.0 2011-12-08 21:07:14 UTC
Update svn:externals to checkout last version of menuselect for the 1.6.0 bra...

Author: Leif Madsen
Author Date: 2011-12-08 21:07:14 UTC

Update svn:externals to checkout last version of menuselect for the 1.6.0 branch.

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.0@347660 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1.2 2010-02-18 16:53:01 UTC
Add additional link to best practices document per jsmith.

Author: Leif Madsen
Author Date: 2010-02-18 16:53:01 UTC

Add additional link to best practices document per jsmith.

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@247507 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1.2-netsec 2009-08-18 20:57:01 UTC
Convert this branch to Opsound music-on-hold.

Author: Kevin P. Fleming
Author Date: 2009-08-18 20:57:01 UTC

Convert this branch to Opsound music-on-hold.

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2-netsec@212960 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1.0 2009-08-18 20:22:48 UTC
Convert this branch to Opsound music-on-hold.

Author: Kevin P. Fleming
Author Date: 2009-08-18 20:22:48 UTC

Convert this branch to Opsound music-on-hold.

For more details:
http://blogs.digium.com/2009/08/18/asterisk-music-on-hold-changes/

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.0@212901 65c4cc65-6c06-0410-ace0-fbb531ad65f3

149 of 49 results
This repository contains Public information 
Everyone can see this information.

Subscribers