CVS commit: pkgsrc/comms/asterisk

["John Nemeth" <jnemeth%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   jnemeth
Date:           Tue May 19 07:52:14 UTC 2015

Modified Files:
        pkgsrc/comms/asterisk: Makefile distinfo
        pkgsrc/comms/asterisk/patches: patch-apps_app__followme.c
            patch-apps_app__meetme.c patch-apps_app__queue.c
            patch-build__tools_mkpkgconfig patch-channels_chan__sip.c
            patch-include_asterisk_lock.h patch-include_asterisk_utils.h
            patch-main_asterisk.c patch-main_http.c patch-main_manager.c
            patch-main_stdtime_localtime.c patch-main_utils.c
            patch-pbx_pbx__dundi.c patch-utils_extconf.c
Added Files:
        pkgsrc/comms/asterisk/patches: patch-addons_chan__ooh323.c
            patch-apps_app__dumpchan.c patch-apps_app__osplookup.c
            patch-apps_app__voicemail.c patch-cdr_cdr__pgsql.c
            patch-cel_cel__pgsql.c patch-main_astmm.c patch-main_cdr.c
            patch-main_cel.c patch-main_logger.c patch-main_pbx.c
            patch-main_test.c patch-res_res__calendar.c
            patch-res_res__calendar__caldav.c
            patch-res_res__calendar__icalendar.c
            patch-tests_test__voicemail__api.c patch-utils_smsq.c
Removed Files:
        pkgsrc/comms/asterisk/patches: patch-include_asterisk_inline__api.h

Log Message:
Update to Asterisk 11.17.1: this contains a security fix, plus various bugs.

pkgsrc changes:
- adapt to upstream support for clang
- more comprehensive sweep for 64-bit time_t related stuff
- XXX pjsip has its own time related stuff that is 32-bit only

-----

The Asterisk Development Team has announced security releases for Certified
Asterisk 1.8.28, 11.6, and 13.1 and Asterisk 1.8, 11, 12, and 13. The available
security releases are released as versions 1.8.28.cert-5, 1.8.32.3, 11.6-cert11,
11.17.1, 12.8.2, 13.1-cert2, and 13.3.2.

The release of these versions resolves the following security vulnerability:

* AST-2015-003: TLS Certificate Common name NULL byte exploit

  When Asterisk registers to a SIP TLS device and and verifies the server,
  Asterisk will accept signed certificates that match a common name other than
  the one Asterisk is expecting if the signed certificate has a common name
  containing a null byte after the portion of the common name that Asterisk
  expected. This potentially allows for a man in the middle attack.

For more information about the details of this vulnerability, please read
security advisory AST-2015-003, which was released at the same time as this
announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.17.1

The security advisory is available at:

* http://downloads.asterisk.org/pub/security/AST-2015-003.pdf

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced the release of Asterisk 11.17.0.

The release of Asterisk 11.17.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following are the issues resolved in this release:

New Features made in this release:
-----------------------------------
 * ASTERISK-17899 - Handle crypto lifetime in SDES-SRTP negotiation
      (Reported by Dwayne Hubbard)

Bugs fixed in this release:
-----------------------------------
 * ASTERISK-24742 - [patch] Fix ast_odbc_find_table function in
      res_odbc (Reported by ibercom)
 * ASTERISK-22436 - [patch] No BYE to masqueraded channel on INVITE
      with replaces (Reported by Eelco Brolman)
 * ASTERISK-24479 - Enable REF_DEBUG for module references
      (Reported by Corey Farrell)
 * ASTERISK-24701 - Stasis: Write timeout on WebSocket fails to
      fully disconnect underlying socket, leading to events being
      dropped with no additional information (Reported by Matt Jordan)
 * ASTERISK-24772 - ODBC error in realtime sippeers when device
      unregisters under MariaDB (Reported by Richard Miller)
 * ASTERISK-24451 - chan_iax2: reference leak in sched_delay_remove
      (Reported by Corey Farrell)
 * ASTERISK-24799 - [patch] make fails with undefined reference to
      SSLv3_client_method (Reported by Alexander Traud)
 * ASTERISK-24787 - [patch] - Microsoft exchange incompatibility
      for playing back messages stored in IMAP - play_message: No
      origtime (Reported by Graham Barnett)
 * ASTERISK-24814 - asterisk/lock.h: Fix syntax errors for non-gcc
      OSX with 64 bit integers (Reported by Corey Farrell)
 * ASTERISK-24796 - Codecs and bucket schema's prevent module
      unload (Reported by Corey Farrell)
 * ASTERISK-24724 - 'httpstatus' Web Page Produces Incomplete HTML
      (Reported by Ashley Sanders)
 * ASTERISK-24797 - bridge_softmix: G.729 codec license held
      (Reported by Kevin Harwell)
 * ASTERISK-24800 - Crash in __sip_reliable_xmit due to invalid
      thread ID being passed to pthread_kill (Reported by JoshE)
 * ASTERISK-17721 - Incoming SRTP calls that specify a key lifetime
      fail (Reported by Terry Wilson)
 * ASTERISK-23214 - chan_sip WARNING message 'We are requesting
      SRTP for audio, but they responded without it' is ambiguous and
      wrong in some cases (Reported by Rusty Newton)
 * ASTERISK-15434 - [patch] When ast_pbx_start failed, both an
      error response and BYE are sent to the caller (Reported by
      Makoto Dei)
 * ASTERISK-18105 - most of asterisk modules are unbuildable in
      cygwin environment (Reported by feyfre)
 * ASTERISK-24828 - Fix Frame Leaks (Reported by Kevin Harwell)
 * ASTERISK-24838 - chan_sip: Locking inversion occurs when
      building a peer causes a peer poke during request handling
      (Reported by Richard Mudgett)
 * ASTERISK-24825 - Caller ID not recognized using
      Centrex/Distinctive dialing (Reported by Richard Mudgett)
 * ASTERISK-24739 - [patch] - Out of files -- call fails --
      numerous files with inodes from under /usr/share/zoneinfo,
      mostly posixrules (Reported by Ed Hynan)
 * ASTERISK-23390 - NewExten Event with application AGI shows up
      before and after AGI runs (Reported by Benjamin Keith Ford)
 * ASTERISK-24786 - [patch] - Asterisk terminates when playing a
      voicemail stored in LDAP (Reported by Graham Barnett)
 * ASTERISK-24808 - res_config_odbc: Improper escaping of
      backslashes occurs with MySQL (Reported by Javier Acosta)
 * ASTERISK-20850 - [patch]Nested functions aren't portable.
      Adapting RAII_VAR to use clang/llvm blocks to get the
      same/similar functionality. (Reported by Diederik de Groot)
 * ASTERISK-19470 - Documentation on app_amd is incorrect (Reported
      by Frank DiGennaro)
 * ASTERISK-21038 - Bad command completion of "core set debug
      channel" (Reported by Richard Kenner)
 * ASTERISK-18708 - func_curl hangs channel under load (Reported by
      Dave Cabot)
 * ASTERISK-16779 - Cannot disallow unknown format '' (Reported by
      Atis Lezdins)
 * ASTERISK-24876 - Investigate reference leaks from
      tests/channels/local/local_optimize_away (Reported by Corey
      Farrell)
 * ASTERISK-24817 - init_logger_chain: unreachable code block
      (Reported by Corey Farrell)
 * ASTERISK-24880 - [patch]Compilation under OpenBSD  (Reported by
      snuffy)
 * ASTERISK-24879 - [patch]Compilation fails due to 64bit time
      under OpenBSD (Reported by snuffy)

Improvements made in this release:
-----------------------------------
 * ASTERISK-24790 - Reduce spurious noise in logs from voicemail -
      Couldn't find mailbox %s in context (Reported by Graham Barnett)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.17.0

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced the release of Asterisk 11.16.0.

The release of Asterisk 11.16.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following are the issues resolved in this release:

Bugs fixed in this release:
-----------------------------------
 * ASTERISK-24472 - Asterisk Crash in OpenSSL when calling over WSS
      from JSSIP (Reported by Badalian Vyacheslav)
 * ASTERISK-24614 - Deadlock when DEBUG_THREADS compiler flag
      enabled (Reported by Richard Mudgett)
 * ASTERISK-24449 - Reinvite for T.38 UDPTL fails if SRTP is
      enabled (Reported by Andreas Steinmetz)
 * ASTERISK-24619 - [patch]Gcc 4.10 fixes in r413589 (1.8) wrongly
      casts char to unsigned int (Reported by Walter Doekes)
 * ASTERISK-24337 - Spammy DEBUG message needs to be at a higher
      level - 'Remote address is null, most likely RTP has been
      stopped' (Reported by Rusty Newton)
 * ASTERISK-23733 - 'reload acl' fails if acl.conf is not present
      on startup (Reported by Richard Kenner)
 * ASTERISK-24628 - [patch] chan_sip - CANCEL is sent to wrong
      destination when 'sendrpid=yes' (in proxy environment) (Reported
      by Karsten Wemheuer)
 * ASTERISK-24672 - [PATCH] Memory leak in func_curl CURLOPT
      (Reported by Kristian Høgh)
 * ASTERISK-20744 - [patch] Security event logging does not work
      over syslog (Reported by Michael Keuter)
 * ASTERISK-23850 - Park Application does not respect Return
      Context Priority (Reported by Andrew Nagy)
 * ASTERISK-23991 - [patch]asterisk.pc file contains a small error
      in the CFlags returned (Reported by Diederik de Groot)
 * ASTERISK-24288 - [patch] - ODBC usage with app_voicemail -
      voicemail is not deleted after review, hangup (Reported by LEI
      FU)
 * ASTERISK-24048 - [patch] contrib/scripts/install_prereq selects
      32-bit packages on 64-bit hosts (Reported by Ben Klang)
 * ASTERISK-24709 - [patch] msg_create_from_file used by MixMonitor
      m() option does not queue an MWI event (Reported by Gareth
      Palmer)
 * ASTERISK-24355 - [patch] chan_sip realtime uses case sensitive
      column comparison for 'defaultuser' (Reported by
      HZMI8gkCvPpom0tM)
 * ASTERISK-24719 - ConfBridge recording channels get stuck when
      recording started/stopped more than once (Reported by Richard
      Mudgett)
 * ASTERISK-24715 - chan_sip: stale nonce causes failure (Reported
      by Kevin Harwell)
 * ASTERISK-24728 - tcptls: Bad file descriptor error when
      reloading chan_sip (Reported by Kevin Harwell)
 * ASTERISK-24676 - Security Vulnerability: URL request injection
      in libCURL (CVE-2014-8150) (Reported by Matt Jordan)
 * ASTERISK-24711 - DTLS handshake broken with latest OpenSSL
      versions (Reported by Jared Biel)
 * ASTERISK-24646 - PJSIP changeset 4899 breaks TLS (Reported by
      Stephan Eisvogel)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.16.0

Thank you for your continued support of Asterisk!


To generate a diff of this commit:
cvs rdiff -u -r1.122 -r1.123 pkgsrc/comms/asterisk/Makefile
cvs rdiff -u -r1.72 -r1.73 pkgsrc/comms/asterisk/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/comms/asterisk/patches/patch-addons_chan__ooh323.c \
    pkgsrc/comms/asterisk/patches/patch-apps_app__dumpchan.c \
    pkgsrc/comms/asterisk/patches/patch-apps_app__osplookup.c \
    pkgsrc/comms/asterisk/patches/patch-apps_app__voicemail.c \
    pkgsrc/comms/asterisk/patches/patch-cdr_cdr__pgsql.c \
    pkgsrc/comms/asterisk/patches/patch-cel_cel__pgsql.c \
    pkgsrc/comms/asterisk/patches/patch-main_astmm.c \
    pkgsrc/comms/asterisk/patches/patch-main_cdr.c \
    pkgsrc/comms/asterisk/patches/patch-main_cel.c \
    pkgsrc/comms/asterisk/patches/patch-main_logger.c \
    pkgsrc/comms/asterisk/patches/patch-main_pbx.c \
    pkgsrc/comms/asterisk/patches/patch-main_test.c \
    pkgsrc/comms/asterisk/patches/patch-res_res__calendar.c \
    pkgsrc/comms/asterisk/patches/patch-res_res__calendar__caldav.c \
    pkgsrc/comms/asterisk/patches/patch-res_res__calendar__icalendar.c \
    pkgsrc/comms/asterisk/patches/patch-tests_test__voicemail__api.c \
    pkgsrc/comms/asterisk/patches/patch-utils_smsq.c
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/comms/asterisk/patches/patch-apps_app__followme.c \
    pkgsrc/comms/asterisk/patches/patch-apps_app__meetme.c \
    pkgsrc/comms/asterisk/patches/patch-build__tools_mkpkgconfig \
    pkgsrc/comms/asterisk/patches/patch-channels_chan__sip.c \
    pkgsrc/comms/asterisk/patches/patch-include_asterisk_utils.h \
    pkgsrc/comms/asterisk/patches/patch-main_asterisk.c \
    pkgsrc/comms/asterisk/patches/patch-main_http.c \
    pkgsrc/comms/asterisk/patches/patch-main_stdtime_localtime.c \
    pkgsrc/comms/asterisk/patches/patch-main_utils.c \
    pkgsrc/comms/asterisk/patches/patch-pbx_pbx__dundi.c \
    pkgsrc/comms/asterisk/patches/patch-utils_extconf.c
cvs rdiff -u -r1.4 -r1.5 \
    pkgsrc/comms/asterisk/patches/patch-apps_app__queue.c \
    pkgsrc/comms/asterisk/patches/patch-main_manager.c
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/comms/asterisk/patches/patch-include_asterisk_inline__api.h
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/comms/asterisk/patches/patch-include_asterisk_lock.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.