Work around PR toolchain/48878: make it build on NetBSD/i386 with GCC 4.8.
Initial import of BIND 9.10.
add and enable bind910
Added net/bind910 version 9.10.0pl2
Update to Asterisk 11.10.2: this fixes multiple security issues along
with general bug fixes.  The security issues fixed are:  AST-2014-001,
AST-2014-002, AST-2014-006, and AST-2014-007.

-----

The Asterisk Development Team has announced security releases for
Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The
available security releases are released as versions 1.8.15-cert7,
11.6-cert4, 1.8.28.2, 11.10.2, and 12.3.2.

These releases resolve security vulnerabilities that were previously
fixed in 1.8.15-cert6, 11.6-cert3, 1.8.28.1, 11.10.1, and 12.3.1.
Unfortunately, the fix for AST-2014-007 inadvertently introduced
a regression in Asterisk's TCP and TLS handling that prevented
Asterisk from sending data over these transports. This regression
and the security vulnerabilities have been fixed in the versions
specified in this release announcement.

Please note that the release of these versions resolves the following security
vulnerabilities:

* AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized
                Shell Access

* AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
                Connections

For more information about the details of these vulnerabilities,
please read security advisories AST-2014-005, AST-2014-006,
AST-2014-007, and AST-2014-008, which were released with the previous
versions that addressed these vulnerabilities.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.10.2

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2014-006.pdf
 * http://downloads.asterisk.org/pub/security/AST-2014-007.pdf

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced security releases for
Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The
available security releases are released as versions 1.8.15-cert6,
11.6-cert3, 1.8.28.1, 11.10.1, and 12.3.1.

The release of these versions resolves the following issue:

* AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
                Connections

  Establishing a TCP or TLS connection to the configured HTTP or HTTPS port
  respectively in http.conf and then not sending or completing a HTTP request
  will tie up a HTTP session. By doing this repeatedly until the maximum number
  of open HTTP sessions is reached, legitimate requests are blocked.

Additionally, the release of 11.6-cert3, 11.10.1, and 12.3.1 resolves the
following issue:

* AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized
                Shell Access

  Manager users can execute arbitrary shell commands with the MixMonitor manager
  action. Asterisk does not require system class authorization for a manager
  user to use the MixMonitor action, so any manager user who is permitted to use
  manager commands can potentially execute shell commands as the user executing
  the Asterisk process.

These issues and their resolutions are described in the security advisories.

For more information about the details of these vulnerabilities,
please read security advisories AST-2014-005, AST-2014-006,
AST-2014-007, and AST-2014-008, which were released at the same
time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.10.1

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2014-006.pdf
 * http://downloads.asterisk.org/pub/security/AST-2014-007.pdf

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced the release of Asterisk 11.10.0.

The release of Asterisk 11.10.0 resolves several issues reported
by the community and would have not been possible without your
participation.  Thank you!

The following are the issues resolved in this release:

Bugs fixed in this release:
-----------------------------------
 * ASTERISK-23547 - [patch] app_queue removing callers from queue
      when reloading (Reported by Italo Rossi)
 * ASTERISK-23559 - app_voicemail fails to load after fix to
      dialplan functions (Reported by Corey Farrell)
 * ASTERISK-22846 - testsuite: masquerade super test fails on all
      branches (still) (Reported by Matt Jordan)
 * ASTERISK-23545 - Confbridge talker detection settings
      configuration load bug (Reported by John Knott)
 * ASTERISK-23546 - CB_ADD_LEN does not do what you'd think
      (Reported by Walter Doekes)
 * ASTERISK-23620 - Code path in app_stack fails to unlock list
      (Reported by Bradley Watkins)
 * ASTERISK-23616 - Big memory leak in logger.c (Reported by
      ibercom)
 * ASTERISK-23576 - Build failure on SmartOS / Illumos / SunOS
      (Reported by Sebastian Wiedenroth)
 * ASTERISK-23550 - Newer sound sets don't show up in menuselect
      (Reported by Rusty Newton)
 * ASTERISK-18331 - app_sms failure (Reported by David Woodhouse)
 * ASTERISK-19465 - P-Asserted-Identity Privacy (Reported by
      Krzysztof Chmielewski)
 * ASTERISK-23605 - res_http_websocket: Race condition in shutting
      down websocket causes crash (Reported by Matt Jordan)
 * ASTERISK-23707 - Realtime Contacts: Apparent mismatch between
      PGSQL database state and Asterisk state (Reported by Mark
      Michelson)
 * ASTERISK-23381 - [patch]ChanSpy- Barge only works on the initial
      'spy', if the spied-on channel makes a new call, unable to
      barge. (Reported by Robert Moss)
 * ASTERISK-23665 - Wrong mime type for codec H263-1998 (h263+)
      (Reported by Guillaume Maudoux)
 * ASTERISK-23664 - Incorrect H264 specification in SDP. (Reported
      by Guillaume Maudoux)
 * ASTERISK-22977 - chan_sip+CEL: missing ANSWER and PICKUP event
      for INVITE/w/replaces pickup (Reported by Walter Doekes)
 * ASTERISK-23709 - Regression in Dahdi/Analog/waitfordialtone
      (Reported by Steve Davies)

Improvements made in this release:
-----------------------------------
 * ASTERISK-23649 - [patch]Support for DTLS retransmission
      (Reported by NITESH BANSAL)
 * ASTERISK-23564 - [patch]TLS/SRTP status of channel not currently
      available in a CLI command (Reported by Patrick Laimbock)
 * ASTERISK-23754 - [patch] Use var/lib directory for log file
      configured in asterisk.conf (Reported by Igor Goncharovsky)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.10.0

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced the release of Asterisk 11.9.0.

The release of Asterisk 11.9.0 resolves several issues reported by
the community and would have not been possible without your
participation.  Thank you!

The following are the issues resolved in this release:

Bugs fixed in this release:
-----------------------------------
 * ASTERISK-22790 - check_modem_rate() may return incorrect rate
      for V.27 (Reported by Paolo Compagnini)
 * ASTERISK-23034 - [patch] manager Originate doesn't abort on
      failed format_cap allocation (Reported by Corey Farrell)
 * ASTERISK-23061 - [Patch] 'textsupport' setting not mentioned in
      sip.conf.sample (Reported by Eugene)
 * ASTERISK-23028 - [patch] Asterisk man pages contains unquoted
      minus signs (Reported by Jeremy Lainé)
 * ASTERISK-23046 - Custom CDR fields set during a GoSUB called
      from app_queue are not inserted (Reported by Denis Pantsyrev)
 * ASTERISK-23027 - [patch] Spelling typo "transfered" instead of
      "transferred" (Reported by Jeremy Lainé)
 * ASTERISK-23008 - Local channels loose CALLERID name when DAHDI
      channel connects (Reported by Michael Cargile)
 * ASTERISK-23100 - [patch] In chan_mgcp the ident in transmitted
      request and request queue may differ - fix for locking (Reported
      by adomjan)
 * ASTERISK-22988 - [patch]T38 , SIP 488 after Rejecting image
      media offer due to invalid or unsupported syntax (Reported by
      adomjan)
 * ASTERISK-22861 - [patch]Specifying a null time as parameter to
      GotoIfTime or ExecIfTime causes segmentation fault (Reported by
      Sebastian Murray-Roberts)
 * ASTERISK-17837 - extconfig.conf - Maximum Include level (1)
      exceeded (Reported by pz)
 * ASTERISK-22662 - Documentation fix? - queues.conf says
      persistentmembers defaults to yes, it appears to lie (Reported
      by Rusty Newton)
 * ASTERISK-23134 - [patch] res_rtp_asterisk port selection cannot
      handle selinux port restrictions (Reported by Corey Farrell)
 * ASTERISK-23220 - STACK_PEEK function with no arguments causes
      crash/core dump (Reported by James Sharp)
 * ASTERISK-19773 - Asterisk crash on issuing Asterisk-CLI 'reload'
      command multiple times on cli_aliases (Reported by Joel Vandal)
 * ASTERISK-22757 - segfault in res_clialiases.so on reload when
      mapping "module reload" command (Reported by Gareth Blades)
 * ASTERISK-17727 - [patch] TLS doesn't get all certificate chain
      (Reported by LN)
 * ASTERISK-23178 - devicestate.h: device state setting functions
      are documented with the wrong return values (Reported by
      Jonathan Rose)
 * ASTERISK-23232 - LocalBridge AMI Event LocalOptimization value
      is opposite to what's expected (Reported by Leon Roy)
 * ASTERISK-23098 - [patch]possible null pointer dereference in
      format.c (Reported by Marcello Ceschia)
 * ASTERISK-23297 - Asterisk 12, pbx_config.so segfaults if
      res_parking.so is not loaded, or if res_parking.conf has no
      configuration (Reported by CJ Oster)
 * ASTERISK-23069 - Custom CDR variable not recorded when set in
      macro called from app_queue (Reported by Bryan Anderson)
 * ASTERISK-19499 - ConfBridge MOH is not working for transferee
      after attended transfer (Reported by Timo Teräs)
 * ASTERISK-23261 - [patch]Output mixup in
      ${CHANNEL(rtpqos,audio,all)} (Reported by rsw686)
 * ASTERISK-23279 - [patch]Asterisk doesn't support the dynamic
      payload change in rtp mapping in the 200 OK response (Reported
      by NITESH BANSAL)
 * ASTERISK-23255 - UUID included for Redhat, but missing for
      Debian distros in install_prereq script (Reported by Rusty
      Newton)
 * ASTERISK-23260 - [patch]ForkCDR v option does not keep CDR
      variables for subsequent records (Reported by zvision)
 * ASTERISK-23141 - Asterisk crashes on Dial(), in
      pbx_find_extension at pbx.c (Reported by Maxim)
 * ASTERISK-23336 - Asterisk warning "Don't know how to indicate
      condition 33 on ooh323c" on outgoing calls from H323 to SIP peer
      (Reported by Alexander Semych)
 * ASTERISK-23231 - Since 405693 If we have res_fax.conf file set
      to minrate=2400, then res_fax refuse to load (Reported by David
      Brillert)
 * ASTERISK-23135 - Crash - segfault in ast_channel_hangupcause_set
      - probably introduced in 11.7.0 (Reported by OK)
 * ASTERISK-23323 - [patch]chan_sip: missing p->owner checks in
      handle_response_invite (Reported by Walter Doekes)
 * ASTERISK-23406 - [patch]Fix typo in "sip show peer" (Reported by
      ibercom)
 * ASTERISK-23310 - bridged channel crashes in bridge_p2p_rtp_write
      (Reported by Jeremy Lainé)
 * ASTERISK-22911 - [patch]Asterisk fails to resume WebRTC call
      from hold (Reported by Vytis Valentinavičius)
 * ASTERISK-23104 - Specifying the SetVar AMI without a Channel
      cause Asterisk to crash (Reported by Joel Vandal)
 * ASTERISK-21930 - [patch]WebRTC over WSS is not working.
      (Reported by John)
 * ASTERISK-23383 - Wrong sense test on stat return code causes
      unchanged config check to break with include files. (Reported by
      David Woolley)
 * ASTERISK-20149 - Crash when faxing SIP to SIP with strictrtp set
      to yes (Reported by Alexandr Gordeev)
 * ASTERISK-17523 - Qualify for static realtime peers does not work
      (Reported by Maciej Krajewski)
 * ASTERISK-21406 - [patch] chan_sip deadlock on monlock between
      unload_module and do_monitor (Reported by Corey Farrell)
 * ASTERISK-23373 - [patch]Security: Open FD exhaustion with
      chan_sip Session-Timers (Reported by Corey Farrell)
 * ASTERISK-23340 - Security Vulnerability: stack allocation of
      cookie headers in loop allows for unauthenticated remote denial
      of service attack (Reported by Matt Jordan)
 * ASTERISK-23311 - Manager - MoH Stop Event fails to show up when
      leaving Conference (Reported by Benjamin Keith Ford)
 * ASTERISK-23420 - [patch]Memory leak in manager_add_filter
      function in manager.c (Reported by Etienne Lessard)
 * ASTERISK-23488 - Logic error in callerid checksum processing
      (Reported by Russ Meyerriecks)
 * ASTERISK-23461 - Only first user is muted when joining
      confbridge with 'startmuted=yes' (Reported by Chico Manobela)
 * ASTERISK-20841 - fromdomain not honored on outbound INVITE
      request (Reported by Kelly Goedert)
 * ASTERISK-22079 - Segfault: INTERNAL_OBJ (user_data=0x6374652f)
      at astobj2.c:120 (Reported by Jamuel Starkey)
 * ASTERISK-23509 - [patch]SayNumber for Polish language tries to
      play empty files for numbers divisible by 100 (Reported by
      zvision)
 * ASTERISK-23103 - [patch]Crash in ast_format_cmp, in ao2_find
      (Reported by JoshE)
 * ASTERISK-23391 - Audit dialplan function usage of channel
      variable (Reported by Corey Farrell)
 * ASTERISK-23548 - POST to ARI sometimes returns no body on
      success (Reported by Scott Griepentrog)
 * ASTERISK-23460 - ooh323 channel stuck if call is placed directly
      and gatekeeper is not available (Reported by Dmitry Melekhov)

Improvements made in this release:
-----------------------------------
 * ASTERISK-22980 - [patch]Allow building cdr_radius and cel_radius
      against libfreeradius-client (Reported by Jeremy Lainé)
 * ASTERISK-22661 - Unable to exit ChanSpy if spied channel does
      not have a call in progress (Reported by Chris Hillman)
 * ASTERISK-23099 - [patch] WSS: enable ast_websocket_read()
      function to read the whole available data at first and then wait
      for any fragmented packets (Reported by Thava Iyer)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.9.0

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced security releases for
Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The
available security releases are released as versions 1.8.15-cert5,
11.6-cert2, 1.8.26.1, 11.8.1, and 12.1.1.

The release of these versions resolve the following issues:

* AST-2014-001: Stack overflow in HTTP processing of Cookie headers.

  Sending a HTTP request that is handled by Asterisk with a large number of
  Cookie headers could overflow the stack.

  Another vulnerability along similar lines is any HTTP request with a
  ridiculous number of headers in the request could exhaust system memory.

* AST-2014-002: chan_sip: Exit early on bad session timers request

  This change allows chan_sip to avoid creation of the channel and
  consumption of associated file descriptors altogether if the inbound
  request is going to be rejected anyway.

These issues and their resolutions are described in the security advisories.

For more information about the details of these vulnerabilities,
please read security advisories AST-2014-001, AST-2014-002,
AST-2014-003, and AST-2014-004, which were released at the same
time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.8.1

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2014-001.pdf
 * http://downloads.asterisk.org/pub/security/AST-2014-002.pdf

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced the release of Asterisk 11.8.0.

The release of Asterisk 11.8.0 resolves several issues reported by
the community and would have not been possible without your
participation.  Thank you!

The following are the issues resolved in this release:

Bugs fixed in this release:
-----------------------------------
 * ASTERISK-22544 - Italian prompt vm-options has advertisement in
      it (Reported by Rusty Newton)
 * ASTERISK-21383 - STUN Binding Requests Not Being Sent Back from
      Asterisk to Chrome (Reported by Shaun Clark)
 * ASTERISK-22478 - [patch]Can't use pound(hash) symbol for custom
      DTMF menus in ConfBridge (processed as directive) (Reported by
      Nicolas Tanski)
 * ASTERISK-12117 - chan_sip creates a new local tag (from-tag) for
      every register message (Reported by Pawel Pierscionek)
 * ASTERISK-20862 - Asterisk min and max member penalties not
      honored when set with 0 (Reported by Schmooze Com)
 * ASTERISK-22746 - [patch]Crash in chan_dahdi during caller id
      read (Reported by Michael Walton)
 * ASTERISK-22788 - [patch] main/translate.c: access to variable f
      after free in ast_translate() (Reported by Corey Farrell)
 * ASTERISK-21242 - Segfault when T.38 re-invite retransmission
      receives 200 OK (Reported by Ashley Winters)
 * ASTERISK-22590 - BufferOverflow in unpacksms16() when receiving
      16 bit multipart SMS with app_sms (Reported by Jan Juergens)
 * ASTERISK-22905 - Prevent Asterisk functions that are 'dangerous'
      from being executed from external interfaces (Reported by Matt
      Jordan)
 * ASTERISK-23021 - Typos in code : "avaliable" instead of
      "available" (Reported by Jeremy Lainé)
 * ASTERISK-22970 - [patch]Documentation fix for QUOTE() (Reported
      by Gareth Palmer)
 * ASTERISK-21960 - ooh323 channels stuck (Reported by Dmitry
      Melekhov)
 * ASTERISK-22350 - DUNDI - core dump on shutdown - segfault in
      sqlite3_reset from /usr/lib/libsqlite3.so.0 (Reported by Birger
      "WIMPy" Harzenetter)
 * ASTERISK-22942 - [patch] - Asterisk crashed after
      Set(FAXOPT(faxdetect)=t38) (Reported by adomjan)
 * ASTERISK-22856 - [patch]SayUnixTime in polish reads minutes
      instead of seconds (Reported by Robert Mordec)
 * ASTERISK-22854 - [patch] - Deadlock between cel_pgsql unload and
      core_event_dispatcher taskprocessor thread (Reported by Etienne
      Lessard)
 * ASTERISK-22910 - [patch] - REPLACE() calls strcpy on overlapping
      memory when <replace-char> is empty (Reported by Gareth Palmer)
 * ASTERISK-22871 - cel_pgsql module not loading after "reload" or
      "reload cel_pgsql.so" command (Reported by Matteo)
 * ASTERISK-23084 - [patch]rasterisk needlessly prints the
      AST-2013-007 warning (Reported by Tzafrir Cohen)
 * ASTERISK-17138 - [patch] Asterisk not re-registering after it
      receives "Forbidden - wrong password on authentication"
      (Reported by Rudi)
 * ASTERISK-23011 - [patch]configure.ac and pbx_lua don't support
      lua 5.2 (Reported by George Joseph)
 * ASTERISK-22834 - Parking by blind transfer when lot full orphans
      channels (Reported by rsw686)
 * ASTERISK-23047 - Orphaned (stuck) channel occurs during a failed
      SIP transfer to parking space (Reported by Tommy Thompson)
 * ASTERISK-22946 - Local From tag regression with sipgate.de
      (Reported by Stephan Eisvogel)
 * ASTERISK-23010 - No BYE message sent when sip INVITE is received
      (Reported by Ryan Tilton)
 * ASTERISK-23135 - Crash - segfault in ast_channel_hangupcause_set
      - probably introduced in 11.7.0 (Reported by OK)

Improvements made in this release:
-----------------------------------
 * ASTERISK-22728 - [patch] Improve Understanding Of 'Forcerport'
      When Running "sip show peers" (Reported by Michael L. Young)
 * ASTERISK-22659 - Make a new core and extra sounds release
      (Reported by Rusty Newton)
 * ASTERISK-22919 - core show channeltypes slicing  (Reported by
      outtolunc)
 * ASTERISK-22918 - dahdi show channels slices PRI channel dnid on
      output (Reported by outtolunc)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.8.0

Thank you for your continued support of Asterisk!
Updated comms/asterisk to 11.10.2
Update to Asterisk 1.8.28.2: this fixes multiple vulnerabilities and
numerous general bugs.  The vulnerabilities fixed are:  AST-2014-001,
AST-2014-002, and AST-2014-007.

-----

The Asterisk Development Team has announced security releases for
Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The
available security releases are released as versions 1.8.15-cert7,
11.6-cert4, 1.8.28.2, 11.10.2, and 12.3.2.

These releases resolve security vulnerabilities that were previously
fixed in 1.8.15-cert6, 11.6-cert3, 1.8.28.1, 11.10.1, and 12.3.1.
Unfortunately, the fix for AST-2014-007 inadvertently introduced
a regression in Asterisk's TCP and TLS handling that prevented
Asterisk from sending data over these transports. This regression
and the security vulnerabilities have been fixed in the versions
specified in this release announcement.

The security patches for AST-2014-007 have been updated with the
fix for the regression, and are available at
http://downloads.asterisk.org/pub/security

Please note that the release of these versions resolves the following security
vulnerabilities:

* AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
                Connections

For more information about the details of these vulnerabilities,
please read security advisories AST-2014-005, AST-2014-006,
AST-2014-007, and AST-2014-008, which were released with the previous
versions that addressed these vulnerabilities.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.28.2

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2014-007.pdf

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced security releases for
Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The
available security releases are released as versions 1.8.15-cert6,
11.6-cert3, 1.8.28.1, 11.10.1, and 12.3.1.

These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of these versions resolves the following issue:

* AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
                Connections

  Establishing a TCP or TLS connection to the configured HTTP or
  HTTPS port respectively in http.conf and then not sending or
  completing a HTTP request will tie up a HTTP session. By doing
  this repeatedly until the maximum number of open HTTP sessions
  is reached, legitimate requests are blocked.

These issues and their resolutions are described in the security advisories.

For more information about the details of these vulnerabilities,
please read security advisories AST-2014-005, AST-2014-006,
AST-2014-007, and AST-2014-008, which were released at the same
time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.28.1

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2014-007.pdf

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced the release of Asterisk 1.8.28.0.

The release of Asterisk 1.8.28.0 resolves several issues reported
by the community and would have not been possible without your
participation.  Thank you!

The following are the issues resolved in this release:

Bugs fixed in this release:
-----------------------------------
 * ASTERISK-23547 - [patch] app_queue removing callers from queue
      when reloading (Reported by Italo Rossi)
 * ASTERISK-22846 - testsuite: masquerade super test fails on all
      branches (still) (Reported by Matt Jordan)
 * ASTERISK-23546 - CB_ADD_LEN does not do what you'd think
      (Reported by Walter Doekes)
 * ASTERISK-23620 - Code path in app_stack fails to unlock list
      (Reported by Bradley Watkins)
 * ASTERISK-18331 - app_sms failure (Reported by David Woodhouse)
 * ASTERISK-19465 - P-Asserted-Identity Privacy (Reported by
      Krzysztof Chmielewski)
 * ASTERISK-23707 - Realtime Contacts: Apparent mismatch between
      PGSQL database state and Asterisk state (Reported by Mark
      Michelson)
 * ASTERISK-23665 - Wrong mime type for codec H263-1998 (h263+)
      (Reported by Guillaume Maudoux)
 * ASTERISK-22977 - chan_sip+CEL: missing ANSWER and PICKUP event
      for INVITE/w/replaces pickup (Reported by Walter Doekes)
 * ASTERISK-23709 - Regression in Dahdi/Analog/waitfordialtone
      (Reported by Steve Davies)
 * ASTERISK-23650 - Intermittent segfault in string functions
      (Reported by Roel van Meer)

Improvements made in this release:
-----------------------------------
 * ASTERISK-23754 - [patch] Use var/lib directory for log file
      configured in asterisk.conf (Reported by Igor Goncharovsky)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.28.0

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced the release of Asterisk 1.8.27.0.

The release of Asterisk 1.8.27.0 resolves several issues reported
by the community and would have not been possible without your
participation.  Thank you!

The following are the issues resolved in this release:

Bugs fixed in this release:
-----------------------------------
 * ASTERISK-22790 - check_modem_rate() may return incorrect rate
      for V.27 (Reported by Paolo Compagnini)
 * ASTERISK-23061 - [Patch] 'textsupport' setting not mentioned in
      sip.conf.sample (Reported by Eugene)
 * ASTERISK-23028 - [patch] Asterisk man pages contains unquoted
      minus signs (Reported by Jeremy Lainé)
 * ASTERISK-23046 - Custom CDR fields set during a GoSUB called
      from app_queue are not inserted (Reported by Denis Pantsyrev)
 * ASTERISK-23027 - [patch] Spelling typo "transfered" instead of
      "transferred" (Reported by Jeremy Lainé)
 * ASTERISK-23008 - Local channels loose CALLERID name when DAHDI
      channel connects (Reported by Michael Cargile)
 * ASTERISK-23100 - [patch] In chan_mgcp the ident in transmitted
      request and request queue may differ - fix for locking (Reported
      by adomjan)
 * ASTERISK-22988 - [patch]T38 , SIP 488 after Rejecting image
      media offer due to invalid or unsupported syntax (Reported by
      adomjan)
 * ASTERISK-22861 - [patch]Specifying a null time as parameter to
      GotoIfTime or ExecIfTime causes segmentation fault (Reported by
      Sebastian Murray-Roberts)
 * ASTERISK-17837 - extconfig.conf - Maximum Include level (1)
      exceeded (Reported by pz)
 * ASTERISK-22662 - Documentation fix? - queues.conf says
      persistentmembers defaults to yes, it appears to lie (Reported
      by Rusty Newton)
 * ASTERISK-23134 - [patch] res_rtp_asterisk port selection cannot
      handle selinux port restrictions (Reported by Corey Farrell)
 * ASTERISK-23220 - STACK_PEEK function with no arguments causes
      crash/core dump (Reported by James Sharp)
 * ASTERISK-19773 - Asterisk crash on issuing Asterisk-CLI 'reload'
      command multiple times on cli_aliases (Reported by Joel Vandal)
 * ASTERISK-22757 - segfault in res_clialiases.so on reload when
      mapping "module reload" command (Reported by Gareth Blades)
 * ASTERISK-17727 - [patch] TLS doesn't get all certificate chain
      (Reported by LN)
 * ASTERISK-23178 - devicestate.h: device state setting functions
      are documented with the wrong return values (Reported by
      Jonathan Rose)
 * ASTERISK-23297 - Asterisk 12, pbx_config.so segfaults if
      res_parking.so is not loaded, or if res_parking.conf has no
      configuration (Reported by CJ Oster)
 * ASTERISK-23069 - Custom CDR variable not recorded when set in
      macro called from app_queue (Reported by Bryan Anderson)
 * ASTERISK-19499 - ConfBridge MOH is not working for transferee
      after attended transfer (Reported by Timo Teräs)
 * ASTERISK-23261 - [patch]Output mixup in
      ${CHANNEL(rtpqos,audio,all)} (Reported by rsw686)
 * ASTERISK-23260 - [patch]ForkCDR v option does not keep CDR
      variables for subsequent records (Reported by zvision)
 * ASTERISK-23141 - Asterisk crashes on Dial(), in
      pbx_find_extension at pbx.c (Reported by Maxim)
 * ASTERISK-23231 - Since 405693 If we have res_fax.conf file set
      to minrate=2400, then res_fax refuse to load (Reported by David
      Brillert)
 * ASTERISK-23135 - Crash - segfault in ast_channel_hangupcause_set
      - probably introduced in 11.7.0 (Reported by OK)
 * ASTERISK-23323 - [patch]chan_sip: missing p->owner checks in
      handle_response_invite (Reported by Walter Doekes)
 * ASTERISK-23382 - [patch]Build System: make -qp can corrupt
      menuselect-tree and related files (Reported by Corey Farrell)
 * ASTERISK-23406 - [patch]Fix typo in "sip show peer" (Reported by
      ibercom)
 * ASTERISK-23310 - bridged channel crashes in bridge_p2p_rtp_write
      (Reported by Jeremy Lainé)
 * ASTERISK-23104 - Specifying the SetVar AMI without a Channel
      cause Asterisk to crash (Reported by Joel Vandal)
 * ASTERISK-23383 - Wrong sense test on stat return code causes
      unchanged config check to break with include files. (Reported by
      David Woolley)
 * ASTERISK-17523 - Qualify for static realtime peers does not work
      (Reported by Maciej Krajewski)
 * ASTERISK-21406 - [patch] chan_sip deadlock on monlock between
      unload_module and do_monitor (Reported by Corey Farrell)
 * ASTERISK-23373 - [patch]Security: Open FD exhaustion with
      chan_sip Session-Timers (Reported by Corey Farrell)
 * ASTERISK-23340 - Security Vulnerability: stack allocation of
      cookie headers in loop allows for unauthenticated remote denial
      of service attack (Reported by Matt Jordan)
 * ASTERISK-23488 - Logic error in callerid checksum processing
      (Reported by Russ Meyerriecks)
 * ASTERISK-20841 - fromdomain not honored on outbound INVITE
      request (Reported by Kelly Goedert)
 * ASTERISK-22079 - Segfault: INTERNAL_OBJ (user_data=0x6374652f)
      at astobj2.c:120 (Reported by Jamuel Starkey)
 * ASTERISK-23509 - [patch]SayNumber for Polish language tries to
      play empty files for numbers divisible by 100 (Reported by
      zvision)
 * ASTERISK-23391 - Audit dialplan function usage of channel
      variable (Reported by Corey Farrell)
 * ASTERISK-23548 - POST to ARI sometimes returns no body on
      success (Reported by Scott Griepentrog)

Improvements made in this release:
-----------------------------------
 * ASTERISK-22980 - [patch]Allow building cdr_radius and cel_radius
      against libfreeradius-client (Reported by Jeremy Lainé)
 * ASTERISK-22661 - Unable to exit ChanSpy if spied channel does
      not have a call in progress (Reported by Chris Hillman)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.27.0

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced security releases for
Certified Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The
available security releases are released as versions 1.8.15-cert5,
11.6-cert2, 1.8.26.1, 11.8.1, and 12.1.1.

The release of these versions resolve the following issues:

* AST-2014-001: Stack overflow in HTTP processing of Cookie headers.

  Sending a HTTP request that is handled by Asterisk with a large number of
  Cookie headers could overflow the stack.

  Another vulnerability along similar lines is any HTTP request with a
  ridiculous number of headers in the request could exhaust system memory.

* AST-2014-002: chan_sip: Exit early on bad session timers request

  This change allows chan_sip to avoid creation of the channel and
  consumption of associated file descriptors altogether if the inbound
  request is going to be rejected anyway.

These issues and their resolutions are described in the security advisories.

For more information about the details of these vulnerabilities,
please read security advisories AST-2014-001, AST-2014-002,
AST-2014-003, and AST-2014-004, which were released at the same
time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.26.1

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2014-001.pdf
 * http://downloads.asterisk.org/pub/security/AST-2014-002.pdf

Thank you for your continued support of Asterisk!

-----

The Asterisk Development Team has announced the release of Asterisk 1.8.26.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk

The release of Asterisk 1.8.26.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following are the issues resolved in this release:

Bugs fixed in this release:
-----------------------------------
 * ASTERISK-22544 - Italian prompt vm-options has advertisement in
      it (Reported by Rusty Newton)
 * ASTERISK-12117 - chan_sip creates a new local tag (from-tag) for
      every register message (Reported by Pawel Pierscionek)
 * ASTERISK-20862 - Asterisk min and max member penalties not
      honored when set with 0 (Reported by Schmooze Com)
 * ASTERISK-22746 - [patch]Crash in chan_dahdi during caller id
      read (Reported by Michael Walton)
 * ASTERISK-22788 - [patch] main/translate.c: access to variable f
      after free in ast_translate() (Reported by Corey Farrell)
 * ASTERISK-21242 - Segfault when T.38 re-invite retransmission
      receives 200 OK (Reported by Ashley Winters)
 * ASTERISK-22590 - BufferOverflow in unpacksms16() when receiving
      16 bit multipart SMS with app_sms (Reported by Jan Juergens)
 * ASTERISK-22905 - Prevent Asterisk functions that are 'dangerous'
      from being executed from external interfaces (Reported by Matt
      Jordan)
 * ASTERISK-23021 - Typos in code : "avaliable" instead of
      "available" (Reported by Jeremy Lainé)
 * ASTERISK-22970 - [patch]Documentation fix for QUOTE() (Reported
      by Gareth Palmer)
 * ASTERISK-22856 - [patch]SayUnixTime in polish reads minutes
      instead of seconds (Reported by Robert Mordec)
 * ASTERISK-22854 - [patch] - Deadlock between cel_pgsql unload and
      core_event_dispatcher taskprocessor thread (Reported by Etienne
      Lessard)
 * ASTERISK-22910 - [patch] - REPLACE() calls strcpy on overlapping
      memory when <replace-char> is empty (Reported by Gareth Palmer)
 * ASTERISK-22871 - cel_pgsql module not loading after "reload" or
      "reload cel_pgsql.so" command (Reported by Matteo)
 * ASTERISK-23084 - [patch]rasterisk needlessly prints the
      AST-2013-007 warning (Reported by Tzafrir Cohen)
 * ASTERISK-17138 - [patch] Asterisk not re-registering after it
      receives "Forbidden - wrong password on authentication"
      (Reported by Rudi)
 * ASTERISK-23011 - [patch]configure.ac and pbx_lua don't support
      lua 5.2 (Reported by George Joseph)
 * ASTERISK-22834 - Parking by blind transfer when lot full orphans
      channels (Reported by rsw686)
 * ASTERISK-23047 - Orphaned (stuck) channel occurs during a failed
      SIP transfer to parking space (Reported by Tommy Thompson)
 * ASTERISK-22946 - Local From tag regression with sipgate.de
      (Reported by Stephan Eisvogel)
 * ASTERISK-23010 - No BYE message sent when sip INVITE is received
      (Reported by Ryan Tilton)

Improvements made in this release:
-----------------------------------
 * ASTERISK-22659 - Make a new core and extra sounds release
      (Reported by Rusty Newton)
 * ASTERISK-22918 - dahdi show channels slices PRI channel dnid on
      output (Reported by outtolunc)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.26.0

Thank you for your continued support of Asterisk!
Updated comms/asterisk18 to 1.8.28.2
PyChart is a Python library for creating high quality Encapsulated Postscript,
PDF, or PNG charts. It currently supports line plots, bar plots, range-fill
plots, and pie charts. Because it is based on Python, you can make full use
of Python's scripting power.
Added graphics/py-chart version 1.39
Update to MySQL Connector-ODBC 5.3.2.

pkgsrc change: add 56 to MYSQL_VERSIONS_ACCEPTED

5.3.2

  Functionality added or changed:
  * Support of ODBCINSTGetProperties in MyODBC Driver (WL #7577)
  * Add DFLT_BIGINT_BIND_STR option to Connector/ODBC GUI (Windows and Linux)
    (WL#7579)
  * Accessibility features in Connector/ODBC Linux GUI (WL #7635)

  Bugs fixed:
  * Connect crash if the catalog name given to SQLSetConnectAttr is invalid
    (Bug #17587913)
  * Driver returns wrong length for output parameter streams
    (Bug #17814768/70946)
  * Assert failure in case of prepared statments and SQLDESCRIBECOL() called
    with column number given larger then actual parameter marker in query.
    (Bug #17311065)
  * SQLFOREIGNKEYS WITH FLAG_NO_INFORMATION_SCHEMA OPTION RETURNS BAD RESULTS
    (Bug #16920750)
  * SQLFetch() crashing when execute using UnixODBC 2.3.2 (Bug #17857204)
  * Segmentation fault in SQLSpecialColumns if table name is invalid
    (Bug# 17854697)
  * Invalid order of free() functions can cause crash (Bug# 17992912)
  * Crash in ODBC Driver with CHARSET=WRONGCHARSET (Bug# 17999659)
  * Driver and myodbc-installer crash with long option names (>100) and
    values (>255) (Bug# 17966018)
  * ODBCManageDataSourcesQ4 cannot run MyODBC GUI setup to edit an existing
    DSN (Bug# 18046123)
  * SQLGetData returning error being called after SQLParamData (Bug #17842966)
  * Valgrind: jump or move depends on uninitialised value error from
    myodbc-installer (Bug# 18046120)
  * Memory leak in sqlexecute() when connection is killed from another thread
    (Bug#17587617)
  * Data corruption in SQLBulkOperations because of buffer overrun.
    (Bug #17714172)
  * Segfault in SQLBulkOperations() for SQL_UPDATE_BY_BOOKMARK when select
    returns 0 records. (Bug# 17714358)
  * MS Access crashed when sorting a column (Bug# 17071780/69550)
  * Empty query giving segmentation fault in myodbc_casecmp (Bug# 17085344)
  * Uninitialized variable free_value can set wrong error in SQLDescribeCol
    (Bug# 17588101)
  * ODBC 5.2.5 DMG installer fails on OSX 10.8.5 (Bug #17512040/70422)
  * Bulk insert on time column with hour value > 99 gives error (Bug#17613161)
  * Concurrent execution of SQLEndTran() with SQL_HANDLE_ENV results in
    SEG FAULT (Bug #18166331)
  * Workaround to GTK bug in GtkComboBox and GtkComboBoxEntry (WL #7637)
  * ODBC Driver GUI in Windows has wrong order of controls selection
    (Bug# 18240696)
  * Wrong installation library directory on some 64bit system other than x86_64.
    (Bug# 68848)
  * SQLNumResultCols() with NULL parameter results in Segmentation Fault
    (Bug# 18165197)
  * SQLBULKOPERATIONS(SQL_FETCH_BOOKMARK) RETURNS SQL_NO_DATA ERROR
    (Bug# 18287216)
  * Segmentation Fault in SQLExecute() while executing test file "my_types"
    (Bug# 18303978)
  * Segmentation fault in SQLParamOptions() in Solaris platform (Bug# 18325878)
  * Segmentation fault in SQLForeignKeys() when number of columns in the table
    is more (Bug# 18286366)
  * Valgrind memory leak in SQLForeignKeys when NO_I_S=1 (Bug# 18286007)
  * Valgrind memory leak in when SQLPrepare used with SQLParamData/SQLPutData for
    NO_I_S=1 (Bug#18295317)
  * The password is getting saved when creating FileDSN using SQLDriverConnect
    (Bug# 18310873)
  * Passing NULL pointer to SQLSetDescField, SQLGetDiagField and SQLGetDiagRec
    results in a crash (Bug# 18431088)

----

5.3.1(20-Nov-2013)

  Functionality added or changed:
  * Support of SQL_ATTR_RESET_CONNECTION connection attribute (WL #7274)

  Bugs fixed:
  * Memory leak using 5.2.6 ODBC Connector (Bug #17653461/70662)

  * MySQL ODBC driver incorrectly quotes TableName when calling SQLPrimaryKeys
    (Bug# 16952531/69448)
  * Bad memory access when get out params (Bug #17640929/70642)
  * Setting Unix Socket using ODBCManageDataSourcesQ4 sets NAMED_PIPE=1
    (Bug# 17586452)
  * Segmentation Fault in SQLBulkOperations() (Bug #17714290)
  * Segmentation fault when SQLColumns table or column argument are provided
    more then 256 and 129 respectively (Bug #17358838)
  * Memory leak in SQLSetStmtAttr() as statement deallocation was missing
    (Bug #17441507)
  * Memory leak is happening in SQLProcedureColumns when returning empty results.
    (Bug #17298721)
  * Memory leak in SQLConnect() called after SQLSetConnectAttr() (Bug #17586844)

  Built using MySQL 5.6.14.

----

5.3.0(19-Oct-2013)

  Functionality added or changed:
  * Support for File Data Sources. (WL #6583, Bug #11746219/24581)
  * Bookmark support added in myodbc (WL #7039)
  * Added new variable in cmake config files ODBCCP32_LIB for odbccpp32.lib path,
    and MYSQLCLIENT_LIB_NAME for linking mysqlclient statically or dynamically by
    specifying mysqlclient library (libmysql.*, mysqlclient.*, libmysqlclient_r.*,
    libmysqlclient.*) to be used. Mysql CPP linkage for mysql version >= 5.6.4
    (WL #6738)
  * Added a new test module for crash bugs (my_crash.c)
  * Added GUI dialog for Linux
  * Support of ODBC 3.8 standard - driver self identification, input/output
    stream parameters (WL #6584)

  Bugs fixed:
  * With utf8 byte string for mysql server version < 5.5.3, insert fails
    with error message "Server does not support 4-byte encoded UTF8
    characters." (Bug #14838690)
  * Driver use the char ';' as separator in attributes string instead
    of the '\0' (Bug #15940689/66548)
  * DSN connection parameters override those specified in the connection
    string (Bug #11760574/52996)
  * Non-compliant behavior of SQLMoreResults (Bug #16101282/67920)
  * MSSQL linked server connected to MySQL 5.1.9 driver causes hard crash
    (Bug #16604346/63386)
  * MySQL ODBC drivers incorrectly returns TIME columns, where value > '99:59:59'
    (Bug #16176981/67793)
  * Conversion of Time field data to Timestamp type may produce incorrect result
    (Bug #17016839/69545)
  * Need to add a lock to access connections member in ENV structure
    (Bug #17240611/69864)
  * Visual Studio 2010 crashes when reading rows from any table in Server
    Explorer (Bug #17304031/69950)
  * Corrected MYSQL_NUM_VERSION calculation error in FindMysql.cmake.
    MYSQL_LIB_DIR, MYSQL_INCLUDE_DIR, MYSQL_LINK_FLAGS and MYSQL_CXXFLAGS will
    be obtained from mysql_config only when they are not provided using cmake
    options.
  * Memory leak in SQLPrepare with queries that use parameters
    (Bug #17400483/70113)
  * Valgrind error, simple loop fix (Bug #17397596/64105)
  * Wrong pointer type can cause crash in convert_c_type2str()
    (Bug #17421620/69733)
  * Memory leak in SQLMoreResults() as deallocation of result_bind buffer
    required before calling mysql_stmt_free_result() (Bug# 17441296)
  * FileDSN is created evein if the connection credentials are wrong
    (Bug #17508006)
  * Error with iodbc in SQLAllocHandle with handle type SQL_HANDLE_DBC
    as odbc_ver is unset.

  Built using MySQL 5.6.14.

----

5.2.5(04-Apr-2013)

  Functionality added or changed:
  * MSI package installs both ANSI and Unicode drivers. (WL#6793)

  Bugs fixed:
  * query_print will cause core dump in 32-bit application
    (Bug #16367440/68201)
  * Microsoft Access Crashes when Bit field updates (Bug# 16287859/68243)
  * Datetime and timestamp second fractions need removing the trailing
    zeros (Bug# 16294197/65418)
  * Binding string to decimal parameter always uses system locale setting
    (Bug# 11766369/59469)
  * Added CLEARTEXT authentication connection option ENABLE_CLEARTEXT_PLUGIN.
   (Bug#16445091)
  * Crash in SQLSetConnectAttr(SQL_ATTR_CURRENT_CATALOG) (Bug# 16526604/63844)

  Built using MySQL 5.6.11.

----

5.2.4 (16-Jan-2013)

  Functionality added or changed:
  * Support of expired passwords. Added conenction string option CAN_HANDLE_EXP_PWD.
    (WL#6786)
  * Add new reserved words from MySQL 5.6 in SQLGetInfo (WL#6704)

  Bugs fixed:
  * While retrieving data from a field, BLOB to CHAR conversion is done only for
    fields having BLOB_FLAG, BINARY_FLAG and binary character set(63) (Bug #11746572)

  Built using MySQL 5.6.10.

----

5.2.3 (19-Dec-2012)

  Bugs fixed:
  * Memory leak in 5.2.2(w) ODBC driver causes Prepared_stmt_count to grow
    (Bug# 67340/14812778)
  * Version 5.1 exports symbols SQLInstallDriverEx and SQLInstallDriverExW
    (Bug# 11766724/59900)
  * Corrected calculation for length indicator descriptor field (Bug# 11766437)
  * is_minimum_version() function does not work correctly (Bug# 15926340)
  * Problem with BIT columns in MS Access (Bug# 15997361/67702)

  Built using MySQL 5.5.27.
Updated databases/myodbc to 5.3.2
Add EXTRACT_USING=gtar to prevent a stream of warnings/errors as
source tarball was created with extensions to tar that aren't
supported by nbtar.  Since this does not change the binary package,
no PKGREVISION bump.
Link against security/libsodium so that CURVE security becomes available.
Conditionalize C++ standard on the compiler being used (the curve code
in zeromq uses "long long" which is not vali in C++98).
Apply a fix for directory-traversal vulnerability, ref.
http://bugs.python.org/issue21766
Bump PKGREVISION.
Note update of lang/python27 to 2.7.7nb2.
Changes 3.4.6:
Docs: external_acl_type documentation lies for cache=n option
Non https connectiona on SSL-bump enabled port may stuck
Do not leak implicit ACLs during reconfigure.
Assure that when LruMap::memLimit_ is set to 0 no entries stored on LruMap
Portability: use 64-bit for X-Cache-Age header
Windows: fix various libip build issues
Windows: rename TcpLogger::connect
Windows: rename ConnOpener::connect
Change order of BSD-specific network includes so that they are properly picked up
Do not leak ex_data for SSL state that survived reconfigure.
Do not register the same Cache Manager action more than once
Fix leaked TcpAcceptor job on reconfiguration
Fix leak of ACLs related to adaptation access rules
Bug 4056: assertion MemPools[type] from netdbExchangeStart()
Bug 4065: round-robin neighbor selection with unequal weights
Bug 4050: Segfault in CommSelectEngine::checkEvents on helper response
Fix segfault setting up server SSL connnection
Regression: segfault logging with %tg format specifier
SourceFormat Enforcement
Updated www/squid3 to 3.4.6
Add fix for CVE-2014-3421, CVE-2014-3422 and CVE-2014-3424.

Bump PKGREVISION.
Note update of editors/emacs24 package to 24.3nb14.