chan_ooh323: fix rtptimeout general value checking

correct condition to check rtptimeout in [general] config section

ASTERISK-24393 #close
Reported by:  Dmitry Melekhov
Tested by:  Dmitry Melekhov
Patches:
  ASTERISK-24393.patch
........

Merged revisions 425547 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 425548 from http://svn.asterisk.org/svn/asterisk/branches/11
res_rtp_asterisk: Fix a bug where ICE state would get reset when it shouldn't.

In the case where the ICE negotiation had not yet started current state would
get wiped when it shouldn't.

This also removes channel binding as in practice this does not work well with
other implementations.
........

Merged revisions 425644 from http://svn.asterisk.org/svn/asterisk/branches/11
Fix loss of voice after second call drops (on a second line) in case using multiple lines on unistim phones. There is regression was introduced in r391379.

Reported by: Rustam Khankishyiev
(closes issue ASTERISK-23846)
........

Merged revisions 425667 from http://svn.asterisk.org/svn/asterisk/branches/11
PJSIP: Enforce module load dependencies

This enforces that res_pjsip, res_pjsip_session, and res_pjsip_pubsub
have loaded properly before attempting to load any modules that depend
on them since the module loader system is not currently capable of
resolving module dependencies on its own.

ASTERISK-24312 #close
Reported by: Dafi Ni
Review: https://reviewboard.asterisk.org/r/4062/
config: Fix inf loop using ast_category_browse and ast_variable_retrieve

Fix infinite loop when calling ast_variable_retrieve inside an
ast_category_browse loop when there is more than 1 category with
the same name.

Tested-by: George Joseph

Review: https://reviewboard.asterisk.org/r/4089/
main/cdr: Use 'time' when rescheduling batched CDRs as opposed to 'size'

When refactoring CDRs to use the configuration framework, a 'whoops' was
introduced where the CDR batch size was used when rescheduling a batch,
as opposed to the time duration. This patch corrects that obvious mistake.

ASTERISK-24426 #close
Reported by: Shane Blaser
test_cel: Update pickup test to expect CANCEL instead of ANSWSER

The CEL pickup test previously looked for a disposition of ANSWER between the
original caller/peer when the call is picked up. This is actually incorrect:
the disposition should, at the very least, not be ANSWER as the call was
never ANSWERed. The disposition is now CANCEL; this patch updates the test
accordingly.
bridge_native_rtp: Fix audio issues when moving from remote bridge to softmix

When a native RTP bridge that is remotely bridging its participants switches
to a softmix bridge, it may not properly re-INVITE the media for one or both
participants back to Asterisk. This is due to the current bridge_native_rtp
code only re-INVITEs if it believes the channel will survive the bridge
operation. Currently, that code is failing, as it expects the channels to
have a soft hangup flag set on it indicating that a redirect has occurred
or that the channel is going to leave the bridge. (The code did not take into
account a smart bridge operation).

This patch also renames a few things to be more reflective of the underlying
types.

Review: https://reviewboard.asterisk.org/r/3997/

ASTERISK-24327 #close
AMI: Add missing VarSet events when a channel inherits variables.

There should be AMI VarSet events when channel variables are inherited by
an outgoing channel.  Also local;2 should generate VarSet events when it
gets all of its channel variables from channel local;1.

ASTERISK-24415 #close
Reported by: Richard Mudgett
Patches:
      jira_asterisk_24415_v12.patch (license #5621) patch uploaded by Richard Mudgett

Review: https://reviewboard.asterisk.org/r/4074/
channels/chan_sip: Respect outboundproxy setting when sending qualify requests

The outboundproxy setting is currently ignored when sending OPTIONS requests
as a result of the qualify setting. This means that if an Asterisk server is
unable to send the packet directly to a peer, it is unable to qualify any
non-inbound registered peer (e.g. a peer SIP Trunk).

This patch grabs the outboundproxy information for a peer when a qualify
attempt is being constructed and, if it finds the information, uses it
when sending the OPTIONS request.

Review: https://reviewboard.asterisk.org/r/3948

ASTERISK-24063 #close
Reported by: Damian Ivereigh
patches:
  outboundproxy-dai.patch uploaded by Damian Ivereigh (License 6632)
........

Merged revisions 425818 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 425819 from http://svn.asterisk.org/svn/asterisk/branches/11
res_pjsip_session/res_pjsip_sdp_rtp: Be more tolerant of offers

When an inbound SDP offer is received, Asterisk currently makes a few
incorrection assumptions:

(1) If the offer contains more than a single audio/video stream, Asterisk will
    reject the entire stream with a 488. This is an overly strict response;
    generally, Asterisk should accept the media streams that it can accept and
    decline the others.
(2) If the offer contains a declined media stream, Asterisk will attempt to
    process it anyway. This can result in attempting to match format
    capabilities on a declined media stream, leading to a 488. Asterisk should
    simply ignore declined media streams.
(3) Asterisk will currently attempt to handle offers with AVPF with
    use_avpf=No/AVP with use_avpf=Yes. This mismatch results in invalid SDP
    answers being sent in response. If there is a mismatch between the media
    type being offered and the configuration, Asterisk must reject the offer
    with a 488.

This patch does the following:
* Asterisk will accept SDP offers with at least one media stream that it can
  use. Some WARNING messages have been dropped to NOTICEs as a result.
* Asterisk will not accept an offer with a media type that doesn't match its
  configuration.
* Asterisk will ignore declined media streams properly.

#SIPit31

Review: https://reviewboard.asterisk.org/r/4063/

ASTERISK-24122 #close
Reported by: James Van Vleet

ASTERISK-24381 #close
Reported by: Matt Jordan
res/res_pjsip_sdp_rtp: Check joint caps when looking to decline outgoing media

When constructing an outgoing media stream for an SDP offer/answer, the current
code checks the override preferences (set by the PJSIP_MEDIA_OFFER function) as
well as what is configured on the endpoint to determine if a codec is available
for the media stream. Unfortunately, this isn't good enough: we must also look
at the negotiated (joint) format capabilities. Otherwise, we'll construct a
media stream offer/answer with no codecs.

Note that this isn't an issue in 13, which already looks at the joint
capabilities thanks to the media re-work done there.
res/res_pjsip_sdp_rtp: Undo 425921

This patch for r425921 introduced a different bug, wherein sending an INVITE
request with no SDP would cause Asterisk to not send an SDP Offer in the 200
OK. The current structure of res_pjsip_sdp_rtp is a bit hard to deal with
to fix this, particularly in 12:
(1) The format capabilities structures and how they are used are a bit harder
    to manipulate than they are in 13
(2) create_outgoing_sdp has no knowledge of whether or not it is creating an
    SDP as a new Offer or an Answer. This is something of an oversight in the
    callback definition, as the caller of it does have this information.
build: Force -fsigned-char on platforms where the default for char is unsigned

gcc on the ARM platform defaults 'char' to 'unsigned char' whereas Intel and
SPARC default to 'signed char'.  This is only an issue in the rare cases where
negative values are assigned to a 'char' but this this patch insures
compatibility by detecting platforms that default to 'unsigned' and adding an
'-fsigned-char' flag to _ASTCFLAGS.

If compiling for ARM (native or cross-compile) be sure to run ./bootstrap.sh
and ./configure to regenerate the build files.  You shouldn't have to do this
for Intel or SPARC.

Tested-by: George Joseph

Review: https://reviewboard.asterisk.org/r/4091/
AST-2014-011: Fix POODLE security issues

There are two aspects to the vulnerability:
(1) res_jabber/res_xmpp use SSLv3 only. This patch updates the module to use
    TLSv1+. At this time, it does not refactor res_jabber/res_xmpp to use the
    TCP/TLS core, which should be done as an improvement at a latter date.
(2) The TCP/TLS core, when tlsclientmethod/sslclientmethod is left unspecified,
    will default to the OpenSSL SSLv23_method. This method allows for all
    encryption methods, including SSLv2/SSLv3. A MITM can exploit this by
    forcing a fallback to SSLv3, which leaves the server vulnerable to POODLE.
    This patch adds WARNINGS if a user uses SSLv2/SSLv3 in their configuration,
    and explicitly disables SSLv2/SSLv3 if using SSLv23_method.

For TLS clients, Asterisk will default to TLSv1+ and WARN if SSLv2 or SSLv3 is
explicitly chosen. For TLS servers, Asterisk will no longer support SSLv2 or
SSLv3.

Much thanks to abelbeck for reporting the vulnerability and providing a patch
for the res_jabber/res_xmpp modules.

Review: https://reviewboard.asterisk.org/r/4096/

ASTERISK-24425 #close
Reported by: abelbeck
Tested by: abelbeck, opsmonitor, gtjoseph
patches:
  asterisk-1.8-jabber-tls.patch uploaded by abelbeck (License 5903)
  asterisk-11-jabber-xmpp-tls.patch uploaded by abelbeck (License 5903)
  AST-2014-011-1.8.diff uploaded by mjordan (License 6283)
  AST-2014-011-11.diff uploaded by mjordan (License 6283)
res/res_srtp: Fix include issue for libsrtp 1.5.0

In libsrtp 1.5.0, crypto_get_random is no longer resolved simply by including
srtp.h. Now, one must include crypto_kernel.h as well. As it turns out, this
header file has been provided by the library since 2006, so this is a
relatively benign change.

ASTERISK-24436 #close
Reported by: Patrick Laimbock
........

Merged revisions 426140 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 426141 from http://svn.asterisk.org/svn/asterisk/branches/11
res/res_phoneprov: Fix crash on shutdown caused by container cleanup

In res_phoneprov, unloading the module first destroys the http_routes
container, followed by the users. However, users may have a route in
the http_routes container; the validity of this container is not checked
in the users destructor. Hence, we hit an assert as the container has already
been set to NULL.

This patch does two things:
(1) It adds a sanity check in the user destructor (because why not)
(2) It switches the order of destruction, so that users are disposed of prior
    to the HTTP routes they may hold a reference to.

Note that this crash was caught by the Test Suite (go go testing!)
res/res_http_websocket: Fix minor nits found by wdoekes on r409681

When Moises committed the fixes for WSS (which was a great patch), wdoekes had
a few style nits that were on the review that got missed. This patch resolves
what I *think* were all of the ones that were still on the review.

Thanks to both moy for the patch, and wdoekes for the reviews.

Review: https://reviewboard.asterisk.org/r/3248/
........

Merged revisions 426209 from http://svn.asterisk.org/svn/asterisk/branches/11
app_queue: Cleanup ao2_iterator

Clean ao2_iterator, resolving reference leak to queue members.

ASTERISK-24454 #close
Reported by: Corey Farrell
Review: https://reviewboard.asterisk.org/r/4111/
........

Merged revisions 426255 from http://svn.asterisk.org/svn/asterisk/branches/11
ASTERISK-24419, fix incorrect syntax for setting language in extensions.conf.sample