| 00:02.52 | *** join/#asterisk-dev pabelanger-lap (~pabelange@CPE0013f7abc09a-CM0013f7abc096.cpe.net.cable.rogers.com) |
| 00:06.51 | *** part/#asterisk-dev alecdavis (~alec@210.48.127.227) |
| 00:35.41 | *** join/#asterisk-dev bklang (~bklang@tesla.alkaloid.net) |
| 00:55.25 | *** join/#asterisk-dev n0tk (~n0tk@166.194.60.48) |
| 00:56.08 | *** join/#asterisk-dev frawd (~francois@157.Red-79-158-130.staticIP.rima-tde.net) |
| 01:20.26 | *** join/#asterisk-dev richardf (~savag3@173.116.124.202.static.snap.net.nz) |
| 01:32.59 | *** join/#asterisk-dev frawd (~francois@210.Red-88-24-190.staticIP.rima-tde.net) |
| 01:37.51 | *** join/#asterisk-dev philipp64|laptop (~chatzilla@mail.redfish-solutions.com) |
| 04:15.40 | *** join/#asterisk-dev guilhermebr (~Guilherme@200.175.244.93.dynamic.dialup.gvt.net.br) |
| 04:44.45 | *** join/#asterisk-dev kpfleming (~kpfleming@asterisk/digium-director-of-software-tech/kpfleming) |
| 04:44.45 | *** mode/#asterisk-dev [+o kpfleming] by ChanServ |
| 05:02.58 | *** join/#asterisk-dev Sipster_ (~Sipster@modemcable045.5-200-24.mc.videotron.ca) |
| 07:52.03 | *** join/#asterisk-dev hehol (~hehol@buero-gw.dortmund.loca.net) |
| 08:02.19 | *** join/#asterisk-dev sgimeno (~chatzilla@226.Red-80-33-64.staticIP.rima-tde.net) |
| 08:54.40 | *** join/#asterisk-dev qvsqvs (~anonymous@196.214.133.226) |
| 08:54.47 | qvsqvs | hi |
| 08:55.20 | qvsqvs | how can is change the default from unknown to some thing els |
| 10:07.16 | tzafrir | qvsqvs, default of? |
| 10:07.47 | qvsqvs | the default of the "unknown" for incomming cid |
| 10:08.00 | tzafrir | PRI? SIP? |
| 10:08.04 | qvsqvs | i want to change unknown to some thing els |
| 10:08.06 | qvsqvs | pri |
| 10:08.13 | qvsqvs | i use misdn |
| 10:08.32 | tzafrir | No idea. Anyway, those questions normally go in #asterisk |
| 10:08.51 | qvsqvs | i add this to my misdn.conf incoming_cid_tag=from telkom but know luck |
| 10:08.58 | qvsqvs | ooo cool thx |
| 10:52.28 | *** join/#asterisk-dev hehol (~hehol@buero-gw.dortmund.loca.net) |
| 11:25.13 | *** join/#asterisk-dev hehol (~hehol@buero-gw.dortmund.loca.net) |
| 11:30.05 | *** join/#asterisk-dev leifmadsen (~Leif@asterisk/documenteur-extraordinaire/blitzrage) |
| 11:30.05 | *** mode/#asterisk-dev [+o leifmadsen] by ChanServ |
| 11:36.12 | *** join/#asterisk-dev Qwell (~north@pdpc/sponsor/digium/Qwell) |
| 11:36.12 | *** mode/#asterisk-dev [+o Qwell] by ChanServ |
| 12:06.34 | *** join/#asterisk-dev kpfleming (~kpfleming@asterisk/digium-director-of-software-tech/kpfleming) |
| 12:06.34 | *** mode/#asterisk-dev [+o kpfleming] by ChanServ |
| 12:09.25 | *** join/#asterisk-dev mpe (~mpe@gate.ipvision.dk) |
| 12:10.18 | *** join/#asterisk-dev caio1982 (~caio1982@CAcert-br/caio1982) |
| 12:17.39 | *** join/#asterisk-dev rrb3942 (~rbullock@208.34.105.161) |
| 12:23.52 | *** join/#asterisk-dev Pazzo (~ugelt@reserved-225136.rol.raiffeisen.net) |
| 12:39.37 | *** join/#asterisk-dev mbranca (~matteo@host139-217-static.224-95-b.business.telecomitalia.it) |
| 13:01.42 | *** join/#asterisk-dev mpe (~mpe@gate.ipvision.dk) |
| 13:24.23 | *** join/#asterisk-dev putnopvut (~putnopvut@asterisk/master-of-queues/mmichelson) |
| 13:24.23 | *** mode/#asterisk-dev [+o putnopvut] by ChanServ |
| 13:39.06 | pabelanger | I've been struggling to merge r277944 into trunk and 1.6.2. Anybody have some free time to help out? I'm a little confused and having a hard time understanding the changes. |
| 13:49.47 | *** join/#asterisk-dev bklang (~bklang@tesla.alkaloid.net) |
| 14:01.17 | *** join/#asterisk-dev eliel (~eliels@201.234.94.226) |
| 14:01.17 | *** mode/#asterisk-dev [+o eliel] by ChanServ |
| 14:07.59 | *** join/#asterisk-dev guilhermebr (~Guilherme@200.103.96.98) |
| 14:09.48 | *** join/#asterisk-dev anthm (~anthm@freeswitch/developer/anthm) |
| 14:15.37 | *** join/#asterisk-dev pyite (~dschreibe@unaffiliated/pyite) |
| 14:21.51 | putnopvut | pabelanger: it's entirely likely that you won't need to merge the change since T.38 negotiation in 1.6.2 and trunk is completely different from 1.4 |
| 14:25.11 | pabelanger | putnopvut: Ok, thanks for checking for me |
| 14:33.54 | kpfleming | yeah... t.38 negotiation stuff in 1.6.x and higher is very, very different, so any problems reports have to be retested there before you try patching the code |
| 14:41.56 | *** join/#asterisk-dev jpeeler (~jpeeler@asterisk/developer/jpeeler) |
| 14:41.56 | *** mode/#asterisk-dev [+o jpeeler] by ChanServ |
| 14:48.24 | *** join/#asterisk-dev The_Boy_Wonder (~vossel@asterisk/batman-developer/dvossel) |
| 14:48.24 | *** mode/#asterisk-dev [+o The_Boy_Wonder] by ChanServ |
| 15:38.35 | *** join/#asterisk-dev infobot (~infobot@rikers.org) |
| 15:38.35 | *** topic/#asterisk-dev is Topic for #asterisk-dev is: Asterisk Development Discussion -=- http://www.asterisk.org/developers -=- Tier 2 and 3.14159265 support is in #asterisk -=- IAX2 is now RFC 5456. |
| 15:50.13 | *** join/#asterisk-dev marv (~timr@24.214.206.254) |
| 15:55.29 | tzafrir | Is "span" a terminology used outside of DAHDI? e.g. in misdn? |
| 16:00.04 | kpfleming | it's commonly used in telephony, yes |
| 16:00.53 | russellb | commit asterisk 278944 |
| 16:00.56 | MuffinMan | [278944] Committed by russell on 2010-07-23T15:57:01.078093Z: Disable SIP support by default for Asterisk 1.8. |
| 16:00.56 | MuffinMan | .. |
| 16:00.56 | MuffinMan | .. http://svn.digium.com/view/asterisk?view=rev&revision=278944 |
| 16:01.01 | russellb | i hope that's ok with everyone |
| 16:02.35 | tzafrir | Switching to IAX2? |
| 16:02.56 | russellb | trying to start a trend of migrating back to H.323 |
| 16:06.50 | Kobaz | what's wrong with sip? |
| 16:07.05 | Kobaz | and what exactly does disabled by default mean? |
| 16:07.30 | Qwell | SIP is deprecated |
| 16:07.32 | eliel | +1 for h.323 |
| 16:08.01 | eliel | i think oej will agree with the idea of deprecating sip |
| 16:08.21 | Kobaz | what? |
| 16:08.33 | Kobaz | it's a little late for april fools |
| 16:08.36 | seanbright | russellb: i don't have time today, but i want the editline update in |
| 16:09.02 | seanbright | just fyi |
| 16:09.06 | Corydon76-dig | seanbright: issue number? |
| 16:09.15 | seanbright | there are a couple |
| 16:09.40 | seanbright | 15929 and 17039 |
| 16:09.57 | russellb | seanbright: didn't know what the state of that was |
| 16:10.07 | russellb | is it up for review already? |
| 16:10.10 | seanbright | i have a branch, editline-update in my team directory. it's mostly there, just needs a teensy bit more love |
| 16:10.13 | seanbright | no |
| 16:10.21 | seanbright | i will do that this weekend |
| 16:10.25 | seanbright | if that's too late, no biggy |
| 16:10.31 | russellb | nah, I don't think it is |
| 16:10.45 | russellb | if you can knock it out and have it ready for commit over the next week, we can sneak it in |
| 16:10.47 | Corydon76-dig | seanbright: I think you can sneak that in. In fact, that could probably go into 1.4 and all other branches |
| 16:11.00 | russellb | Kobaz: i'm just a troll |
| 16:11.31 | seanbright | is off to the DMB show |
| 16:11.40 | seanbright | flame away |
| 16:12.45 | Kobaz | heh |
| 16:13.00 | Qwell | seanbright: DMB? |
| 16:13.06 | seanbright | Qwell: dave matthews |
| 16:18.10 | tzafrir | seanbright, editline or libedit? |
| 16:18.50 | pabelanger | http://asterisk.pastebin.com/dyp6rNCU |
| 16:19.29 | pabelanger | this if statement checks if the variable is a directory. |
| 16:20.14 | pabelanger | but it's not actually check the filesystem, only if the variable itself. Which I don't want |
| 16:20.48 | Qwell | huh? |
| 16:21.01 | pabelanger | Trying to create a for loop in the Makefile to check if a directory exists, if not then use install |
| 16:21.17 | Qwell | there will definitely be a stat() system call with that code |
| 16:26.30 | Corydon76-dig | Not necessarily |
| 16:26.57 | Corydon76-dig | Depending upon the flag, access(2) with F_OK might also be used |
| 16:30.59 | pabelanger | Actually, this seems to work |
| 16:30.59 | pabelanger | [ ! -d $(DESTDIR)$$dir ] && $(INSTALL) -d -m 750 "$(DESTDIR)$$dir" ; \ |
| 16:32.22 | Corydon76-dig | pabelanger: what happens if the directory is a regular file? |
| 16:33.05 | Corydon76-dig | May want to add a trailing slash so that it's interpreted correctly |
| 16:33.13 | pabelanger | good call |
| 16:33.45 | Corydon76-dig | It really should be -e |
| 16:35.23 | *** join/#asterisk-dev kpfleming (~kpfleming@asterisk/digium-director-of-software-tech/kpfleming) |
| 16:35.23 | *** mode/#asterisk-dev [+o kpfleming] by ChanServ |
| 16:37.13 | pabelanger | I guess we want to check it exists, and is a directory |
| 16:37.23 | pabelanger | s/it/if |
| 16:39.58 | Corydon76-dig | pabelanger: what do you do if it exists and is not a directory? |
| 16:40.44 | Corydon76-dig | My point is, if it exists at all, you are not going to create the directory |
| 16:43.50 | pabelanger | Yes, in some cases I don't want to recreate the directory, because $(INSTALL) will overwrite the previous settings. IE: $(INSTALL) -o asterisk -g asterisk /usr/sbin/ |
| 16:46.53 | Corydon76-dig | Right, so -e is sufficient |
| 16:47.33 | pabelanger | Ok, thanks |
| 16:47.47 | Corydon76-dig | Actually, you don't want to be creating that directory as user asterisk anyway |
| 16:48.10 | Corydon76-dig | binary directories should rarely be writable by the user |
| 16:49.25 | Corydon76-dig | else you have a potential exploit where the asterisk binary is overwritten and a restart occurs... |
| 16:49.55 | pabelanger | Hmm... |
| 16:50.42 | Corydon76-dig | or a reboot, and guess who the asterisk binary is executed as at boot? ROOT! |
| 16:51.16 | kpfleming | only if the binary is suid root |
| 16:51.32 | Corydon76-dig | kpfleming: think machine reboot |
| 16:52.12 | kpfleming | i don't see how that matters. if asterisk is being run as root, there is no 'asterisk' user in the picture, and if there an 'asterisk' user, then asterisk isn't being run as root, at machine reboot or any other time. |
| 16:52.42 | Corydon76-dig | kpfleming: sure it is. Asterisk is started as root, so that it can reserve privileges, then drop the other privs |
| 16:52.46 | kpfleming | if a root user is executing a binary that is not owned by root, then that root user should get away from the machine fast |
| 16:53.07 | kpfleming | then i don't understand the point of this non-root install stuff at all |
| 16:53.29 | kpfleming | if the asterisk binary is owned by root, then it should not be writable by anyone but root, that i agree with |
| 16:53.30 | Corydon76-dig | The point is to drop privileges by default |
| 16:53.44 | Corydon76-dig | kpfleming: right, that's my point. |
| 16:53.51 | *** join/#asterisk-dev sgimeno (~chatzilla@147.Red-79-153-158.dynamicIP.rima-tde.net) |
| 16:53.58 | kpfleming | then the ownership of the binary directory, and the modules directory, should not be changed from their current situation at all |
| 16:54.10 | Corydon76-dig | When you make install, the sbindir should NEVER be owned by the asterisk user |
| 16:54.19 | kpfleming | no bin dir should be |
| 16:54.25 | kpfleming | sbin, bin, lib, modules, nothing |
| 16:54.25 | Corydon76-dig | Precisely my point |
| 16:55.24 | kpfleming | so i was confused, i assumed that since that was being discussed, we were talking about asterisk not running as root at all, not even at startup |
| 16:55.34 | kpfleming | otherwise that never should have been on the table -) |
| 16:56.18 | Corydon76-dig | kpfleming: sorry, the discussion started before you joined |
| 16:56.39 | kpfleming | well, but i've seen that discussion going on for days on the -dev list, i thought |
| 16:57.33 | Corydon76-dig | pabelanger was talking about the -o asterisk argument to INSTALL and my point was that you never want that to begin with for binary directories |
| 16:58.24 | kpfleming | right |
| 16:58.40 | kpfleming | and no -g asterisk either |
| 16:58.43 | Corydon76-dig | [11:43:52] <pabelanger> Yes, in some cases I don't want to recreate the directory, because $(INSTALL) will overwrite the previous settings. IE: $(INSTALL) -o asterisk -g asterisk /usr/sbin/ |
| 17:00.25 | pabelanger | However, if any maintain is required, the user will need to be part of the root group. |
| 17:00.39 | pabelanger | maintenance* |
| 17:01.27 | pabelanger | Thats one of the reasons for this patch. Giving somebody the ability without root permissions to manage the asterisk files. |
| 17:01.50 | pabelanger | But you do have a valid point |
| 17:01.52 | Corydon76-dig | pabelanger: you can do that with sudo |
| 17:01.57 | kpfleming | the binary files are not 'maintenance' |
| 17:02.25 | kpfleming | /etc/asterisk, /var/lib/asterisk/, /var/spool/asterisk... etc. |
| 17:02.27 | kpfleming | that's maintenance |
| 17:06.31 | pabelanger | Yes, but which parts of Asterisk actually require root? I know of '-p or setting TOS bits' |
| 17:06.57 | kpfleming | opening port 80 |
| 17:07.08 | kpfleming | if the http interface is enabled |
| 17:07.23 | kpfleming | i can't think of much else at the moment |
| 17:07.49 | pabelanger | but could be resolved if the 'users' was added to the 'apache' group |
| 17:08.55 | kpfleming | nope |
| 17:08.58 | kpfleming | not related at all |
| 17:09.16 | kpfleming | opening port 80 requires being root or having CAP_NET_ADMIN capability (or something like that) |
| 17:09.25 | kpfleming | any port below 1024, in fact |
| 17:09.38 | kpfleming | which is why apache starts as root and then switches to the apache user |
| 17:14.17 | pabelanger | Ok, so modules / binaries are off limit for chown asterisk:asterisk. Let me look into it :) |
| 17:15.14 | anonymouz666 | Corydon76-dig save the world from annoying beep on the console |
| 17:16.48 | pabelanger | My approach was to running Asterisk, using the actual 'asterisk' user, rather then as root and dropping privileges. |
| 17:17.58 | pabelanger | Similar to how Debian / Ubuntu handle Asterisk. |
| 17:19.15 | leifmadsen | pabelanger: also port 161 for SNMP if Asterisk is running SNMP standalone (not a subagent) |
| 17:21.30 | pabelanger | So, if opening ports sub 1024 is the only real reason to run Asterisk from root, I'm going to look into the CAP_NET_ADMIN option |
| 17:25.40 | Corydon76-dig | pabelanger: it's already there |
| 17:26.22 | Corydon76-dig | also because we need the ability to set TOS on UDP packets |
| 17:26.41 | pabelanger | Corydon76-dig: Ya, I remember you saying that before. |
| 17:28.03 | tzafrir | asterisk is already accompanied by a priviligied sub-process. The astcanary |
| 17:30.40 | tzafrir | What if you could ask that process to set TOS on some UDP packets? |
| 17:32.33 | *** join/#asterisk-dev bklang_ (~bklang@tesla.alkaloid.net) |
| 17:33.53 | pabelanger | tzafrir: How does Debian handle it? |
| 17:34.34 | tzafrir | pabelanger, just runs asterisk as root with '-U asterisk' (no -G) |
| 17:34.39 | tzafrir | TOS does not work |
| 17:34.57 | tzafrir | Asterisk does not need to open any priviliged port |
| 17:35.45 | pabelanger | tzafrir: I'm told that is incorrect. IE: SNMP |
| 17:36.09 | tzafrir | hmm... Asterisk attempts to be an snmpd? Why? |
| 17:36.32 | tzafrir | What if you already have snmpd on the system? |
| 17:36.41 | tzafrir | That's just wrong |
| 17:37.42 | tzafrir | Anyway, systemd prefers listening on sockets for daemons. Thus if you use it, no need to be root |
| 17:37.44 | pabelanger | So, this is my argument. A side from a few items, TOS, SNMP. There is no reason to run the Asterisk binary under root. So, assuming a solution can be create for TOS and SNMP, what else would require root for Asterisk? |
| 17:38.27 | tzafrir | IIRC upstart also has something with preferring to run processes as non-root and doing priviliged stuff from the daemon |
| 17:38.43 | pabelanger | And from what I see, Debian / Ubuntu currently does this. They run the Asterisk binary using the 'asterisk' user. |
| 17:39.20 | tzafrir | pabelanger, asterisk is executed as root, but is allowed to drop provileges on its own |
| 17:39.25 | tzafrir | (-U asterisk) |
| 17:39.37 | tzafrir | Thus it can open ports on startup, theoretically |
| 17:39.58 | tzafrir | But it's way before res_snmp is loaded |
| 17:40.37 | tzafrir | It is used to get real-time scheduling priority |
| 17:44.02 | pabelanger | Ok, so that whole discussion aside :) What about changing the default dir (755) / file (644) permission to dir (750) / file (640)? |
| 17:45.04 | tzafrir | Why? |
| 17:45.51 | pabelanger | Security of course. |
| 17:45.58 | tzafrir | Generally the policy of Debian is that the default stuff of the distro should be world readable, unless there's a good reason to do so |
| 17:46.25 | kpfleming | right |
| 17:46.34 | kpfleming | if someone has shell access to your asterisk server, they shouldn't |
| 17:46.59 | tzafrir | Because the user can always find the content of the default install from elsewhere ('make install' on their toy server) |
| 17:47.55 | tzafrir | That said, /etc/asterisk has "secrets" in too many files. I can't think of a simple way other than to make them all non-world-readable |
| 17:48.12 | tzafrir | Which is annoying, as I have to be root to look at the configs |
| 17:48.29 | tzafrir | (and need to be root to check 'help' in the CLI :-) ) |
| 17:49.11 | pabelanger | and that goes back to my original point of non-root. |
| 17:49.58 | kpfleming | the only point of running asterisk as non-root is to minimize the damage someone could cause if they compromised it |
| 17:50.01 | pabelanger | But lets face it, not allow access to ssh access to a system is not a valid way to secure an asterisk box. IE: hosted enviornment |
| 17:50.25 | kpfleming | nobody except the asterisk admins should have ssh access |
| 17:50.53 | kpfleming | hosting does not change that |
| 17:51.13 | tzafrir | Reduce the impact of a bug in asterisk (or in a dialplan / AGI it runs) |
| 17:51.19 | kpfleming | sure |
| 17:51.37 | kpfleming | but it has nothing to do with what other users who have shell access may or may not be able to see, because there shouldn't be any |
| 17:52.13 | tzafrir | s/users with shell access/apache got hacked/ |
| 17:53.17 | kpfleming | but you have that problem regardless of what other services are running on the box along with apache (or whatever gets hacked) |
| 17:53.37 | kpfleming | if someone hacks asterisk, they can read your .htpasswd files |
| 17:54.13 | kpfleming | if you're lucky, they won't be able to guess the passwords for the user accounts they can now list |
| 17:54.14 | pabelanger | I don't agree, if I have SSH access to a box, either back I have permission to access the box, or am providing support for a customer to configure Apache. If we leave /etc/asterisk world-readable by default, there is nothing stopping me from vi /etc/asterisk/sip.conf and grabbing all the username / password. |
| 17:54.37 | pabelanger | Ok, aside for the fact it is morally wrong |
| 17:54.48 | kpfleming | how are you configuring apache without at least temporary root access? |
| 17:55.43 | pabelanger | Bad example... substitute Apache with another non-root process. |
| 17:56.19 | kpfleming | while i can't dispute that scenario exists, i suspect it's pretty rare, and doesn't warrant potentially disruptive changes to asterisk |
| 17:58.28 | philipp64|laptop | is triage still going on for the 1.8 cut-list? and are we still on schedule for today? |
| 17:58.29 | pabelanger | Again, I disagree. How many times to unformed people drop an asterisk box on the Internet, without properly protecting there default context or even a firewall. Just look to asterisk-users mailing list, seems every weeks somebody is complaining there box got hacked and $100's of toll charges were made. |
| 17:58.55 | Qwell | running as non-root won't solve that |
| 17:59.07 | kpfleming | but that has nothing to do with the scenario you outlined. their box got 'hacked' because they chose crappy SIP account passwords |
| 17:59.19 | philipp64|laptop | leifmadsen: how is 17688 looking? |
| 17:59.47 | philipp64|laptop | I need to go on the road this afternoon for a few days, and wanted to make sure nothing is blocking on me... |
| 18:00.25 | Qwell | 17688 would be a bug fix. It doesn't need to be there before the branch. |
| 18:00.42 | philipp64|laptop | ok, good. just making sure. |
| 18:01.12 | philipp64|laptop | paranoia runs in my family... actually, I think it's the fluoridation causing it. that or the mind control drugs. |
| 18:01.48 | pabelanger | Yes, their account was brute forced because of weak SIP passwords, but one could do the same thing to ssh, get access to your box. And vi /etc/asterisk/sip.conf, because it have 755 permissions. |
| 18:01.49 | Qwell | it's definitely the government. sprinklers didn't used to cause rainbows. |
| 18:02.00 | philipp64|laptop | You noticed that too!!!! |
| 18:02.25 | pabelanger | Nothing is 100% secure. So why not do everything we can by default to slow somebody down? |
| 18:02.39 | Qwell | philipp64|laptop: http://www.youtube.com/watch?v=_c6HsiixFS8 |
| 18:04.12 | philipp64|laptop | That woman needs to head up the Gulf spill recovery effort! |
| 18:04.38 | philipp64|laptop | clearly she won't allow herself to be boondoggled by BP and the guvmint. |
| 18:14.42 | philipp64|laptop | Seems Olle and Rossi are at an impasse about M11688. I tend to concur with Rossi that the SPA942's are solid phones and will be around for years, but their firmware hasn't been updated in 3 years. |
| 18:14.55 | MuffinMan | [ready for testing] [Asterisk] Channels/chan_sip/NewFeature 0011688: [patch] Allow Sipura handsets (SPA942) to use Asterisk SLA via implementation of Broadsoft Sip extensions reported by grossi https://issues.asterisk.org/view.php?id=11688 |
| 18:19.03 | russellb | if it really only takes as much code as he added, then i don't see it as a burden to add |
| 18:21.42 | philipp64|laptop | I'm hoping. |
| 18:22.13 | philipp64|laptop | Rossi's in Europe. when he gets back this weekend, I'll try and work with him on a testplan. |
| 18:24.00 | russellb | he's hardcore, IIRC, he's a professor at a medical school or something |
| 18:26.27 | philipp64|laptop | yup. I did a doubletake. |
| 18:26.36 | philipp64|laptop | cardiothoracic surgeon |
| 18:26.46 | philipp64|laptop | (heart surgeon) |
| 18:27.19 | russellb | that's awesome |
| 18:28.31 | Corydon76-dig | pabelanger: if it can be done, it can be scripted. "slowing down" stops being a part of the equation at that point |
| 18:32.06 | Kobaz | arg |
| 18:32.11 | Kobaz | i need some way to debug this |
| 18:32.17 | Kobaz | [Jul 22 16:19:40] ERROR[11262]: utils.c:529 lock_info_destroy: Thread 'handle_tcptls_connection started at [ 276] tcptls.c ast_tcptls_server_root()' still has a lock! - '&c->lock_dont_use' (0xcf0aa60) from 'channel_find_locked' in channel.c:1244! |
| 18:32.34 | *** join/#asterisk-dev caio1982 (~caio1982@CAcert-br/caio1982) |
| 18:32.35 | Kobaz | i tried a sigquit to get the core and backtrace, but asterisk didn't dump core |
| 18:35.49 | philipp64|laptop | russellb: I wonder if he brokers world peace as a hobby. :-) |
| 18:36.07 | russellb | NO KIDDING |
| 18:36.12 | russellb | oops, caps lock. |
| 18:36.20 | russellb | it's caps lock friday in another chat room I'm in :-p |
| 18:36.31 | Kobaz | hah |
| 18:37.10 | russellb | Kobaz: it would be really helpful for the channel_find_locked() code to report the real location in the code that called channel find locked in the lock debugging output |
| 18:37.30 | russellb | that would help find the problem |
| 18:37.41 | Kobaz | yeah |
| 18:37.58 | Kobaz | i've been looking into c backtracing, and it's kind of crappy |
| 18:38.20 | Kobaz | the built in gnu stuff is kinda limited... all it gives you is the function addresses |
| 18:39.13 | Kobaz | russellb: if i force a core and get the backtrace... i hopefully should find the thing that originally locked it and is still processing |
| 18:40.08 | Kobaz | i wonder how you get the symbol from the function address |
| 18:40.13 | Kobaz | and the line number... |
| 18:41.20 | *** join/#asterisk-dev elguero (~miguel323@ns1.nashuacs.com) |
| 18:43.15 | russellb | I think it'd be easier to just propogate the FILE and line number through the channel_find_locked code and then have that stored by the DEBUG_THREADS stuff |
| 18:43.28 | Kobaz | probably |
| 18:45.34 | philipp64|laptop | Kobaz: you can't always count on being compiled with symbols still present (i.e. non-stripped)... so addresses are about the best you can unconditionally hope for. |
| 18:46.16 | philipp64|laptop | and even then, dynamic loading makings things a little hit-or-miss: you can't always count on required libraries being loaded in the same order, especially in a threaded program. |
| 18:47.37 | philipp64|laptop | compiling with -g and leaving line-number info present typically increases the size of large binaries by up to 300%. |
| 18:47.56 | philipp64|laptop | the good news, of course, is that's the size of the binaries, but doesn't change the core footprint any. |
| 18:49.56 | Kobaz | yeah |
| 18:49.58 | philipp64|laptop | as I remember, gcc's backtrace() function always dumps to stderr... and doesn't allow you to simply copy the backtrace info into an array. they might have fixed that by now. |
| 18:49.59 | Kobaz | i compile with -g anyway |
| 18:50.16 | Kobaz | yeah the gcc backtrace you can stuff into an array |
| 18:50.57 | Kobaz | need like a fancy preprocessor that finds all function calls and stuff __LINE__ and __FILE__ in the call |
| 18:51.23 | philipp64|laptop | yay, they fixed it. I remember cursing it 20 years ago... |
| 18:51.38 | Kobaz | hehe |
| 19:07.58 | philipp64|laptop | putnopvut: hey mark. |
| 19:08.19 | philipp64|laptop | had a chance to weigh in on 11688? |
| 19:08.45 | philipp64|laptop | I'm not enough of a SIP expert to say one way or another. |
| 19:10.17 | putnopvut | philipp64|laptop: I've not. With the work I have assigned, I have no idea when/if I'd be able to get around to it. |
| 19:10.39 | Kobaz | i'm not sure if it's all the same problem, but i've been running into one deadlock or another just about every day with 1.6.2 |
| 19:10.47 | philipp64|laptop | ok... no worries. just trying to get as much insight into it as is available. |
| 19:19.55 | philipp64|laptop | 1.4.34 and 1.6.2.10 both build in astlinux... yay. |
| 19:22.21 | *** join/#asterisk-dev kpfleming (~kpfleming@asterisk/digium-director-of-software-tech/kpfleming) |
| 19:22.21 | *** mode/#asterisk-dev [+o kpfleming] by ChanServ |
| 19:23.21 | philipp64|laptop | trunk build fail: http://pastebin.com/R4FPPAwn |
| 19:24.41 | kpfleming | pabelanger: if you are running systems with ssh enabled on the internet and you allow password authentication, then you are asking for what happens to you :-) |
| 19:25.15 | philipp64|laptop | putnopvut: 278980 looks like it breaks with uclibc. |
| 19:25.52 | putnopvut | looks |
| 19:27.50 | putnopvut | philipp64|laptop: If you add #include <locale.h> to the reqresp_parser.c file, does that make the build errors go away? If not, then it sounds like uclibc does not have locale support and a bug report should be opened to get that fixed up. |
| 19:28.40 | philipp64|laptop | wait 2 |
| 19:34.57 | philipp64|laptop | new fail: http://pastebin.com/B32s8xGr |
| 19:36.21 | pabelanger | kpfleming: Ya, we both agree that statement is true. But I still think the point is valid, lock down some files by default (/etc/asterisk), rather then assuming Asterisk is the only thing running on the system. |
| 19:37.39 | kpfleming | actually, i don't think changing ownership really accomplishes much. /etc/passwd is owned by root and isn't world-readable, but that's not good enough... the sensitive contents are encrypted. |
| 19:38.10 | kpfleming | i guess my point is that if someone is on your system, filesystem permissions are not 'high security'. if the information is that sensitive, either they shouldn't be on your system, or it should be encrypted. |
| 19:38.44 | kpfleming | and storing the sip.conf secrets in an encrypted format wouldn't accomplish much, because the decryption key would have to be present on the same system. |
| 19:38.56 | kpfleming | so the most you can accomplish is obscuring the data... you can't really protect it. |
| 19:38.57 | pabelanger | Using your own statement that 'if someone has shell access to your asterisk server, they shouldn't', any your the only person on the system, making /etc/asterisk non-world readable, should not affect the users either way. |
| 19:39.21 | kpfleming | no, it doesn't, except that it will give less clued-in people a false sense of security. |
| 19:39.49 | kpfleming | i'm much happier taking *no* steps to attempt to secure the data, than taking partial steps and hoping people will read the docs and understand that it isn't a complete solution. |
| 19:41.54 | putnopvut | philipp64|laptop: Seems to be that uclibc doesn't have POSIX locale functions. Yuck |
| 19:44.18 | Kobaz | actually /etc/password must be world readable for a number of tools to work |
| 19:44.22 | philipp64|laptop | checking to see if CFLAGS needs -D__USE_GNU -D__UCLIBC_HAS_XLOCALE__ ... fail. we don't have xlocale.h |
| 19:45.01 | Kobaz | i would say it's up to the user to secure their system |
| 19:45.06 | Corydon76-dig | Kobaz: I think he meant /etc/shadow or /etc/master.passwd |
| 19:45.09 | philipp64|laptop | putnopvut: there's a digium account on the machine we do production builds on... send me an ssh public key and I can make access available to you. |
| 19:45.15 | Kobaz | Corydon76-dig: yeah |
| 19:45.54 | philipp64|laptop | btw, uclibc is never as cut and dried as that... more often the answer is "sort of". |
| 19:46.24 | pabelanger | kpfleming: Fair enough, looks like we'll agree to disagree :) |
| 19:47.29 | putnopvut | philipp64|laptop: sent |
| 19:47.34 | Corydon76-dig | pabelanger: There's also the fact that you should never attempt to be smarter than the sysadmin. |
| 19:47.50 | kpfleming | pabelanger: indeed |
| 19:47.55 | Corydon76-dig | That only causes frustration and pisses people off |
| 19:48.10 | Corydon76-dig | Be smart, but no smarter |
| 19:48.19 | pabelanger | nods |
| 19:48.50 | tzafrir | files owned by asterisk are files asterisk should be able to write |
| 19:48.51 | pabelanger | I agree, most / if not all the work could, and will likely, we handled at the OS level. |
| 19:49.23 | tzafrir | The only rationale I can think of for making the sounds owned by Asterisk is to allow it to record over them |
| 19:49.24 | pabelanger | s/OS/packaging |
| 19:49.42 | kpfleming | on another subject... Asterisk 1.8.0-beta1!!!!!!!! |
| 19:49.46 | Corydon76-dig | tzafrir: that, and the default location for recording files is in the sounds directory |
| 19:50.19 | Corydon76-dig | tzafrir: only way to get around that is to set the sticky bit on the sounds directory |
| 19:50.32 | philipp64|laptop | putnopvut: back at you. |
| 19:50.39 | Corydon76-dig | Not a terrible idea, actually |
| 19:50.52 | putnopvut | philipp64|laptop: cool, where's the source located? |
| 19:50.55 | russellb | kpfleming: yes, if we can figure out the release script ^_^ |
| 19:51.09 | Corydon76-dig | tzafrir: what do you think about setting the sticky bit there? |
| 19:51.11 | putnopvut | guesses $PWD/trunk |
| 19:51.15 | philipp64|laptop | yup. |
| 19:51.23 | kpfleming | no, it's not the sticky bit, that's different |
| 19:51.26 | kpfleming | you mean the 'group suid' bit |
| 19:51.41 | Corydon76-dig | kpfleming: I mean to prevent overwriting the default files |
| 19:51.48 | tzafrir | Corydon76-dig, why the sticky bit? Anybody apart from Asterisk will typically generate files there? |
| 19:52.10 | tzafrir | oh, that? More likely |
| 19:52.30 | Corydon76-dig | Sticky bit would allow the daemon user to write new files, overwrite its new files, but not overwrite default files |
| 19:53.09 | kpfleming | that's not a terrible idea, actually :-) |
| 19:53.37 | putnopvut | philipp64|laptop: Is a special make command necessary to build? I'm getting lmsensors errors. |
| 19:53.56 | Corydon76-dig | Just thought of it, but I don't know if there are downsides I'm not thinking of |
| 19:55.21 | philipp64|laptop | putnopvut: you building from scratch? hmm... |
| 19:55.34 | putnopvut | philipp64|laptop: just typed "make" |
| 19:57.19 | philipp64|laptop | I'm running the script ./rebuild right now... it deletes the local tarball of dl/asterisk-trunk.tar.gz (causing it to get regenerated from SVN) and rebuilds asterisk and dahdi* |
| 19:57.29 | putnopvut | okay |
| 19:57.51 | philipp64|laptop | it will leave around some *.log files... |
| 19:59.56 | philipp64|laptop | done. |
| 20:00.44 | philipp64|laptop | and you can peek in build_i586/staging_dir/include/locale.h |
| 20:14.07 | putnopvut | philipp64|laptop: I looked at that file, and it has all the items that the build is claiming don't exist. |
| 20:24.55 | philipp64|laptop | right, but they're only exposed if you compile with -D__USE_GNU --D__UCLIBC_HAS_XLOCALE__ -- problem is our uclibc (0.9.28) doesn't have xlocale.h, so if I turn on the latter it breaks because of the missing header file. |
| 20:25.50 | philipp64|laptop | how necessary is the locale stuff, anyway? |
| 20:26.29 | putnopvut | It's there for RFC 3261 compliance, and if reqresp_parser.c doesn't build, you won't have a chan_sip.so module |
| 20:29.47 | philipp64|laptop | right, but it built as of yesterday... |
| 20:30.01 | philipp64|laptop | I'm wondering if it could be made to compile conditionally? |
| 20:54.36 | philipp64|laptop | rebuilding the astlinux toolchain with xlocale.h included. |
| 21:06.23 | russellb | philipp64|laptop: you were the reporter of 19 closed issues between 1.6.2.0-beta1 and 1.8.0-beta1, nice |
| 21:07.07 | philipp64|laptop | was I? |
| 21:07.14 | philipp64|laptop | wasn't counting. |
| 21:07.17 | russellb | heh. |
| 21:07.22 | russellb | i have a script that counts these things. |
| 21:17.07 | *** join/#asterisk-dev pabelanger-lap (~pabelange@CPE0013f7abc09a-CM0013f7abc096.cpe.net.cable.rogers.com) |
| 21:19.41 | pabelanger-lap | Change of plans! ;) moving non-root out of Makefile, into contribs/scripts. |
| 21:22.58 | pabelanger-lap | What's autotag_for_asterisk tag for? |
| 21:24.15 | pabelanger-lap | Ah, menuselect |
| 21:26.48 | russellb | pabelanger-lap: not bad, sir, not bad |
| 21:26.54 | russellb | (the contrib/script idea) |
| 21:33.16 | russellb | I still like the idea of making it easier for people to run as non-root ... |
| 21:33.24 | russellb | even if it's not in the core "make install" stuff |
| 21:55.41 | leifmadsen | Asterisk 1.8.0-beta1 is now available for testing! http://www.asterisk.org/node/51396 |
| 22:15.20 | pabelanger-lap | russellb: Ya, will have to sit in contrib/scripts for a while. |
| 22:15.23 | pabelanger-lap | leifmadsen: w00t |
| 22:35.48 | leifmadsen | pabelanger-lap: w00t indeed :) |
| 22:42.11 | *** join/#asterisk-dev mpe (~mpe@0x4dd624b2.adsl.cybercity.dk) |
| 22:42.34 | *** part/#asterisk-dev mpe (~mpe@0x4dd624b2.adsl.cybercity.dk) |
| 23:25.59 | *** join/#asterisk-dev infobot (~infobot@rikers.org) |
| 23:25.59 | *** topic/#asterisk-dev is Topic for #asterisk-dev is: Asterisk Development Discussion -=- http://www.asterisk.org/developers -=- Tier 2 and 3.14159265 support is in #asterisk -=- IAX2 is now RFC 5456. |
| 23:43.44 | *** join/#asterisk-dev NEEDINGHELP123 (Mordi@v58.sgsvr.com) |
| 23:43.59 | NEEDINGHELP123 | guys i have a problem i need to solve for next week's project... |
| 23:44.10 | NEEDINGHELP123 | <PROTECTED> |
| 23:44.17 | NEEDINGHELP123 | it still says NO ANSWER |
| 23:45.16 | NEEDINGHELP123 | some help please |
| 23:50.47 | jsmith | NEEDINGHELP123: You're asking in the wrong channel. This channel is for discussion of the Asterisk source code (in C) |
| 23:52.03 | NEEDINGHELP123 | however maybe that is a bug? |
| 23:52.11 | NEEDINGHELP123 | part of the source code might need changing for it to work? |
| 23:52.23 | NEEDINGHELP123 | maybe someone had coded it, from the dev 'team' |
| 23:52.35 | NEEDINGHELP123 | (a patch).. hence i asked here |