| 03:38.26 | *** join/#asterisk-dev infobot (ibot@c-174-52-60-165.hsd1.ut.comcast.net) |
| 03:38.26 | *** topic/#asterisk-dev is Take the March 2019 Asterisk User Survey! https://goo.gl/forms/xL1VUHRsf95saly13 -- Asterisk Development Discussion -=- http://www.asterisk.org/developers -=- Tier 2 and 3.14159265 support is in #asterisk -=- Check out our blog! blogs.asterisk.org -=- Follow on Twitter at @AsteriskDev |
| 04:06.55 | *** join/#asterisk-dev spatel (~spatel@pool-96-237-230-175.bstnma.fios.verizon.net) |
| 06:48.39 | *** join/#asterisk-dev tsearle (~tsearle@37.19.10.33) |
| 06:48.40 | *** mode/#asterisk-dev [+o tsearle] by ChanServ |
| 07:12.32 | *** join/#asterisk-dev pchero_work (~pchero@87.213.247.82) |
| 07:25.40 | *** join/#asterisk-dev CELYA_ (~Thunderbi@2a01cb0583d31d00f4d7ddd1bc0987bc.ipv6.abo.wanadoo.fr) |
| 07:32.46 | *** join/#asterisk-dev pchero_work (~pchero@109.36.139.241) |
| 08:06.56 | *** join/#asterisk-dev CELYA_ (~Thunderbi@2a01cb0583d31d00f4d7ddd1bc0987bc.ipv6.abo.wanadoo.fr) |
| 08:30.12 | *** join/#asterisk-dev CELYA_ (~Thunderbi@2a01:e0a:d:1111:b749:768d:ed77:7c9a) |
| 09:04.40 | *** join/#asterisk-dev pchero_work (~pchero@87.213.247.82) |
| 09:28.58 | *** join/#asterisk-dev pchero_work (~pchero@87.213.247.82) |
| 09:43.32 | *** join/#asterisk-dev csavinovich (sid296765@gateway/web/irccloud.com/x-omqcqotdsylovjii) |
| 09:43.32 | *** join/#asterisk-dev gtjoseph (~gtjoseph@unaffiliated/gtj) |
| 09:43.32 | *** mode/#asterisk-dev [+oo csavinovich gtjoseph] by hitchcock.freenode.net |
| 10:28.27 | *** join/#asterisk-dev spatel (~spatel@pool-96-237-230-175.bstnma.fios.verizon.net) |
| 15:08.51 | *** join/#asterisk-dev infobot (ibot@c-174-52-60-165.hsd1.ut.comcast.net) |
| 15:08.51 | *** topic/#asterisk-dev is Take the March 2019 Asterisk User Survey! https://goo.gl/forms/xL1VUHRsf95saly13 -- Asterisk Development Discussion -=- http://www.asterisk.org/developers -=- Tier 2 and 3.14159265 support is in #asterisk -=- Check out our blog! blogs.asterisk.org -=- Follow on Twitter at @AsteriskDev |
| 15:24.56 | *** join/#asterisk-dev kharwell (uid358942@gateway/web/irccloud.com/x-jrkeszadtoidzggg) |
| 15:24.56 | *** mode/#asterisk-dev [+o kharwell] by ChanServ |
| 15:37.51 | *** join/#asterisk-dev CELYA_ (~Thunderbi@pop.92-184-96-79.mobile.abo.orange.fr) |
| 15:49.35 | kharwell | do we want to cherry pick https://gerrit.asterisk.org/c/asterisk/+/13853 or meh? |
| 15:49.50 | gtjoseph | i'd cherry picvkj |
| 15:49.59 | gtjoseph | seems useful |
| 15:52.07 | file | seems fine to |
| 15:54.53 | kharwell | file: you mind taking a quick look at the cherry picks for https://gerrit.asterisk.org/c/asterisk/+/13852. If okay those will be the last to merge I guess before RCs |
| 15:54.55 | *** join/#asterisk-dev spatel (~spatel@static-71-174-102-210.bstnma.fios.verizon.net) |
| 15:56.34 | file | done |
| 15:56.44 | kharwell | thanks |
| 16:01.35 | *** join/#asterisk-dev anthm (~anthm@freeswitch/developer/anthm) |
| 16:02.03 | *** join/#asterisk-dev anthm (~anthm@freeswitch/developer/anthm) |
| 16:02.47 | *** join/#asterisk-dev anthm (~anthm@freeswitch/developer/anthm) |
| 16:25.45 | seanbright | rmudgett: you missed "immediatly" |
| 16:27.00 | rmudgett | heh |
| 16:27.05 | rmudgett | for some reason that didn't stand out |
| 16:31.04 | file | seanbright: would you like to toy with something in DNS land? |
| 16:31.22 | seanbright | not really, but shoot |
| 16:31.38 | file | see what making ast_sockaddr_resolve wrap the DNS API does? |
| 16:31.50 | file | :D |
| 16:32.01 | seanbright | will take a gander |
| 16:33.56 | file | I think that function is the only thing that really needs to be touched to have the old world use it |
| 16:34.18 | file | well, I s |
| 16:34.25 | file | er s'pose the old SRV implementation but I'm shrug at that |
| 16:36.41 | seanbright | if we're using ast_sockaddr_resolve to look up 0.0.0.0 or :: it would be problematic i think |
| 16:36.52 | seanbright | a passive address, as it were |
| 16:37.44 | file | yeah, if it's just parsing |
| 16:57.04 | seanbright | i don't like it |
| 16:58.59 | seanbright | getaddrinfo() is going to give us A and AAAA records back, but with ast_dns_resolve is only going to give us one |
| 16:59.32 | seanbright | we don't short-circuit out (that i can see) if we pass an IP to ast_dns_resolve |
| 17:01.00 | seanbright | and i am fairly confident (without testing) that AGI(agi://0.0.0.0/foo) will fail with ast_dns_resolve under the hood (unless we special case it) |
| 17:01.14 | file | Boo |
| 17:01.27 | seanbright | although using the wildcard address on the client side is a little strange |
| 17:01.41 | seanbright | but it does work (at least with telnet) |
| 17:02.55 | file | abort, abort, bake cookies instead |
| 17:02.55 | file | :D |
| 17:03.03 | seanbright | so... one thought is that you could still use getaddrinfo() and pass AI_NUMERICHOST to it |
| 17:03.11 | seanbright | which would prevent a DNS lookup |
| 17:03.25 | seanbright | and then fallback to ast_dns_resolve if that returns EAI_NONAME |
| 17:03.43 | seanbright | so that would handle the IP address case and still let you use DNS API for lookups? |
| 17:04.04 | file | it sounds like it should |
| 17:04.54 | seanbright | how would you decide if you should do an A and/or AAAA lookup? |
| 17:05.05 | seanbright | one of the other or both? |
| 17:05.39 | seanbright | (or do DNS servers return both for an A lookup? /me does not know) |
| 17:06.37 | seanbright | also: the validation in ast_dns_resolve is excessive |
| 17:07.09 | seanbright | other than the name check, the rest should just be ast_asserts |
| 17:07.45 | seanbright | drops microphone |
| 17:09.30 | file | into the void? |
| 17:10.26 | seanbright | i can futz around |
| 17:10.35 | seanbright | unless it's something you need soon |
| 17:10.57 | file | nah |
| 17:11.05 | file | not needed at all, just thought I'd plant it in your mind :P |
| 17:11.30 | seanbright | gotcha |
| 17:20.28 | coreyfarrell | gtjoseph: should I open a bug about the res_pjsip /proc/net access so we have a place to track it? |
| 17:20.46 | gtjoseph | yeah please. i thought i could get to it yesterday but alas no. |
| 17:34.44 | coreyfarrell | gtjoseph: https://issues.asterisk.org/jira/browse/ASTERISK-28770 |
| 17:34.51 | gtjoseph | kk, thanks |
| 17:49.33 | seanbright | coreyfarrell: what does 'search' mean in that error message? |
| 17:55.16 | seanbright | my silly wild ass guess is that it is the call to pj_gethostip() in res/res_pjsip.c |
| 18:07.56 | coreyfarrell | seanbright: I *think* that's what allows listing files in a directory. |
| 18:09.56 | coreyfarrell | Interesting thing /proc/net/ itself has unconfined label so it must be trying to read one of the subdirectories - /proc/net/dev_snmp6, /proc/net/netfilter or /proc/net/stat |
| 18:12.22 | file | coreyfarrell: Friendly Automation is saddened by your comment deletion :D |
| 18:29.41 | seanbright | coreyfarrell: could you try commenting out the two calls to pj_gethostip() in res_pjsip.c:load_pjsip and see if that makes the message go away? |
| 18:31.19 | seanbright | my theory is that enumerate interfaces is what is causing it |
| 18:31.34 | seanbright | but unsure |
| 18:34.03 | coreyfarrell | hmm I misread the denial, I think it's actually trying to read /proc/sys/net or something inside it. |
| 18:35.05 | seanbright | so 'no' on commenting out those two calls then? |
| 18:35.28 | coreyfarrell | I'm going to have to setup a VM to do testing like that.. I'll work on it |
| 18:35.37 | seanbright | ah. ok. |
| 18:35.40 | seanbright | i can do it |
| 18:35.45 | seanbright | centos 7 with selinux right? |
| 18:36.15 | coreyfarrell | yes centos 7 minimal default install |
| 18:40.30 | seanbright | coreyfarrell: sorry, i know nothing about selinux. what does your /etc/selinux/config file look like? |
| 18:41.30 | coreyfarrell | seanbright: comments aside it has "SELINUX=enforcing" and "SELINUXTYPE=targeted" |
| 18:42.03 | seanbright | perfect. thanks. |
| 18:43.00 | coreyfarrell | seanbright: I didn't touch selinux settings at all (also thanks for helping with this!) |
| 18:43.23 | seanbright | sure |
| 18:43.29 | seanbright | i mean, is it a problem? |
| 18:43.42 | coreyfarrell | is what a problem? |
| 18:43.53 | seanbright | like, couldn't you just configure avc or whatever to not complain when asterisk tries to access /proc/net? |
| 18:44.11 | seanbright | it's a network application, accessing /proc/net seems completely reasonable to me |
| 18:45.29 | seanbright | also, how are you configuring the asterisk build? --with-pjproject-bundled --with-jansson-bundled? |
| 18:45.54 | gtjoseph | might be able to set something in the systemd service file |
| 18:47.05 | coreyfarrell | seanbright: yes both bundled |
| 18:47.36 | coreyfarrell | I'm playing with audit2allow now, going to iterate the failures (likely allowing search on the directory will uncover additional errors) |
| 18:49.57 | seanbright | ok, so then my checking this one thing is probably a waste of time then |
| 18:51.18 | coreyfarrell | sorry yes at least for now |
| 18:51.52 | coreyfarrell | I just thought to try audit2allow when you suggested configuring avc |
| 18:53.52 | seanbright | well, i kinda want to know if i was right or not, so now i have to try it |
| 18:54.34 | coreyfarrell | something is trying to read /proc/sys/net/ipv6/conf/all/disable_ipv6 |
| 18:56.44 | seanbright | it's asterisk |
| 18:57.04 | seanbright | i've narrowed your problem down to asterisk |
| 18:58.01 | coreyfarrell | it seems like it might be a bug in the centos default selinux policy for asterisk. |
| 19:08.11 | seanbright | how does one make systemd be more verbose other than "thing failed" |
| 19:10.28 | coreyfarrell | you more to show more than `systemctl status -l asterisk`? generally systemd would only know about the exit code and stdout/stderr. |
| 19:13.07 | seanbright | yes, all that says is it failed. it doesn't give me anything useful. |
| 19:13.45 | seanbright | does the asterisk user need special permissions? |
| 19:14.02 | coreyfarrell | what code? status=number/label |
| 19:15.13 | seanbright | 1/FAILURE |
| 19:17.17 | seanbright | if i 'sudo -s -u asterisk' and start it directly with "/usr/sbin/asterisk -mqf -C /etc/asterisk/asterisk.conf" it works fine |
| 19:17.21 | seanbright | just not through systemd |
| 19:24.28 | coreyfarrell | sorry I'm working on posting a bug against centos. if you remove 'StandardOutput=null' from the systemd unit you might see something asterisk prints from stderr. I think exit code 1 means that asterisk is failing to start so possibly being denied FS access to something critical. |
| 19:31.12 | coreyfarrell | fyi https://bugzilla.redhat.com/show_bug.cgi?id=1810727 |
| 19:34.17 | seanbright | i changed the perms of /var/lib/asterisk and /var/run/asterisk but it's complaining that it can't open /var/lib/asterisk/astdb.sqlite3 |
| 19:35.32 | seanbright | yeah, it's getting blocked by selinux i guess |
| 19:36.54 | seanbright | coreyfarrell: where is the "centos default selinux policy for asterisk?" |
| 19:38.10 | coreyfarrell | it's part of selinux-policy-targeted but you'll want to `yum install policycoreutils-python` then run `audit2allow -a` |
| 19:38.35 | coreyfarrell | BTW I'm working on cleaning up my asterisk.spec so I can share with you. |
| 19:40.41 | seanbright | this is a disaster |
| 19:40.45 | seanbright | why would you do this to yourself? |
| 19:40.58 | seanbright | i give up |
| 19:40.59 | seanbright | heh |
| 19:41.12 | gtjoseph | why don't you guys just tell jsmith to fix it?? :) |
| 19:41.25 | seanbright | so am i good to close the issue with wont fix? |
| 19:41.32 | seanbright | doesn't appear to be asterisk related, unless i don't understand |
| 19:43.36 | seanbright | coreyfarrell: you ok with me closing this or do you think a change in asterisk is necessary? |
| 19:43.47 | coreyfarrell | i'm about to close it |
| 19:43.52 | seanbright | ok cool |
| 20:19.25 | file | I take my dog for a walk and come back to a closed issue |
| 20:19.28 | file | I wish every day was like this |
| 20:38.50 | seanbright | work occasionally gets done when you aren't here |
| 20:50.18 | seanbright | anyone know of any sites (other than google.com) that have A and AAAA records? |
| 20:51.31 | file | cloudflare... |
| 20:51.32 | file | cnn |
| 20:51.38 | file | youtube |
| 20:51.46 | file | downloads.asterisk.org |
| 20:51.55 | seanbright | so getaddrinfo consistently returns IPv4 addresses and then IPv6 addresses |
| 20:51.59 | file | oh not downloads |
| 20:52.01 | file | sad |
| 20:52.07 | seanbright | i have no idea if that is specified or if that is just luck |
| 20:52.19 | file | in PJSIP land we prefer IPv6 first |
| 20:52.50 | file | I'd personally like to nudge stuff that way |
| 20:55.10 | coreyfarrell | he.com, luadns.com (I'd guess almost all DNS hosts that are maintained have a + aaaa) |
| 20:55.37 | coreyfarrell | or should be anyways |
| 20:55.42 | file | is now booked to go to an IETF Hackathon |
| 20:55.45 | file | will it still occur? |
| 20:55.47 | file | WHO THE HECK KNOWS |
| 20:56.05 | file | will Josh end up with a huge travel credit due to it being cancelled? stay tuned! |
| 23:30.25 | *** join/#asterisk-dev spatel (~spatel@pool-96-237-230-175.bstnma.fios.verizon.net) |