The channel redirect function (CLI or AMI) hangs up the call instead of redirecting the call.

To recreate the problem:
1) Party A calls Party B
2) Invoke CLI "channel redirect" command to redirect channel call leg
associated with A.
3) All associated channels are hung up.

Note that if the CLI command were done on the channel call leg associated
with B it works.

This regression was a result of the fix for issue #16946
(https://reviewboard.asterisk.org/r/740/).

The regression affects all features that use an async goto to execute the
dialplan because of an external event: Channel redirect, AMI redirect, SIP
REFER, and FAX detection.

The struct ast_channel._softhangup code is a mess.  The variable is used
for several purposes that do not necessarily result in the call being hung
up.  I have added doxygen comments to describe how the various _softhangup
bits are used.  I have corrected all the places where the variable was
tested in a non-bit oriented manner.

The primary fix is the new AST_CONTROL_END_OF_Q frame.  It acts as a weak
hangup request so the soft hangup requests that do not normally result in
a hangup do not hangup.

JIRA SWP-2470
JIRA SWP-2489

(closes issue #18171)
Reported by: SantaFox
(closes issue #18185)
Reported by: kwemheuer
(closes issue #18211)
Reported by: zahir_koradia
(closes issue #18230)
Reported by: vmarrone
(closes issue #18299)
Reported by: mbrevda
(closes issue #18322)
Reported by: nerbos

Review:	https://reviewboard.asterisk.org/r/1013/


git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@295790 f38db490-d61c-443f-a65b-d21fe96a405b

5 files changed, 132 insertions, 55 deletions

diff --git a/apps/app_macro.c b/apps/app_macro.c
index 5586f24e5..c591135e9 100644
--- a/apps/app_macro.c
+++ b/apps/app_macro.c
@@ -501,20 +501,20 @@ static int _macro_exec(struct ast_channel *chan, void *data, int exclusive)
 	}
 
 	if (!strcasecmp(chan->context, fullmacro)) {
+		const char *offsets;
+
   		/* If we're leaving the macro normally, restore original information */
 		chan->priority = oldpriority;
 		ast_copy_string(chan->context, oldcontext, sizeof(chan->context));
-		if (!(chan->_softhangup & AST_SOFTHANGUP_ASYNCGOTO)) {
-			/* Copy the extension, so long as we're not in softhangup, where we could be given an asyncgoto */
-			const char *offsets;
-			ast_copy_string(chan->exten, oldexten, sizeof(chan->exten));
-			if ((offsets = pbx_builtin_getvar_helper(chan, "MACRO_OFFSET"))) {
-				/* Handle macro offset if it's set by checking the availability of step n + offset + 1, otherwise continue
-			   	normally if there is any problem */
-				if (sscanf(offsets, "%30d", &offset) == 1) {
-					if (ast_exists_extension(chan, chan->context, chan->exten, chan->priority + offset + 1, chan->cid.cid_num)) {
-						chan->priority += offset;
-					}
+		ast_copy_string(chan->exten, oldexten, sizeof(chan->exten));
+		if ((offsets = pbx_builtin_getvar_helper(chan, "MACRO_OFFSET"))) {
+			/* Handle macro offset if it's set by checking the availability of step n + offset + 1, otherwise continue
+			normally if there is any problem */
+			if (sscanf(offsets, "%30d", &offset) == 1) {
+				if (ast_exists_extension(chan, chan->context, chan->exten,
+					chan->priority + offset + 1,
+					chan->cid.cid_num)) {
+					chan->priority += offset;
 				}
 			}
 		}
diff --git a/include/asterisk/channel.h b/include/asterisk/channel.h
index fb0046782..848682576 100644
--- a/include/asterisk/channel.h
+++ b/include/asterisk/channel.h
@@ -608,14 +608,42 @@ enum {
 };
 
 enum {
-	/*! Soft hangup by device */
+	/*!
+	 * Soft hangup requested by device or other internal reason.
+	 * Actual hangup needed.
+	 */
 	AST_SOFTHANGUP_DEV =       (1 << 0),
-	/*! Soft hangup for async goto */
+	/*!
+	 * Used to break the normal frame flow so an async goto can be
+	 * done instead of actually hanging up.
+	 */
 	AST_SOFTHANGUP_ASYNCGOTO = (1 << 1),
+	/*!
+	 * Soft hangup requested by system shutdown.  Actual hangup
+	 * needed.
+	 */
 	AST_SOFTHANGUP_SHUTDOWN =  (1 << 2),
+	/*!
+	 * Used to break the normal frame flow after a timeout so an
+	 * implicit async goto can be done to the 'T' exten if it exists
+	 * instead of actually hanging up.  If the exten does not exist
+	 * then actually hangup.
+	 */
 	AST_SOFTHANGUP_TIMEOUT =   (1 << 3),
+	/*!
+	 * Soft hangup requested by application/channel-driver being
+	 * unloaded.  Actual hangup needed.
+	 */
 	AST_SOFTHANGUP_APPUNLOAD = (1 << 4),
+	/*!
+	 * Soft hangup requested by non-associated party.  Actual hangup
+	 * needed.
+	 */
 	AST_SOFTHANGUP_EXPLICIT =  (1 << 5),
+	/*!
+	 * Used to break a bridge so the channel can be spied upon
+	 * instead of actually hanging up.
+	 */
 	AST_SOFTHANGUP_UNBRIDGE =  (1 << 6),
 };
 
diff --git a/include/asterisk/frame.h b/include/asterisk/frame.h
index 6fc933a74..645e4071d 100644
--- a/include/asterisk/frame.h
+++ b/include/asterisk/frame.h
@@ -292,6 +292,7 @@ enum ast_control_frame_type {
 	AST_CONTROL_VIDUPDATE = 18,	/*!< Indicate video frame update */
 	AST_CONTROL_SRCUPDATE = 20,     /*!< Indicate source of media has changed */
 	AST_CONTROL_SRCCHANGE = 21,     /*!< Media has changed and requires a new RTP SSRC */
+	AST_CONTROL_END_OF_Q = 22,		/*!< Indicate that this position was the end of the channel queue for a softhangup. */
 };
 
 #define AST_SMOOTHER_FLAG_G729		(1 << 0)
diff --git a/main/channel.c b/main/channel.c
index 0db9dbff2..43443287a 100644
--- a/main/channel.c
+++ b/main/channel.c
@@ -919,15 +919,42 @@ static int __ast_queue_frame(struct ast_channel *chan, struct ast_frame *fin, in
 
 	ast_channel_lock(chan);
 
-	/* See if the last frame on the queue is a hangup, if so don't queue anything */
-	if ((cur = AST_LIST_LAST(&chan->readq)) &&
-	    (cur->frametype == AST_FRAME_CONTROL) &&
-	    (cur->subclass == AST_CONTROL_HANGUP)) {
-		ast_channel_unlock(chan);
-		return 0;
+	/*
+	 * Check the last frame on the queue if we are queuing the new
+	 * frames after it.
+	 */
+	cur = AST_LIST_LAST(&chan->readq);
+	if (cur && cur->frametype == AST_FRAME_CONTROL && !head && (!after || after == cur)) {
+		switch (cur->subclass) {
+		case AST_CONTROL_END_OF_Q:
+			if (fin->frametype == AST_FRAME_CONTROL
+				&& fin->subclass == AST_CONTROL_HANGUP) {
+				/*
+				 * Destroy the end-of-Q marker frame so we can queue the hangup
+				 * frame in its place.
+				 */
+				AST_LIST_REMOVE(&chan->readq, cur, frame_list);
+				ast_frfree(cur);
+
+				/*
+				 * This has degenerated to a normal queue append anyway.  Since
+				 * we just destroyed the last frame in the queue we must make
+				 * sure that "after" is NULL or bad things will happen.
+				 */
+				after = NULL;
+				break;
+			}
+			/* Fall through */
+		case AST_CONTROL_HANGUP:
+			/* Don't queue anything. */
+			ast_channel_unlock(chan);
+			return 0;
+		default:
+			break;
+		}
 	}
 
-	/* Build copies of all the frames and count them */
+	/* Build copies of all the new frames and count them */
 	AST_LIST_HEAD_INIT_NOLOCK(&frames);
 	for (cur = fin; cur; cur = AST_LIST_NEXT(cur, frame_list)) {
 		if (!(f = ast_frdup(cur))) {
@@ -2187,14 +2214,17 @@ static struct ast_frame *__ast_read(struct ast_channel *chan, int dropaudio)
 		if (chan->generator)
 			ast_deactivate_generator(chan);
 
-		/* It is possible for chan->_softhangup to be set, yet there still be control
-		 * frames that still need to be read. Instead of just going to 'done' in the
-		 * case of ast_check_hangup(), we instead need to send the HANGUP frame so that
-		 * it can mark the end of the read queue. If there are frames to be read, 
-		 * ast_queue_control will be called repeatedly, but will only queue one hangup
-		 * frame. */
-		if (ast_check_hangup(chan)) {
-			ast_queue_control(chan, AST_CONTROL_HANGUP);
+		/*
+		 * It is possible for chan->_softhangup to be set and there
+		 * still be control frames that need to be read.  Instead of
+		 * just going to 'done' in the case of ast_check_hangup(), we
+		 * need to queue the end-of-Q frame so that it can mark the end
+		 * of the read queue.  If there are frames to be read,
+		 * ast_queue_control() will be called repeatedly, but will only
+		 * queue the first end-of-Q frame.
+		 */
+		if (chan->_softhangup) {
+			ast_queue_control(chan, AST_CONTROL_END_OF_Q);
 		} else {
 			goto done;
 		}
@@ -2320,11 +2350,20 @@ static struct ast_frame *__ast_read(struct ast_channel *chan, int dropaudio)
 			}
 		}
 
-		/* Interpret hangup and return NULL */
+		/* Interpret hangup and end-of-Q frames to return NULL */
 		/* XXX why not the same for frames from the channel ? */
-		if (f->frametype == AST_FRAME_CONTROL && f->subclass == AST_CONTROL_HANGUP) {
-			ast_frfree(f);
-			f = NULL;
+		if (f->frametype == AST_FRAME_CONTROL) {
+			switch (f->subclass) {
+			case AST_CONTROL_HANGUP:
+				chan->_softhangup |= AST_SOFTHANGUP_DEV;
+				/* Fall through */
+			case AST_CONTROL_END_OF_Q:
+				ast_frfree(f);
+				f = NULL;
+				break;
+			default:
+				break;
+			}
 		}
 	} else {
 		chan->blocker = pthread_self();
@@ -2617,7 +2656,9 @@ static struct ast_frame *__ast_read(struct ast_channel *chan, int dropaudio)
 		}
 	} else {
 		/* Make sure we always return NULL in the future */
-		chan->_softhangup |= AST_SOFTHANGUP_DEV;
+		if (!chan->_softhangup) {
+			chan->_softhangup |= AST_SOFTHANGUP_DEV;
+		}
 		if (chan->generator)
 			ast_deactivate_generator(chan);
 		/* We no longer End the CDR here */
@@ -2678,6 +2719,7 @@ static int attribute_const is_visible_indication(enum ast_control_frame_type con
 	case AST_CONTROL_TAKEOFFHOOK:
 	case AST_CONTROL_ANSWER:
 	case AST_CONTROL_HANGUP:
+	case AST_CONTROL_END_OF_Q:
 		return 0;
 
 	case AST_CONTROL_CONGESTION:
@@ -2774,6 +2816,7 @@ int ast_indicate_data(struct ast_channel *chan, int _condition,
 	case AST_CONTROL_RING:
 	case AST_CONTROL_HOLD:
 	case AST_CONTROL_UNHOLD:
+	case AST_CONTROL_END_OF_Q:
 		/* Nothing left to do for these. */
 		res = 0;
 		break;
@@ -4541,11 +4584,13 @@ static enum ast_bridge_result ast_generic_bridge(struct ast_channel *c0, struct
 			/* No frame received within the specified timeout - check if we have to deliver now */
 			if (jb_in_use)
 				ast_jb_get_and_deliver(c0, c1);
-			if (c0->_softhangup == AST_SOFTHANGUP_UNBRIDGE || c1->_softhangup == AST_SOFTHANGUP_UNBRIDGE) {
-				if (c0->_softhangup == AST_SOFTHANGUP_UNBRIDGE)
-					c0->_softhangup = 0;
-				if (c1->_softhangup == AST_SOFTHANGUP_UNBRIDGE)
-					c1->_softhangup = 0;
+			if ((c0->_softhangup | c1->_softhangup) & AST_SOFTHANGUP_UNBRIDGE) {/* Bit operators are intentional. */
+				if (c0->_softhangup & AST_SOFTHANGUP_UNBRIDGE) {
+					c0->_softhangup &= ~AST_SOFTHANGUP_UNBRIDGE;
+				}
+				if (c1->_softhangup & AST_SOFTHANGUP_UNBRIDGE) {
+					c1->_softhangup &= ~AST_SOFTHANGUP_UNBRIDGE;
+				}
 				c0->_bridge = c1;
 				c1->_bridge = c0;
 			}
@@ -4785,11 +4830,13 @@ enum ast_bridge_result ast_channel_bridge(struct ast_channel *c0, struct ast_cha
 			ast_clear_flag(config, AST_FEATURE_WARNING_ACTIVE);
 		}
 
-		if (c0->_softhangup == AST_SOFTHANGUP_UNBRIDGE || c1->_softhangup == AST_SOFTHANGUP_UNBRIDGE) {
-			if (c0->_softhangup == AST_SOFTHANGUP_UNBRIDGE)
-				c0->_softhangup = 0;
-			if (c1->_softhangup == AST_SOFTHANGUP_UNBRIDGE)
-				c1->_softhangup = 0;
+		if ((c0->_softhangup | c1->_softhangup) & AST_SOFTHANGUP_UNBRIDGE) {/* Bit operators are intentional. */
+			if (c0->_softhangup & AST_SOFTHANGUP_UNBRIDGE) {
+				c0->_softhangup &= ~AST_SOFTHANGUP_UNBRIDGE;
+			}
+			if (c1->_softhangup & AST_SOFTHANGUP_UNBRIDGE) {
+				c1->_softhangup &= ~AST_SOFTHANGUP_UNBRIDGE;
+			}
 			c0->_bridge = c1;
 			c1->_bridge = c0;
 			if (option_debug)
@@ -4840,8 +4887,9 @@ enum ast_bridge_result ast_channel_bridge(struct ast_channel *c0, struct ast_cha
 				ast_clear_flag(c0, AST_FLAG_NBRIDGE);
 				ast_clear_flag(c1, AST_FLAG_NBRIDGE);
 
-				if (c0->_softhangup == AST_SOFTHANGUP_UNBRIDGE || c1->_softhangup == AST_SOFTHANGUP_UNBRIDGE)
+				if ((c0->_softhangup | c1->_softhangup) & AST_SOFTHANGUP_UNBRIDGE) {/* Bit operators are intentional. */
 					continue;
+				}
 
 				c0->_bridge = NULL;
 				c1->_bridge = NULL;
diff --git a/main/pbx.c b/main/pbx.c
index dab9aa5ce..491c8a932 100644
--- a/main/pbx.c
+++ b/main/pbx.c
@@ -2382,8 +2382,8 @@ static int collect_digits(struct ast_channel *c, int waittime, char *buf, int bu
 		/* As long as we're willing to wait, and as long as it's not defined,
 		   keep reading digits until we can't possibly get a right answer anymore.  */
 		digit = ast_waitfordigit(c, waittime * 1000);
-		if (c->_softhangup == AST_SOFTHANGUP_ASYNCGOTO) {
-			c->_softhangup = 0;
+		if (c->_softhangup & AST_SOFTHANGUP_ASYNCGOTO) {
+			c->_softhangup &= ~AST_SOFTHANGUP_ASYNCGOTO;
 		} else {
 			if (!digit)	/* No entry */
 				break;
@@ -2473,9 +2473,9 @@ static int __ast_pbx_run(struct ast_channel *c)
 					ast_log(LOG_DEBUG, "Spawn extension (%s,%s,%d) exited non-zero on '%s'\n", c->context, c->exten, c->priority, c->name);
 				if (option_verbose > 1)
 					ast_verbose( VERBOSE_PREFIX_2 "Spawn extension (%s, %s, %d) exited non-zero on '%s'\n", c->context, c->exten, c->priority, c->name);
-				if (c->_softhangup == AST_SOFTHANGUP_ASYNCGOTO) {
-					c->_softhangup = 0;
-				} else if (c->_softhangup == AST_SOFTHANGUP_TIMEOUT) {
+				if (c->_softhangup & AST_SOFTHANGUP_ASYNCGOTO) {
+					c->_softhangup &= ~AST_SOFTHANGUP_ASYNCGOTO;
+				} else if (c->_softhangup & AST_SOFTHANGUP_TIMEOUT) {
 					/* atimeout, nothing bad */
 				} else {
 					if (c->cdr)
@@ -2484,9 +2484,9 @@ static int __ast_pbx_run(struct ast_channel *c)
 					break;
 				}
 			}
-			if (c->_softhangup == AST_SOFTHANGUP_ASYNCGOTO) {
-				c->_softhangup = 0;
-			} else if (c->_softhangup == AST_SOFTHANGUP_TIMEOUT && ast_exists_extension(c,c->context,"T",1,c->cid.cid_num)) {
+			if (c->_softhangup & AST_SOFTHANGUP_ASYNCGOTO) {
+				c->_softhangup &= ~AST_SOFTHANGUP_ASYNCGOTO;
+			} else if (c->_softhangup & AST_SOFTHANGUP_TIMEOUT && ast_exists_extension(c,c->context,"T",1,c->cid.cid_num)) {
 				set_ext_pri(c, "T", 0); /* 0 will become 1 with the c->priority++; at the end */
 				/* If the AbsoluteTimeout is not reset to 0, we'll get an infinite loop */
 				c->whentohangup = 0;
@@ -2520,9 +2520,9 @@ static int __ast_pbx_run(struct ast_channel *c)
 				error = 1; /* we know what to do with it */
 				break;
 			}
-		} else if (c->_softhangup == AST_SOFTHANGUP_TIMEOUT) {
+		} else if (c->_softhangup & AST_SOFTHANGUP_TIMEOUT) {
 			/* If we get this far with AST_SOFTHANGUP_TIMEOUT, then we know that the "T" extension is next. */
-			c->_softhangup = 0;
+			c->_softhangup &= ~AST_SOFTHANGUP_TIMEOUT;
 		} else {	/* keypress received, get more digits for a full extension */
 			int waittime = 0;
 			if (digit)
@@ -5744,7 +5744,7 @@ static int pbx_builtin_waitexten(struct ast_channel *chan, void *data)
 		if (ast_exists_extension(chan, chan->context, chan->exten, chan->priority + 1, chan->cid.cid_num)) {
 			if (option_verbose > 2)
 				ast_verbose(VERBOSE_PREFIX_3 "Timeout on %s, continuing...\n", chan->name);
-		} else if (chan->_softhangup == AST_SOFTHANGUP_TIMEOUT) {
+		} else if (chan->_softhangup & AST_SOFTHANGUP_TIMEOUT) {
 			if (option_verbose > 2)
 				ast_verbose(VERBOSE_PREFIX_3 "Call timeout on %s, checking for 'T'\n", chan->name);
 			res = -1;