diff options
author | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-07-22 21:14:10 +0000 |
---|---|---|
committer | tilghman <tilghman@f38db490-d61c-443f-a65b-d21fe96a405b> | 2008-07-22 21:14:10 +0000 |
commit | 7e1729e3ca6c91eb416ea423fb0e4047604c1472 (patch) | |
tree | 009ec02baa237505801f0feead3ddb57e6d4ee18 | |
parent | ef4d7c392240c48c586898649e2ca1134bc227ad (diff) |
Fixes for AST-2008-010 and AST-2008-011
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.2@132711 f38db490-d61c-443f-a65b-d21fe96a405b
-rw-r--r-- | channels/chan_iax2.c | 29 | ||||
-rw-r--r-- | configs/iax.conf.sample | 10 |
2 files changed, 38 insertions, 1 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index 09a51a51c..eb902147f 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -272,6 +272,7 @@ enum { IAX_DELAYPBXSTART = (1 << 25), /*!< Don't start a PBX on the channel until the peer sends us a response, so that we've achieved a three-way handshake with them before sending voice or anything else*/ + IAX_ALLOWFWDOWNLOAD = (1 << 26), /*!< Allow the FWDOWNL command? */ } iax2_flags; static int global_rtautoclear = 120; @@ -1282,7 +1283,7 @@ static int find_callno(unsigned short callno, unsigned short dcallno, struct soc } /* Look for an existing connection first */ - for (x=1;(res < 1) && (x<maxnontrunkcall);x++) { + for (x=2;(res < 1) && (x<maxnontrunkcall);x++) { ast_mutex_lock(&iaxsl[x]); if (iaxs[x]) { /* Look for an exact match */ @@ -3098,6 +3099,15 @@ struct parsed_dial_string { char *options; }; +static int send_apathetic_reply(unsigned short callno, unsigned short dcallno, struct sockaddr_in *sin, int command, int ts, unsigned char seqno) +{ + struct ast_iax2_full_hdr f = { .scallno = htons(0x8000 | callno), .dcallno = htons(dcallno), + .ts = htonl(ts), .iseqno = seqno, .oseqno = seqno, .type = AST_FRAME_IAX, + .csub = compress_subclass(command) }; + + return sendto(defaultsockfd, &f, sizeof(f), 0, (struct sockaddr *)sin, sizeof(*sin)); +} + /*! * \brief Parses an IAX dial string into its component parts. * \param data the string to be parsed @@ -6828,6 +6838,17 @@ static int socket_read(int *id, int fd, short events, void *cbdata) } else { f.subclass = uncompress_subclass(fh->csub); } + + /* Deal with POKE/PONG without allocating a callno */ + if (f.frametype == AST_FRAME_IAX && f.subclass == IAX_COMMAND_POKE) { + /* Reply back with a PONG, but don't care about the result. */ + send_apathetic_reply(1, ntohs(fh->scallno), &sin, IAX_COMMAND_PONG, ntohs(fh->ts), fh->oseqno); + return 1; + } else if (f.frametype == AST_FRAME_IAX && f.subclass == IAX_COMMAND_ACK && dcallno == 1) { + /* Ignore */ + return 1; + } + if ((f.frametype == AST_FRAME_IAX) && ((f.subclass == IAX_COMMAND_NEW) || (f.subclass == IAX_COMMAND_REGREQ) || (f.subclass == IAX_COMMAND_POKE) || (f.subclass == IAX_COMMAND_FWDOWNL) || (f.subclass == IAX_COMMAND_REGREL))) @@ -7921,6 +7942,10 @@ retryowner2: break; case IAX_COMMAND_FWDOWNL: /* Firmware download */ + if (!ast_test_flag(&globalflags, IAX_ALLOWFWDOWNLOAD)) { + send_command_final(iaxs[fr->callno], AST_FRAME_IAX, IAX_COMMAND_UNSUPPORT, 0, NULL, 0, -1); + break; + } memset(&ied0, 0, sizeof(ied0)); res = iax_firmware_append(&ied0, (unsigned char *)ies.devicetype, ies.fwdesc); if (res < 0) @@ -9188,6 +9213,8 @@ static int set_config(char *config_file, int reload) delayreject = ast_true(v->value); else if (!strcasecmp(v->name, "mailboxdetail")) ast_set2_flag((&globalflags), ast_true(v->value), IAX_MESSAGEDETAIL); + else if (!strcasecmp(v->name, "allowfwdownload")) + ast_set2_flag((&globalflags), ast_true(v->value), IAX_ALLOWFWDOWNLOAD); else if (!strcasecmp(v->name, "rtcachefriends")) ast_set2_flag((&globalflags), ast_true(v->value), IAX_RTCACHEFRIENDS); else if (!strcasecmp(v->name, "rtignoreregexpire")) diff --git a/configs/iax.conf.sample b/configs/iax.conf.sample index 85f1bf06e..bcbb58c50 100644 --- a/configs/iax.conf.sample +++ b/configs/iax.conf.sample @@ -255,6 +255,16 @@ autokill=yes ; The default value is 'host' ; ;codecpriority=host +; +; allowfwdownload controls whether this host will serve out firmware to +; IAX clients which request it. This has only been used for the IAXy, +; and it has been recently proven that this firmware distribution method +; can be used as a source of traffic amplification attacks. Also, the +; IAXy firmware has not been updated for at least 18 months, so unless +; you are provisioning IAXys in a secure network, we recommend that you +; leave this option to the default, off. +; +;allowfwdownload=yes ;rtcachefriends=yes ; Cache realtime friends by adding them to the internal list ; just like friends added from the config file only on a |