diff options
| author | jpeeler <jpeeler@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-10-26 19:42:39 +0000 |
|---|---|---|
| committer | jpeeler <jpeeler@f38db490-d61c-443f-a65b-d21fe96a405b> | 2009-10-26 19:42:39 +0000 |
| commit | 2ae6aaa896df0a259239b85246b9de44b0c971a0 (patch) | |
| tree | 6111be252e87d01b2da2d31d6a0fda27f05e7599 | |
| parent | f0bdab685429143bd06997a87ba5d83e17aa62c4 (diff) | |
ACL check not present for verifying SIP INVITEs
The ACL check in check_peer_ok was missing and has now been restored. The
missing check allowed for calls to be made on prohibited networks where an ACL
was defined in sip.conf and the allowguest option was set to off. See the AST
security advisory below for more information.
Merge code associated with AST-2009-007.
(closes issue #16091)
Reported by: thom4fun
git-svn-id: http://svn.digium.com/svn/asterisk/tags/1.6.1.8@225915 f38db490-d61c-443f-a65b-d21fe96a405b
| -rw-r--r-- | channels/chan_sip.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 2fa124ff2..4bce649f7 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -12570,7 +12570,11 @@ static enum check_auth_result check_peer_ok(struct sip_pvt *p, char *of, of, ast_inet_ntoa(p->recv.sin_addr), ntohs(p->recv.sin_port)); return AUTH_DONT_KNOW; } - + if (!ast_apply_ha(peer->ha, sin)) { + ast_debug(2, "Found peer '%s' for '%s', but fails host access\n", peer->name, of); + unref_peer(peer, "unref_peer: check_peer_ok: from find_peer call, early return of AUTH_ACL_FAILED"); + return AUTH_ACL_FAILED; + } if (debug) ast_verbose("Found peer '%s' for '%s' from %s:%d\n", peer->name, of, ast_inet_ntoa(p->recv.sin_addr), ntohs(p->recv.sin_port)); |