Asterisk
/
asterisk
mirror of https://github.com/asterisk/asterisk
1
0
Fork 0
Code Issues Releases Wiki Activity

Default to nat=yes; warn when nat in general and peer differ

Browse Source 
It is possible to enumerate SIP usernames when the general and user/peer
nat settings differ in whether to respond to the port a request is sent
from or the port listed for responses in the Via header. In 1.4 and 1.6.2,
this would mean if one setting was nat=yes or nat=route and the other was
either nat=no or nat=never. In 1.8 and 10, this would mean when one was
nat=force_rport and the other was nat=no.

In order to address this problem, it was decided to switch the default
behavior to nat=yes/force_rport as it is the most commonly used option
and to strongly discourage setting nat per-peer/user when at all possible.

For more discussion of the issue, please see:
  http://lists.digium.com/pipermail/asterisk-dev/2011-November/052191.html

(closes issue ASTERISK-18862)
Review: https://reviewboard.asterisk.org/r/1591/
........

Merged revisions 345776 from http://svn.asterisk.org/svn/asterisk/branches/1.4
........

Merged revisions 345800 from http://svn.asterisk.org/svn/asterisk/branches/1.6.2
........

Merged revisions 345828 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 345830 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@345831 65c4cc65-6c06-0410-ace0-fbb531ad65f3
certified/11.2
Terry Wilson 14 years ago
parent 298d015828
commit 32d0faac9c
3 changed files with 31 additions and 12 deletions
Show Stats Download Patch File Download Diff File

5
CHANGES
Unescape View File

@ -323,6 +323,11 @@ PBX Core
SIP Changes
-----------
* Due to potential username discovery vulnerabilities, the 'nat' setting in sip.conf
now defaults to force_rport. It is very important that phones requiring nat=no be
specifically set as such instead of relying on the default setting. If at all
possible, all devices should have nat settings configured in the general section as
opposed to configuring nat per-device.
* Added preferred_codec_only option in sip.conf. This feature limits the joint
codecs sent in response to an INVITE to the single most preferred codec.
* Added SIP_CODEC_OUTBOUND dialplan variable which can be used to set the codec

23
channels/chan_sip.c
Unescape View File

@ -27222,12 +27222,11 @@ static int handle_common_options(struct ast_flags *flags, struct ast_flags *mask
}
} else if (!strcasecmp(v->name, "nat")) {
ast_set_flag(&mask[0], SIP_NAT_FORCE_RPORT);
ast_set_flag(&flags[0], SIP_NAT_FORCE_RPORT); /* Default to "force_rport" */
if (!strcasecmp(v->value, "no")) {
ast_clear_flag(&flags[0], SIP_NAT_FORCE_RPORT);
} else if (!strcasecmp(v->value, "force_rport")) {
ast_set_flag(&flags[0], SIP_NAT_FORCE_RPORT);
} else if (!strcasecmp(v->value, "yes")) {
ast_set_flag(&flags[0], SIP_NAT_FORCE_RPORT);
/* We've already defaulted to force_rport */
ast_set_flag(&mask[1], SIP_PAGE2_SYMMETRICRTP);
ast_set_flag(&flags[1], SIP_PAGE2_SYMMETRICRTP);
} else if (!strcasecmp(v->value, "comedia")) {
@ -28381,6 +28380,18 @@ static void sip_set_default_format_capabilities(struct ast_format_cap *cap)
ast_format_cap_add(cap, ast_format_set(&tmp_fmt, AST_FORMAT_H263, 0));
}
static void display_nat_warning(const char *cat, int reason, struct ast_flags *flags) {
int global_nat, specific_nat;
if (reason == CHANNEL_MODULE_LOAD && (specific_nat = ast_test_flag(&flags[0], SIP_NAT_FORCE_RPORT)) != (global_nat = ast_test_flag(&global_flags[0], SIP_NAT_FORCE_RPORT))) {
ast_log(LOG_WARNING, "!!! PLEASE NOTE: Setting 'nat' for a peer/user that differs from the global setting can make\n");
ast_log(LOG_WARNING, "!!! the name of that peer/user discoverable by an attacker. Replies for non-existent peers/users\n");
ast_log(LOG_WARNING, "!!! will be sent to a different port than replies for an existing peer/user. If at all possible,\n");
ast_log(LOG_WARNING, "!!! use the global 'nat' setting and do not set 'nat' per peer/user.\n");
ast_log(LOG_WARNING, "!!! (config category='%s' global force_rport='%s' peer/user force_rport='%s')\n", cat, AST_CLI_YESNO(global_nat), AST_CLI_YESNO(specific_nat));
}
}
/*! \brief Re-read SIP.conf config file
\note This function reloads all config data, except for
active peers (with registrations). They will only
@ -28608,8 +28619,9 @@ static int reload_config(enum channelreloadreason reason)
ast_copy_string(default_mohinterpret, DEFAULT_MOHINTERPRET, sizeof(default_mohinterpret));
ast_copy_string(default_mohsuggest, DEFAULT_MOHSUGGEST, sizeof(default_mohsuggest));
ast_copy_string(default_vmexten, DEFAULT_VMEXTEN, sizeof(default_vmexten));
ast_set_flag(&global_flags[0], SIP_DTMF_RFC2833); /*!< Default DTMF setting: RFC2833 */
ast_set_flag(&global_flags[0], SIP_DIRECT_MEDIA); /*!< Allow re-invites */
ast_set_flag(&global_flags[0], SIP_DTMF_RFC2833); /*!< Default DTMF setting: RFC2833 */
ast_set_flag(&global_flags[0], SIP_DIRECT_MEDIA); /*!< Allow re-invites */
ast_set_flag(&global_flags[0], SIP_NAT_FORCE_RPORT); /*!< Default to nat=force_rport */
ast_copy_string(default_engine, DEFAULT_ENGINE, sizeof(default_engine));
ast_copy_string(default_parkinglot, DEFAULT_PARKINGLOT, sizeof(default_parkinglot));
@ -29394,6 +29406,7 @@ static int reload_config(enum channelreloadreason reason)
}
peer = build_peer(cat, ast_variable_browse(cfg, cat), NULL, 0, 0);
if (peer) {
display_nat_warning(cat, reason, &peer->flags[0]);
ao2_t_link(peers, peer, "link peer into peers table");
if ((peer->type & SIP_TYPE_PEER) && !ast_sockaddr_isnull(&peer->addr)) {
ao2_t_link(peers_by_ip, peer, "link peer into peers_by_ip table");

15
configs/sip.conf.sample
Unescape View File

@ -824,6 +824,14 @@ srvlookup=yes ; Enable DNS SRV lookups on outbound calls
; for their media streams is not actual port number that will be used on the nearer
; side of the NAT.
;
; IT IS IMPORTANT TO NOTE that if the nat setting in the general section differs from
; the nat setting in a peer definition, then the peer username will be discoverable
; by outside parties as Asterisk will respond to different ports for defined and
; undefined peers. For this reason it is recommended to ONLY DEFINE NAT SETTINGS IN THE
; GENERAL SECTION. Specifically, if nat=force_rport in one section and nat=no in the
; other, then valid users with settings differing from those in the general section will
; be discoverable.
;
; In addition to these settings, Asterisk *always* uses 'symmetric RTP' mode as defined by
; RFC 4961; Asterisk will always send RTP packets from the same port number it expects
; to receive them on.
@ -1212,12 +1220,10 @@ srvlookup=yes ; Enable DNS SRV lookups on outbound calls
type=friend
[natted-phone](!,basic-options) ; another template inheriting basic-options
nat=yes
directmedia=no
host=dynamic
[public-phone](!,basic-options) ; another template inheriting basic-options
nat=no
directmedia=yes
[my-codecs](!) ; a template for my preferred codecs
@ -1257,7 +1263,6 @@ srvlookup=yes ; Enable DNS SRV lookups on outbound calls
;description=Courtesy Phone ; Description of the peer. Shown when doing 'sip show peers'.
;host=192.168.0.23 ; we have a static but private IP address
; No registration allowed
;nat=no ; there is not NAT between phone and Asterisk
;directmedia=yes ; allow RTP voice traffic to bypass Asterisk
;dtmfmode=info ; either RFC2833 or INFO for the BudgeTone
;call-limit=1 ; permit only 1 outgoing call and 1 incoming call at a time
@ -1287,7 +1292,6 @@ srvlookup=yes ; Enable DNS SRV lookups on outbound calls
;regexten=1234 ; When they register, create extension 1234
;callerid="Jane Smith" <5678>
;host=dynamic ; This device needs to register
;nat=yes ; X-Lite is behind a NAT router
;directmedia=no ; Typically set to NO if behind NAT
;disallow=all
;allow=gsm ; GSM consumes far less bandwidth than ulaw
@ -1361,9 +1365,6 @@ srvlookup=yes ; Enable DNS SRV lookups on outbound calls
;type=friend
;secret=blah
;qualify=200 ; Qualify peer is no more than 200ms away
;nat=yes ; This phone may be natted
; Send SIP and RTP to the IP address that packet is
; received from instead of trusting SIP headers
;host=dynamic ; This device registers with us
;directmedia=no ; Asterisk by default tries to redirect the
; RTP media stream (audio) to go directly from

Write Preview
Loading…
Cancel
Save