net/asterisk-13.x/patches/110-AST-2018-008-13.diff

   1 From 4eeb16d1a316aa3d6f5710a2f6beffb0fecb6121 Mon Sep 17 00:00:00 2001
   2 From: Richard Mudgett <rmudgett@digium.com>
   3 Date: Mon, 30 Apr 2018 17:38:58 -0500
   4 Subject: [PATCH] AST-2018-008: Fix enumeration of endpoints from ACL rejected addresses.
   5
   6 When endpoint specific ACL rules block a SIP request they respond with a
   7 403 forbidden.  However, if an endpoint is not identified then a 401
   8 unauthorized response is sent.  This vulnerability just discloses which
   9 requests hit a defined endpoint.  The ACL rules cannot be bypassed to gain
  10 access to the disclosed endpoints.
  11
  12 * Made endpoint specific ACL rules now respond with a 401 unauthorized
  13 which is the same as if an endpoint were not identified.  The fix is
  14 accomplished by replacing the found endpoint with the artificial endpoint
  15 which always fails authentication.
  16
  17 ASTERISK-27818
  18
  19 Change-Id: Icb275a54ff8e2df6c671a6d9bda37b5d732b3b32
  20 ---
  21
  22 diff --git a/res/res_pjsip/pjsip_distributor.c b/res/res_pjsip/pjsip_distributor.c
  23 index e056b60..19266df 100644
  24 --- a/res/res_pjsip/pjsip_distributor.c
  25 +++ b/res/res_pjsip/pjsip_distributor.c
  26 @@ -666,6 +666,26 @@
  27         ao2_unlock(unid);
  28  }
  29
  30 +static int apply_endpoint_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint);
  31 +static int apply_endpoint_contact_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint);
  32 +
  33 +static void apply_acls(pjsip_rx_data *rdata)
  34 +{
  35 +       struct ast_sip_endpoint *endpoint;
  36 +
  37 +       /* Is the endpoint allowed with the source or contact address? */
  38 +       endpoint = rdata->endpt_info.mod_data[endpoint_mod.id];
  39 +       if (endpoint != artificial_endpoint
  40 +               && (apply_endpoint_acl(rdata, endpoint)
  41 +                       || apply_endpoint_contact_acl(rdata, endpoint))) {
  42 +               ast_debug(1, "Endpoint '%s' not allowed by ACL\n",
  43 +                       ast_sorcery_object_get_id(endpoint));
  44 +
  45 +               /* Replace the rdata endpoint with the artificial endpoint. */
  46 +               ao2_replace(rdata->endpt_info.mod_data[endpoint_mod.id], artificial_endpoint);
  47 +       }
  48 +}
  49 +
  50  static pj_bool_t endpoint_lookup(pjsip_rx_data *rdata)
  51  {
  52         struct ast_sip_endpoint *endpoint;
  53 @@ -684,6 +704,7 @@
  54                         ao2_unlink(unidentified_requests, unid);
  55                         ao2_ref(unid, -1);
  56                 }
  57 +               apply_acls(rdata);
  58                 return PJ_FALSE;
  59         }
  60
  61 @@ -743,6 +764,8 @@
  62                         ast_sip_report_invalid_endpoint(name, rdata);
  63                 }
  64         }
  65 +
  66 +       apply_acls(rdata);
  67         return PJ_FALSE;
  68  }
  69
  70 @@ -826,16 +849,11 @@
  71
  72         ast_assert(endpoint != NULL);
  73
  74 -       if (endpoint!=artificial_endpoint) {
  75 -               if (apply_endpoint_acl(rdata, endpoint) || apply_endpoint_contact_acl(rdata, endpoint)) {
  76 -                       if (!is_ack) {
  77 -                               pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 403, NULL, NULL, NULL);
  78 -                       }
  79 -                       return PJ_TRUE;
  80 -               }
  81 +       if (is_ack) {
  82 +               return PJ_FALSE;
  83         }
  84
  85 -       if (!is_ack && ast_sip_requires_authentication(endpoint, rdata)) {
  86 +       if (ast_sip_requires_authentication(endpoint, rdata)) {
  87                 pjsip_tx_data *tdata;
  88                 struct unidentified_request *unid;
  89
  90 @@ -871,6 +889,10 @@
  91                         return PJ_TRUE;
  92                 }
  93                 pjsip_tx_data_dec_ref(tdata);
  94 +       } else if (endpoint == artificial_endpoint) {
  95 +               /* Uh. Oh.  The artificial endpoint couldn't challenge so block the request. */
  96 +               pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 500, NULL, NULL, NULL);
  97 +               return PJ_TRUE;
  98         }
  99
 100         return PJ_FALSE;
 101