net/asterisk-15.x/patches/120-AST-2018-008-15.diff

   1 From f597032e833a4d3e8e710e5b1416ba780f002b8b Mon Sep 17 00:00:00 2001
   2 From: Richard Mudgett <rmudgett@digium.com>
   3 Date: Mon, 30 Apr 2018 17:38:58 -0500
   4 Subject: [PATCH] AST-2018-008: Fix enumeration of endpoints from ACL rejected addresses.
   5
   6 When endpoint specific ACL rules block a SIP request they respond with a
   7 403 forbidden.  However, if an endpoint is not identified then a 401
   8 unauthorized response is sent.  This vulnerability just discloses which
   9 requests hit a defined endpoint.  The ACL rules cannot be bypassed to gain
  10 access to the disclosed endpoints.
  11
  12 * Made endpoint specific ACL rules now respond with a 401 unauthorized
  13 which is the same as if an endpoint were not identified.  The fix is
  14 accomplished by replacing the found endpoint with the artificial endpoint
  15 which always fails authentication.
  16
  17 ASTERISK-27818
  18
  19 Change-Id: Icb275a54ff8e2df6c671a6d9bda37b5d732b3b32
  20 ---
  21
  22 --- a/res/res_pjsip/pjsip_distributor.c
  23 +++ b/res/res_pjsip/pjsip_distributor.c
  24 @@ -676,6 +676,26 @@ static void check_endpoint(pjsip_rx_data
  25         ao2_unlock(unid);
  26  }
  27
  28 +static int apply_endpoint_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint);
  29 +static int apply_endpoint_contact_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint);
  30 +
  31 +static void apply_acls(pjsip_rx_data *rdata)
  32 +{
  33 +       struct ast_sip_endpoint *endpoint;
  34 +
  35 +       /* Is the endpoint allowed with the source or contact address? */
  36 +       endpoint = rdata->endpt_info.mod_data[endpoint_mod.id];
  37 +       if (endpoint != artificial_endpoint
  38 +               && (apply_endpoint_acl(rdata, endpoint)
  39 +                       || apply_endpoint_contact_acl(rdata, endpoint))) {
  40 +               ast_debug(1, "Endpoint '%s' not allowed by ACL\n",
  41 +                       ast_sorcery_object_get_id(endpoint));
  42 +
  43 +               /* Replace the rdata endpoint with the artificial endpoint. */
  44 +               ao2_replace(rdata->endpt_info.mod_data[endpoint_mod.id], artificial_endpoint);
  45 +       }
  46 +}
  47 +
  48  static pj_bool_t endpoint_lookup(pjsip_rx_data *rdata)
  49  {
  50         struct ast_sip_endpoint *endpoint;
  51 @@ -694,6 +714,7 @@ static pj_bool_t endpoint_lookup(pjsip_r
  52                         ao2_unlink(unidentified_requests, unid);
  53                         ao2_ref(unid, -1);
  54                 }
  55 +               apply_acls(rdata);
  56                 return PJ_FALSE;
  57         }
  58
  59 @@ -753,6 +774,8 @@ static pj_bool_t endpoint_lookup(pjsip_r
  60                         ast_sip_report_invalid_endpoint(name, rdata);
  61                 }
  62         }
  63 +
  64 +       apply_acls(rdata);
  65         return PJ_FALSE;
  66  }
  67
  68 @@ -836,16 +859,11 @@ static pj_bool_t authenticate(pjsip_rx_d
  69
  70         ast_assert(endpoint != NULL);
  71
  72 -       if (endpoint!=artificial_endpoint) {
  73 -               if (apply_endpoint_acl(rdata, endpoint) || apply_endpoint_contact_acl(rdata, endpoint)) {
  74 -                       if (!is_ack) {
  75 -                               pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 403, NULL, NULL, NULL);
  76 -                       }
  77 -                       return PJ_TRUE;
  78 -               }
  79 +       if (is_ack) {
  80 +               return PJ_FALSE;
  81         }
  82
  83 -       if (!is_ack && ast_sip_requires_authentication(endpoint, rdata)) {
  84 +       if (ast_sip_requires_authentication(endpoint, rdata)) {
  85                 pjsip_tx_data *tdata;
  86                 struct unidentified_request *unid;
  87
  88 @@ -881,6 +899,10 @@ static pj_bool_t authenticate(pjsip_rx_d
  89                         return PJ_TRUE;
  90                 }
  91                 pjsip_tx_data_dec_ref(tdata);
  92 +       } else if (endpoint == artificial_endpoint) {
  93 +               /* Uh. Oh.  The artificial endpoint couldn't challenge so block the request. */
  94 +               pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 500, NULL, NULL, NULL);
  95 +               return PJ_TRUE;
  96         }
  97
  98         return PJ_FALSE;