kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-12 15:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_pjsip: Add 'ip' as a valid option to 'identify_by' on endpoint.

Browse Source 
When the identify_by option on an endpoint is set to ip it will
only be identified using the res_pjsip_endpoint_identifier_ip module.
This ensures that it is not mistakenly matched using the username of
the From header. To ensure behavior has not changed the default has
been changed to "username,ip" for the identify_by option.

ASTERISK-27206

Change-Id: I2170b86a7f7e221b4f00bf14aa1ef1ac5b050bbd
This commit is contained in:
Joshua Colp
2017-10-24 15:33:57 +00:00
parent e7d8b4ebe7
commit 7385d1e017
7 changed files with 93 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
res/res_pjsip.c
View File

@@ -268,15 +268,17 @@
<configOption name="ice_support" default="no">
<synopsis>Enable the ICE mechanism to help traverse NAT</synopsis>
</configOption>
<configOption name="identify_by" default="username,location">
<configOption name="identify_by" default="username,ip">
<synopsis>Way(s) for Endpoint to be identified</synopsis>
<description><para>
Endpoints and aors can be identified in multiple ways. Currently, the supported
options are <literal>username</literal>, which matches the endpoint or aor id based on
the username and domain in the From header (or To header for aors), and
the username and domain in the From header (or To header for aors),
<literal>auth_username</literal>, which matches the endpoint or aor id based on the
username and realm in the Authentication header. In all cases, if an exact match
on both username and domain/realm fails, the match will be retried with just the username.
username and realm in the Authentication header, and <literal>ip</literal> which matches
an endpoint based on the source IP address. In the <literal>username</literal> and
<literal>auth_username</literal> cases, if an exact match on both username and
domain/realm fails, the match will be retried with just the username.
</para>
<note><para>
Identification by auth_username has some security considerations because an
@@ -292,14 +294,19 @@
configuration object.
</para></note>
<note><para>Endpoints can also be identified by IP address; however, that method
of identification is not handled by this configuration option. See the documentation
for the <literal>identify</literal> configuration section for more details on that
method of endpoint identification. If this option is set and an <literal>identify</literal>
configuration section exists for the endpoint, then the endpoint can be identified in
multiple ways.</para></note>
of identification is not configured but simply allowed by this configuration option.
See the documentation for the <literal>identify</literal> configuration section for
more details on that method of endpoint identification.</para></note>
<note><para>
This option controls both how an endpoint is matched for incoming traffic and also how
an AoR is determined if a registration occurs. If <literal>ip</literal> is set alone
then incoming registration will not find an AoR and the registration attempt will fail.
If you want to allow incoming registrations to succeed you must set a second identify
method such as <literal>username</literal> in this case.</para></note>
<enumlist>
<enum name="username" />
<enum name="auth_username" />
<enum name="ip" />
</enumlist>
</description>
</configOption>