kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-12 15:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_pjsip.c: OPTIONS processing can now optionally skip authentication

Browse Source 
ASTERISK-27477 #close

Change-Id: I68f6715bba92a525149e35d142a49377a34a1193
This commit is contained in:
Sean Bright
2021-04-23 13:37:20 -04:00
committed by George Joseph
parent dec44306cf
commit d2dcd15bd8
6 changed files with 80 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
res/res_pjsip.c
View File

@@ -1472,6 +1472,23 @@
INVITEs, an Identity header will be added.</para>
</description>
</configOption>
<configOption name="allow_unauthenticated_options" default="no">
<synopsis>Skip authentication when receiving OPTIONS requests</synopsis>
<description><para>
RFC 3261 says that the response to an OPTIONS request MUST be the
same had the request been an INVITE. Some UAs use OPTIONS requests
like a 'ping' and the expectation is that they will return a
200 OK.</para>
<para>Enabling <literal>allow_unauthenticated_options</literal>
will skip authentication of OPTIONS requests for the given
endpoint.</para>
<para>There are security implications to enabling this setting as
it can allow information disclosure to occur - specifically, if
enabled, an external party could enumerate and find the endpoint
name by sending OPTIONS requests and examining the
responses.</para>
</description>
</configOption>
</configObject>
<configObject name="auth">
<synopsis>Authentication type</synopsis>
@@ -3307,6 +3324,12 @@ void ast_sip_unregister_authenticator(struct ast_sip_authenticator *auth)
int ast_sip_requires_authentication(struct ast_sip_endpoint *endpoint, pjsip_rx_data *rdata)
{
if (endpoint->allow_unauthenticated_options
&& !pjsip_method_cmp(&rdata->msg_info.msg->line.req.method, &pjsip_options_method)) {
ast_debug(3, "Skipping OPTIONS authentication due to endpoint configuration\n");
return 0;
}
if (!registered_authenticator) {
ast_log(LOG_WARNING, "No SIP authenticator registered. Assuming authentication is not required\n");
return 0;

1
res/res_pjsip/pjsip_configuration.c
View File

@@ -2153,6 +2153,7 @@ int ast_res_pjsip_initialize_configuration(void)
"prefer: pending, operation: intersect, keep: all",
codec_prefs_handler, outgoing_answer_codec_prefs_to_str, NULL, 0, 0);
ast_sorcery_object_field_register(sip_sorcery, "endpoint", "stir_shaken", "no", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, stir_shaken));
ast_sorcery_object_field_register(sip_sorcery, "endpoint", "allow_unauthenticated_options", "no", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, allow_unauthenticated_options));
if (ast_sip_initialize_sorcery_transport()) {
ast_log(LOG_ERROR, "Failed to register SIP transport support with sorcery\n");