[asterisk-bugs] [Asterisk 0008952]: Asterisk accepts RTP from random endpoints

[noreply at bugs.digium.com]

The following issue has been ASSIGNED. 
====================================================================== 
http://bugs.digium.com/view.php?id=8952 
====================================================================== 
Reported By:                amorsen
Assigned To:                file
====================================================================== 
Project:                    Asterisk
Issue ID:                   8952
Category:                   Core/RTP
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     assigned
Asterisk Version:            1.2.13 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Disclaimer on File?:        No 
Request Review:              
====================================================================== 
Date Submitted:             01-31-2007 08:38 CST
Last Modified:              01-24-2008 11:47 CST
====================================================================== 
Summary:                    Asterisk accepts RTP from random endpoints
Description: 
Sometimes the audio from an unrelated call would enter the RTP stream,
accompanied by a stream of:  == Forcing Marker bit, because SSRC has
changed

I finally had the chance to tcpdump when it happened. The basic setup is a
central asterisk connected by SIP to two branch asterisks. A call from the
central to branch2 has failed on the central asterisk but somehow stayed
open on branch2, so branch2 kept sending audio which central naturally
ignored. The audio is sent as RTP, and the RTP port on central happens to
be 18796.

Later another call comes along from central to branch1, and the RTP port
chosen for this call on central happens to be 18796. branch1 starts sending
RTP to that port, and asterisk happily accepts BOTH RTP streams. Obviously
asterisk should reject the RTP stream from branch2. Failure to do so is a
security breach.

I have not tried to replicate this issue, it has happened several times
but until now I have not had the chance to debug it. Replicating it
properly would involve generating an RTP stream.

====================================================================== 

---------------------------------------------------------------------- 
 svnbot - 01-24-08 11:47  
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 100206

U   trunk/CHANGES
U   trunk/configs/rtp.conf.sample
U   trunk/main/rtp.c

------------------------------------------------------------------------
r100206 | file | 2008-01-24 11:47:29 -0600 (Thu, 24 Jan 2008) | 4 lines

Merge in strictrtp branch. This adds a strictrtp option to rtp.conf which
drops packets that do not come from the remote party.
(closes issue http://bugs.digium.com/view.php?id=8952)
Reported by: amorsen

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=100206 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
01-24-08 11:47  svnbot         Note Added: 0081144                          
01-24-08 11:47  svnbot         Status                   ready for testing =>
assigned
======================================================================