[asterisk-bugs] [Asterisk 0016091]: Security Problem

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16091 
====================================================================== 
Reported By:                thom4fun
Assigned To:                ebroad
====================================================================== 
Project:                    Asterisk
Issue ID:                   16091
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     assigned
Asterisk Version:           1.6.1.6 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-10-18 03:22 CDT
Last Modified:              2009-10-19 12:57 CDT
====================================================================== 
Summary:                    Security Problem
Description: 
We use Asterisk 1.6.1.6.

It seems that Asterisk will ignore the deny and permit values.
I have a try just like in 1.4.... where it works fine, but if I use the
values:
deny=0.0.0.0/0.0.0.0
permit=192.168.30.10
the call will be executed from everywhere.

Also I try the insecure option but I do not find a reason to give some
special clients the possibility to make an invite without authentication.
It looks like: Everybody or Nobody!

Also we try to use these options in the file sip.conf and PGSQL database.

Are there some hints to get deny/permit to work?

Regards
Thomas

====================================================================== 

---------------------------------------------------------------------- 
 (0112429) thom4fun (reporter) - 2009-10-19 12:57
 https://issues.asterisk.org/view.php?id=16091#c112429 
---------------------------------------------------------------------- 
What I want to do is following:
I run asterisk with very high load. What will mean, that the most channels
I used will playback an .wav file. What I saw is that one call will use
0.1% of CPU Power. But if I use more than round about 130 Channals at the
same time, there is one or more "Ghost Channels". That channels will use
10% ore more CPU Load per Channel. I think that there are too many SIP
Headers between asterisk and the client. And my try is, to use an invite
without authentication to save a lot of SIP requests. In earlier versions I
use insecure = invite so that an client that is regesterd do not have a
need of authentication, but this feature seems out of order in version
1.6.. So my try was to get the security over deny/permit.... 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-10-19 12:57 thom4fun       Note Added: 0112429                          
======================================================================