[asterisk-bugs] [JIRA] (ASTERISK-20578) sip handle_incoming needs more calls to sec. framework

[Matt Jordan (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-20578?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=198769#comment-198769 ] 

Matt Jordan commented on ASTERISK-20578:
----------------------------------------

Agreed - you could argue either way that this is a bug versus an improvement, but I personally think the value added of covering all of the SIP requests makes it worthwhile.
                
> sip handle_incoming needs more calls to sec. framework
> ------------------------------------------------------
>
>                 Key: ASTERISK-20578
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-20578
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_sip/Security Framework
>    Affects Versions: 10.10.0
>            Reporter: Walter Doekes
>            Severity: Trivial
>
> From ASTERISK-20506:
> {quote}
> You do have a valid point there. auth_options_requests=no (the default) does mitigate the OPTIONS problem. But there are indeed a couple of other methods that do get the authentication process working and they should be sent to the security framework. \[Make new bug report #1]
> {quote}
> Two issues here:
> - handle_incoming() sports the magic number 9:
>   if (res < 9) { sip_report_security_event(p, req, res); }
>   should be fixed using extra constants in sip/include/sip.h
> - handle_incoming() calls other methods which can be used for brute forcing (OPTIONS, MESSAGE, ...).
>   the calls to sip_report_security_event() are missing there.
>   (perhaps it should be moved to check_auth)

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira