[asterisk-bugs] [JIRA] (ASTERISK-19348) With alwaysauthreject=yes AND allowguest=no Asterisk fails to report a SIP Security Event

[Michael L. Young (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-19348?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=205747#comment-205747 ] 

Michael L. Young edited comment on ASTERISK-19348 at 4/24/13 10:20 AM:
-----------------------------------------------------------------------

motekpc - It is not a problem with the fail2ban scripts, I could not get your patch to work as it would still show the same info as the regular asterisk line (my IP address).
Vladimir - I added this patch instead (for 1.8.20.1, not sure about .21)

[edit: removed inline patch]
                
      was (Author: mglazer):
    motekpc - It is not a problem with the fail2ban scripts, I could not get your patch to work as it would still show the same info as the regular asterisk line (my IP address).
Vladimir - I added this patch instead (for 1.8.20.1, not sure about .21)

--- chan_sip.c.orig     2013-04-03 12:30:07.000000000 -0600
+++ chan_sip.c  2013-04-24 08:34:00.000000000 -0600
@@ -16730,6 +16730,7 @@
                }
        } else if (sip_cfg.alwaysauthreject) {
                res = AUTH_FAKE_AUTH; /* reject with fake authorization request */
+               ast_log(LOG_NOTICE, "heres the mofo %s\n", ast_sockaddr_stringify(addr));
        } else {
                res = AUTH_SECRET_FAILED; /* we don't want any guests, authentication will fail */
        }

                  
> With alwaysauthreject=yes AND allowguest=no Asterisk fails to report a SIP Security Event
> -----------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-19348
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-19348
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Channels/chan_sip/General
>    Affects Versions: 1.8.9.2, 10.1.2
>            Reporter: Bruce B
>         Attachments: asterisk-19348-auth_fake-sec-event_v1.patch, asterisk-19348-auth_fake-sip-log-event_v1.patch
>
>
> Asterisk should log source IP address of incoming calls when allowguest=no AND alwaysauthreject=yes but it doesn't. It seems to be a deficiency of allowguest feature. The only log found when there is an incoming call is this which doesn't include source IP address:
> NOTICE[10331] chan_sip.c: Sending fake auth rejection for device "Anonymous" <sip:Anonymous at anonymous.invalid>;tag=as4a1b8317
> ***WARNING: source IP address in this MUST be pulled from OS network layer rather than relying on SIP Packets as spoofed source IP is not really the source IP. Better yet maybe include both spoofed source IP and true source IP in a message like this:
> chan_sip.c: NOTICE[xxxxx]: Call attempt was made from SPOOFED SOURCE IP: x.x.x.x with TRUE SOURCE IP: x.x.x.x
> ***It's best to create this log in full log file as well.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira