[asterisk-bugs] [JIRA] (ASTERISK-23322) Unable to use SIP INVITE authentication with type=peer and device name mismatch with username

[Michael L. Young (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-23322?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=215437#comment-215437 ] 

Michael L. Young commented on ASTERISK-23322:
---------------------------------------------

>From sip.conf:
{noformat}
;------------------------------------------------------------------------------
; DEVICE CONFIGURATION
;
; The SIP channel has two types of devices, the friend and the peer.
; * The type=friend is a device type that accepts both incoming and outbound calls,
;   where Asterisk match on the From: username on incoming calls.
;   (A synonym for friend is "user"). This is a type you use for your local
;   SIP phones.
; * The type=peer also handles both incoming and outbound calls. On inbound calls,
;   Asterisk only matches on IP/port, not on names. This is mostly used for SIP
;   trunks.
;
; For device names, we recommend using only a-z, numerics (0-9) and underscore
;
; For local phones, type=friend works most of the time
{noformat}

So, if you are setting a device as type=peer then name is not used at all according to the documentation unless the documentation is not correct.
                
> Unable to use SIP INVITE authentication with type=peer and device name mismatch with username
> ---------------------------------------------------------------------------------------------
>
>                 Key: ASTERISK-23322
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-23322
>             Project: Asterisk
>          Issue Type: Improvement
>      Security Level: None
>          Components: Channels/chan_sip/General
>    Affects Versions: 11.7.0
>            Reporter: Igor Nikolaev
>            Severity: Trivial
>         Attachments: asterisk-chan_sip-inbound-invite-auth.patch
>
>
> Scenario:
> sip.conf
> {noformat}
> [devicename]
> type=peer
> fromuser=authuser
> secret=...
> {noformat}
> In this case if devicename not equal authuser you need add statement "insecure=invite" for receiving incoming calls. But this INVITEs is not authenticated by receiving system. It's security hole.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira