[asterisk-bugs] [JIRA] (ASTERISK-24506) 403 Forbidden Fix for Big Loaded systems

[Rusty Newton (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-24506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=223460#comment-223460 ] 

Rusty Newton commented on ASTERISK-24506:
-----------------------------------------

{quote}
To Rusty Newton
i completed license agreement but every time you refuse it. 
{quote}
Digium legal has responded to your E-mail and is awaiting your response. After that your license may be accepted.

> 403 Forbidden Fix for Big Loaded systems 
> -----------------------------------------
>
>                 Key: ASTERISK-24506
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-24506
>             Project: Asterisk
>          Issue Type: Improvement
>      Security Level: None
>          Components: Channels/chan_sip/General
>    Affects Versions: 13.0.0-beta2, 13.0.0-beta3, 13.0.0
>            Reporter: HZMI8gkCvPpom0tM
>            Assignee: HZMI8gkCvPpom0tM
>         Attachments: chan_sip403.patch, new.patch
>
>
> On big loaded systems with more than 40k subscribers 403 Forbidden (Bad auth) is only way to detect and block username scans which can create REALTIME database deny of service. As practice show - for frauders absolutely no matter is it 403 Forbidden or 403 Forbidden (Bad auth) they continue to send hundreds thousands registrations and invites with different credentials until finish their list.  Usage 403 Forbidden (Bad auth) best style to detect such attacks and stop them on firewall side instead to pass them through whole infrastructure to database. I included patch which return back 403 Forbidden (Bad auth) in chan_sip. 



--
This message was sent by Atlassian JIRA
(v6.2#6252)