[Asterisk-code-review] AST-2015-006: Vulnerability replication test. (testsuite[master])

Richard Mudgett asteriskteam at digium.com
Wed Feb 3 14:30:02 CST 2016


Richard Mudgett has uploaded a new change for review.

  https://gerrit.asterisk.org/2190

Change subject: AST-2015-006: Vulnerability replication test.
......................................................................

AST-2015-006: Vulnerability replication test.

Sending UDPTL packets to Asterisk with the right amount of missing
sequence numbers and enough redundant 0-length IFP packets, can make
Asterisk crash.

The test fails if Asterisk crashes.

ASTERISK-25603 #close
Reported by: Walter Doekes

ASTERISK-25742 #close
Reported by: Torrey Searle

Change-Id: Ia043c29557f32595efaf825696de24a90a6756ce
---
A tests/fax/pjsip/ast-2015-006/configs/ast1/extensions.conf
A tests/fax/pjsip/ast-2015-006/configs/ast1/pjsip.conf
A tests/fax/pjsip/ast-2015-006/sipp/crash.pcap
A tests/fax/pjsip/ast-2015-006/sipp/endpoint_A.xml
A tests/fax/pjsip/ast-2015-006/sipp/endpoint_B.xml
A tests/fax/pjsip/ast-2015-006/sipp/inject_bridge.csv
A tests/fax/pjsip/ast-2015-006/test-config.yaml
M tests/fax/pjsip/tests.yaml
8 files changed, 400 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.asterisk.org:29418/testsuite refs/changes/90/2190/1

diff --git a/tests/fax/pjsip/ast-2015-006/configs/ast1/extensions.conf b/tests/fax/pjsip/ast-2015-006/configs/ast1/extensions.conf
new file mode 100644
index 0000000..9ccf33d
--- /dev/null
+++ b/tests/fax/pjsip/ast-2015-006/configs/ast1/extensions.conf
@@ -0,0 +1,6 @@
+[general]
+
+[default]
+exten => basicdial,1,NoOp()
+same => n,Dial(PJSIP/endpoint_B/sip:127.0.0.3)
+same => n,Hangup()
diff --git a/tests/fax/pjsip/ast-2015-006/configs/ast1/pjsip.conf b/tests/fax/pjsip/ast-2015-006/configs/ast1/pjsip.conf
new file mode 100644
index 0000000..bc95b50
--- /dev/null
+++ b/tests/fax/pjsip/ast-2015-006/configs/ast1/pjsip.conf
@@ -0,0 +1,26 @@
+[local-transport]
+type=transport
+protocol=udp
+bind=127.0.0.1
+
+[endpoint-template](!)
+type=endpoint
+context=default
+allow=!all,ulaw
+t38_udptl=yes
+direct_media=no
+
+[endpoint_A](endpoint-template)
+
+[endpoint_B](endpoint-template)
+
+[identify-template](!)
+type=identify
+
+[endpoint_A](identify-template)
+endpoint=endpoint_A
+match=127.0.0.2
+
+[endpoint_B](identify-template)
+endpoint=endpoint_B
+match=127.0.0.3
diff --git a/tests/fax/pjsip/ast-2015-006/sipp/crash.pcap b/tests/fax/pjsip/ast-2015-006/sipp/crash.pcap
new file mode 100644
index 0000000..472370b
--- /dev/null
+++ b/tests/fax/pjsip/ast-2015-006/sipp/crash.pcap
Binary files differ
diff --git a/tests/fax/pjsip/ast-2015-006/sipp/endpoint_A.xml b/tests/fax/pjsip/ast-2015-006/sipp/endpoint_A.xml
new file mode 100644
index 0000000..05f753c
--- /dev/null
+++ b/tests/fax/pjsip/ast-2015-006/sipp/endpoint_A.xml
@@ -0,0 +1,156 @@
+<?xml version="1.0" encoding="ISO-8859-1" ?>
+<!DOCTYPE scenario SYSTEM "sipp.dtd">
+
+<scenario name="Phone A calls B to receive a T.38 UDPTL stream.">
+
+	<!-- Initial invite - Call phone B -->
+	<send retrans="500">
+		<![CDATA[
+			INVITE sip:[field2]@[remote_ip]:[remote_port] SIP/2.0
+			Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+			From: [field0] <sip:[field0]@[local_ip]:[local_port]>;tag=[call_number]
+			To: <sip:[field2]@[remote_ip]:[remote_port];user=phone>
+			CSeq: 1 INVITE
+			Call-ID: [call_id]
+			Contact: <sip:[field0]@[local_ip]:[local_port]>
+			Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Allow-Events: talk,hold,conference
+			Max-Forwards: 70
+			Content-Type: application/sdp
+			Content-Length: [len]
+
+			v=0
+			o=- 1324901698 1324901698 IN IP4 [local_ip]
+			s=Polycom IP Phone
+			c=IN IP4 [local_ip]
+			t=0 0
+			a=sendrecv
+			m=audio 2226 RTP/AVP 0 101
+			a=sendrecv
+			a=rtpmap:0 PCMU/8000
+			a=rtpmap:101 telephone-event/8000
+		]]>
+	</send>
+
+	<recv response="100" optional="true" />
+
+	<recv response="180" optional="true" />
+
+	<recv response="183" optional="true" />
+
+	<recv response="200" />
+
+	<send>
+		<![CDATA[
+			ACK sip:[field1]@[remote_ip]:[remote_port] SIP/2.0
+			Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+			From: [field0] <sip:[field0]@[remote_ip]>;tag=[call_number]
+			To: <sip:[field1]@[remote_ip];user=phone>[peer_tag_param]
+			CSeq: 1 ACK
+			Call-ID: [call_id]
+			Contact: <sip:[field0]@[local_ip]:[local_port]>
+			Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Max-Forwards: 70
+			Content-Length: 0
+		]]>
+	</send>
+
+	<!-- Reinvite received for T38 - media flows between Enpoint A and Asterisk -->
+	<recv request="INVITE" />
+
+	<send retrans="500">
+		<![CDATA[
+			SIP/2.0 200 OK
+			[last_Via:]
+			[last_From:]
+			[last_To:];tag=[call_number]
+			[last_Call-ID:]
+			[last_CSeq:]
+			Contact: <sip:[field0]@[local_ip]:[local_port];transport=[transport]>
+			Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
+			Supported: 100rel,replaces
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Testsuite-Track-Phone-A: 2
+			Content-Type: application/sdp
+			Content-Length: [len]
+
+			v=0
+			o=- 1324901698 1324901700 IN IP4 [local_ip]
+			s=Polycom IP Phone
+			c=IN IP4 [local_ip]
+			t=0 0
+			m=image 10972 udptl t38
+			a=sendrecv
+			a=T38FaxVersion:0
+			a=T38MaxBitRate:9600
+			a=T38FaxMaxBuffer:1024
+			a=T38FaxMaxDatagram:400
+			a=T38FaxRateManagement:transferredTCF
+			a=T38FaxUdpEC:t38UDPRedundancy
+		]]>
+	</send>
+
+	<recv request="ACK"/>
+
+	<!-- Reinvite received when phone B hangs up to clear T.38 -->
+	<recv request="INVITE"/>
+
+	<send retrans="500">
+		<![CDATA[
+			SIP/2.0 200 OK
+			[last_Via:]
+			[last_From:]
+			[last_To:];tag=[call_number]
+			[last_Call-ID:]
+			[last_CSeq:]
+			Contact: <sip:[field0]@[local_ip]:[local_port];transport=[transport]>
+			Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
+			Supported: 100rel,replaces
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Testsuite-Track-Phone-A: 3
+			Content-Type: application/sdp
+			Content-Length: [len]
+
+			v=0
+			o=- 1324901698 1324901698 IN IP4 [local_ip]
+			s=Polycom IP Phone
+			c=IN IP4 [local_ip]
+			t=0 0
+			a=sendrecv
+			m=audio 2226 RTP/AVP 0 101
+			a=sendrecv
+			a=rtpmap:0 PCMU/8000
+			a=rtpmap:101 telephone-event/8000
+		]]>
+	</send>
+
+	<recv request="ACK"/>
+
+	<recv request="BYE"/>
+
+	<send retrans="500">
+		<![CDATA[
+			SIP/2.0 200 OK
+			[last_Via:]
+			[last_From:]
+			[last_To:];tag=[call_number]
+			[last_Call-ID:]
+			[last_CSeq:]
+			Contact: <sip:[field0]@[local_ip]:[local_port];transport=[transport]>
+			Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
+			Supported: 100rel,replaces
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Testsuite-Track-Phone-A: 5
+			Content-Type: application/sdp
+			Content-Length: 0
+		]]>
+	</send>
+</scenario>
+
diff --git a/tests/fax/pjsip/ast-2015-006/sipp/endpoint_B.xml b/tests/fax/pjsip/ast-2015-006/sipp/endpoint_B.xml
new file mode 100644
index 0000000..f6a6cfe
--- /dev/null
+++ b/tests/fax/pjsip/ast-2015-006/sipp/endpoint_B.xml
@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="ISO-8859-1" ?>
+<!DOCTYPE scenario SYSTEM "sipp.dtd">
+
+<scenario name="Phone B Answers and reINVITEs to send T.38 malicious UDPTL pcap stream.">
+	<Global variables="remote_tag"/>
+
+	<recv request="INVITE" crlf="true">
+		<action>
+			<ereg regexp=".*(;tag=.*)"
+				header="From:"
+				search_in="hdr"
+				check_it="true"
+				assign_to="remote_tag"/>
+		</action>
+	</recv>
+
+	<send>
+		<![CDATA[
+			SIP/2.0 100 Trying
+			[last_Via:]
+			[last_From:]
+			[last_To:];tag=[call_number]
+			[last_Call-ID:]
+			[last_CSeq:]
+			Contact: <sip:[field1]@[local_ip]:[local_port];transport=[transport]>
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Content-Length: 0
+		]]>
+	</send>
+
+	<send>
+		<![CDATA[
+			SIP/2.0 180 Ringing
+			[last_Via:]
+			[last_From:]
+			[last_To:];tag=[call_number]
+			[last_Call-ID:]
+			[last_CSeq:]
+			Contact: <sip:[field1]@[local_ip]:[local_port];transport=[transport]>
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Allow-Events: talk,hold,conference
+			Accept-Language: en
+			Content-Length: 0
+		]]>
+	</send>
+
+	<pause milliseconds="200"/>
+
+	<send retrans="500">
+		<![CDATA[
+			SIP/2.0 200 OK
+			[last_Via:]
+			[last_From:]
+			[last_To:]
+			[last_Call-ID:]
+			[last_CSeq:]
+			Contact: <sip:[field1]@[local_ip]:[local_port];transport=[transport]>
+			Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
+			Supported: 100rel,replaces
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Testsuite-Track-Phone-B-Media-Restrict: 1
+			Content-Type: application/sdp
+			Content-Length: [len]
+
+			v=0
+			o=- 1324901698 1324901698 IN IP4 [local_ip]
+			s=Polycom IP Phone
+			c=IN IP4 [local_ip]
+			t=0 0
+			a=sendrecv
+			m=audio 2226 RTP/AVP 0 101
+			a=sendrecv
+			a=rtpmap:0 PCMU/8000
+			a=rtpmap:101 telephone-event/8000
+		]]>
+	</send>
+
+	<!-- RECV ACK -->
+	<recv request="ACK"/>
+
+	<!-- Wait some period of time -->
+	<pause milliseconds="1500"/>
+
+	<!-- Reinvite to set up T38 Fax session -->
+	<send retrans="500">
+		<![CDATA[
+			INVITE sip:endpoint_B@[remote_ip]:[remote_port] SIP/2.0
+			Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+			From: <sip:127.0.0.3>
+			To: [$remote_tag]
+			CSeq: [cseq] INVITE
+			[last_Call-ID:]
+			Contact: <sip:[field1]@[local_ip]:[local_port]>
+			Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Supported: 100rel,replaces
+			Allow-Events: talk,hold,conference
+			Max-Forwards: 70
+			Content-Type: application/sdp
+			Content-Length: [len]
+
+			v=0
+			o=- 1324901698 1324901700 IN IP4 [local_ip]
+			s=Polycom IP Phone
+			c=IN IP4 [local_ip]
+			t=0 0
+			m=image 30002 udptl t38
+			a=sendrecv
+			a=T38FaxVersion:0
+			a=T38MaxBitRate:9600
+			a=T38FaxMaxBuffer:1024
+			a=T38FaxMaxDatagram:400
+			a=T38FaxRateManagement:transferredTCF
+			a=T38FaxUdpEC:t38UDPRedundancy
+		]]>
+	</send>
+
+	<recv response="100" optional="true" />
+
+	<recv response="200" />
+
+	<send>
+		<![CDATA[
+			ACK sip:[field1]@[remote_ip]:[remote_port] SIP/2.0
+			Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+			From: <sip:127.0.0.3>
+			To: [$remote_tag]
+			CSeq: [cseq] ACK
+			[last_Call-ID:]
+			Contact: <sip:[field1]@[local_ip]:[local_port]>
+			Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Max-Forwards: 70
+			Content-Length: 0
+		]]>
+	</send>
+
+	<!-- Send malicious T.38 pcap file. -->
+	<nop>
+		<action>
+			<exec play_pcap_image="tests/fax/pjsip/ast-2015-006/sipp/crash.pcap" />
+		</action>
+	</nop>
+
+	<!-- Wait for the pcap to fully get sent. -->
+	<pause milliseconds="14000"/>
+
+	<send>
+		<![CDATA[
+			BYE sip:[field1]@1[remote_ip]:[remote_port] SIP/2.0
+			Via: SIP/2.0/UDP [local_ip]:[local_port];branch=[branch]
+			From: <sip:127.0.0.3>
+			To: [$remote_tag]
+			CSeq: [cseq] BYE
+			[last_Call-ID:]
+			Contact: <sip:[field1]@[local_ip]:[local_port]>
+			User-Agent: PolycomSoundPointIP-SPIP_430-UA/3.2.3.1734
+			Accept-Language: en
+			Max-Forwards: 70
+			Content-Length: 0
+		]]>
+	</send>
+
+	<recv response="200" />
+</scenario>
+
diff --git a/tests/fax/pjsip/ast-2015-006/sipp/inject_bridge.csv b/tests/fax/pjsip/ast-2015-006/sipp/inject_bridge.csv
new file mode 100644
index 0000000..3d6c1c9
--- /dev/null
+++ b/tests/fax/pjsip/ast-2015-006/sipp/inject_bridge.csv
@@ -0,0 +1,3 @@
+SEQUENTIAL
+endpoint_A;endpoint_B;basicdial
+
diff --git a/tests/fax/pjsip/ast-2015-006/test-config.yaml b/tests/fax/pjsip/ast-2015-006/test-config.yaml
new file mode 100644
index 0000000..f477623
--- /dev/null
+++ b/tests/fax/pjsip/ast-2015-006/test-config.yaml
@@ -0,0 +1,38 @@
+testinfo:
+    summary: 'Test for AST-2015-006 T.38 FAX UDPTL vulnerability'
+    description: |
+        'Two devices are in a normal Audio call when one does a reinvite
+        to start a T.38 Fax session to send a malicious UDPTL stream.
+        A calls B
+        B initiates T.38 reINVITE
+        B sends malicious UDPTL stream.'
+
+test-modules:
+    add-test-to-search-path: 'True'
+    test-object:
+        config-section: test-object-config
+        typename: 'sipp.SIPpTestCase'
+
+test-object-config:
+    fail-on-any: False
+    test-iterations:
+        -
+            scenarios:
+                - { 'key-args': {'scenario': 'endpoint_A.xml', '-i': '127.0.0.2', '-p': '5060', '-inf': 'inject_bridge.csv'} }
+                - { 'key-args': {'scenario': 'endpoint_B.xml', '-i': '127.0.0.3', '-p': '5060', '-inf': 'inject_bridge.csv'} }
+
+properties:
+    minversion: '13.8.0'
+    dependencies:
+        # The test requires the use of the SIPp feature play_pcap_image.
+        # However the feature is not in a released SIPp version yet.
+        # The feature might be present in the specified version below.
+        - sipp :
+            version : 'v3.5'
+            feature : 'PCAP'
+        - asterisk : 'app_dial'
+        - asterisk : 'chan_pjsip'
+        - asterisk : 'res_pjsip_t38'
+    tags:
+        - pjsip
+        - fax
diff --git a/tests/fax/pjsip/tests.yaml b/tests/fax/pjsip/tests.yaml
index 58bd614..87a641a 100644
--- a/tests/fax/pjsip/tests.yaml
+++ b/tests/fax/pjsip/tests.yaml
@@ -1,5 +1,6 @@
 # Enter tests here in the order they should be considered for execution:
 tests:
+    - test: 'ast-2015-006'
     - test: 't38'
     - test: 't38_with_auth'
     - test: 'directmedia_reinvite_t38'

-- 
To view, visit https://gerrit.asterisk.org/2190
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ia043c29557f32595efaf825696de24a90a6756ce
Gerrit-PatchSet: 1
Gerrit-Project: testsuite
Gerrit-Branch: master
Gerrit-Owner: Richard Mudgett <rmudgett at digium.com>



More information about the asterisk-code-review mailing list