[Asterisk-code-review] res_pjsip.c: OPTIONS processing can now optionally skip authentication (asterisk[master])
Friendly Automation
asteriskteam at digium.com
Wed Apr 28 16:39:08 CDT 2021
Friendly Automation has submitted this change. ( https://gerrit.asterisk.org/c/asterisk/+/15831 )
Change subject: res_pjsip.c: OPTIONS processing can now optionally skip authentication
......................................................................
res_pjsip.c: OPTIONS processing can now optionally skip authentication
ASTERISK-27477 #close
Change-Id: I68f6715bba92a525149e35d142a49377a34a1193
---
M configs/samples/pjsip.conf.sample
A contrib/ast-db-manage/config/versions/c20d6e3992f4_add_allow_unauthenticated_options.py
A doc/CHANGES-staging/pjsip_endpoint_unauthenticated_options.txt
M include/asterisk/res_pjsip.h
M res/res_pjsip.c
M res/res_pjsip/pjsip_configuration.c
6 files changed, 80 insertions(+), 0 deletions(-)
Approvals:
Joshua Colp: Looks good to me, but someone else must approve
Kevin Harwell: Looks good to me, approved
Friendly Automation: Approved for Submit
diff --git a/configs/samples/pjsip.conf.sample b/configs/samples/pjsip.conf.sample
index de3e866..7b4c7aa 100644
--- a/configs/samples/pjsip.conf.sample
+++ b/configs/samples/pjsip.conf.sample
@@ -927,6 +927,26 @@
; happens to the call if verification fails; it's up to
; you to determine what to do with the results.
; (default: no)
+;allow_unauthenticated_options =
+ ; By default, chan_pjsip will challenge an incoming
+ ; OPTIONS request for authentication credentials just
+ ; as it would an INVITE request. This is consistent
+ ; with RFC 3261.
+ ; There are many UAs that use an OPTIONS request as a
+ ; "ping" and they expect a 200 response indicating that
+ ; the remote party is up and running without a need to
+ ; authenticate.
+ ; Setting allow_unauthenticated_options to 'yes' will
+ ; instruct chan_pjsip to skip the authentication step
+ ; when it receives an OPTIONS request for this
+ ; endpoint.
+ ; There are security implications to enabling this
+ ; setting as it can allow information disclosure to
+ ; occur - specifically, if enabled, an external party
+ ; could enumerate and find the endpoint name by
+ ; sending OPTIONS requests and examining the
+ ; responses.
+ ; (default: no)
;==========================AUTH SECTION OPTIONS=========================
;[auth]
diff --git a/contrib/ast-db-manage/config/versions/c20d6e3992f4_add_allow_unauthenticated_options.py b/contrib/ast-db-manage/config/versions/c20d6e3992f4_add_allow_unauthenticated_options.py
new file mode 100644
index 0000000..deec532
--- /dev/null
+++ b/contrib/ast-db-manage/config/versions/c20d6e3992f4_add_allow_unauthenticated_options.py
@@ -0,0 +1,29 @@
+"""add allow_unauthenticated_options
+
+Revision ID: c20d6e3992f4
+Revises: 8915fcc5766f
+Create Date: 2021-04-23 13:44:38.296558
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = 'c20d6e3992f4'
+down_revision = '8915fcc5766f'
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import ENUM
+
+AST_BOOL_NAME = 'ast_bool_values'
+AST_BOOL_VALUES = [ '0', '1',
+ 'off', 'on',
+ 'false', 'true',
+ 'no', 'yes' ]
+
+def upgrade():
+ ast_bool_values = ENUM(*AST_BOOL_VALUES, name=AST_BOOL_NAME, create_type=False)
+ op.add_column('ps_endpoints', sa.Column('allow_unauthenticated_options', ast_bool_values))
+
+def downgrade():
+ op.drop_column('ps_endpoints', 'allow_unauthenticated_options')
+ pass
diff --git a/doc/CHANGES-staging/pjsip_endpoint_unauthenticated_options.txt b/doc/CHANGES-staging/pjsip_endpoint_unauthenticated_options.txt
new file mode 100644
index 0000000..9c8d32c
--- /dev/null
+++ b/doc/CHANGES-staging/pjsip_endpoint_unauthenticated_options.txt
@@ -0,0 +1,5 @@
+Subject: res_pjsip
+
+PJSIP endpoints can now be configured to skip authentication when
+handling OPTIONS requests by setting the allow_unauthenticated_options
+configuration property to 'yes.'
diff --git a/include/asterisk/res_pjsip.h b/include/asterisk/res_pjsip.h
index 5e3e439..2020ca8 100644
--- a/include/asterisk/res_pjsip.h
+++ b/include/asterisk/res_pjsip.h
@@ -915,6 +915,8 @@
unsigned int ignore_183_without_sdp;
/*! Enable STIR/SHAKEN support on this endpoint */
unsigned int stir_shaken;
+ /*! Should we authenticate OPTIONS requests per RFC 3261? */
+ unsigned int allow_unauthenticated_options;
};
/*! URI parameter for symmetric transport */
diff --git a/res/res_pjsip.c b/res/res_pjsip.c
index 53198ea..775b63f 100644
--- a/res/res_pjsip.c
+++ b/res/res_pjsip.c
@@ -1472,6 +1472,23 @@
INVITEs, an Identity header will be added.</para>
</description>
</configOption>
+ <configOption name="allow_unauthenticated_options" default="no">
+ <synopsis>Skip authentication when receiving OPTIONS requests</synopsis>
+ <description><para>
+ RFC 3261 says that the response to an OPTIONS request MUST be the
+ same had the request been an INVITE. Some UAs use OPTIONS requests
+ like a 'ping' and the expectation is that they will return a
+ 200 OK.</para>
+ <para>Enabling <literal>allow_unauthenticated_options</literal>
+ will skip authentication of OPTIONS requests for the given
+ endpoint.</para>
+ <para>There are security implications to enabling this setting as
+ it can allow information disclosure to occur - specifically, if
+ enabled, an external party could enumerate and find the endpoint
+ name by sending OPTIONS requests and examining the
+ responses.</para>
+ </description>
+ </configOption>
</configObject>
<configObject name="auth">
<synopsis>Authentication type</synopsis>
@@ -3307,6 +3324,12 @@
int ast_sip_requires_authentication(struct ast_sip_endpoint *endpoint, pjsip_rx_data *rdata)
{
+ if (endpoint->allow_unauthenticated_options
+ && !pjsip_method_cmp(&rdata->msg_info.msg->line.req.method, &pjsip_options_method)) {
+ ast_debug(3, "Skipping OPTIONS authentication due to endpoint configuration\n");
+ return 0;
+ }
+
if (!registered_authenticator) {
ast_log(LOG_WARNING, "No SIP authenticator registered. Assuming authentication is not required\n");
return 0;
diff --git a/res/res_pjsip/pjsip_configuration.c b/res/res_pjsip/pjsip_configuration.c
index 80bad02..6d12c6f 100644
--- a/res/res_pjsip/pjsip_configuration.c
+++ b/res/res_pjsip/pjsip_configuration.c
@@ -2153,6 +2153,7 @@
"prefer: pending, operation: intersect, keep: all",
codec_prefs_handler, outgoing_answer_codec_prefs_to_str, NULL, 0, 0);
ast_sorcery_object_field_register(sip_sorcery, "endpoint", "stir_shaken", "no", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, stir_shaken));
+ ast_sorcery_object_field_register(sip_sorcery, "endpoint", "allow_unauthenticated_options", "no", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, allow_unauthenticated_options));
if (ast_sip_initialize_sorcery_transport()) {
ast_log(LOG_ERROR, "Failed to register SIP transport support with sorcery\n");
--
To view, visit https://gerrit.asterisk.org/c/asterisk/+/15831
To unsubscribe, or for help writing mail filters, visit https://gerrit.asterisk.org/settings
Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-Change-Id: I68f6715bba92a525149e35d142a49377a34a1193
Gerrit-Change-Number: 15831
Gerrit-PatchSet: 2
Gerrit-Owner: Sean Bright <sean at seanbright.com>
Gerrit-Reviewer: Friendly Automation
Gerrit-Reviewer: Joshua Colp <jcolp at sangoma.com>
Gerrit-Reviewer: Kevin Harwell <kharwell at digium.com>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20210428/d9c36ffb/attachment-0001.html>
More information about the asterisk-code-review
mailing list