[Asterisk-Dev] Security issue mumblings - SIP

[Kevin P. Fleming]

Olle E. Johansson wrote:

> According to specs we have to start listening when we send an SDP and
> are able to start sending audio when we get an SDP. I agree that the ACK
> would be the time that the call "started" but that's not really
> implemented. In Asterisk the call is UP when we get or send a 200 OK.

That is intentional, and will not be changed. The same is true on PRI 
links, where we consider the call 'up' as soon as we send CONNECT, 
without waiting for the CONNECT ACKNOWLEDGE. This is proper behavior and 
is 'by design' :-)

Of course you are correct in saying that if the ACK is never received we 
will tear the call down, but during that interval that the call is up, 
the call will be 'billed'.