Default to nat=yes; warn when nat in general and peer differ

It is possible to enumerate SIP usernames when the general and user/peer
nat settings differ in whether to respond to the port a request is sent
from or the port listed for responses in the Via header. In 1.4 and 1.6.2,
this would mean if one setting was nat=yes or nat=route and the other was
either nat=no or nat=never. In 1.8 and 10, this would mean when one was
nat=force_rport and the other was nat=no.

In order to address this problem, it was decided to switch the default
behavior to nat=yes/force_rport as it is the most commonly used option
and to strongly discourage setting nat per-peer/user when at all possible.

For more discussion of the issue, please see:
  http://lists.digium.com/pipermail/asterisk-dev/2011-November/052191.html

(closes issue ASTERISK-18862)
Review: https://reviewboard.asterisk.org/r/1591/
........

Merged revisions 345776 from http://svn.asterisk.org/svn/asterisk/branches/1.4
........

Merged revisions 345800 from http://svn.asterisk.org/svn/asterisk/branches/1.6.2
........

Merged revisions 345828 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 345830 from http://svn.asterisk.org/svn/asterisk/branches/10

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@345831 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/CHANGES b/CHANGES
index bfc7301..5dc8623 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -323,6 +323,11 @@ PBX Core
 
 SIP Changes
 -----------
+ * Due to potential username discovery vulnerabilities, the 'nat' setting in sip.conf
+   now defaults to force_rport. It is very important that phones requiring nat=no be
+   specifically set as such instead of relying on the default setting. If at all
+   possible, all devices should have nat settings configured in the general section as
+   opposed to configuring nat per-device.
  * Added preferred_codec_only option in sip.conf. This feature limits the joint
    codecs sent in response to an INVITE to the single most preferred codec.
  * Added SIP_CODEC_OUTBOUND dialplan variable which can be used to set the codec

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index d540115..2eecb0a 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -27222,12 +27222,11 @@ static int handle_common_options(struct ast_flags *flags, struct ast_flags *mask
                }
        } else if (!strcasecmp(v->name, "nat")) {
                ast_set_flag(&mask[0], SIP_NAT_FORCE_RPORT);
+               ast_set_flag(&flags[0], SIP_NAT_FORCE_RPORT); /* Default to "force_rport" */
                if (!strcasecmp(v->value, "no")) {
                        ast_clear_flag(&flags[0], SIP_NAT_FORCE_RPORT);
-               } else if (!strcasecmp(v->value, "force_rport")) {
-                       ast_set_flag(&flags[0], SIP_NAT_FORCE_RPORT);
                } else if (!strcasecmp(v->value, "yes")) {
-                       ast_set_flag(&flags[0], SIP_NAT_FORCE_RPORT);
+                       /* We've already defaulted to force_rport */
                        ast_set_flag(&mask[1], SIP_PAGE2_SYMMETRICRTP);
                        ast_set_flag(&flags[1], SIP_PAGE2_SYMMETRICRTP);
                } else if (!strcasecmp(v->value, "comedia")) {
@@ -28381,6 +28380,18 @@ static void sip_set_default_format_capabilities(struct ast_format_cap *cap)
        ast_format_cap_add(cap, ast_format_set(&tmp_fmt, AST_FORMAT_H263, 0));
 }
 
+static void display_nat_warning(const char *cat, int reason, struct ast_flags *flags) {
+       int global_nat, specific_nat;
+
+       if (reason == CHANNEL_MODULE_LOAD && (specific_nat = ast_test_flag(&flags[0], SIP_NAT_FORCE_RPORT)) != (global_nat = ast_test_flag(&global_flags[0], SIP_NAT_FORCE_RPORT))) {
+               ast_log(LOG_WARNING, "!!! PLEASE NOTE: Setting 'nat' for a peer/user that differs from the  global setting can make\n");
+               ast_log(LOG_WARNING, "!!! the name of that peer/user discoverable by an attacker. Replies for non-existent peers/users\n");
+               ast_log(LOG_WARNING, "!!! will be sent to a different port than replies for an existing peer/user. If at all possible,\n");
+               ast_log(LOG_WARNING, "!!! use the global 'nat' setting and do not set 'nat' per peer/user.\n");
+               ast_log(LOG_WARNING, "!!! (config category='%s' global force_rport='%s' peer/user force_rport='%s')\n", cat, AST_CLI_YESNO(global_nat), AST_CLI_YESNO(specific_nat));
+       }
+}
+
 /*! \brief Re-read SIP.conf config file
 \note  This function reloads all config data, except for
        active peers (with registrations). They will only
@@ -28608,8 +28619,9 @@ static int reload_config(enum channelreloadreason reason)
        ast_copy_string(default_mohinterpret, DEFAULT_MOHINTERPRET, sizeof(default_mohinterpret));
        ast_copy_string(default_mohsuggest, DEFAULT_MOHSUGGEST, sizeof(default_mohsuggest));
        ast_copy_string(default_vmexten, DEFAULT_VMEXTEN, sizeof(default_vmexten));
-       ast_set_flag(&global_flags[0], SIP_DTMF_RFC2833);                       /*!< Default DTMF setting: RFC2833 */
-       ast_set_flag(&global_flags[0], SIP_DIRECT_MEDIA);                       /*!< Allow re-invites */
+       ast_set_flag(&global_flags[0], SIP_DTMF_RFC2833);    /*!< Default DTMF setting: RFC2833 */
+       ast_set_flag(&global_flags[0], SIP_DIRECT_MEDIA);    /*!< Allow re-invites */
+       ast_set_flag(&global_flags[0], SIP_NAT_FORCE_RPORT); /*!< Default to nat=force_rport */
        ast_copy_string(default_engine, DEFAULT_ENGINE, sizeof(default_engine));
        ast_copy_string(default_parkinglot, DEFAULT_PARKINGLOT, sizeof(default_parkinglot));
 
@@ -29394,6 +29406,7 @@ static int reload_config(enum channelreloadreason reason)
                        }
                        peer = build_peer(cat, ast_variable_browse(cfg, cat), NULL, 0, 0);
                        if (peer) {
+                               display_nat_warning(cat, reason, &peer->flags[0]);
                                ao2_t_link(peers, peer, "link peer into peers table");
                                if ((peer->type & SIP_TYPE_PEER) && !ast_sockaddr_isnull(&peer->addr)) {
                                        ao2_t_link(peers_by_ip, peer, "link peer into peers_by_ip table");

diff --git a/configs/sip.conf.sample b/configs/sip.conf.sample
index 3c77a88..cb49216 100644 (file)
--- a/configs/sip.conf.sample
+++ b/configs/sip.conf.sample
@@ -824,6 +824,14 @@ srvlookup=yes                   ; Enable DNS SRV lookups on outbound calls
 ; for their media streams is not actual port number that will be used on the nearer
 ; side of the NAT.
 ;
+; IT IS IMPORTANT TO NOTE that if the nat setting in the general section differs from
+; the nat setting in a peer definition, then the peer username will be discoverable
+; by outside parties as Asterisk will respond to different ports for defined and
+; undefined peers. For this reason it is recommended to ONLY DEFINE NAT SETTINGS IN THE
+; GENERAL SECTION. Specifically, if nat=force_rport in one section and nat=no in the
+; other, then valid users with settings differing from those in the general section will
+; be discoverable.
+;
 ; In addition to these settings, Asterisk *always* uses 'symmetric RTP' mode as defined by
 ; RFC 4961; Asterisk will always send RTP packets from the same port number it expects
 ; to receive them on.
@@ -1212,12 +1220,10 @@ srvlookup=yes                   ; Enable DNS SRV lookups on outbound calls
         type=friend
 
 [natted-phone](!,basic-options)   ; another template inheriting basic-options
-        nat=yes
         directmedia=no
         host=dynamic
 
 [public-phone](!,basic-options)   ; another template inheriting basic-options
-        nat=no
         directmedia=yes
 
 [my-codecs](!)                    ; a template for my preferred codecs
@@ -1257,7 +1263,6 @@ srvlookup=yes                   ; Enable DNS SRV lookups on outbound calls
 ;description=Courtesy Phone      ; Description of the peer. Shown when doing 'sip show peers'.
 ;host=192.168.0.23               ; we have a static but private IP address
                                  ; No registration allowed
-;nat=no                          ; there is not NAT between phone and Asterisk
 ;directmedia=yes                 ; allow RTP voice traffic to bypass Asterisk
 ;dtmfmode=info                   ; either RFC2833 or INFO for the BudgeTone
 ;call-limit=1                    ; permit only 1 outgoing call and 1 incoming call at a time
@@ -1287,7 +1292,6 @@ srvlookup=yes                   ; Enable DNS SRV lookups on outbound calls
 ;regexten=1234                   ; When they register, create extension 1234
 ;callerid="Jane Smith" <5678>
 ;host=dynamic                    ; This device needs to register
-;nat=yes                         ; X-Lite is behind a NAT router
 ;directmedia=no                  ; Typically set to NO if behind NAT
 ;disallow=all
 ;allow=gsm                       ; GSM consumes far less bandwidth than ulaw
@@ -1361,9 +1365,6 @@ srvlookup=yes                   ; Enable DNS SRV lookups on outbound calls
 ;type=friend
 ;secret=blah
 ;qualify=200                     ; Qualify peer is no more than 200ms away
-;nat=yes                         ; This phone may be natted
-                                 ; Send SIP and RTP to the IP address that packet is
-                                 ; received from instead of trusting SIP headers
 ;host=dynamic                    ; This device registers with us
 ;directmedia=no                  ; Asterisk by default tries to redirect the
                                  ; RTP media stream (audio) to go directly from