diff options
author | Russell Bryant <russell@russellbryant.com> | 2009-09-04 13:14:25 +0000 |
---|---|---|
committer | Russell Bryant <russell@russellbryant.com> | 2009-09-04 13:14:25 +0000 |
commit | ca23afaf2d2ad38a0b881addc37097c45a942c47 (patch) | |
tree | 691919ade6335320f13a6f266a3d58521e37a594 | |
parent | 773e22596a7e44de482add4c6f30e3e6b2f290e4 (diff) |
Do not treat every SIP peer as if they were configured with insecure=port.
There was a problem in the function responsible for doing peer matching by
IP address and port number such that during the second pass for checking for
a peer configured with insecure=port, it would end up treating every peer as
if it had been configured that way. These changes fix the logic in the peer
IP and port comparison callback to handle insecure=port checking properly.
This problem was introduced when SIP peers were converted to astobj2. Many
thanks to dvossel for noticing this while working on another peer matching
issue.
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@216368 65c4cc65-6c06-0410-ace0-fbb531ad65f3
-rw-r--r-- | channels/chan_sip.c | 36 |
1 files changed, 28 insertions, 8 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index 5bd05b0a1..edf631d5b 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -2186,22 +2186,42 @@ static int peer_iphash_cb(const void *obj, const int flags) } /*! + * Match Peers by IP and Port number. + * + * This function has two modes. + * - If the peer arg does not have INSECURE_PORT set, then we will only return + * a match for a peer that matches both the IP and port. + * - If the peer arg does have the INSECURE_PORT flag set, then we will only + * return a match for a peer that matches the IP and has insecure=port + * in its configuration. + * + * This callback will be used twice when doing peer matching. There is a first + * pass for full IP+port matching, and a second pass in case there is a match + * that meets the insecure=port criteria. + * * \note the peer's addr struct provides to fields combined to make a key: the sin_addr.s_addr and sin_port fields. */ static int peer_ipcmp_cb(void *obj, void *arg, int flags) { struct sip_peer *peer = obj, *peer2 = arg; - if (peer->addr.sin_addr.s_addr != peer2->addr.sin_addr.s_addr) + if (peer->addr.sin_addr.s_addr != peer2->addr.sin_addr.s_addr) { + /* IP doesn't match */ return 0; - - if (!ast_test_flag(&peer->flags[0], SIP_INSECURE_PORT) && !ast_test_flag(&peer2->flags[0], SIP_INSECURE_PORT)) { - if (peer->addr.sin_port == peer2->addr.sin_port) - return CMP_MATCH | CMP_STOP; - else - return 0; } - return CMP_MATCH | CMP_STOP; + + /* We matched the IP, now check the port if appropriate. */ + + if (ast_test_flag(&peer2->flags[0], SIP_INSECURE_PORT)) { + /* We are allowing match without port for peers configured that + * way in this pass through the peers. */ + return ast_test_flag(&peer->flags[0], SIP_INSECURE_PORT) ? + (CMP_MATCH | CMP_STOP) : 0; + } + + /* Only return a match if the port matches, as well. */ + + return peer->addr.sin_port == peer2->addr.sin_port ? (CMP_MATCH | CMP_STOP) : 0; } /*! |