]> git.ipfire.org Git - thirdparty/asterisk.git/commit
AST-2012-013: Resolve ACL rules being ignored during calls by some IAX2 peers
authorMatthew Jordan <mjordan@digium.com>
Thu, 30 Aug 2012 16:22:54 +0000 (16:22 +0000)
committerMatthew Jordan <mjordan@digium.com>
Thu, 30 Aug 2012 16:22:54 +0000 (16:22 +0000)
commitd1c00fe8cddfdabe56b3467ce44170f1c475be6d
tree26d04244749c22d8dab3eb5a583ef377e7b45f6c
parent9e30706a68641cd14c28a03d19114c2426c64f73
AST-2012-013: Resolve ACL rules being ignored during calls by some IAX2 peers

When an IAX2 call is made using the credentials of a peer defined in a dynamic
Asterisk Realtime Architecture (ARA) backend, the ACL rules for that peer are
not applied to the call attempt. This allows for a remote attacker who is aware
of a peer's credentials to bypass the ACL rules set for that peer.

This patch ensures that the ACLs are applied for all peers, regardless of their
storage mechanism.

(closes issue ASTERISK-20186)
Reported by: Alan Frisch
Tested by: mjordan, Alan Frisch
........

Merged revisions 372015 from http://svn.asterisk.org/svn/asterisk/branches/1.8

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@372020 65c4cc65-6c06-0410-ace0-fbb531ad65f3
channels/chan_iax2.c