IAX2 encryption regression

The IAX2 Call Token security patch inadvertently broke the use of
encryption due to the reorganization of code in the socket_process()
function.  When encryption is used, an incoming full frame must first
be decrypted before the information elements can be parsed.  The
security release mistakenly moved IE parsing before decryption in
order to process the new Call Token IE.  To resolve this, decryption
of full frames is once again done before looking into the frame.  This
involves searching for an existing callno, checking the pvt to see if
encryption is turned on, and decrypting the packet before the internal
fields of the full frame are accessed.

associated with AST-2009-006

(closes issue #15834)
Reported by: karesmakro
Patches:
      iax2_encryption_fix_1.4.diff uploaded by dvossel (license 671)
Tested by: dvossel, karesmakro

Review: https://reviewboard.asterisk.org/r/355/

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@217887 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c
index f47ca82022d040af7dce1c5f75e787829e624d49..8ef382af735d9a09981e69dd865fa5c00435d6ac 100644 (file)
--- a/channels/chan_iax2.c
+++ b/channels/chan_iax2.c
@@ -7634,6 +7634,7 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
        void *ptr;
        socklen_t len = sizeof(sin);
        int dcallno = 0;
+       char decrypted = 0;
        struct ast_iax2_full_hdr *fh = (struct ast_iax2_full_hdr *)buf;
        struct ast_iax2_mini_hdr *mh = (struct ast_iax2_mini_hdr *)buf;
        struct ast_iax2_meta_hdr *meta = (struct ast_iax2_meta_hdr *)buf;
@@ -7833,6 +7834,25 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
 
                /* Get the destination call number */
                dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS;
+
+
+               /* check to make sure this full frame isn't encrypted before we attempt
+                * to look inside of it. If it is encrypted, decrypt it first. Its ok if the
+                * callno is not found here, that just means one hasn't been allocated for
+                * this connection yet. */
+               if ((dcallno != 1) && (fr->callno = find_callno(ntohs(mh->callno) & ~IAX_FLAG_FULL, dcallno, &sin, NEW_PREVENT, 1, fd, 1))) {
+                       ast_mutex_lock(&iaxsl[fr->callno]);
+                       if (ast_test_flag(iaxs[fr->callno], IAX_ENCRYPTED)) {
+                               if (decrypt_frame(fr->callno, fh, &f, &res)) {
+                                       ast_log(LOG_NOTICE, "Packet Decrypt Failed!\n");
+                                       ast_mutex_unlock(&iaxsl[fr->callno]);
+                                       return 1;
+                               }
+                               decrypted = 1;
+                       }
+                       ast_mutex_unlock(&iaxsl[fr->callno]);
+               }
+
                /* Retrieve the type and subclass */
                f.frametype = fh->type;
                if (f.frametype == AST_FRAME_VIDEO) {
@@ -7942,17 +7962,19 @@ static int socket_read(int *id, int fd, short events, void *cbdata)
                        ast_mutex_unlock(&iaxsl[fr->callno]);
                return 1;
        }
-       if (ast_test_flag(iaxs[fr->callno], IAX_ENCRYPTED)) {
+       if (ast_test_flag(iaxs[fr->callno], IAX_ENCRYPTED) && !decrypted) {
                if (decrypt_frame(fr->callno, fh, &f, &res)) {
                        ast_log(LOG_NOTICE, "Packet Decrypt Failed!\n");
                        ast_mutex_unlock(&iaxsl[fr->callno]);
                        return 1;
                }
+               decrypted = 1;
+       }
 #ifdef DEBUG_SUPPORT
-               else if (iaxdebug)
-                       iax_showframe(NULL, fh, 3, &sin, res - sizeof(*fh));
-#endif
+       if (decrypted && iaxdebug) {
+               iax_showframe(NULL, fh, 3, &sin, res - sizeof(*fh));
        }
+#endif
 
        /* count this frame */
        iaxs[fr->callno]->frames_received++;