From: Kinsey Moore <kmoore@digium.com>
Date: Mon, 31 Dec 2012 14:41:37 +0000 (+0000)
Subject: Ensure chan_sip rejects encrypted streams without crypto info
X-Git-Tag: 1.8.21.0-rc1~47
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=367bed142a7648a5f7d07f500ebf8ab080e1eeb5;p=thirdparty%2Fasterisk.git

Ensure chan_sip rejects encrypted streams without crypto info

This ensures that Asterisk rejects encrypted media streams (RTP/SAVP
audio and video) that are missing cryptographic keys and ensures that
the incoming SDP is consistent with RFC4568 as far as having a crypto
attribute present for any SAVP streams.

Review: https://reviewboard.asterisk.org/r/2204/


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@378217 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index d0857dcfbb..18a0f7cf2d 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -9547,6 +9547,15 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
 				  type, value,
 				  (processed == TRUE)? "OK." : "UNSUPPORTED OR FAILED.");
 		}
+
+		/* Ensure crypto lines are provided where necessary */
+		if (audio && secure_audio && !processed_crypto) {
+			ast_log(LOG_WARNING, "Rejecting secure audio stream without encryption details: %s\n", m);
+			return -1;
+		} else if (video && secure_video && !processed_crypto) {
+			ast_log(LOG_WARNING, "Rejecting secure video stream without encryption details: %s\n", m);
+			return -1;
+		}
 	}
 
 	/* Sanity checks */