Skip to content

PJSIP source identify rules do not reject unmatched INVITEs #68

Description

@ryanmurf

Problem\n\nConfigured type=identify IP/CIDR matches are consulted only after authentication and dialplan lookup to label the created channel. An INVITE from an unmatched source is still challenged/routed/accepted. The configured source list therefore is not an allowlist.\n\n## Expected\n\nWhen at least one IP/CIDR match= rule is configured, treat the rules as a default-deny source ACL: match the actual transport source address at the beginning of initial INVITE and REGISTER handling, allow matching sources, and answer unmatched sources with 403 before digest authentication, extension lookup, or channel creation. A configuration with no IP match= rules retains the existing non-ACL behavior for authenticated endpoint deployments.\n\nRFC 3261 section 18.2.1 establishes the packet source as the transport peer; spoofable Via/From values are not an ACL identity. Section 21.4.4 defines 403 for a request the server understands but refuses to fulfill.\n\n## Regression test\n\nConfigure an authenticated endpoint with a CIDR identify rule. An unauthenticated INVITE from outside that CIDR must receive 403 (not the 401 it received before), create no call state, and never reach dialplan. A source inside the CIDR must proceed to the expected authentication challenge.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions