You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Problem\n\nConfigured type=identify IP/CIDR matches are consulted only after authentication and dialplan lookup to label the created channel. An INVITE from an unmatched source is still challenged/routed/accepted. The configured source list therefore is not an allowlist.\n\n## Expected\n\nWhen at least one IP/CIDR match= rule is configured, treat the rules as a default-deny source ACL: match the actual transport source address at the beginning of initial INVITE and REGISTER handling, allow matching sources, and answer unmatched sources with 403 before digest authentication, extension lookup, or channel creation. A configuration with no IP match= rules retains the existing non-ACL behavior for authenticated endpoint deployments.\n\nRFC 3261 section 18.2.1 establishes the packet source as the transport peer; spoofable Via/From values are not an ACL identity. Section 21.4.4 defines 403 for a request the server understands but refuses to fulfill.\n\n## Regression test\n\nConfigure an authenticated endpoint with a CIDR identify rule. An unauthenticated INVITE from outside that CIDR must receive 403 (not the 401 it received before), create no call state, and never reach dialplan. A source inside the CIDR must proceed to the expected authentication challenge.
Problem\n\nConfigured
type=identifyIP/CIDR matches are consulted only after authentication and dialplan lookup to label the created channel. An INVITE from an unmatched source is still challenged/routed/accepted. The configured source list therefore is not an allowlist.\n\n## Expected\n\nWhen at least one IP/CIDRmatch=rule is configured, treat the rules as a default-deny source ACL: match the actual transport source address at the beginning of initial INVITE and REGISTER handling, allow matching sources, and answer unmatched sources with 403 before digest authentication, extension lookup, or channel creation. A configuration with no IPmatch=rules retains the existing non-ACL behavior for authenticated endpoint deployments.\n\nRFC 3261 section 18.2.1 establishes the packet source as the transport peer; spoofable Via/From values are not an ACL identity. Section 21.4.4 defines 403 for a request the server understands but refuses to fulfill.\n\n## Regression test\n\nConfigure an authenticated endpoint with a CIDR identify rule. An unauthenticated INVITE from outside that CIDR must receive 403 (not the 401 it received before), create no call state, and never reach dialplan. A source inside the CIDR must proceed to the expected authentication challenge.