Summary: | ASTERISK-22738: "Security denial" error in calls from H323 trunk (ooh323.c) | ||
Reporter: | Gabriele Odone (gabrieleodone) | Labels: | |
Date Opened: | 2013-10-21 02:32:09 | Date Closed: | 2014-02-19 04:22:03.000-0600 |
Priority: | Major | Regression? | |
Status: | Closed/Complete | Components: | Addons/chan_ooh323 |
Versions: | 11.4.0 11.5.1 12.0.0-beta1 | Frequency of Occurrence | Constant |
Related Issues: | |||
Environment: | Linux RH 5.5 | Attachments: | ( 0) ASTERISK-22738-1.patch ( 1) h323_successful.pcap ( 2) h323.pcap |
Description: | Environment: Asterisk 11.4
Attempting H.323 trunk integration with a H323 Gateway ("Polycom CMA") using ooh323 module. When placing H323 calls from the H323 Gateway, the call goes through the trunk (as shown by tcpdump on Asterisk server) but is rejected by Asterisk with the following error in /var/log/asterisk/h323_log {noformat} 10:40:28:564 ERROR: Security denial remote sig IP isn't a socket ip, 10.44.1.156 not 10.71.0.55 (incoming, ooh323c_1) 10:40:28:565 ERROR:Failed ooH2250Receive - Clearing call (incoming, ooh323c_1) {noformat} In this log, 10.44.1.156 being IP address of H323 client registered to Polycom CMA, 10.71.0.55 being the address of Polycom CMA. tcpdump shows "disengageRequest" H.225 sent by Asterisk to Polycom CMA. I solved this problem by commenting these lines in ooh323.c and recompiling: {noformat} if (strncmp(remoteIP, call->remoteIP, strlen(remoteIP))) { OOTRACEERR5("ERROR: Security denial remote sig IP isn't a socket ip, %s not %s " "(%s, %s)\n", remoteIP, call->remoteIP, call->callType, call->callToken); return OO_FAILED; } {noformat} Same code on the latest 12.0 beta. I suppose this check is made for security reasons, but as you can see it blocks legitimate calls, thus making the trunk useless. I think a cofiguration parameter should be introduced to disable the check. I will attach the tcpdump. 10.71.0.55 being the address of Polycom CMA, 10.100.202.88 Asterisk server. Thanks Kind Regards, Gabriele Odone | ||
Comments: | By: Gabriele Odone (gabrieleodone) 2013-10-21 02:33:16.760-0500 referenced tcpdump collected on Asterisk server. By: Alexander Anikin (may213) 2013-10-22 05:50:09.139-0500 Gabriele, could you please attach cap file for success call on asterisk with your patch? It's need to see another packets with signalling from Polycom CMA. By: Gabriele Odone (gabrieleodone) 2013-10-22 07:07:55.913-0500 Hi Alexander, Please find attached a pcap file with successful call incoming from H323 trunk directed to a SIP client registered to Asterisk (and hang-up initiated by H323 client at the end). 10.71.0.55 = H323 Gateway 10.100.202.88 = Asterisk Server 10.44.1.156 = H323 client By: Alexander Anikin (may213) 2013-11-17 14:21:22.292-0600 Patch enable different between socket ip and callsignalsource ip for gatekeeper calls By: Alexander Anikin (may213) 2013-11-17 14:22:19.161-0600 Gabriele, Please try with attached patch. It enable different call IP's for gatekeeper routed calls. By: Gabriele Odone (gabrieleodone) 2013-11-19 03:25:43.050-0600 Hi Alexander, The patch works fine, thank you. Kind Regards Gabriele Odone |