[Home]

Summary:ASTERISK-22738: "Security denial" error in calls from H323 trunk (ooh323.c)
Reporter:Gabriele Odone (gabrieleodone)Labels:
Date Opened:2013-10-21 02:32:09Date Closed:2014-02-19 04:22:03.000-0600
Priority:MajorRegression?
Status:Closed/CompleteComponents:Addons/chan_ooh323
Versions:11.4.0 11.5.1 12.0.0-beta1 Frequency of
Occurrence		Constant
Related
Issues:
Environment:Linux RH 5.5Attachments:( 0) ASTERISK-22738-1.patch
( 1) h323_successful.pcap
( 2) h323.pcap
Description:Environment: Asterisk 11.4
Attempting H.323 trunk integration with a H323 Gateway ("Polycom CMA") using ooh323 module.

When placing H323 calls from the H323 Gateway, the call goes through the trunk (as shown by tcpdump on Asterisk server) but is rejected by Asterisk with the following error in /var/log/asterisk/h323_log

{noformat}
10:40:28:564 ERROR: Security denial remote sig IP isn't a socket ip, 10.44.1.156 not 10.71.0.55 (incoming, ooh323c_1)
10:40:28:565 ERROR:Failed ooH2250Receive - Clearing call (incoming, ooh323c_1)
{noformat}

In this log, 10.44.1.156 being IP address of H323 client registered to Polycom CMA, 10.71.0.55 being the address of Polycom CMA.

tcpdump shows "disengageRequest" H.225 sent by Asterisk to Polycom CMA.

I solved this problem by commenting these lines in ooh323.c and recompiling:

{noformat}
  if (strncmp(remoteIP, call->remoteIP, strlen(remoteIP))) {
    OOTRACEERR5("ERROR: Security denial remote sig IP isn't a socket ip, %s not %s "
    "(%s, %s)\n", remoteIP, call->remoteIP, call->callType,
    call->callToken);
    return OO_FAILED;
  }
{noformat}

Same code on the latest 12.0 beta.

I suppose this check is made for security reasons, but as you can see it blocks legitimate calls, thus making the trunk useless.
I think a cofiguration parameter should be introduced to disable the check.

I will attach the tcpdump. 10.71.0.55 being the address of Polycom CMA, 10.100.202.88 Asterisk server.

Thanks

Kind Regards,

Gabriele Odone
Comments:By: Gabriele Odone (gabrieleodone) 2013-10-21 02:33:16.760-0500

referenced tcpdump collected on Asterisk server.
By: Alexander Anikin (may213) 2013-10-22 05:50:09.139-0500

Gabriele,

could you please attach cap file for success call on asterisk with your patch?
It's need to see another packets with signalling from Polycom CMA.
By: Gabriele Odone (gabrieleodone) 2013-10-22 07:07:55.913-0500

Hi Alexander,

Please find attached a pcap file with successful call incoming from H323 trunk directed to a SIP client registered to Asterisk (and hang-up initiated by H323 client at the end).

10.71.0.55 = H323 Gateway
10.100.202.88 = Asterisk Server
10.44.1.156 = H323 client
By: Alexander Anikin (may213) 2013-11-17 14:21:22.292-0600

Patch enable different between socket ip and callsignalsource ip for gatekeeper calls
By: Alexander Anikin (may213) 2013-11-17 14:22:19.161-0600

Gabriele,

Please try with attached patch. It enable different call IP's for gatekeeper routed calls.
By: Gabriele Odone (gabrieleodone) 2013-11-19 03:25:43.050-0600

Hi Alexander,

The patch works fine, thank you.

Kind Regards
Gabriele Odone