Changes On IAX2 Protocol To Prevent VoIP DDOS (AST-2009-006)

Asterisk Security
Asterisk Security list has posted has  published Security Advisory - AST-2009-006 outlining the needs for changes.
There is an accompanying IAX2-security.pdf that has information on the advisory. The following is an excerpt from the posted information.
The IAX2 protocol uses a call number to associate messages with the call that they belong to. However, the protocol defines the call number field in messages as a fixed size 15 bit field. So, if all call numbers are in use, no additional sessions can be handled.             
A call number gets created at the start of an IAX2 message exchange. So, an attacker can send a large number of messages and consume the call number space. The attack is also possible using spoofed source IP addresses as no handshake is required before a call number is assigned.                                  
Purposed and advised resolution  is to upgrade to a version of Asterisk listed in this document as containing the IAX2 protocol security enhancements. In addition to upgrading, administrators should consult the users guide section of the IAX2 Security document (IAX2-security.pdf), as well as the sample configuration file for chan_iax2 that have been distributed with those releases for assistance with new options that have been provided.

+-----------------------------------------------------------------------+
   |                       Affected Versions                            |
   |--------------------------------------------------------------------|
   |             Product          | Release Series |                    |
   |------------------------------+----------------+--------------------|
   |       Asterisk Open Source   |     1.2.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |       Asterisk Open Source   |     1.4.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |       Asterisk Open Source   |     1.6.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |    Asterisk Business Edition |     B.x.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |    Asterisk Business Edition |     C.x.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |    s800i (Asterisk Appliance)|     1.3.x      | All versions       |
   +--------------------------------------------------------------------+

   +-------------------------------------------------------------------+
   |                              Corrected In                         |
   |-------------------------------------------------------------------|
   |                   Product              |         Release          |
   |----------------------------------------+--------------------------|
   |            Asterisk Open Source        |          1.2.35          |
   |----------------------------------------+--------------------------|
   |            Asterisk Open Source        |         1.4.26.2         |
   |----------------------------------------+--------------------------|
   |            Asterisk Open Source        |         1.6.0.15         |
   |----------------------------------------+--------------------------|
   |            Asterisk Open Source        |         1.6.1.6          |
   |----------------------------------------+--------------------------|
   |          Asterisk Business Edition     |         B.2.5.10         |
   |----------------------------------------+--------------------------|
   |          Asterisk Business Edition     |         C.2.4.3          |
   |----------------------------------------+--------------------------|
   |          Asterisk Business Edition     |         C.3.1.1          |
   |----------------------------------------+--------------------------|
   |         S800i (Asterisk Appliance)     |         1.3.0.3          |
   +-------------------------------------------------------------------+

VoIP Phone Supports H.323,MGCP,SIP,IAX2 And Many Codecs

Multi Protocol VoIP Phone, YWH500
A Company in China, Zhengzhou Yuneng Communication Co., Ltd, has released a VoIP Phone that fits most of the VoIP networks that exists today.
As well as supporting H.323 MGCP SIP IAX2, the phone supports G.711, G.723.1, G729 codec among others. The phones lists following features as well;
Multi-Language support (Chinese,English,Japanese,German,French,Spanish,Italian)
Tone generation and Local DTMF generation and detection according with ITU-T
call hold;Unattended/ attended call transfer
call waiting and per call-waiting blocking
call forward (Always, busy, no answer, power off)
Large 2*16 LCD with blue back light
12 function keys for operating and setting phone besides standard keys 0-9,#
Hotline
80 entries each for missed calls, answered calls and dialed calls
100 entries for speed dial number
voice promote,configurable jitter buffer size,configurable audio frame
adjustable user password and super password
http, telnet, keypad and dedicate manage tool
URL based FTP,HTTP and TFTP auto provision
E.164 dial plan and customized dial rules

You can read more info at VoIP-Info.ORG article. Pricing was not indicated.

Tags: E.164 dial plan, H.323, MGCP, SIP, IAX2, VoIP Phone, G.711, G.723.1, G729

The Asterisk Development Team Releases The Asterisk 1.6.1.0

http://snapvoip.blogspot.com/

The Asterisk Development Team has released the Asterisk 1.6.1.0. Asterisk 1.6.1.0 is available for immediate download at Digium Downloads

This being the first in the 1.6.1 branch, there are additional features that are added since 1.6.0. Please see the CHANGES file for more information about the additional functionality

If you are upgrading from previous versions of Asterisk, like Asterisk 1.6.1.0-RC5, you are directed to review the UPGRADE.txt file.

Also do not forget to get Asterisk-Addons 1.6.1.0.

Notable changes in this release:
----------------------------------------------

* It is now possible to specify a pattern match as a hint. Once a phone subscribes to something that matches the pattern a hint will be created using the contents and variables evaluated.

* IAX2 encryption support has been improved to support periodic key rotation within a call for enhanced security. The option "keyrotate" has been provided to disable this functionality to preserve backwards compatibility with older versions of IAX2 that do not support key rotation.

* res_odbc no longer has a limit of 1023 total possible unshared connections, as some people were running into this limit. This limit has been increased to 4.2 billion.

* Several (ODBC, Postgres, MySQL, SQLite) realtime drivers have been given adaptive capabilities. What this means in practical terms is that if your realtime table lacks critical fields, Asterisk will now emit warnings to that effect. Also, some of the realtime drivers have the ability (if configured) to automatically add those columns to the table with the correct type and length.

* Config file variables may now be appended to, by using the '+=' append operator. This is most helpful when working with long SQL queries in func_odbc.conf, as the queries no longer need to be specified on a single line.

Tags: Asterisk 1.6.1.0, IAX2 encryption, IAX2, Asterisk 1.6.1.0-RC5

IAX2 Becomes RFC 5456, Congratulations RFC Team!

http://snapvoip.blogspot.com/
I saw this wonderful message on Asterisk Dev List posted by John Todd! Congratulations to hard working team, Ed Guy, Mark Spencer, Brian Capouch, Frank Miller, and Kenny Shumard! Now to find a good beer! Amoocon is a good place to celebrate this!

Mark and Ed received word today that the long-awaited RFC for IAX2 has
been approved by the IETF, and is now published:

http://www.rfc-editor.org/authors/rfc5456.txt

Thanks to Ed Guy, Mark Spencer, Brian Capouch, Frank Miller, and Kenny
Shumard!  Lots of revisions and discussions have paid off.

JT

---
John Todd                       email:jtodd at digium.com
Digium, Inc. | Asterisk Open Source Community Director
445 Jan Davis Drive NW -  Huntsville AL 35806  -   USA
direct: +1-256-428-6083         http://www.digium.com/

Tags: RFC 5456, IAX2, Asterisk, Ed Guy, Mark Spencer, Brian Capouch, Frank Miller, Kenny Shumard, Asterisk Dev List

Asterisk 1.6.0.6-rc1 Yours For The Taking

http://snapvoip.blogspot.com/
Asterisk Development team has released the Asterisk 1.6.0.6-rc1yesterday. This release of Asterisk fixes several issues related to overall stability and usability, especially with applications and their options. In addition, an issue with IAX2 transfers not taking place has been fixed. Issues found in this release candidate can be reported at http://bugs.digium.com/.
Download at http://downloads.digium.com/

Tags: Asterisk, Asterisk 1.6.0.6-rc1, IAX2

Zoiper Free for all major platforms, Linux, OS X and windows

Attractel has released two versions of Zoiper IAX and SIP softphone: Zoiper 2.0 for Linux and Zoiper 2.0 for Mac Os X. (There is also Zoiper 2.0 for Windows.). These are all free versions. In addition to free versions, there is also a BIZ version available as well. The BIZ version has more options and you can compare those here.

Following is from release notes;

Linux, ver. 2.0:

• RTP media address is set automatically
• Implemented per account options (STUN for SIP accounts and codecs)
• Fixed problem with the audio
• Fixed bug: when dial is clicked and no account is selected, Zoiper crashes
• Fixed bug: when deleting last account, pressing OK crashes the phone
• Fixed creating of new accounts- empty name is not permitted anymore

Tags: IAX, IAX2, VoIP Client, Zoiper Free, Zoiper BIZ, Mac OS X

Asterisk 1.4 branch, what changes did it bring? Updated

Following an article on Asterisk blog by Russell, "Sneak peek at new features" and provided a link to SVN reository. Following is a part of it (85 lines, there are 235 lines of description). I was surprised that so many features had sneaked by and yet we are happy to use...!

UPDATE!
Seems like formatting makes this impossible to read;

So you have to go Asterisk developer site (SVN repository) see the complete document.
Thanks

1 -------------------------------------------------------------------------------
    2 --- Functionality changes since Asterisk 1.4-beta was branched ----------------
    3 -------------------------------------------------------------------------------
    4      5 AMI - The manager (TCP/TLS/HTTP)
    6 --------------------------------
    7   * Added the URI redirect option for the built-in HTTP server
    8   * The output of CallerID in Manager events is now more consistent.
    9      CallerIDNum is used for number and CallerIDName for name.
   10   * enable https support for builtin web server.
   11      See configs/http.conf.sample for details.
   12   * Added a new action, GetConfigJSON, which can return the contents of an
   13      Asterisk configuration file in JSON format.  This is intended to help
   14      improve the performance of AJAX applications using the manager interface
   15      over HTTP.
   16   * SIP and IAX manager events now use "ChannelType" in all cases where we
   17      indicate channel driver. Previously, we used a mixture of "Channel"
   18      and "ChannelDriver" headers.
   19   * Added a "Bridge" action which allows you to bridge any two channels that
   20      are currently active on the system.
   21   * Added a "ListAllVoicemailUsers" action that allows you to get a list of all
   22      the voicemail users setup.
   23     24 Dialplan functions
   25 ------------------
   26   * Added the DEVSTATE() dialplan function which allows retrieving any device
   27     state in the dialplan, as well as creating custom device states that are
   28     controllable from the dialplan.
   29   * Extend CALLERID() function with "pres" and "ton" parameters to
   30      fetch string representation of calling number presentation indicator
   31      and numeric representation of type of calling number value.
   32   * MailboxExists converted to dialplan function
   33     34 CLI Changes
   35 -----------
   36   * New CLI command "core show settings"
   37   * Added 'core show channels count' CLI command.
   38     39 SIP changes
   40 -----------
   41   * The default SIP useragent= identifier now includes the Asterisk version
   42   * A new option, match_auth_username in sip.conf changes the matching of incoming requests.
   43      If set, and the incoming request carries authentication info,
   44      the username to match in the users list is taken from the Digest header
   45      rather than from the From: field. This feature is considered experimental.
   46   * The "musiconhold" and "musicclass" settings in sip.conf are now removed,
   47      since they where replaced by "mohsuggest" and "mohinterpret" in version 1.4
   48   * The "localmask" setting was removed in version 1.2 and the reminder about it
   49      being removed is now also removed.
   50   * A new option "busy-level" for setting a level of calls where asterisk reports
   51      a device as busy, to separate it from call-limit
   52   * A new realtime family called "sipregs" is now supported to store SIP registration
   53      data. If this family is defined, "sippeers" will be used for configuration and
   54      "sipregs" for registrations. If it's not defined, "sippeers" will be used for
   55      registration data, as before.
   56   * The SIPPEER function have new options for port address, call and pickup groups
   57   * Added support for T.140 realtime text in SIP/RTP
   58   * The "checkmwi" option has been removed from sip.conf, as it is no longer
   59      required due to the restructuring of how MWI is handled.  See the descriptions
   60      in this file of the "pollmailboxes" and "pollfreq" options to voicemail.conf
   61      for more information.
   62   * Added rtpdest option to CHANNEL() dialplan function.
   63   * Added SIPREFERRINGCONTEXT and SIPREFERREDBYHDR variables which are set when a transfer takes place.
   64     65 IAX2 changes
   66 ------------
   67   * Added the trunkmaxsize configuration option to chan_iax2.
   68   * Added the srvlookup option to iax.conf
   69   * Added support for OSP.  The token is set and retrieved through the CHANNEL()
   70      dialplan function.
   71     72 DUNDi changes
   73 -------------
   74   * Added the ability to specify arguments to the Dial application when using
   75      the DUNDi switch in the dialplan.
   76   * Added the ability to set weights for responses dynamically.  This can be
   77      done using a global variable or a dialplan function.  Using the SHELL()
   78      function would allow you to have an external script set the weight for
   79      each response.
   80   * Added two new dialplan functions, DUNDIQUERY and DUNDIRESULT.  These
   81      functions will allow you to initiate a DUNDi query from the dialplan,
   82      find out how many results there are, and access each one.
   83     84 ENUM changes
85....
235.....
So you have to go Asterisk developer site (SVN repository) see the rest of the lines.
"Sneak peek at new features"

Tags: Asterisk, AMI - The manager, Dialplan, CALLERID, SIP, SIPPEER, IAX2, DUNDI, ENUM