Let's say a weird way to do NAT.
To make it short, the algorithm to compute the external source port of a connection was statically computed from source IP and source port (no randomization of any kind).
So basically, if you had a packet coming from internal IP:port and one coming from internal IP+1:port-1, both were using the same outside port....
You can imagine the result of that with RTP and its systematic RTCP flow using the same port+1.
We had no to number the IP Phones using consecutive IP addresses...

The issue is I had trouble to convince the support that was very wrong.

David Ponzone  Direction Technique
tel:      01 74 03 18 97
gsm:   06 66 98 76 34

Service Client IPeva
tel:      0811 46 26 26

Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.




Le 18/06/2011 à 18:31, shouldbe q931 a écrit :

2011/6/18 David Ponzone <david.ponzone@ipeva.fr>:
I found bugs in the NAT layer of the Vigor 2820 that I prefer not to tell
you about....

Is this a security issue, or a breaks protocol x issue ?

_______________________________________________
Join us at ClueCon 2011, Aug 9-11, Chicago
http://www.cluecon.com 877-7-4ACLUE

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org