From b21dd4e7f3a6f1d5f7be3ea500a319a5bc11db9e Mon Sep 17 00:00:00 2001
From: Donald Maxwell <donald.maxwell@signalwire.com>
Date: Thu, 3 Sep 2020 12:26:04 -0500
Subject: [PATCH] [Default-Configuration] Force sip subscription requests to
 require authentication.

---
 conf/insideout/sip_profiles/internal.xml | 2 ++
 conf/minimal/sip_profiles/internal.xml   | 2 ++
 conf/testing/sip_profiles/internal.xml   | 2 ++
 conf/vanilla/sip_profiles/internal.xml   | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/conf/insideout/sip_profiles/internal.xml b/conf/insideout/sip_profiles/internal.xml
index 158d5974a7..b64b5cea86 100644
--- a/conf/insideout/sip_profiles/internal.xml
+++ b/conf/insideout/sip_profiles/internal.xml
@@ -129,6 +129,8 @@
     <!-- add a ;received="<ip>:<port>" to the contact when replying to register for nat handling -->
     <!--<param name="NDLB-received-in-nat-reg-contact" value="true"/>-->
     <param name="auth-calls" value="$${internal_auth_calls}"/>
+    <!-- Force subscription requests to require authentication -->
+    <param name="auth-subscriptions" value="true"/>
     <!-- Force the user and auth-user to match. -->
     <param name="inbound-reg-force-matching-username" value="true"/>
     <!-- on authed calls, authenticate *all* the packets not just invite -->
diff --git a/conf/minimal/sip_profiles/internal.xml b/conf/minimal/sip_profiles/internal.xml
index f9d1f56338..8ac59684fc 100644
--- a/conf/minimal/sip_profiles/internal.xml
+++ b/conf/minimal/sip_profiles/internal.xml
@@ -1,6 +1,8 @@
 <profile name="internal">
   <settings>
     <param name="auth-calls" value="true"/>
+    <!-- Force subscription requests to require authentication -->
+    <param name="auth-subscriptions" value="true"/>
     <param name="apply-nat-acl" value="nat.auto"/>
 
     <param name="debug" value="0"/>
diff --git a/conf/testing/sip_profiles/internal.xml b/conf/testing/sip_profiles/internal.xml
index a5749324c5..2a3564ebb4 100644
--- a/conf/testing/sip_profiles/internal.xml
+++ b/conf/testing/sip_profiles/internal.xml
@@ -267,6 +267,8 @@
     <!-- add a ;received="<ip>:<port>" to the contact when replying to register for nat handling -->
     <!--<param name="NDLB-received-in-nat-reg-contact" value="true"/>-->
     <param name="auth-calls" value="$${internal_auth_calls}"/>
+    <!-- Force subscription requests to require authentication -->
+    <param name="auth-subscriptions" value="true"/>
     <!-- Force the user and auth-user to match. -->
     <param name="inbound-reg-force-matching-username" value="true"/>
     <!-- on authed calls, authenticate *all* the packets not just invite -->
diff --git a/conf/vanilla/sip_profiles/internal.xml b/conf/vanilla/sip_profiles/internal.xml
index da7abc07a6..58350e827b 100644
--- a/conf/vanilla/sip_profiles/internal.xml
+++ b/conf/vanilla/sip_profiles/internal.xml
@@ -267,6 +267,8 @@
     <!-- add a ;received="<ip>:<port>" to the contact when replying to register for nat handling -->
     <!--<param name="NDLB-received-in-nat-reg-contact" value="true"/>-->
     <param name="auth-calls" value="$${internal_auth_calls}"/>
+    <!-- Force subscription requests to require authentication -->
+    <param name="auth-subscriptions" value="true"/>
     <!-- Force the user and auth-user to match. -->
     <param name="inbound-reg-force-matching-username" value="true"/>
     <!-- on authed calls, authenticate *all* the packets not just invite -->