/* * Asterisk -- An open source telephony toolkit. * * Copyright (C) 2013, Digium, Inc. * * Mark Michelson * * See http://www.asterisk.org for more information about * the Asterisk project. Please do not directly contact * any of the maintainers of this project for assistance; * the project provides a web site, mailing lists and IRC * channels for your use. * * This program is free software, distributed under the terms of * the GNU General Public License Version 2. See the LICENSE file * at the top of the source tree. */ /*** MODULEINFO pjproject res_pjsip core ***/ #include "asterisk.h" #include #include "asterisk/res_pjsip.h" #include "asterisk/module.h" #include "asterisk/logger.h" #include "asterisk/sorcery.h" #include "asterisk/acl.h" #include "asterisk/stasis.h" #include "asterisk/security_events.h" /*** DOCUMENTATION SIP ACL module ACL The ACL module used by res_pjsip. This module is independent of endpoints and operates on all inbound SIP communication using res_pjsip. There are two main ways of defining your ACL with the options provided. You can use the permit and deny options which act on IP addresses, or the contactpermit and contactdeny options which act on Contact header addresses in incoming REGISTER requests. You can combine the various options to create a mixed ACL. Additionally, instead of defining an ACL with options, you can reference IP or Contact header ACLs from the file acl.conf by using the acl or contactacl options. Access Control List List of IP ACL section names in acl.conf This matches sections configured in acl.conf. The value is defined as a list of comma-delimited section names. List of Contact ACL section names in acl.conf This matches sections configured in acl.conf. The value is defined as a list of comma-delimited section names. List of Contact header addresses to deny The value is a comma-delimited list of IP addresses. IP addresses may have a subnet mask appended. The subnet mask may be written in either CIDR or dotted-decimal notation. Separate the IP address and subnet mask with a slash ('/') List of Contact header addresses to permit The value is a comma-delimited list of IP addresses. IP addresses may have a subnet mask appended. The subnet mask may be written in either CIDR or dotted-decimal notation. Separate the IP address and subnet mask with a slash ('/') List of IP addresses to deny access from The value is a comma-delimited list of IP addresses. IP addresses may have a subnet mask appended. The subnet mask may be written in either CIDR or dotted-decimal notation. Separate the IP address and subnet mask with a slash ('/') List of IP addresses to permit access from The value is a comma-delimited list of IP addresses. IP addresses may have a subnet mask appended. The subnet mask may be written in either CIDR or dotted-decimal notation. Separate the IP address and subnet mask with a slash ('/') Must be of type 'acl'. ***/ static struct stasis_subscription *acl_change_sub; static int apply_acl(pjsip_rx_data *rdata, struct ast_acl_list *acl) { struct ast_sockaddr addr; if (ast_acl_list_is_empty(acl)) { return 0; } memset(&addr, 0, sizeof(addr)); ast_sockaddr_parse(&addr, rdata->pkt_info.src_name, PARSE_PORT_FORBID); ast_sockaddr_set_port(&addr, rdata->pkt_info.src_port); if (ast_apply_acl(acl, &addr, "SIP ACL: ") != AST_SENSE_ALLOW) { ast_log(LOG_WARNING, "Incoming SIP message from %s did not pass ACL test\n", ast_sockaddr_stringify(&addr)); return 1; } return 0; } static int extract_contact_addr(pjsip_contact_hdr *contact, struct ast_sockaddr **addrs) { pjsip_sip_uri *sip_uri; char host[256]; if (!contact || contact->star) { *addrs = NULL; return 0; } if (!PJSIP_URI_SCHEME_IS_SIP(contact->uri) && !PJSIP_URI_SCHEME_IS_SIPS(contact->uri)) { *addrs = NULL; return 0; } sip_uri = pjsip_uri_get_uri(contact->uri); ast_copy_pj_str(host, &sip_uri->host, sizeof(host)); return ast_sockaddr_resolve(addrs, host, PARSE_PORT_FORBID, AST_AF_UNSPEC); } static int apply_contact_acl(pjsip_rx_data *rdata, struct ast_acl_list *contact_acl) { int num_contact_addrs; int forbidden = 0; struct ast_sockaddr *contact_addrs; int i; pjsip_contact_hdr *contact = (pjsip_contact_hdr *)&rdata->msg_info.msg->hdr; if (ast_acl_list_is_empty(contact_acl)) { return 0; } while ((contact = pjsip_msg_find_hdr(rdata->msg_info.msg, PJSIP_H_CONTACT, contact->next))) { num_contact_addrs = extract_contact_addr(contact, &contact_addrs); if (num_contact_addrs <= 0) { continue; } for (i = 0; i < num_contact_addrs; ++i) { if (ast_apply_acl(contact_acl, &contact_addrs[i], "SIP Contact ACL: ") != AST_SENSE_ALLOW) { ast_log(LOG_WARNING, "Incoming SIP message from %s did not pass ACL test\n", ast_sockaddr_stringify(&contact_addrs[i])); forbidden = 1; break; } } ast_free(contact_addrs); if (forbidden) { /* No use checking other contacts if we already have failed ACL check */ break; } } return forbidden; } #define SIP_SORCERY_ACL_TYPE "acl" /*! * \brief SIP ACL details and configuration. */ struct ast_sip_acl { SORCERY_OBJECT(details); struct ast_acl_list *acl; struct ast_acl_list *contact_acl; }; static int check_acls(void *obj, void *arg, int flags) { struct ast_sip_acl *sip_acl = obj; pjsip_rx_data *rdata = arg; if (apply_acl(rdata, sip_acl->acl) || apply_contact_acl(rdata, sip_acl->contact_acl)) { return CMP_MATCH | CMP_STOP; } return 0; } static pj_bool_t acl_on_rx_msg(pjsip_rx_data *rdata) { RAII_VAR(struct ao2_container *, acls, ast_sorcery_retrieve_by_fields( ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, AST_RETRIEVE_FLAG_MULTIPLE | AST_RETRIEVE_FLAG_ALL, NULL), ao2_cleanup); RAII_VAR(struct ast_sip_acl *, matched_acl, NULL, ao2_cleanup); if (!acls) { ast_log(LOG_ERROR, "Unable to retrieve ACL sorcery data\n"); return PJ_FALSE; } if ((matched_acl = ao2_callback(acls, 0, check_acls, rdata))) { if (rdata->msg_info.msg->line.req.method.id != PJSIP_ACK_METHOD) { pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 403, NULL, NULL, NULL); } return PJ_TRUE; } return PJ_FALSE; } static int acl_handler(const struct aco_option *opt, struct ast_variable *var, void *obj) { struct ast_sip_acl *sip_acl = obj; int error = 0; int ignore; if (!strncmp(var->name, "contact_", 8)) { ast_append_acl(var->name + 8, var->value, &sip_acl->contact_acl, &error, &ignore); if (error) { ast_log(LOG_ERROR, "Bad contact ACL '%s' at line '%d' of pjsip.conf\n", var->value, var->lineno); } } else { ast_append_acl(var->name, var->value, &sip_acl->acl, &error, &ignore); if (error) { ast_log(LOG_ERROR, "Bad ACL '%s' at line '%d' of pjsip.conf\n", var->value, var->lineno); } } if (error) { ast_log(LOG_ERROR, "There is an error in ACL configuration. Blocking ALL SIP traffic.\n"); ast_append_acl("deny", "0.0.0.0/0.0.0.0", &sip_acl->acl, NULL, &ignore); } return error; } static pjsip_module acl_module = { .name = { "ACL Module", 14 }, /* This should run after a logger but before anything else */ .priority = 1, .on_rx_request = acl_on_rx_msg, }; static void acl_destroy(void *obj) { struct ast_sip_acl *sip_acl = obj; sip_acl->acl = ast_free_acl_list(sip_acl->acl); sip_acl->contact_acl = ast_free_acl_list(sip_acl->contact_acl); } static void *acl_alloc(const char *name) { struct ast_sip_acl *sip_acl = ast_sorcery_generic_alloc(sizeof(*sip_acl), acl_destroy); return sip_acl; } static void acl_change_stasis_cb(void *data, struct stasis_subscription *sub, struct stasis_message *message) { if (stasis_message_type(message) != ast_named_acl_change_type()) { return; } ast_sorcery_force_reload_object(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE); } static int load_module(void) { ast_sorcery_apply_config(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE); ast_sorcery_apply_default(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, "config", "pjsip.conf,criteria=type=acl"); if (ast_sorcery_object_register(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, acl_alloc, NULL, NULL)) { ast_log(LOG_ERROR, "Failed to register SIP %s object with sorcery\n", SIP_SORCERY_ACL_TYPE); return AST_MODULE_LOAD_DECLINE; } ast_sorcery_object_field_register(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, "type", "", OPT_NOOP_T, 0, 0); ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, "permit", "", acl_handler, NULL, NULL, 0, 0); ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, "deny", "", acl_handler, NULL, NULL, 0, 0); ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, "acl", "", acl_handler, NULL, NULL, 0, 0); ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, "contact_permit", "", acl_handler, NULL, NULL, 0, 0); ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, "contact_deny", "", acl_handler, NULL, NULL, 0, 0); ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE, "contact_acl", "", acl_handler, NULL, NULL, 0, 0); ast_sorcery_load_object(ast_sip_get_sorcery(), SIP_SORCERY_ACL_TYPE); acl_change_sub = stasis_subscribe(ast_security_topic(), acl_change_stasis_cb, NULL); stasis_subscription_accept_message_type(acl_change_sub, ast_named_acl_change_type()); stasis_subscription_set_filter(acl_change_sub, STASIS_SUBSCRIPTION_FILTER_SELECTIVE); ast_sip_register_service(&acl_module); return AST_MODULE_LOAD_SUCCESS; } static int unload_module(void) { acl_change_sub = stasis_unsubscribe_and_join(acl_change_sub); ast_sip_unregister_service(&acl_module); return 0; } AST_MODULE_INFO(ASTERISK_GPL_KEY, AST_MODFLAG_LOAD_ORDER, "PJSIP ACL Resource", .support_level = AST_MODULE_SUPPORT_CORE, .load = load_module, .unload = unload_module, .load_pri = AST_MODPRI_APP_DEPEND, .requires = "res_pjsip", );