3927f79cb5
Integrated STIR/SHAKEN support with incoming INVITES. Upon receiving an INVITE, the Identity header is retrieved, parsing the message to verify the signature. If any of the parsing fails, AST_STIR_SHAKEN_VERIFY_NOT_PRESENT will be added to the channel for this caller ID. If verification itself fails, AST_STIR_SHAKEN_VERIFY_SIGNATURE_FAILED will be added. If anything in the payload does not line up with the SIP signaling, AST_STIR_SHAKEN_VERIFY_MISMATCH will be added. If all of the above steps pass, then AST_STIR_SHAKEN_VERIFY_PASSED will be added, completing the verification process. A new config option has been added to the general section for stir_shaken.conf. "signature_timeout" is the amount of time a signature will be considered valid. If an INVITE is received and the amount of time between when it was received and when it was signed is greater than signature_timeout, verification will fail. Some changes were also made to signing and verification. There was an error where the whole JSON string was being signed rather than the header combined with the payload. This has been changed to sign the correct thing. Verification has been changed to do this as well, and the unit tests have been updated to reflect these changes. A couple of utility functions have also been added. One decodes a BASE64 string and returns the decoded string, doing all the length calculations for you. The other retrieves a string value from a header in a rdata object. Change-Id: I855f857be3d1c63b64812ac35d9ce0534085b913
112 lines
3.2 KiB
C
112 lines
3.2 KiB
C
/*
|
|
* Asterisk -- An open source telephony toolkit.
|
|
*
|
|
* Copyright (C) 2020, Sangoma Technologies Corporation
|
|
*
|
|
* Kevin Harwell <kharwell@sangoma.com>
|
|
*
|
|
* See http://www.asterisk.org for more information about
|
|
* the Asterisk project. Please do not directly contact
|
|
* any of the maintainers of this project for assistance;
|
|
* the project provides a web site, mailing lists and IRC
|
|
* channels for your use.
|
|
*
|
|
* This program is free software, distributed under the terms of
|
|
* the GNU General Public License Version 2. See the LICENSE file
|
|
* at the top of the source tree.
|
|
*/
|
|
#ifndef _STIR_SHAKEN_GENERAL_H
|
|
#define _STIR_SHAKEN_GENERAL_H
|
|
|
|
struct ast_sorcery;
|
|
|
|
/*!
|
|
* \brief General configuration for stir/shaken
|
|
*/
|
|
struct stir_shaken_general;
|
|
|
|
/*!
|
|
* \brief Retrieve the stir/shaken 'general' configuration object
|
|
*
|
|
* A default configuration object is returned if no configuration was specified.
|
|
* As well, NULL can be returned if there is no configuration, and a problem
|
|
* occurred while loading the defaults.
|
|
*
|
|
* \note Object is returned with a reference that the caller is responsible
|
|
* for de-referencing.
|
|
*
|
|
* \retval A 'general' configuration object, or NULL
|
|
*/
|
|
struct stir_shaken_general *stir_shaken_general_get(void);
|
|
|
|
/*!
|
|
* \brief Retrieve the 'ca_file' general configuration option value
|
|
*
|
|
* \note If a NULL configuration is given, then the default value is returned
|
|
*
|
|
* \param cfg A 'general' configuration object
|
|
*
|
|
* \retval The 'ca_file' value
|
|
*/
|
|
const char *ast_stir_shaken_ca_file(const struct stir_shaken_general *cfg);
|
|
|
|
/*!
|
|
* \brief Retrieve the 'ca_path' general configuration option value
|
|
*
|
|
* \note If a NULL configuration is given, then the default value is returned
|
|
*
|
|
* \param cfg A 'general' configuration object
|
|
*
|
|
* \retval The 'ca_path' value
|
|
*/
|
|
const char *ast_stir_shaken_ca_path(const struct stir_shaken_general *cfg);
|
|
|
|
/*!
|
|
* \brief Retrieve the 'cache_max_size' general configuration option value
|
|
*
|
|
* \note If a NULL configuration is given, then the default value is returned
|
|
*
|
|
* \param cfg A 'general' configuration object
|
|
*
|
|
* \retval The 'cache_max_size' value
|
|
*/
|
|
unsigned int ast_stir_shaken_cache_max_size(const struct stir_shaken_general *cfg);
|
|
|
|
/*!
|
|
* \brief Retrieve the 'curl_timeout' general configuration option value
|
|
*
|
|
* \note If a NULL configuration is given, then the default value is returned
|
|
*
|
|
* \param cfg A 'general' configuration object
|
|
*
|
|
* \retval The 'curl_timeout' value
|
|
*/
|
|
unsigned int ast_stir_shaken_curl_timeout(const struct stir_shaken_general *cfg);
|
|
|
|
/*!
|
|
* \brief Retrieve the 'signature_timeout' general configuration option value
|
|
*
|
|
* \note if a NULL configuration is given, then the default value is returned
|
|
*
|
|
* \param cfg A 'general' configuration object
|
|
*
|
|
* \retval The 'signature_timeout' value
|
|
*/
|
|
unsigned int ast_stir_shaken_signature_timeout(const struct stir_shaken_general *cfg);
|
|
|
|
/*!
|
|
* \brief Load time initialization for the stir/shaken 'general' configuration
|
|
*
|
|
* \retval 0 on success, -1 on error
|
|
*/
|
|
int stir_shaken_general_load(void);
|
|
|
|
/*!
|
|
* \brief Unload time cleanup for the stir/shaken 'general' configuration
|
|
*
|
|
* \retval 0 on success, -1 on error
|
|
*/
|
|
int stir_shaken_general_unload(void);
|
|
|
|
#endif /* _STIR_SHAKEN_GENERAL_H */
|