sysmocom
/
asterisk
11
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
asterisk/res/res_stir_shaken/general.h

112 lines
3.2 KiB
C
Raw Normal View History

res_stir_shaken: Initial commit and reading private key. This commit sets up some of the initial framework for the module and adds a way to read the private key from the specified file, which will then be appended to the certificate object. This works fine for now, but eventually some other structure will likely need to be used to store all this information. Similarly, the caller_id_number is specified on the certificate config object, but in the end we will want that information to be tied to the certificate itself and read it from there. A method has been added that will retrieve the private key associated with the caller_id_number passed in. Tab completion for certificates and stores has also been added. Change-Id: Ic4bc1416fab5d6afe15a8e2d32f7ddd4e023295f
2020-03-23 20:00:09 +00:00
/*
* Asterisk -- An open source telephony toolkit.
*
* Copyright (C) 2020, Sangoma Technologies Corporation
*
* Kevin Harwell <kharwell@sangoma.com>
*
* See http://www.asterisk.org for more information about
* the Asterisk project. Please do not directly contact
* any of the maintainers of this project for assistance;
* the project provides a web site, mailing lists and IRC
* channels for your use.
*
* This program is free software, distributed under the terms of
* the GNU General Public License Version 2. See the LICENSE file
* at the top of the source tree.
*/
#ifndef _STIR_SHAKEN_GENERAL_H
#define _STIR_SHAKEN_GENERAL_H
struct ast_sorcery;
/*!
* \brief General configuration for stir/shaken
*/
struct stir_shaken_general;
/*!
* \brief Retrieve the stir/shaken 'general' configuration object
*
* A default configuration object is returned if no configuration was specified.
* As well, NULL can be returned if there is no configuration, and a problem
* occurred while loading the defaults.
*
* \note Object is returned with a reference that the caller is responsible
* for de-referencing.
*
* \retval A 'general' configuration object, or NULL
*/
struct stir_shaken_general *stir_shaken_general_get(void);
/*!
* \brief Retrieve the 'ca_file' general configuration option value
*
* \note If a NULL configuration is given, then the default value is returned
*
* \param cfg A 'general' configuration object
*
* \retval The 'ca_file' value
*/
const char *ast_stir_shaken_ca_file(const struct stir_shaken_general *cfg);
/*!
* \brief Retrieve the 'ca_path' general configuration option value
*
* \note If a NULL configuration is given, then the default value is returned
*
* \param cfg A 'general' configuration object
*
* \retval The 'ca_path' value
*/
const char *ast_stir_shaken_ca_path(const struct stir_shaken_general *cfg);
/*!
* \brief Retrieve the 'cache_max_size' general configuration option value
*
* \note If a NULL configuration is given, then the default value is returned
*
* \param cfg A 'general' configuration object
*
* \retval The 'cache_max_size' value
*/
unsigned int ast_stir_shaken_cache_max_size(const struct stir_shaken_general *cfg);
res_stir_shaken: Implemented signature verification. There are a lot of moving parts in this patch, but the focus of it is on the verification of the signature using a public key located at the public key URL provided in the JSON payload. First, we check the database to see if we have already downloaded the key. If so, check to see if it has expired. If it has, redownload from the URL. If we don't have an entry in the database, just go ahead and download the public key. The expiration is tested each time we download the file. After that, read the public key from the file and use it to verify the signature. All sanity checking is done when the payload is first received, so the verification is complete once this point is reached. The XML has also been added since a new config option was added to general (curl_timeout). The maximum amount of time to wait for a download can be configured through this option, with a low value by default. Change-Id: I3ba4c63880493bf8c7d17a9cfca1af0e934d1a1c
2020-04-15 18:15:21 +00:00
/*!
* \brief Retrieve the 'curl_timeout' general configuration option value
*
* \note If a NULL configuration is given, then the default value is returned
*
* \param cfg A 'general' configuration object
*
* \retval The 'curl_timeout' value
*/
unsigned int ast_stir_shaken_curl_timeout(const struct stir_shaken_general *cfg);
res_stir_shaken: Add inbound INVITE support. Integrated STIR/SHAKEN support with incoming INVITES. Upon receiving an INVITE, the Identity header is retrieved, parsing the message to verify the signature. If any of the parsing fails, AST_STIR_SHAKEN_VERIFY_NOT_PRESENT will be added to the channel for this caller ID. If verification itself fails, AST_STIR_SHAKEN_VERIFY_SIGNATURE_FAILED will be added. If anything in the payload does not line up with the SIP signaling, AST_STIR_SHAKEN_VERIFY_MISMATCH will be added. If all of the above steps pass, then AST_STIR_SHAKEN_VERIFY_PASSED will be added, completing the verification process. A new config option has been added to the general section for stir_shaken.conf. "signature_timeout" is the amount of time a signature will be considered valid. If an INVITE is received and the amount of time between when it was received and when it was signed is greater than signature_timeout, verification will fail. Some changes were also made to signing and verification. There was an error where the whole JSON string was being signed rather than the header combined with the payload. This has been changed to sign the correct thing. Verification has been changed to do this as well, and the unit tests have been updated to reflect these changes. A couple of utility functions have also been added. One decodes a BASE64 string and returns the decoded string, doing all the length calculations for you. The other retrieves a string value from a header in a rdata object. Change-Id: I855f857be3d1c63b64812ac35d9ce0534085b913
2020-05-19 19:46:45 +00:00
/*!
* \brief Retrieve the 'signature_timeout' general configuration option value
*
* \note if a NULL configuration is given, then the default value is returned
*
* \param cfg A 'general' configuration object
*
* \retval The 'signature_timeout' value
*/
unsigned int ast_stir_shaken_signature_timeout(const struct stir_shaken_general *cfg);
res_stir_shaken: Initial commit and reading private key. This commit sets up some of the initial framework for the module and adds a way to read the private key from the specified file, which will then be appended to the certificate object. This works fine for now, but eventually some other structure will likely need to be used to store all this information. Similarly, the caller_id_number is specified on the certificate config object, but in the end we will want that information to be tied to the certificate itself and read it from there. A method has been added that will retrieve the private key associated with the caller_id_number passed in. Tab completion for certificates and stores has also been added. Change-Id: Ic4bc1416fab5d6afe15a8e2d32f7ddd4e023295f
2020-03-23 20:00:09 +00:00
/*!
* \brief Load time initialization for the stir/shaken 'general' configuration
*
* \retval 0 on success, -1 on error
*/
int stir_shaken_general_load(void);
/*!
* \brief Unload time cleanup for the stir/shaken 'general' configuration
*
* \retval 0 on success, -1 on error
*/
int stir_shaken_general_unload(void);
#endif /* _STIR_SHAKEN_GENERAL_H */