AST_SIP_AUTH_TYPE_USER_PASS,
/*! Credentials stored as an MD5 sum */
AST_SIP_AUTH_TYPE_MD5,
+ /*! Credentials not stored this is a fake auth */
+ AST_SIP_AUTH_TYPE_ARTIFICIAL
};
#define SIP_SORCERY_AUTH_TYPE "auth"
struct ast_sip_endpoint *(*identify_endpoint)(pjsip_rx_data *rdata);
};
+#define SIP_SORCERY_SECURITY_TYPE "security"
+
+/*!
+ * \brief SIP security details and configuration.
+ */
+struct ast_sip_security {
+ SORCERY_OBJECT(details);
+ struct ast_acl_list *acl;
+ struct ast_acl_list *contact_acl;
+};
+
/*!
* \brief Register a SIP service in Asterisk.
*
int ast_sip_initialize_sorcery_auth(struct ast_sorcery *sorcery);
/*!
+ * \brief Initialize security support on a sorcery instance
+ *
+ * \param sorcery The sorcery instance
+ *
+ * \retval -1 failure
+ * \retval 0 success
+ */
+int ast_sip_initialize_sorcery_security(struct ast_sorcery *sorcery);
+
+/*!
* \brief Callback called when an outbound request with authentication credentials is to be sent in dialog
*
* This callback will have the created request on it. The callback's purpose is to do any extra
int ast_sip_initialize_distributor(void);
/*!
+ * \brief Destruct the distributor module.
+ *
+ * Unregisters pjsip modules and cleans up any allocated resources.
+ */
+void ast_sip_destroy_distributor(void);
+
+/*!
+ * \brief Retrieves a reference to the artificial auth.
+ *
+ * \retval The artificial auth
+ */
+struct ast_sip_auth *ast_sip_get_artificial_auth(void);
+
+/*!
+ * \brief Retrieves a reference to the artificial endpoint.
+ *
+ * \retval The artificial endpoint
+ */
+struct ast_sip_endpoint *ast_sip_get_artificial_endpoint(void);
+
+/*!
* \page Threading model for SIP
*
* There are three major types of threads that SIP will have to deal with:
return AST_MODULE_LOAD_SUCCESS;
error:
+ ast_sip_destroy_distributor();
ast_res_sip_destroy_configuration();
if (monitor_thread) {
stop_monitor_thread();
static int unload_module(void)
{
+ ast_sip_destroy_distributor();
ast_res_sip_destroy_configuration();
if (monitor_thread) {
stop_monitor_thread();
LINKER_SYMBOL_PREFIXast_sip_retrieve_auths;
LINKER_SYMBOL_PREFIXast_sip_cleanup_auths;
LINKER_SYMBOL_PREFIXast_sip_is_content_type;
+ LINKER_SYMBOL_PREFIXast_sip_get_artificial_endpoint;
+ LINKER_SYMBOL_PREFIXast_sip_get_artificial_auth;
LINKER_SYMBOL_PREFIXast_sip_report_invalid_endpoint;
LINKER_SYMBOL_PREFIXast_sip_report_failed_acl;
LINKER_SYMBOL_PREFIXast_sip_report_auth_failed_challenge_response;
res = -1;
}
break;
+ case AST_SIP_AUTH_TYPE_ARTIFICIAL:
+ break;
}
return res;
--- /dev/null
+/*
+ * Asterisk -- An open source telephony toolkit.
+ *
+ * Copyright (C) 2013, Digium, Inc.
+ *
+ * Mark Michelson <mmichelson@digium.com>
+ * Kevin Harwell <kharwell@digium.com>
+ *
+ * See http://www.asterisk.org for more information about
+ * the Asterisk project. Please do not directly contact
+ * any of the maintainers of this project for assistance;
+ * the project provides a web site, mailing lists and IRC
+ * channels for your use.
+ *
+ * This program is free software, distributed under the terms of
+ * the GNU General Public License Version 2. See the LICENSE file
+ * at the top of the source tree.
+ */
+
+/*** MODULEINFO
+ <depend>pjproject</depend>
+ <depend>res_sip</depend>
+ <support_level>core</support_level>
+ ***/
+#include "asterisk.h"
+
+#include <pjsip.h>
+
+#include "asterisk/res_sip.h"
+#include "asterisk/logger.h"
+#include "asterisk/sorcery.h"
+#include "asterisk/acl.h"
+
+static int acl_handler(const struct aco_option *opt, struct ast_variable *var, void *obj)
+{
+ struct ast_sip_security *security = obj;
+ int error = 0;
+ int ignore;
+ if (!strncmp(var->name, "contact", 7)) {
+ ast_append_acl(var->name + 7, var->value, &security->contact_acl, &error, &ignore);
+ } else {
+ ast_append_acl(var->name, var->value, &security->acl, &error, &ignore);
+ }
+
+ return error;
+}
+
+static void security_destroy(void *obj)
+{
+ struct ast_sip_security *security = obj;
+ security->acl = ast_free_acl_list(security->acl);
+ security->contact_acl = ast_free_acl_list(security->contact_acl);
+}
+
+static void *security_alloc(const char *name)
+{
+ struct ast_sip_security *security =
+ ast_sorcery_generic_alloc(sizeof(*security), security_destroy);
+
+ if (!security) {
+ return NULL;
+ }
+
+ return security;
+}
+
+int ast_sip_initialize_sorcery_security(struct ast_sorcery *sorcery)
+{
+ ast_sorcery_apply_default(sorcery, SIP_SORCERY_SECURITY_TYPE,
+ "config", "res_sip.conf,criteria=type=security");
+
+ if (ast_sorcery_object_register(sorcery, SIP_SORCERY_SECURITY_TYPE,
+ security_alloc, NULL, NULL)) {
+
+ ast_log(LOG_ERROR, "Failed to register SIP %s object with sorcery\n",
+ SIP_SORCERY_SECURITY_TYPE);
+ return -1;
+ }
+
+ ast_sorcery_object_field_register(sorcery, SIP_SORCERY_SECURITY_TYPE, "type", "", OPT_NOOP_T, 0, 0);
+ ast_sorcery_object_field_register_custom(sorcery, SIP_SORCERY_SECURITY_TYPE, "permit", "", acl_handler, NULL, 0, 0);
+ ast_sorcery_object_field_register_custom(sorcery, SIP_SORCERY_SECURITY_TYPE, "deny", "", acl_handler, NULL, 0, 0);
+ ast_sorcery_object_field_register_custom(sorcery, SIP_SORCERY_SECURITY_TYPE, "acl", "", acl_handler, NULL, 0, 0);
+ ast_sorcery_object_field_register_custom(sorcery, SIP_SORCERY_SECURITY_TYPE, "contactpermit", "", acl_handler, NULL, 0, 0);
+ ast_sorcery_object_field_register_custom(sorcery, SIP_SORCERY_SECURITY_TYPE, "contactdeny", "", acl_handler, NULL, 0, 0);
+ ast_sorcery_object_field_register_custom(sorcery, SIP_SORCERY_SECURITY_TYPE, "contactacl", "", acl_handler, NULL, 0, 0);
+ return 0;
+}
static void destroy_auths(const char **auths, size_t num_auths)
{
int i;
+
+ if (!auths) {
+ return;
+ }
+
for (i = 0; i < num_auths; ++i) {
ast_free((char *) auths[i]);
}
return -1;
}
+ if (ast_sip_initialize_sorcery_security(sip_sorcery)) {
+ ast_log(LOG_ERROR, "Failed to register SIP security support\n");
+ ast_sorcery_unref(sip_sorcery);
+ sip_sorcery = NULL;
+ return -1;
+ }
+
ast_sorcery_load(sip_sorcery);
return 0;
{
struct distributor_dialog_data *dist;
SCOPED_LOCK(lock, dlg, pjsip_dlg_inc_lock, pjsip_dlg_dec_lock);
-
+
dist = pjsip_dlg_get_mod_data(dlg, distributor_mod.id);
if (!dist) {
dist = distributor_dialog_data_alloc(dlg);
{
struct distributor_dialog_data *dist;
SCOPED_LOCK(lock, dlg, pjsip_dlg_inc_lock, pjsip_dlg_dec_lock);
-
+
dist = pjsip_dlg_get_mod_data(dlg, distributor_mod.id);
if (!dist) {
dist = distributor_dialog_data_alloc(dlg);
.on_rx_request = endpoint_lookup,
};
+static struct ast_sip_auth *artificial_auth;
+
+static int create_artificial_auth(void)
+{
+ if (!(artificial_auth = ast_sorcery_alloc(
+ ast_sip_get_sorcery(), SIP_SORCERY_AUTH_TYPE, "artificial"))) {
+ ast_log(LOG_ERROR, "Unable to create artificial auth\n");
+ return -1;
+ }
+
+ ast_string_field_set(artificial_auth, realm, "asterisk");
+ ast_string_field_set(artificial_auth, auth_user, "");
+ ast_string_field_set(artificial_auth, auth_pass, "");
+ artificial_auth->type = AST_SIP_AUTH_TYPE_ARTIFICIAL;
+ return 0;
+}
+
+struct ast_sip_auth *ast_sip_get_artificial_auth(void)
+{
+ ao2_ref(artificial_auth, +1);
+ return artificial_auth;
+}
+
+static struct ast_sip_endpoint *artificial_endpoint;
+
+static int create_artificial_endpoint(void)
+{
+ if (!(artificial_endpoint = ast_sorcery_alloc(
+ ast_sip_get_sorcery(), "endpoint", NULL))) {
+ return -1;
+ }
+
+ artificial_endpoint->num_inbound_auths = 1;
+ return 0;
+}
+
+struct ast_sip_endpoint *ast_sip_get_artificial_endpoint(void)
+{
+ ao2_ref(artificial_endpoint, +1);
+ return artificial_endpoint;
+}
+
static pj_bool_t endpoint_lookup(pjsip_rx_data *rdata)
{
struct ast_sip_endpoint *endpoint;
char name[AST_UUID_STR_LEN] = "";
pjsip_uri *from = rdata->msg_info.from->uri;
- /* XXX When we do an alwaysauthreject-like option, we'll need to take that into account
- * for this response. Either that, or have a pseudo-endpoint to pass along so that authentication
- * will fail
- */
- pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 403, NULL, NULL, NULL);
+ /* always use an artificial endpoint - per discussion no reason
+ to have "alwaysauthreject" as an option. It is felt using it
+ was a bug fix and it is not needed since we are not worried about
+ breaking old stuff and we really don't want to enable the discovery
+ of SIP accounts */
+ endpoint = ast_sip_get_artificial_endpoint();
if (PJSIP_URI_SCHEME_IS_SIP(from) || PJSIP_URI_SCHEME_IS_SIPS(from)) {
pjsip_sip_uri *sip_from = pjsip_uri_get_uri(from);
}
ast_sip_report_invalid_endpoint(name, rdata);
- return PJ_TRUE;
}
rdata->endpt_info.mod_data[endpoint_mod.id] = endpoint;
return PJ_FALSE;
return PJ_FALSE;
case AST_SIP_AUTHENTICATION_FAILED:
ast_sip_report_auth_failed_challenge_response(endpoint, rdata);
- pjsip_tx_data_dec_ref(tdata);
- pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 403, NULL, NULL, NULL);
+ pjsip_endpt_send_response2(ast_sip_get_pjsip_endpoint(), rdata, tdata, NULL, NULL);
return PJ_TRUE;
case AST_SIP_AUTHENTICATION_ERROR:
ast_sip_report_auth_failed_challenge_response(endpoint, rdata);
int ast_sip_initialize_distributor(void)
{
+ if (create_artificial_endpoint() || create_artificial_auth()) {
+ return -1;
+ }
+
if (ast_sip_register_service(&distributor_mod)) {
return -1;
}
if (ast_sip_register_service(&auth_mod)) {
return -1;
}
+
return 0;
}
+
+void ast_sip_destroy_distributor(void)
+{
+ ast_sip_unregister_service(&distributor_mod);
+ ast_sip_unregister_service(&endpoint_mod);
+ ast_sip_unregister_service(&auth_mod);
+
+ ao2_cleanup(artificial_auth);
+ ao2_cleanup(artificial_endpoint);
+}
<synopsis>List of IP-domains to allow access from</synopsis>
</configOption>
<configOption name="type">
- <synopsis>Must be of type 'acl'.</synopsis>
+ <synopsis>Must be of type 'security'.</synopsis>
</configOption>
</configObject>
</configFile>
</configInfo>
***/
-struct sip_acl {
- SORCERY_OBJECT(details);
- struct ast_acl_list *acl;
- struct ast_acl_list *contact_acl;
-};
-
static int apply_acl(pjsip_rx_data *rdata, struct ast_acl_list *acl)
{
struct ast_sockaddr addr;
static int check_acls(void *obj, void *arg, int flags)
{
- struct sip_acl *acl = obj;
+ struct ast_sip_security *security = obj;
pjsip_rx_data *rdata = arg;
- if (apply_acl(rdata, acl->acl) || apply_contact_acl(rdata, acl->contact_acl)) {
+ if (apply_acl(rdata, security->acl) ||
+ apply_contact_acl(rdata, security->contact_acl)) {
return CMP_MATCH | CMP_STOP;
}
return 0;
static pj_bool_t acl_on_rx_msg(pjsip_rx_data *rdata)
{
- int forbidden = 0;
- struct ao2_container *acls = ast_sorcery_retrieve_by_fields(ast_sip_get_sorcery(), "acl", AST_RETRIEVE_FLAG_MULTIPLE | AST_RETRIEVE_FLAG_ALL, NULL);
- struct sip_acl *matched_acl;
+ RAII_VAR(struct ao2_container *, acls, ast_sorcery_retrieve_by_fields(
+ ast_sip_get_sorcery(), SIP_SORCERY_SECURITY_TYPE,
+ AST_RETRIEVE_FLAG_MULTIPLE | AST_RETRIEVE_FLAG_ALL, NULL), ao2_cleanup);
+ RAII_VAR(struct ast_sip_security *, matched_acl, NULL, ao2_cleanup);
+
if (!acls) {
ast_log(LOG_ERROR, "Unable to retrieve ACL sorcery data\n");
return PJ_FALSE;
}
- matched_acl = ao2_callback(acls, 0, check_acls, rdata);
- if (matched_acl) {
- forbidden = 1;
- ao2_ref(matched_acl, -1);
- }
- ao2_ref(acls, -1);
-
- if (forbidden) {
+ if ((matched_acl = ao2_callback(acls, 0, check_acls, rdata))) {
if (rdata->msg_info.msg->line.req.method.id != PJSIP_ACK_METHOD) {
pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 403, NULL, NULL, NULL);
}
.on_rx_request = acl_on_rx_msg,
};
-static int acl_handler(const struct aco_option *opt, struct ast_variable *var, void *obj)
-{
- struct sip_acl *acl = obj;
- int error;
- int ignore;
- if (!strncmp(var->name, "contact", 7)) {
- ast_append_acl(var->name + 7, var->value, &acl->contact_acl, &error, &ignore);
- } else {
- ast_append_acl(var->name, var->value, &acl->acl, &error, &ignore);
- }
- return error;
-}
-
-static void sip_acl_destructor(void *obj)
-{
- struct sip_acl *acl = obj;
- acl->acl = ast_free_acl_list(acl->acl);
- acl->contact_acl = ast_free_acl_list(acl->contact_acl);
-}
-
-static void *sip_acl_alloc(const char *name)
-{
- struct sip_acl *acl = ast_sorcery_generic_alloc(sizeof(*acl), sip_acl_destructor);
- if (!acl) {
- return NULL;
- }
- return acl;
-}
-
-static int load_acls(void)
-{
- ast_sorcery_apply_default(ast_sip_get_sorcery(), "acl", "config", "res_sip.conf,criteria=type=acl");
- if (ast_sorcery_object_register(ast_sip_get_sorcery(), "acl", sip_acl_alloc, NULL, NULL)) {
- ast_log(LOG_ERROR, "Failed to register SIP ACL object with sorcery\n");
- return -1;
- }
- ast_sorcery_object_field_register(ast_sip_get_sorcery(), "acl", "type", "", OPT_NOOP_T, 0, 0);
- ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), "acl", "permit", "", acl_handler, NULL, 0, 0);
- ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), "acl", "deny", "", acl_handler, NULL, 0, 0);
- ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), "acl", "acl", "", acl_handler, NULL, 0, 0);
- ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), "acl", "contactpermit", "", acl_handler, NULL, 0, 0);
- ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), "acl", "contactdeny", "", acl_handler, NULL, 0, 0);
- ast_sorcery_object_field_register_custom(ast_sip_get_sorcery(), "acl", "contactacl", "", acl_handler, NULL, 0, 0);
-
- /* XXX Is there a more selective way to do this? (i.e. Just reload a specific object type?) */
- ast_sorcery_reload(ast_sip_get_sorcery());
- return 0;
-}
-
static int load_module(void)
{
- if (load_acls()) {
- return AST_MODULE_LOAD_DECLINE;
- }
ast_sip_register_service(&acl_module);
return AST_MODULE_LOAD_SUCCESS;
}
return PJSIP_SC_FORBIDDEN;
}
+ if (auth->type == AST_SIP_AUTH_TYPE_ARTIFICIAL) {
+ return PJSIP_SC_FORBIDDEN;
+ }
+
if (pj_strcmp2(realm, auth->realm)) {
return PJSIP_SC_FORBIDDEN;
}
/*!
* \brief Common code for initializing a pjsip_auth_srv
*/
-static void setup_auth_srv(pj_pool_t *pool, pjsip_auth_srv *auth_server, const struct ast_sip_auth *auth)
+static void setup_auth_srv(pj_pool_t *pool, pjsip_auth_srv *auth_server, const char *realm)
{
- pj_str_t realm;
- pj_cstr(&realm, auth->realm);
+ pj_str_t realm_str;
+ pj_cstr(&realm_str, realm);
- pjsip_auth_srv_init(pool, auth_server, &realm, digest_lookup, 0);
+ pjsip_auth_srv_init(pool, auth_server, &realm_str, digest_lookup, 0);
}
/*!
stale = 1;
}
- setup_auth_srv(pool, &auth_server, auth);
+ setup_auth_srv(pool, &auth_server, auth->realm);
store_auth(auth);
/*!
* \brief astobj2 callback for adding digest challenges to responses
*
- * \param auth The ast_aip_auth to build a challenge from
+ * \param realm An auth's realm to build a challenge from
* \param tdata The response to add the challenge to
* \param rdata The request the challenge is in response to
* \param is_stale Indicates whether nonce on incoming request was stale
*/
-static void challenge(const struct ast_sip_auth *auth, pjsip_tx_data *tdata, const pjsip_rx_data *rdata, int is_stale)
+static void challenge(const char *realm, pjsip_tx_data *tdata, const pjsip_rx_data *rdata, int is_stale)
{
pj_str_t qop;
pj_str_t pj_nonce;
time_t timestamp = time(NULL);
snprintf(time_buf, sizeof(time_buf), "%d", (int) timestamp);
- build_nonce(&nonce, time_buf, rdata, auth->realm);
+ build_nonce(&nonce, time_buf, rdata, realm);
- setup_auth_srv(tdata->pool, &auth_server, auth);
+ setup_auth_srv(tdata->pool, &auth_server, realm);
pj_cstr(&pj_nonce, ast_str_buffer(nonce));
pj_cstr(&qop, "auth");
* This function will check an incoming message against configured authentication
* options. If \b any of the incoming Authorization headers result in successful
* authentication, then authentication is considered successful.
- *
+ *
* \see ast_sip_check_authentication
*/
static enum ast_sip_check_auth_result digest_check_auth(struct ast_sip_endpoint *endpoint,
pjsip_rx_data *rdata, pjsip_tx_data *tdata)
{
- struct ast_sip_auth **auths = ast_alloca(endpoint->num_inbound_auths * sizeof(*auths));
- enum digest_verify_result *verify_res = ast_alloca(endpoint->num_inbound_auths * sizeof(*verify_res));
+ struct ast_sip_auth **auths;
+ enum digest_verify_result *verify_res;
enum ast_sip_check_auth_result res;
int i;
+ RAII_VAR(struct ast_sip_endpoint *, artificial_endpoint,
+ ast_sip_get_artificial_endpoint(), ao2_cleanup);
+
+ auths = ast_alloca(endpoint->num_inbound_auths * sizeof(*auths));
+ verify_res = ast_alloca(endpoint->num_inbound_auths * sizeof(*verify_res));
+
if (!auths) {
return AST_SIP_AUTHENTICATION_ERROR;
}
- if (ast_sip_retrieve_auths(endpoint->sip_inbound_auths, endpoint->num_inbound_auths, auths)) {
+ if (endpoint == artificial_endpoint) {
+ auths[0] = ast_sip_get_artificial_auth();
+ } else if (ast_sip_retrieve_auths(endpoint->sip_inbound_auths, endpoint->num_inbound_auths, auths)) {
res = AST_SIP_AUTHENTICATION_ERROR;
goto cleanup;
}
}
for (i = 0; i < endpoint->num_inbound_auths; ++i) {
- challenge(auths[i], tdata, rdata, verify_res[i] == AUTH_STALE);
+ challenge(auths[i]->realm, tdata, rdata, verify_res[i] == AUTH_STALE);
}
-
+
res = AST_SIP_AUTHENTICATION_CHALLENGE;
cleanup:
pj_cstr(&auth_creds[i].data, auths[i]->md5_creds);
auth_creds[i].data_type = PJSIP_CRED_DATA_DIGEST;
break;
+ case AST_SIP_AUTH_TYPE_ARTIFICIAL:
+ ast_log(LOG_ERROR, "Trying to set artificial outbound auth credentials shouldn't happen.\n");
+ break;
}
}
projects / asterisk/asterisk.git / commitdiff