kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-03 11:25:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

AST-2022-002 - res_stir_shaken/curl: Add ACL checks for Identity header.

Browse Source 
Adds a new configuration option, stir_shaken_profile, in pjsip.conf that
can be specified on a per endpoint basis. This option will reference a
stir_shaken_profile that can be configured in stir_shaken.conf. The type
of this option must be 'profile'. The stir_shaken option can be
specified on this object with the same values as before (attest, verify,
on), but it cannot be off since having the profile itself implies wanting
STIR/SHAKEN support. You can also specify an ACL from acl.conf (along
with permit and deny lines in the object itself) that will be used to
limit what interfaces Asterisk will attempt to retrieve information from
when reading the Identity header.

ASTERISK-29476

Change-Id: I87fa61f78a9ea0cd42530691a30da3c781842406
This commit is contained in:
Ben Ford
2022-02-28 11:19:54 -06:00
committed by Joshua Colp
parent 1e3ffda3db
commit aba30b11a6
13 changed files with 558 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/asterisk/res_pjsip.h
View File

@@ -878,6 +878,8 @@ struct ast_sip_endpoint {
AST_STRING_FIELD(accountcode);
/*! If set, we'll push incoming MWI NOTIFYs to stasis using this mailbox */
AST_STRING_FIELD(incoming_mwi_mailbox);
/*! STIR/SHAKEN profile to use */
AST_STRING_FIELD(stir_shaken_profile);
);
/*! Configuration for extensions */
struct ast_sip_endpoint_extensions extensions;

54
include/asterisk/res_stir_shaken.h
View File

@@ -38,6 +38,8 @@ enum ast_stir_shaken_verify_failure_reason {
struct ast_stir_shaken_payload;
struct ast_acl_list;
struct ast_json;
/*!
@@ -65,6 +67,38 @@ char *ast_stir_shaken_payload_get_public_cert_url(const struct ast_stir_shaken_p
*/
unsigned int ast_stir_shaken_get_signature_timeout(void);
/*!
* \brief Retrieve a stir_shaken_profile by id
*
* \note The profile will need to be unref'd when not needed anymore
*
* \param id The id of the stir_shaken_profile to get
*
* \retval stir_shaken_profile on success
* \retval NULL on failure
*/
struct stir_shaken_profile *ast_stir_shaken_get_profile(const char *id);
/*!
* \brief Check if a stir_shaken_profile supports attestation
*
* \param profile The stir_shaken_profile to test
*
* \retval 0 if not supported
* \retval 1 if supported
*/
unsigned int ast_stir_shaken_profile_supports_attestation(const struct stir_shaken_profile *profile);
/*!
* \brief Check if a stir_shaken_profile supports verification
*
* \param profile The stir_shaken_profile to test
*
* \retval 0 if not supported
* \retval 1 if supported
*/
unsigned int ast_stir_shaken_profile_supports_verification(const struct stir_shaken_profile *profile);
/*!
* \brief Add a STIR/SHAKEN verification result to a channel
*
@@ -112,6 +146,26 @@ struct ast_stir_shaken_payload *ast_stir_shaken_verify(const char *header, const
struct ast_stir_shaken_payload *ast_stir_shaken_verify2(const char *header, const char *payload, const char *signature,
const char *algorithm, const char *public_cert_url, int *failure_code);
/*!
* \brief Same as ast_stir_shaken_verify2, but passes in a stir_shaken_profile with additional configuration
*
* \note failure_code will be written to in this function
*
* \param header The payload header
* \param payload The payload section
* \param signature The payload signature
* \param algorithm The signature algorithm
* \param public_cert_url The public key URL
* \param failure_code Additional failure information
* \param profile The stir_shaken_profile
*
* \retval ast_stir_shaken_payload on success
* \retval NULL on failure
*/
struct ast_stir_shaken_payload *ast_stir_shaken_verify_with_profile(const char *header, const char *payload,
const char *signature, const char *algorithm, const char *public_cert_url, int *failure,
const struct stir_shaken_profile *profile);
/*!
* \brief Retrieve the stir/shaken sorcery context
*