kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-31 10:47:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge "chan_sip: Don't refuse calls with "optional crypto"; fall back to RTP."

Browse Source
This commit is contained in:
Joshua Colp
2016-09-07 05:03:24 -05:00
committed by Gerrit Code Review
parent 2ff853279f d80b28560c
commit e6cad17d6d
1 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
channels/chan_sip.c
View File

@@ -1479,7 +1479,8 @@ static int handle_response_register(struct sip_pvt *p, int resp, const char *res
static void handle_response(struct sip_pvt *p, int resp, const char *rest, struct sip_request *req, uint32_t seqno);
/*------ SRTP Support -------- */
static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp, const char *a);
static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp,
const char *a, int secure_transport);
/*------ T38 Support --------- */
static int transmit_response_with_t38_sdp(struct sip_pvt *p, char *msg, struct sip_request *req, int retrans);
@@ -10609,7 +10610,7 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
}
} else if (process_sdp_a_sendonly(value, &sendonly)) {
processed = TRUE;
} else if (!processed_crypto && process_crypto(p, p->rtp, &p->srtp, value)) {
} else if (!processed_crypto && process_crypto(p, p->rtp, &p->srtp, value, secure_audio)) {
processed_crypto = TRUE;
processed = TRUE;
} else if (process_sdp_a_audio(value, p, &newaudiortp, &last_rtpmap_codec)) {
@@ -10626,7 +10627,7 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
if (p->vsrtp) {
ast_set_flag(p->vsrtp, AST_SRTP_CRYPTO_OFFER_OK);
}
} else if (!processed_crypto && process_crypto(p, p->vrtp, &p->vsrtp, value)) {
} else if (!processed_crypto && process_crypto(p, p->vrtp, &p->vsrtp, value, secure_video)) {
processed_crypto = TRUE;
processed = TRUE;
} else if (process_sdp_a_video(value, p, &newvideortp, &last_rtpmap_codec)) {
@@ -10639,7 +10640,7 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
processed = TRUE;
} else if (process_sdp_a_text(value, p, &newtextrtp, red_fmtp, &red_num_gen, red_data_pt, &last_rtpmap_codec)) {
processed = TRUE;
} else if (!processed_crypto && process_crypto(p, p->trtp, &p->tsrtp, value)) {
} else if (!processed_crypto && process_crypto(p, p->trtp, &p->tsrtp, value, 1)) {
processed_crypto = TRUE;
processed = TRUE;
}
@@ -33750,7 +33751,8 @@ static void sip_send_all_mwi_subscriptions(void)
ao2_iterator_destroy(&iter);
}
static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp, const char *a)
static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp,
const char *a, int secure_transport)
{
struct ast_rtp_engine_dtls *dtls;
@@ -33766,6 +33768,23 @@ static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struc
/* skip "crypto:" */
a += strlen("crypto:");
if (!secure_transport) {
/* > The Secure Real-time Transport Protocol (SRTP)
* > [RFC3711] provides security services for RTP media
* > and is signaled by use of secure RTP transport (e.g.,
* > "RTP/SAVP" or "RTP/SAVPF") in an SDP media (m=) line.
* > ...
* > The "crypto" attribute MUST only appear at the SDP
* > media level (not at the session level).
*
* Ergo, we can trust RTP/(S)AVP to be read from the m=
* line before we get here. If it was RTP/AVP, then this
* is SNOM-specific optional SRTP. Ignore it.
*/
ast_log(LOG_WARNING, "Ignoring crypto attribute in SDP because RTP transport is insecure\n");
return FALSE;
}
if (!*srtp) {
if (ast_test_flag(&p->flags[0], SIP_OUTGOING)) {
ast_log(LOG_WARNING, "Ignoring unexpected crypto attribute in SDP answer\n");