Commit Graph

4202 Commits

Author SHA1 Message Date
Kevin Harwell
d112916e98 strings/json: Add string delimter match, and object create with vars methods
Add a function to check if there is an exact match a one string between
delimiters in another string.

Add a function that will create an ast_json object out of a list of
Asterisk variables. An excludes string can also optionally be passed
in.

Also, add a macro to make it easier to get object integers.

Change-Id: I5f34f18e102126aef3997f19a553a266d70d6226
2021-10-28 09:37:07 -05:00
Ben Ford
669e16b3dc STIR/SHAKEN: Option split and response codes.
The stir_shaken configuration option now has 4 different choices to pick
from: off, attest, verify, and on. Off and on behave the same way they
do now. Attest will only perform attestation on the endpoint, and verify
will only perform verification on the endpoint.

Certain responses are required to be sent based on certain conditions
for STIR/SHAKEN. For example, if we get a Date header that is outside of
the time range that is considered valid, a 403 Stale Date response
should be sent. This and several other responses have been added.

Change-Id: I4ac1ecf652cd0e336006b0ca638dc826b5b1ebf7
2021-10-27 09:56:20 -05:00
Kevin Harwell
04e79fd0e3 res_speech: Add a type conversion, and new engine unregister methods
Add a new function that converts a speech results type to a string.
Also add another function to unregister an engine, but returns a
pointer to the unregistered engine object instead of a success/fail
integer.

Change-Id: I0f7de17cb411021c09fb03988bc2b904e1380192
2021-10-22 08:14:59 -05:00
George Joseph
362b7f2411 BuildSystem: Check for alternate openssl packages
OpenSSL is one of those packages that often have alternatives
with later versions.  For instance, CentOS/EL 7 has an
openssl package at version 1.0.2 but there's an openssl11
package from the epel repository that has 1.1.1.  This gets
installed to /usr/include/openssl11 and /usr/lib64/openssl11.
Unfortunately, the existing --with-ssl and --with-crypto
./configure options expect to point to a source tree and
don't work in this situation.  Also unfortunately, the
checks in ./configure don't use pkg-config.

In order to make this work with the existing situation, you'd
have to run...
./configure --with-ssl=/usr/lib64/openssl11 \
    --with-crypto=/usr/lib64/openssl11 \
    CFLAGS=-I/usr/include/openssl11

BUT...  those options don't get passed down to bundled pjproject
so when you run make, you have to include the CFLAGS again
which is a big pain.

Oh...  To make matters worse, although you can specify
PJPROJECT_CONFIGURE_OPTS on the ./configure command line,
they don't get saved so if you do a make clean, which will
force a re-configure of bundled pjproject, those options
don't get used.

So...

* In configure.ac... Since pkg-config is installed by install_prereq
  anyway, we now use it to check for the system openssl >= 1.1.0.
  If that works, great.  If not, we check for the openssl11
  package. If that works, great.  If not, we fall back to just
  checking for any openssl.  If pkg-config isn't installed for some
  reason, or --with-ssl=<dir> or --with-crypto=<dir> were specified
  on the ./configure command line, we fall back to the existing
  logic that uses AST_EXT_LIB_CHECK().

* The whole OpenSSL check process has been moved up before
  THIRD_PARTY_CONFIGURE(), which does the initial pjproject
  bundled configure, is run.  This way the results of the above
  checks, which may result in new include or library directories,
  is included.

* Although not strictly needed for openssl, We now save the value of
  PJPROJECT_CONFIGURE_OPTS in the makeopts file so it can be used
  again if a re-configure is triggered.

ASTERISK-29693

Change-Id: I341ab7603e6b156aa15a66f43675ac5029d5fbde
2021-10-21 07:26:13 -05:00
Sean Bright
0c71619f8a configure: Remove unused OpenSSL SRTP check.
Discovered while looking at ASTERISK~29684. Usage was removed in change
I3c77c7b00b2ffa2e935632097fa057b9fdf480c0.

Change-Id: Iaf2f7a16ea5a7eee6375319347e4b40b8e7b10e3
2021-10-15 10:47:00 -05:00
Matthew Kern
39824c7a96 res_pjsip_t38: bind UDPTL sessions like RTP
In res_pjsip_sdp_rtp, the bind_rtp_to_media_address option and the
fallback use of the transport's bind address solve problems sending
media on systems that cannot send ipv4 packets on ipv6 sockets, and
certain other situations. This change extends both of these behaviors
to UDPTL sessions as well in res_pjsip_t38, to fix fax-specific
problems on these systems, introducing a new option
endpoint/t38_bind_udptl_to_media_address.

ASTERISK-29402

Change-Id: I87220c0e9cdd2fe9d156846cb906debe08c63557
2021-10-01 08:55:56 -05:00
Joseph Nadiv
722b81904e res_pjsip_registrar: Remove unavailable contacts if exceeds max_contacts
The behavior of max_contacts and remove_existing are connected.  If
remove_existing is enabled, the soonest expiring contacts are removed.
This may occur when there is an unavailable contact.  Similarly,
when remove_existing is not enabled, registrations from good
endpoints are rejected in favor of retaining unavailable contacts.

This commit adds a new AOR option remove_unavailable, and the effect
of this setting will depend on remove_existing.  If remove_existing
is set to no, we will still remove unavailable contacts when they
exceed max_contacts, if there are any. If remove_existing is set to
yes, we will prioritize the removal of unavailable contacts before
those that are expiring soonest.

ASTERISK-29525

Change-Id: Ia2711b08f2b4d1177411b1be23e970d7fdff5784
2021-09-24 09:48:52 -05:00
Naveen Albert
41ba9f5f31 logger: Add custom logging capabilities
Adds the ability for users to log to custom log levels
by providing custom log level names in logger.conf. Also
adds a logger show levels CLI command.

ASTERISK-29529

Change-Id: If082703cf81a436ae5a565c75225fa8c0554b702
2021-09-21 11:52:00 -05:00
Naveen Albert
7feee9c65b res_pjsip_caller_id: Add ANI2/OLI parsing
Adds parsing of ANI II digits (Originating
Line Information) to PJSIP, on par with
what currently exists in chan_sip.

ASTERISK-29472

Change-Id: Ifc938a7a7d45ce33999ebf3656a542226f6d3847
2021-09-14 15:16:00 -05:00
Naveen Albert
11516e4b8e func_sayfiles: Retrieve say file names
Up until now, all of the logic used to translate
arguments to the Say applications has been
directly coupled to playback, preventing other
modules from using this logic.

This refactors code in say.c and adds a SAYFILES
function that can be used to retrieve the file
names that would be played. These can then be
used in other applications or for other purposes.

Additionally, a SayMoney application and a SayOrdinal
application are added. Both SayOrdinal and SayNumber
are also expanded to support integers greater than
one billion.

ASTERISK-29531

Change-Id: If9718c89353b8e153d84add3cc4637b79585db19
2021-09-10 11:45:29 -05:00
Naveen Albert
698604a064 res_tonedetect: Tone detection module
dsp.c contains arbitrary tone detection functionality
which is currently only used for fax tone recognition.
This change makes this functionality publicly
accessible so that other modules can take advantage
of this.

Additionally, a WaitForTone and TONE_DETECT app and
function are included to allow users to do their
own tone detection operations in the dialplan.

ASTERISK-29546

Change-Id: Ie38c395000f4fd4d04e942e8658e177f8f499b26
2021-09-10 11:08:47 -05:00
Sean Bright
fb72158f46 dns.c: Load IPv6 DNS resolvers if configured.
IPv6 nameserver addresses are stored in different part of the
__res_state structure, so look there if we appear to have support for
it.

ASTERISK-28004 #close

Change-Id: I67067077d8a406ee996664518d9c8fbf11f6977d
2021-09-08 18:17:53 -05:00
Naveen Albert
c5c5171ec8 app_read: Allow reading # as a digit
Allows for the digit # to be read as a digit,
just like any other DTMF digit, as opposed to
forcing it to be used as an end of input
indicator. The default behavior remains
unchanged.

ASTERISK-18454 #close

Change-Id: I3033432adb9d296ad227e76b540b8b4a2417665b
2021-09-01 10:30:51 -05:00
Rijnhard Hessel
b40e97b1d7 res_statsd: handle non-standard meter type safely
Meter types are not well supported,
lacking support in telegraf, datadog and the official statsd servers.
We deprecate meters and provide a compliant fallback for any existing usages.

A flag has been introduced to allow meters to fallback to counters.


ASTERISK-29513

Change-Id: I5fcb385983a1b88f03696ff30a26b55c546a1dd7
2021-08-03 08:44:45 -05:00
Andre Barbosa
884d863c08 res_stasis_playback: Send PlaybackFinish event only once for errors
When we try to play a list of sound files in the same Play command,
we get only one PlaybackFinish event, after all sounds are played.

But in the case where the Play fails (because channel is destroyed
for example), Asterisk will send one PlaybackFinish event for each
sound file still to be played. If the list is big, Asterisk is
sending many events.

This patch adds a failed state so we can understand that the play
failed. On that case we don't send the event, if we still have a
list of sounds to be played.

When we reach the last sound, we send the PlaybackFinish with
the failed state.

ASTERISK-29464 #close

Change-Id: I4c2e5921cc597702513af0d7c6c2c982e1798322
2021-06-24 08:54:20 -05:00
Joshua C. Colp
4470838d89 core: Don't play silence for Busy() and Congestion() applications.
When using the Busy() and Congestion() applications the
function ast_safe_sleep is used by wait_for_hangup to safely
wait on the channel. This function may send silence if Asterisk
is configured to do so using the transmit_silence option.

In a scenario where an answered channel dials a Local channel
either directly or through call forwarding and the Busy()
or Congestion() dialplan applications were executed with the
transmit_silence option enabled the busy or congestion
tone would not be heard.

This is because inband generation of tones (such as busy
and congestion) is stopped when other audio is sent to
the channel they are being played to. In the given
scenario the transmit_silence option would result in
silence being sent to the channel, thus stopping the
inband generation.

This change adds a variant of ast_safe_sleep which can be
used when silence should not be played to the channel. The
wait_for_hangup function has been updated to use this
resulting in the tones being generated as expected.

ASTERISK-29485

Change-Id: I066bfc987a3ad6f0ccc88e0af4cd63f6a4729133
2021-06-22 09:47:01 -05:00
Ben Ford
cee88c9826 STIR/SHAKEN: Add Date header, dest->tn, and URL checking.
STIR/SHAKEN requires a Date header alongside the Identity header, so
that has been added. Still on the outgoing side, we were missing the
dest->tn section of the JSON payload, so that has been added as well.
Moving to the incoming side, URL checking has been added to the public
cert URL to ensure that it starts with http.

https://wiki.asterisk.org/wiki/display/AST/OpenSIPit+2021

Change-Id: Idee5b1b5e45bc3b483b3070e46ce322dca5b3f1c
2021-05-26 12:46:10 -05:00
George Joseph
7c0b8f0701 res_pjsip_outbound_authenticator_digest: Be tolerant of RFC8760 UASs
RFC7616 and RFC8760 allow more than one WWW-Authenticate or
Proxy-Authenticate header per realm, each with different digest
algorithms (including new ones like SHA-256 and SHA-512-256).
Thankfully however a UAS can NOT send back multiple Authenticate
headers for the same realm with the same digest algorithm.  The
UAS is also supposed to send the headers in order of preference
with the first one being the most preferred.  We're supposed to
send an Authorization header for the first one we encounter for a
realm that we can support.

The UAS can also send multiple realms, especially when it's a
proxy that has forked the request in which case the proxy will
aggregate all of the Authenticate headers and then send them all
back to the UAC.

It doesn't stop there though... Each realm can require a
different username from the others.  There's also nothing
preventing each digest algorithm from having a unique password
although I'm not sure if that adds any benefit.

So now... For each Authenticate header we encounter, we have to
determine if we support the digest algorithm and, if not, just
skip the header.  We then have to find an auth object that
matches the realm AND the digest algorithm or find a wildcard
object that matches the digest algorithm. If we find one, we add
it to the results vector and read the next Authenticate header.
If the next header is for the same realm AND we already added an
auth object for that realm, we skip the header. Otherwise we
repeat the process for the next header.

In the end, we'll have accumulated a list of credentials we can
pass to pjproject that it can use to add Authentication headers
to a request.

NOTE: Neither we nor pjproject can currently handle digest
algorithms other than MD5.  We don't even have a place for it in
the ast_sip_auth object. For this reason, we just skip processing
any Authenticate header that's not MD5.  When we support the
others, we'll move the check into the loop that searches the
objects.

Changes:

 * Added a new API ast_sip_retrieve_auths_vector() that takes in
   a vector of auth ids (usually supplied on a call to
   ast_sip_create_request_with_auth()) and populates another
   vector with the actual objects.

 * Refactored res_pjsip_outbound_authenticator_digest to handle
   multiple Authenticate headers and set the stage for handling
   additional digest algorithms.

 * Added a pjproject patch that allows them to ignore digest
   algorithms they don't support.  This patch has already been
   merged upstream.

 * Updated documentation for auth objects in the XML and
   in pjsip.conf.sample.

 * Although res_pjsip_authenticator_digest isn't affected
   by this change, some debugging and a testsuite AMI event
   was added to facilitate testing.

Discovered during OpenSIPit 2021.

ASTERISK-29397

Change-Id: I3aef5ce4fe1d27e48d61268520f284d15d650281
2021-05-21 06:59:57 -05:00
Naveen Albert
ea117be4c6 AMI: Add AMI event to expose hook flash events
Although Asterisk can receive and propogate flash events, it currently
provides no mechanism for doing anything with them itself.

This AMI event allows flash events to be processed by Asterisk.
Additionally, AST_CONTROL_FLASH is included in a switch statement
in channel.c to avoid throwing a warning when we shouldn't.

ASTERISK-29380

Change-Id: Ie17ffe65086e0282c88542e38eed6a461ec79e81
2021-05-19 08:02:46 -05:00
Ben Ford
0b4b207076 STIR/SHAKEN: Switch to base64 URL encoding.
STIR/SHAKEN encodes using base64 URL format. Currently, we just use
base64. New functions have been added that convert to and from base64
encoding.

The origid field should also be an UUID. This means there's no reason to
have it as an option in stir_shaken.conf, as we can simply generate one
when creating the Identity header.

https://wiki.asterisk.org/wiki/display/AST/OpenSIPit+2021

Change-Id: Icf094a2a54e87db91d6b12244c9f5ba4fc2e0b8c
2021-05-12 06:43:22 -05:00
Ben Ford
184a027eaa STIR/SHAKEN: Fix certificate type and storage.
During OpenSIPit, we found out that the public certificates must be of
type X.509. When reading in public keys, we use the corresponding X.509
functions now.

We also discovered that we needed a better naming scheme for the
certificates since certificates with the same name would cause issues
(overwriting certs, etc.). Now when we download a public certificate, we
get the serial number from it and use that as the name of the cached
certificate.

The configuration option public_key_url in stir_shaken.conf has also
been renamed to public_cert_url, which better describes what the option
is for.

https://wiki.asterisk.org/wiki/display/AST/OpenSIPit+2021

Change-Id: Ia00b20835f5f976e3603797f2f2fb19672d8114d
2021-05-11 09:29:18 -05:00
Sean Bright
5a2939a5d6 res_pjsip.c: OPTIONS processing can now optionally skip authentication
ASTERISK-27477 #close

Change-Id: I68f6715bba92a525149e35d142a49377a34a1193
2021-04-29 07:44:41 -05:00
Kevin Harwell
20af6d23df time: Add timeval create and unit conversion functions
Added a TIME_UNIT enumeration, and a function that converts a
string to one of the enumerated values. Also, added functions
that create and initialize a timeval object using a specified
value, and unit type.

Change-Id: Ic31a1c3262a44f77a5ef78bfc85dcf69a8d47392
2021-03-31 09:19:56 -05:00
Mark Murawski
98d149b4ce logger: Console sessions will now respect logger.conf dateformat= option
The 'core' console (ie: asterisk -c) does read logger.conf and does
use the dateformat= option.

Whereas 'remote' consoles (ie: asterisk -r -T) does not read logger.conf
and uses a hard coded dateformat option for printing received verbose messages:
  main/logger.c: static char dateformat[256] = "%b %e %T"

This change will load logger.conf for each remote console session and
use the dateformat= option to set the per-line timestamp for verbose messages

Change-Id: I3ea10990dbd920e9f7ce8ff771bc65aa7f4ea8c1
ASTERISK-25358: #close
Reported-by: Igor Liferenko
2021-03-22 11:18:14 -05:00
Kevin Harwell
ec8b030bd7 manager: Increase the non breaking AMI version number
ASTERISK~29244 added three new AMI events, so bump the version number.

Change-Id: I0e77fa36d38fb27dec3481d4ef08131330da0632
2021-03-11 10:54:49 -06:00
Jaco Kroon
fce875cf46 app.h: Fix -Werror=zero-length-bounds compile errors in dev mode.
Change-Id: I5c104dc1f8417ccd3d01faf86e84ccbf89bc3b31
Signed-off-by: Jaco Kroon <jaco@uls.co.za>
2021-03-10 04:24:40 -06:00
Sean Bright
08b94d5837 strings.h: ast_str_to_upper() and _to_lower() are not pure.
Because they modify their argument they are not pure functions and
should not be marked as such, otherwise the compiler may optimize
them away.

ASTERISK-29306 #close

Change-Id: Ibec03a08522dd39e8a137ece9bc6a3059dfaad5f
2021-03-10 04:18:14 -06:00
Joshua C. Colp
11b53aecc8 sorcery: Add support for more intelligent reloading.
Some sorcery objects actually contain dynamic content
that can change despite the underlying configuration
itself not changing. A good example of this is the
res_pjsip_endpoint_identifier_ip module which allows
specifying hostnames. While the configuration may not
change between reloads the DNS information of the
hostnames can.

This change adds the ability for a sorcery object to be
marked as having dynamic contents which is then taken
into account when reloading by the sorcery file based
config module. If there is an object with dynamic content
then a reload will be forced while if there are none
then the existing behavior of not reloading occurs.

ASTERISK-29321

Change-Id: I9342dc55be46cc00204533c266a68d972760a0b1
2021-03-05 10:32:59 -06:00
Jaco Kroon
a63c7883b4 app.h: Restore C++ compatibility for macro AST_DECLARE_APP_ARGS
This partially reverts commit 3d1bf3c537,
specifically for app.h.

This works with both gcc 9.3.0 and 10.2.0 now, both for C and C++ (as
tested with external modules).

ASTERISK-29287

Change-Id: I5b9f02a9b290675682a1d13f1788fdda597c9fca
Signed-off-by: Jaco Kroon <jaco@uls.co.za>
2021-02-23 13:01:54 -06:00
Sebastien Duthil
435d68be97 app_mixmonitor: Add AMI events MixMonitorStart, -Stop and -Mute.
ASTERISK-29244

Change-Id: I1862d58264c2c8b5d8983272cb29734b184d67c5
2021-02-18 17:17:00 -06:00
Ben Ford
215550ed4b core_unreal: Fix T.38 faxing when using local channels.
After some changes to streams and topologies, receiving fax through
local channels stopped working. This change adds a stream topology with
a stream of type IMAGE to the local channel pair and allows fax to be
received.

ASTERISK-29035 #close

Change-Id: Id103cc5c9295295d8e68d5628e76220f8f17e9fb
2021-02-16 18:11:07 -06:00
Dan Cropp
a5364ac69b chan_pjsip, app_transfer: Add TRANSFERSTATUSPROTOCOL variable
When a Transfer/REFER is executed, TRANSFERSTATUSPROTOCOL variable is
0 when no protocl specific error
SIP example of failure, 3xx-6xx for the SIP error code received

This allows applications to perform actions based on the failure
reason.

ASTERISK-29252 #close
Reported-by: Dan Cropp

Change-Id: Ia6a94784b4925628af122409cdd733c9f29abfc4
2021-01-27 11:46:39 -06:00
Sean Bright
4c5bffb217 asterisk: Export additional manager functions
Rename check_manager_enabled() and check_webmanager_enabled() to begin
with ast_ so that the symbols are automatically exported by the
linker.

ASTERISK~29184

Change-Id: I85762b9a5d14500c15f6bad6507138c8858644c9
2021-01-06 09:11:20 -06:00
lvl
8d2558209b Introduce astcachedir, to be used for temporary bucket files
As described in the issue, /tmp is not a suitable location for a
large amount of cached media files, since most distributions make
/tmp a RAM-based tmpfs mount with limited capacity.

I opted for a location that can be configured separately, as opposed
to using a subdirectory of spooldir, given the different storage
profile (transient files vs files that might stay there indefinitely).

This commit just makes the cache directory configurable, but leaves
it at /tmp by default, to ensure backwards compatibility.

A future commit that only targets master could change the default
location to something more sensible such as /var/tmp/asterisk. At
that point, the cachedir could be created and cleaned up during
uninstall by the Makefile script.

ASTERISK-29143

Change-Id: Ic54e95199405abacd9e509cef5f08fa14c510b5d
2020-12-09 13:06:27 -06:00
George Joseph
80f116c156 pjsip_scheduler.c: Add type ONESHOT and enhance cli show command
* Added a ONESHOT type that never reschedules.

* Added "like" capability to "pjsip show scheduled_tasks" so you can do
  the following:

  CLI> pjsip show scheduled_tasks like outreg
  PJSIP Scheduled Tasks:

  Task Name                                     Interval  Times Run ...
  ============================================= ========= ========= ...
  pjsip/outreg/testtrunk-reg-0-00000074            50.000   oneshot ...
  pjsip/outreg/voipms-reg-0-00000073              110.000   oneshot ...

* Fixed incorrect display of "Next Start".

* Compacted the displays of times in the CLI.

* Added two new functions (ast_sip_sched_task_get_times2,
  ast_sip_sched_task_get_times_by_name2) that retrieve the interval,
  next start time, and next run time in addition to the times already
  returned by ast_sip_sched_task_get_times().

Change-Id: Ie718ca9fd30490b8a167bedf6b0b06d619dc52f3
2020-11-09 14:46:53 -06:00
Alexei Gradinari
728cd55cde sched: AST_SCHED_REPLACE_UNREF can lead to use after free of data
The data can be freed if the old object '_data' is the same object as
new 'data'. Because at first the object is unreferenced which can lead
to destroying it.

This could happened in res_pjsip_pubsub when the publication is updated
which could lead to segfault in function publish_expire.

Change-Id: I0164f57c387243510bdbd2f8dcf33377b6c202da
2020-11-09 09:00:07 -06:00
Alexander Traud
277aa0ced6 res_stir_shaken: Include OpenSSL headers where used actually.
This avoids the inclusion of the OpenSSL headers in the public header,
which avoids one external library dependency in res_pjsip_stir_shaken.

Change-Id: I6a07e2d81d2b5442e24e99b8cc733a99f881dcf4
2020-11-09 08:35:51 -06:00
Kevin Harwell
8973fe5cf3 AST-2020-001 - res_pjsip: Return dialog locked and referenced
pjproject returns the dialog locked and with a reference. However,
in Asterisk the method that handles this decrements the reference
and removes the lock prior to returning. This makes it possible,
under some circumstances, for another thread to free said dialog
before the thread that created it attempts to use it again. Of
course when the thread that created it tries to use a freed dialog
a crash can occur.

This patch makes it so Asterisk now returns the newly created
dialog both locked, and with an added reference. This allows the
caller to de-reference, and unlock the dialog when it is safe to
do so.

In the case of a new SIP Invite the lock, and reference are now
held for the entirety of the new invite handling process.
Otherwise it's possible for the dialog, or its dependent objects,
like the transaction, to disappear. For example if there is a TCP
transport error.

ASTERISK-29057 #close

Change-Id: I5ef645a47829596f402cf383dc02c629c618969e
2020-11-05 11:02:20 -06:00
Ben Ford
58aa6a7057 AST-2020-002 - res_pjsip: Stop sending INVITEs after challenge limit.
If Asterisk sends out an INVITE and receives a challenge with a
different nonce value each time, it will continuously send out INVITEs,
even if the call is hung up. The endpoint must be configured for
outbound authentication for this to occur. A limit has been set on
outbound INVITEs so that, once reached, Asterisk will stop sending
INVITEs and the transaction will terminate.

ASTERISK-29013

Change-Id: I2d001ca745b00ca8aa12030f2240cd72363b46f7
2020-11-05 10:30:26 -06:00
Kevin Harwell
e051806e80 Logging: Add debug logging categories
Added debug logging categories that allow a user to output debug
information based on a specified category. This lets the user limit,
and filter debug output to data relevant to a particular context,
or topic. For instance the following categories are now available for
debug logging purposes:

  dtls, dtls_packet, ice, rtcp, rtcp_packet, rtp, rtp_packet,
  stun, stun_packet

These debug categories can be enable/disable via an Asterisk CLI command.

While this overrides, and outputs debug data, core system debugging is
not affected by this patch. Statements still output at their appropriate
debug level. As well backwards compatibility has been maintained with
past debug groups that could be enabled using the CLI (e.g. rtpdebug,
stundebug, etc.).

ASTERISK-29054 #close

Change-Id: I6e6cb247bb1f01dbf34750b2cd98e5b5b41a1849
(cherry picked from commit 56028426de)
2020-10-12 10:50:10 -05:00
Ben Ford
681a1624b5 utils.c: NULL terminate ast_base64decode_string.
With the addition of STIR/SHAKEN, the function ast_base64decode_string
was added for convenience since there is a lot of converting done during
the STIR/SHAKEN process. This function returned the decoded string for
you, but did not NULL terminate it, causing some issues (specifically
with MALLOC_DEBUG). Now, the returned string is NULL terminated, and the
documentation has been updated to reflect this.

Change-Id: Icdd7d05b323b0c47ff6ed43492937a03641bdcf5
2020-10-06 09:07:51 -05:00
Ben Ford
21ab0a450b res_stir_shaken: Add stir_shaken option and general improvements.
Added a new configuration option for PJSIP endpoints - stir_shaken. If
set to yes, then STIR/SHAKEN support will be added to inbound and
outbound INVITEs. The default is no. Alembic has been updated to include
this option.

Previously the dialplan function was not trimming the whitespace from
the parameters it recieved. Now it does.

Also added a conditional that, when TEST_FRAMEWORK is enabled, the
timestamp in the identity header will be overlooked. This is just for
testing, since the testsuite will rely on a SIPp scenario with a preset
identity header to trigger the MISMATCH result.

Change-Id: I43d67f1489b8c1c5729ed3ca8d71e35ddf438df1
2020-10-06 09:07:51 -05:00
Ben Ford
d979bdf87a res_stir_shaken: Add outbound INVITE support.
Integrated STIR/SHAKEN support with outgoing INVITEs. When an INVITE is
sent, the caller ID will be checked to see if there is a certificate
that corresponds to it. If so, that information will be retrieved and an
Identity header will be added to the SIP message. The format is:

header.payload.signature;info=<public_key_url>alg=ES256;ppt=shaken

Header, payload, and signature are all BASE64 encoded. The public key
URL is retrieved from the certificate. Currently the algorithm and ppt
are ES256 and shaken, respectively. This message is signed and can be
used for verification on the receiving end.

Two new configuration options have been added to the certificate object:
attestation and origid. The attestation is required and must be A, B, or
C. origid is the origination identifier.

A new utility function has been added as well that takes a string,
allocates space, BASE64 encodes it, then returns it, eliminating the
need to calculate the size yourself.

Change-Id: I1f84d6a5839cb2ed152ef4255b380cfc2de662b4
2020-10-06 09:07:51 -05:00
Ben Ford
746ce16b16 res_stir_shaken: Add inbound INVITE support.
Integrated STIR/SHAKEN support with incoming INVITES. Upon receiving an
INVITE, the Identity header is retrieved, parsing the message to verify
the signature. If any of the parsing fails,
AST_STIR_SHAKEN_VERIFY_NOT_PRESENT will be added to the channel for this
caller ID. If verification itself fails,
AST_STIR_SHAKEN_VERIFY_SIGNATURE_FAILED will be added. If anything in
the payload does not line up with the SIP signaling,
AST_STIR_SHAKEN_VERIFY_MISMATCH will be added. If all of the above steps
pass, then AST_STIR_SHAKEN_VERIFY_PASSED will be added, completing the
verification process.

A new config option has been added to the general section for
stir_shaken.conf. "signature_timeout" is the amount of time a signature
will be considered valid. If an INVITE is received and the amount of
time between when it was received and when it was signed is greater than
signature_timeout, verification will fail.

Some changes were also made to signing and verification. There was an
error where the whole JSON string was being signed rather than the
header combined with the payload. This has been changed to sign the
correct thing. Verification has been changed to do this as well, and the
unit tests have been updated to reflect these changes.

A couple of utility functions have also been added. One decodes a BASE64
string and returns the decoded string, doing all the length calculations
for you. The other retrieves a string value from a header in a rdata
object.

Change-Id: I855f857be3d1c63b64812ac35d9ce0534085b913
2020-10-06 09:07:51 -05:00
Ben Ford
035b463c93 res_stir_shaken: Added dialplan function and API call.
Adds the "STIR_SHAKEN" dialplan function and an API call to add a
STIR_SHAKEN verification result to a channel. This information will be
held in a datastore on the channel that can later be queried through the
"STIR_SHAKEN" dialplan funtion to get information on STIR_SHAKEN results
including identity, attestation, and verify_result. Here are some
examples:

STIR_SHAKEN(count)
STIR_SHAKEN(0, identity)
STIR_SHAKEN(1, attestation)
STIR_SHAKEN(2, verify_result)

Getting the count can be used to iterate through the results and pull
information by specifying the index and the field you want to retrieve.

Change-Id: Ice6d52a3a7d6e4607c9c35b28a1f7c25f5284a82
2020-10-06 09:07:51 -05:00
Ben Ford
70af7e1311 res_stir_shaken: Implemented signature verification.
There are a lot of moving parts in this patch, but the focus of it is on
the verification of the signature using a public key located at the
public key URL provided in the JSON payload. First, we check the
database to see if we have already downloaded the key. If so, check to
see if it has expired. If it has, redownload from the URL. If we don't
have an entry in the database, just go ahead and download the public
key. The expiration is tested each time we download the file. After
that, read the public key from the file and use it to verify the
signature. All sanity checking is done when the payload is first
received, so the verification is complete once this point is reached.

The XML has also been added since a new config option was added to
general (curl_timeout). The maximum amount of time to wait for a
download can be configured through this option, with a low value by
default.

Change-Id: I3ba4c63880493bf8c7d17a9cfca1af0e934d1a1c
2020-10-06 09:07:51 -05:00
Ben Ford
e9ee9a381b res_stir_shaken: Implemented signing of JSON payload.
This change provides functions that take in a JSON payload, verify that
the contents contain all the mandatory fields and required values (if
any), and signs the payload with the private key. Four fields are added
to the payload: x5u, attest, iat, and origid. As of now, these are just
placeholder values that will be set to actual values once the logic is
implemented for what to do when an actual payload is received, but the
functions to add these values have all been implemented and are ready to
use. Upon successful signing and the addition of those four values, a
ast_stir_shaken_payload is returned, containing other useful information
such as the algorithm and signature.

Change-Id: I74fa41c0640ab2a64a1a80110155bd7062f13393
2020-10-06 09:07:51 -05:00
Ben Ford
716e51a3f3 res_stir_shaken: Initial commit and reading private key.
This commit sets up some of the initial framework for the module and
adds a way to read the private key from the specified file, which will
then be appended to the certificate object. This works fine for now, but
eventually some other structure will likely need to be used to store all
this information. Similarly, the caller_id_number is specified on the
certificate config object, but in the end we will want that information
to be tied to the certificate itself and read it from there.

A method has been added that will retrieve the private key associated
with the caller_id_number passed in. Tab completion for certificates and
stores has also been added.

Change-Id: Ic4bc1416fab5d6afe15a8e2d32f7ddd4e023295f
2020-10-06 09:07:51 -05:00
Sean Bright
7a64868118 pbx.c: On error, ast_add_extension2_lockopt should always free 'data'
In the event that the desired extension already exists,
ast_add_extension2_lockopt() will free the 'data' it is passed before
returning an error, so we should not be freeing it ourselves.

Additionally, there were two places where ast_add_extension2_lockopt()
could return an error without also freeing the 'data' pointer, so we
add that.

ASTERISK-29097 #close

Change-Id: I904707aae55169feda050a5ed7c6793b53fe6eae
2020-10-02 10:10:58 -05:00
George Joseph
3b0a53f257 app_confbridge/bridge_softmix: Add ability to force estimated bitrate
app_confbridge now has the ability to set the estimated bitrate on an
SFU bridge.  To use it, set a bridge profile's remb_behavior to "force"
and set remb_estimated_bitrate to a rate in bits per second.  The
remb_estimated_bitrate parameter is ignored if remb_behavior is something
other than "force".

Change-Id: Idce6464ff014a37ea3b82944452e56cc4d75ab0a
2020-10-01 08:01:17 -05:00