asterisk/res/res_stir_shaken/attestation.c

/*
 * Asterisk -- An open source telephony toolkit.
 *
 * Copyright (C) 2023, Sangoma Technologies Corporation
 *
 * George Joseph <gjoseph@sangoma.com>
 *
 * See http://www.asterisk.org for more information about
 * the Asterisk project. Please do not directly contact
 * any of the maintainers of this project for assistance;
 * the project provides a web site, mailing lists and IRC
 * channels for your use.
 *
 * This program is free software, distributed under the terms of
 * the GNU General Public License Version 2. See the LICENSE file
 * at the top of the source tree.
 */

#include <jwt.h>

#define _TRACE_PREFIX_ "a",__LINE__, ""

#include "asterisk.h"
#include "asterisk/module.h"
#include "asterisk/uuid.h"
#include "asterisk/json.h"
#include "asterisk/channel.h"

#include "stir_shaken.h"

static const char *as_rc_map[] = {
	[AST_STIR_SHAKEN_AS_SUCCESS] = "success",
	[AST_STIR_SHAKEN_AS_DISABLED] = "disabled",
	[AST_STIR_SHAKEN_AS_INVALID_ARGUMENTS] = "invalid_arguments",
	[AST_STIR_SHAKEN_AS_MISSING_PARAMETERS] = "missing_parameters",
	[AST_STIR_SHAKEN_AS_INTERNAL_ERROR] = "internal_error",
	[AST_STIR_SHAKEN_AS_NO_TN_FOR_CALLERID] = "no_tn_for_callerid",
	[AST_STIR_SHAKEN_AS_NO_PRIVATE_KEY_AVAIL] = "no_private_key_avail",
	[AST_STIR_SHAKEN_AS_NO_PUBLIC_CERT_URL_AVAIL] = "no_public_cert_url_avail",
	[AST_STIR_SHAKEN_AS_NO_ATTEST_LEVEL] = "no_attest_level",
	[AST_STIR_SHAKEN_AS_IDENTITY_HDR_EXISTS] = "identity_header_exists",
	[AST_STIR_SHAKEN_AS_NO_TO_HDR] = "no_to_hdr",
	[AST_STIR_SHAKEN_AS_TO_HDR_BAD_URI] = "to_hdr_bad_uri",
	[AST_STIR_SHAKEN_AS_SIGN_ENCODE_FAILURE] "sign_encode_failure",
};

const char *as_response_code_to_str(
	enum ast_stir_shaken_as_response_code as_rc)
{
	return ARRAY_IN_BOUNDS(as_rc, as_rc_map) ?
		as_rc_map[as_rc] : NULL;
}

static void ctx_destructor(void *obj)
{
	struct ast_stir_shaken_as_ctx *ctx = obj;

	ao2_cleanup(ctx->etn);
	ast_channel_cleanup(ctx->chan);
	ast_string_field_free_memory(ctx);
	AST_VECTOR_RESET(&ctx->fingerprints, ast_free);
	AST_VECTOR_FREE(&ctx->fingerprints);
}

enum ast_stir_shaken_as_response_code
	ast_stir_shaken_as_ctx_create(const char *orig_tn,
		const char *dest_tn, struct ast_channel *chan,
		const char *profile_name,
		const char *tag, struct ast_stir_shaken_as_ctx **ctxout)
{
	RAII_VAR(struct ast_stir_shaken_as_ctx *, ctx, NULL, ao2_cleanup);
	RAII_VAR(struct profile_cfg *, eprofile, NULL, ao2_cleanup);
	RAII_VAR(struct attestation_cfg *, as_cfg, NULL, ao2_cleanup);
	RAII_VAR(struct tn_cfg *, etn, NULL, ao2_cleanup);
	RAII_VAR(char *, canon_dest_tn , canonicalize_tn_alloc(dest_tn), ast_free);
	RAII_VAR(char *, canon_orig_tn , canonicalize_tn_alloc(orig_tn), ast_free);

	const char *t = S_OR(tag, S_COR(chan, ast_channel_name(chan), ""));
	SCOPE_ENTER(3, "%s: Enter\n", t);

	as_cfg = as_get_cfg();
	if (as_cfg->global_disable) {
		SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_DISABLED,
			"%s: Globally disabled\n", t);
	}

	if (ast_strlen_zero(profile_name)) {
		SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_DISABLED,
			"%s: Disabled due to missing profile name\n", t);
	}

	eprofile = eprofile_get_cfg(profile_name);
	if (!eprofile) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_DISABLED,
		LOG_ERROR, "%s: No profile for profile name '%s'.  Call will continue\n", tag,
			profile_name);
	}

	if (!PROFILE_ALLOW_ATTEST(eprofile)) {
		SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_DISABLED,
			"%s: Disabled by profile '%s'\n", t, profile_name);
	}

	if (ast_strlen_zero(tag)) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INVALID_ARGUMENTS,
			LOG_ERROR, "%s: Must provide tag\n", t);
	}

	if (!canon_orig_tn) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INVALID_ARGUMENTS,
			LOG_ERROR, "%s: Must provide caller_id/orig_tn\n", tag);
	}

	if (!canon_dest_tn) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INVALID_ARGUMENTS,
			LOG_ERROR, "%s: Must provide dest_tn\n", tag);
	}

	if (!ctxout) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INVALID_ARGUMENTS,
			LOG_ERROR, "%s: Must provide ctxout\n", tag);
	}

	etn = tn_get_etn(canon_orig_tn, eprofile);
	if (!etn) {
		SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_DISABLED,
			"%s: No tn for orig_tn '%s'\n", tag, canon_orig_tn);
	}

	/* We don't need eprofile or as_cfg anymore so let's clean em up */
	ao2_cleanup(as_cfg);
	as_cfg = NULL;
	ao2_cleanup(eprofile);
	eprofile = NULL;


	if (etn->acfg_common.attest_level == attest_level_NOT_SET) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_MISSING_PARAMETERS,
			LOG_ERROR,
			"'%s': No attest_level specified in tn, profile or attestation objects\n",
			tag);
	}

	if (ast_strlen_zero(etn->acfg_common.public_cert_url)) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_NO_PUBLIC_CERT_URL_AVAIL,
			LOG_ERROR, "%s: No public cert url in tn %s, profile or attestation objects\n",
			tag, canon_orig_tn);
	}

	if (etn->acfg_common.raw_key_length == 0) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_NO_PRIVATE_KEY_AVAIL,
			LOG_ERROR, "%s: No private key in tn %s, profile or attestation objects\n",
			canon_orig_tn, tag);
	}

	ctx = ao2_alloc_options(sizeof(*ctx), ctx_destructor,
		AO2_ALLOC_OPT_LOCK_NOLOCK);
	if (!ctx) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			LOG_ERROR, "%s: Unable to allocate memory for ctx\n", tag);
	}

	if (ast_string_field_init(ctx, 1024) != 0) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			LOG_ERROR, "%s: Unable to allocate memory for ctx\n", tag);
	}

	if (ast_string_field_set(ctx, tag, tag) != 0) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			LOG_ERROR, "%s: Unable to allocate memory for ctx\n", tag);
	}

	if (ast_string_field_set(ctx, orig_tn, canon_orig_tn) != 0) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			LOG_ERROR, "%s: Unable to allocate memory for ctx\n", tag);
	}

	if (ast_string_field_set(ctx, dest_tn, canon_dest_tn)) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			LOG_ERROR, "%s: Unable to allocate memory for ctx\n", tag);
	}

	ctx->chan = chan;
	ast_channel_ref(ctx->chan);

	if (AST_VECTOR_INIT(&ctx->fingerprints, 1) != 0) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			LOG_ERROR, "%s: Unable to allocate memory for ctx\n", tag);
	}

	/* Transfer the references */
	ctx->etn = etn;
	etn = NULL;
	*ctxout = ctx;
	ctx = NULL;

	SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_SUCCESS, "%s: Done\n", tag);
}

int ast_stir_shaken_as_ctx_wants_fingerprints(struct ast_stir_shaken_as_ctx *ctx)
{
	return ENUM_BOOL(ctx->etn->acfg_common.send_mky, send_mky);
}

enum ast_stir_shaken_as_response_code
	ast_stir_shaken_as_ctx_add_fingerprint(
	struct ast_stir_shaken_as_ctx *ctx, const char *alg, const char *fingerprint)
{
	char *compacted_fp = ast_alloca(strlen(fingerprint) + 1);
	const char *f = fingerprint;
	char *fp = compacted_fp;
	char *combined;
	int rc;
	SCOPE_ENTER(4, "%s: Add fingerprint %s:%s\n", ctx ? ctx->tag : "",
		alg, fingerprint);

	if (!ctx || ast_strlen_zero(alg) || ast_strlen_zero(fingerprint)) {
		SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_INVALID_ARGUMENTS,
			"%s: Missing arguments\n", ctx->tag);
	}

	if (!ENUM_BOOL(ctx->etn->acfg_common.send_mky, send_mky)) {
		SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_DISABLED,
			"%s: Not needed\n", ctx->tag);
	}

	/* De-colonize */
	while (*f != '\0') {
		if (*f != ':') {
			*fp++ = *f;
		}
		f++;
	}
	*fp = '\0';
	rc = ast_asprintf(&combined, "%s:%s", alg, compacted_fp);
	if (rc < 0) {
		SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			"%s: Can't allocate memory for comobined string\n", ctx->tag);
	}

	rc = AST_VECTOR_ADD_SORTED(&ctx->fingerprints, combined, strcasecmp);
	if (rc < 0) {
		SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			"%s: Can't add entry to vector\n", ctx->tag);
	}

	SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_SUCCESS,
		"%s: Done\n", ctx->tag);
}

/*
 * We have to construct the PASSporT payload manually instead of
 * using ast_json_pack.  These macros help make sure nothing
 * leaks if there are errors creating the individual objects.
 */
#define CREATE_JSON_SET_OBJ(__val, __obj, __name) \
({ \
	struct ast_json *__var; \
	if (!(__var = __val)) {\
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR, \
			LOG_ERROR, "%s: Cannot allocate one of the JSON objects\n", \
			ctx->tag); \
	} else { \
		if (ast_json_object_set(__obj, __name, __var)) { \
			SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR, \
				LOG_ERROR, "%s: Cannot set one of the JSON objects\n", \
				ctx->tag); \
		} \
	} \
	(__var); \
})

#define CREATE_JSON_APPEND_ARRAY(__val, __obj) \
({ \
	struct ast_json *__var; \
	if (!(__var = __val)) {\
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR, \
			LOG_ERROR, "%s: Cannot allocate one of the JSON objects\n", \
			ctx->tag); \
	} else { \
		if (ast_json_array_append(__obj, __var)) { \
			SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR, \
				LOG_ERROR, "%s: Cannot set one of the JSON objects\n", \
				ctx->tag); \
		} \
	} \
	(__var); \
})

static enum ast_stir_shaken_as_response_code pack_payload(
	struct ast_stir_shaken_as_ctx *ctx, jwt_t *jwt)
{
	RAII_VAR(struct ast_json *, payload, ast_json_object_create(), ast_json_unref);
	/*
	 * These don't need RAII because once they're added to payload,
	 * they'll get destroyed when payload gets unreffed.
	 */
	struct ast_json *dest;
	struct ast_json *tns;
	struct ast_json *orig;
	char origid[AST_UUID_STR_LEN];
	char *payload_str = NULL;
	SCOPE_ENTER(3, "%s: Enter\n", ctx->tag);

	/*
	 * All fields added need to be in alphabetical order
	 * and there must be no whitespace in the result.
	 *
	 * We can't use ast_json_pack here because the entries
	 * need to be kept in order and the "mky" array may
	 * not be present.
	 */

	/*
	 * The order of the calls matters.  We want to add an object
	 * to its parent as soon as it's created, then add things
	 * to it.  This way if something later fails, the whole thing
	 * will get destroyed when its parent gets destroyed.
	 */
	CREATE_JSON_SET_OBJ(ast_json_string_create(
		attest_level_to_str(ctx->etn->acfg_common.attest_level)),
		payload, "attest");

	dest = CREATE_JSON_SET_OBJ(ast_json_object_create(), payload, "dest");
	tns = CREATE_JSON_SET_OBJ(ast_json_array_create(), dest, "tn");
	CREATE_JSON_APPEND_ARRAY(ast_json_string_create(ctx->dest_tn), tns);

	CREATE_JSON_SET_OBJ(ast_json_integer_create(time(NULL)), payload, "iat");

	if (AST_VECTOR_SIZE(&ctx->fingerprints)
		&& ENUM_BOOL(ctx->etn->acfg_common.send_mky, send_mky)) {
		struct ast_json *mky;
		int i;

		mky = CREATE_JSON_SET_OBJ(ast_json_array_create(), payload, "mky");

		for (i = 0; i < AST_VECTOR_SIZE(&ctx->fingerprints); i++) {
			struct ast_json *mk;
			char *afp = AST_VECTOR_GET(&ctx->fingerprints, i);
			char *fp = strchr(afp, ':');
			*fp++ = '\0';

			mk = CREATE_JSON_APPEND_ARRAY(ast_json_object_create(), mky);
			CREATE_JSON_SET_OBJ(ast_json_string_create(afp), mk, "alg");
			CREATE_JSON_SET_OBJ(ast_json_string_create(fp), mk, "dig");
		}
	}

	orig = CREATE_JSON_SET_OBJ(ast_json_object_create(), payload, "orig");
	CREATE_JSON_SET_OBJ(ast_json_string_create(ctx->orig_tn), orig, "tn");

	ast_uuid_generate_str(origid, sizeof(origid));
	CREATE_JSON_SET_OBJ(ast_json_string_create(origid), payload, "origid");

	payload_str = ast_json_dump_string_format(payload, AST_JSON_COMPACT);
	ast_trace(2, "Payload: %s\n", payload_str);
	jwt_add_grants_json(jwt, payload_str);
	ast_json_free(payload_str);

	SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_SUCCESS, "Done\n");

}

enum ast_stir_shaken_as_response_code ast_stir_shaken_attest(
	struct ast_stir_shaken_as_ctx *ctx, char **header)
{
	RAII_VAR(jwt_t *, jwt, NULL, jwt_free);
	jwt_alg_t alg;
	char *encoded = NULL;
	enum ast_stir_shaken_as_response_code as_rc;
	int rc = 0;
	SCOPE_ENTER(3, "%s: Attestation: orig: %s dest: %s\n",
		ctx ? ctx->tag : "NULL", ctx ? ctx->orig_tn : "NULL",
		ctx ? ctx->dest_tn : "NULL");

	if (!ctx) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR, LOG_ERROR,
			"%s: No context object!\n", "NULL");
	}

	if (header == NULL) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INVALID_ARGUMENTS,
			LOG_ERROR, "%s: Header buffer was NULL\n", ctx->tag);
	}

	rc = jwt_new(&jwt);
	if (rc != 0) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			LOG_ERROR, "%s: Cannot create JWT\n", ctx->tag);
	}

	/*
	 * All headers added need to be in alphabetical order!
	 */
	alg = jwt_str_alg(STIR_SHAKEN_ENCRYPTION_ALGORITHM);
	jwt_set_alg(jwt, alg, (const unsigned char *)ctx->etn->acfg_common.raw_key,
		ctx->etn->acfg_common.raw_key_length);
	jwt_add_header(jwt, "ppt", STIR_SHAKEN_PPT);
	jwt_add_header(jwt, "typ", STIR_SHAKEN_TYPE);
	jwt_add_header(jwt, "x5u", ctx->etn->acfg_common.public_cert_url);

	as_rc = pack_payload(ctx, jwt);
	if (as_rc != AST_STIR_SHAKEN_AS_SUCCESS) {
		SCOPE_EXIT_LOG_RTN_VALUE(as_rc,
			LOG_ERROR, "%s: Cannot pack payload\n", ctx->tag);
	}

	encoded = jwt_encode_str(jwt);
	if (!encoded) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_SIGN_ENCODE_FAILURE,
			LOG_ERROR, "%s: Unable to sign/encode JWT\n", ctx->tag);
	}

	rc = ast_asprintf(header, "%s;info=<%s>;alg=%s;ppt=%s",
		encoded, ctx->etn->acfg_common.public_cert_url, jwt_alg_str(alg),
		STIR_SHAKEN_PPT);
	ast_std_free(encoded);
	if (rc < 0) {
		SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_AS_INTERNAL_ERROR,
			LOG_ERROR, "%s: Unable to allocate memory for identity header\n",
			ctx->tag);
	}

	SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_AS_SUCCESS, "%s: Done\n", ctx->tag);
}

int as_reload()
{
	as_config_reload();

	return 0;
}

int as_unload()
{
	as_config_unload();
	return 0;
}

int as_load()
{
	if (as_config_load()) {
		return AST_MODULE_LOAD_DECLINE;
	}

	return AST_MODULE_LOAD_SUCCESS;
}