kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-11-17 15:29:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

chan_sip: Add sendrpid trust options

Browse Source 
In r411189, some behavior was changed which made sendrpid behavior
act in a more trusting manner by sending full user data for peers
set with private caller presence in P-Asserted-Identity headers.
Since this changed long time expected behaviors, we decided to pull
that patch when that was pointed out by the community. Instead, this
patch provides a trust_id_outbound setting which will expose the data
per RFC-3325 if set to 'yes' and simply not send the PAI/RPID headers
at all if set to 'no'. By default trust_id_outbound will be set to
'legacy' which will preserve the behavior prior to these patches.
Extra special thanks to Walter Doekes for providing advice and
feedback.

(closes issue AST-1301)

(closes issue ASTERISK-19465)
Reported by: Krzysztof Chmielewski

Review: https://reviewboard.asterisk.org/r/3447/
........

Merged revisions 412744 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@412746 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Jonathan Rose
2014-04-21 15:51:40 +00:00
parent a4de660c40
commit 43f21b8564
4 changed files with 95 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
channels/chan_sip.c
View File

@@ -12525,15 +12525,39 @@ static int add_rpid(struct sip_request *req, struct sip_pvt *p)
}
lid_pres = ast_party_id_presentation(&connected_id);
fromdomain = S_OR(p->fromdomain, ast_sockaddr_stringify_host_remote(&p->ourip));
if (((lid_pres & AST_PRES_RESTRICTION) != AST_PRES_ALLOWED) &&
(ast_test_flag(&p->flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND) == SIP_PAGE2_TRUST_ID_OUTBOUND_NO)) {
/* If pres is not allowed and we don't trust the peer, we don't apply an RPID header */
return 0;
}
fromdomain = p->fromdomain;
if (!fromdomain ||
((ast_test_flag(&p->flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND) == SIP_PAGE2_TRUST_ID_OUTBOUND_YES) &&
!strcmp("anonymous.invalid", fromdomain))) {
/* If the fromdomain is NULL or if it was set to anonymous.invalid due to privacy settings and we trust the peer,
* use the host IP address */
fromdomain = ast_sockaddr_stringify_host_remote(&p->ourip);
}
lid_num = ast_uri_encode(lid_num, tmp2, sizeof(tmp2), ast_uri_sip_user);
if (ast_test_flag(&p->flags[0], SIP_SENDRPID_PAI)) {
if ((lid_pres & AST_PRES_RESTRICTION) != AST_PRES_ALLOWED) {
ast_str_set(&tmp, -1, "%s", anonymous_string);
} else {
if (ast_test_flag(&p->flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND) != SIP_PAGE2_TRUST_ID_OUTBOUND_LEGACY) {
/* trust_id_outbound = yes - Always give full information even if it's private, but append a privacy header
* When private data is included */
ast_str_set(&tmp, -1, "\"%s\" <sip:%s@%s>", lid_name, lid_num, fromdomain);
if ((lid_pres & AST_PRES_RESTRICTION) != AST_PRES_ALLOWED) {
add_header(req, "Privacy", "id");
}
} else {
/* trust_id_outbound = legacy - behave in a non RFC-3325 compliant manner and send anonymized data when
* when handling private data. */
if ((lid_pres & AST_PRES_RESTRICTION) == AST_PRES_ALLOWED) {
ast_str_set(&tmp, -1, "\"%s\" <sip:%s@%s>", lid_name, lid_num, fromdomain);
} else {
ast_str_set(&tmp, -1, "%s", anonymous_string);
}
}
add_header(req, "P-Asserted-Identity", ast_str_buffer(tmp));
} else {
@@ -19418,6 +19442,18 @@ static const char *allowoverlap2str(int mode)
return map_x_s(allowoverlapstr, mode, "<error>");
}
static const struct _map_x_s trust_id_outboundstr[] = {
{ SIP_PAGE2_TRUST_ID_OUTBOUND_LEGACY, "Legacy" },
{ SIP_PAGE2_TRUST_ID_OUTBOUND_NO, "No" },
{ SIP_PAGE2_TRUST_ID_OUTBOUND_YES, "Yes" },
{ -1, NULL }, /* terminator */
};
static const char *trust_id_outbound2str(int mode)
{
return map_x_s(trust_id_outboundstr, mode, "<error>");
}
/*! \brief Destroy disused contexts between reloads
Only used in reload_config so the code for regcontext doesn't get ugly
*/
@@ -20057,6 +20093,7 @@ static char *_sip_show_peer(int type, int fd, struct mansession *s, const struct
ast_cli(fd, " Ign SDP ver : %s\n", AST_CLI_YESNO(ast_test_flag(&peer->flags[1], SIP_PAGE2_IGNORESDPVERSION)));
ast_cli(fd, " Trust RPID : %s\n", AST_CLI_YESNO(ast_test_flag(&peer->flags[0], SIP_TRUSTRPID)));
ast_cli(fd, " Send RPID : %s\n", AST_CLI_YESNO(ast_test_flag(&peer->flags[0], SIP_SENDRPID)));
ast_cli(fd, " TrustIDOutbnd: %s\n", trust_id_outbound2str(ast_test_flag(&peer->flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND)));
ast_cli(fd, " Subscriptions: %s\n", AST_CLI_YESNO(ast_test_flag(&peer->flags[1], SIP_PAGE2_ALLOWSUBSCRIBE)));
ast_cli(fd, " Overlap dial : %s\n", allowoverlap2str(ast_test_flag(&peer->flags[1], SIP_PAGE2_ALLOWOVERLAP)));
if (peer->outboundproxy)
@@ -30087,6 +30124,19 @@ static int handle_common_options(struct ast_flags *flags, struct ast_flags *mask
} else if (!strcasecmp(v->name, "rpid_immediate")) {
ast_set_flag(&mask[1], SIP_PAGE2_RPID_IMMEDIATE);
ast_set2_flag(&flags[1], ast_true(v->value), SIP_PAGE2_RPID_IMMEDIATE);
} else if (!strcasecmp(v->name, "trust_id_outbound")) {
ast_set_flag(&mask[1], SIP_PAGE2_TRUST_ID_OUTBOUND);
ast_clear_flag(&flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND);
if (!strcasecmp(v->value, "legacy")) {
ast_set_flag(&flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND_LEGACY);
} else if (ast_true(v->value)) {
ast_set_flag(&flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND_YES);
} else if (ast_false(v->value)) {
ast_set_flag(&flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND_NO);
} else {
ast_log(LOG_WARNING, "Unknown trust_id_outbound mode '%s' on line %d, using legacy\n", v->value, v->lineno);
ast_set_flag(&flags[1], SIP_PAGE2_TRUST_ID_OUTBOUND_LEGACY);
}
} else if (!strcasecmp(v->name, "g726nonstandard")) {
ast_set_flag(&mask[0], SIP_G726_NONSTANDARD);
ast_set2_flag(&flags[0], ast_true(v->value), SIP_G726_NONSTANDARD);