kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-26 06:26:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

STIR/SHAKEN: Option split and response codes.

Browse Source 
The stir_shaken configuration option now has 4 different choices to pick
from: off, attest, verify, and on. Off and on behave the same way they
do now. Attest will only perform attestation on the endpoint, and verify
will only perform verification on the endpoint.

Certain responses are required to be sent based on certain conditions
for STIR/SHAKEN. For example, if we get a Date header that is outside of
the time range that is considered valid, a 403 Stale Date response
should be sent. This and several other responses have been added.

Change-Id: I4ac1ecf652cd0e336006b0ca638dc826b5b1ebf7
This commit is contained in:
Ben Ford
2021-09-21 12:09:10 -05:00
committed by Friendly Automation
parent d81d5ad832
commit ba3f6c0b1e
7 changed files with 420 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
include/asterisk/res_pjsip.h
View File

@@ -63,6 +63,22 @@
#define PJSIP_EXPIRES_NOT_SPECIFIED ((pj_uint32_t)-1)
#endif
/* Response codes from RFC8224 */
#define AST_STIR_SHAKEN_RESPONSE_CODE_STALE_DATE 403
#define AST_STIR_SHAKEN_RESPONSE_CODE_USE_IDENTITY_HEADER 428
#define AST_STIR_SHAKEN_RESPONSE_CODE_USE_SUPPORTED_PASSPORT_FORMAT 428
#define AST_STIR_SHAKEN_RESPONSE_CODE_BAD_IDENTITY_INFO 436
#define AST_STIR_SHAKEN_RESPONSE_CODE_UNSUPPORTED_CREDENTIAL 437
#define AST_STIR_SHAKEN_RESPONSE_CODE_INVALID_IDENTITY_HEADER 438
/* Response strings from RFC8224 */
#define AST_STIR_SHAKEN_RESPONSE_STR_STALE_DATE "Stale Date"
#define AST_STIR_SHAKEN_RESPONSE_STR_USE_IDENTITY_HEADER "Use Identity Header"
#define AST_STIR_SHAKEN_RESPONSE_STR_USE_SUPPORTED_PASSPORT_FORMAT "Use Supported PASSporT Format"
#define AST_STIR_SHAKEN_RESPONSE_STR_BAD_IDENTITY_INFO "Bad Identity Info"
#define AST_STIR_SHAKEN_RESPONSE_STR_UNSUPPORTED_CREDENTIAL "Unsupported Credential"
#define AST_STIR_SHAKEN_RESPONSE_STR_INVALID_IDENTITY_HEADER "Invalid Identity Header"
/* Forward declarations of PJSIP stuff */
struct pjsip_rx_data;
struct pjsip_module;
@@ -527,6 +543,17 @@ enum ast_sip_session_redirect {
AST_SIP_REDIRECT_URI_PJSIP,
};
enum ast_sip_stir_shaken_behavior {
/*! Don't do any STIR/SHAKEN operations */
AST_SIP_STIR_SHAKEN_OFF = 0,
/*! Only do STIR/SHAKEN attestation */
AST_SIP_STIR_SHAKEN_ATTEST = 1,
/*! Only do STIR/SHAKEN verification */
AST_SIP_STIR_SHAKEN_VERIFY = 2,
/*! Do STIR/SHAKEN attestation and verification */
AST_SIP_STIR_SHAKEN_ON = 3,
};
/*!
* \brief Incoming/Outgoing call offer/answer joint codec preference.
*
@@ -917,7 +944,7 @@ struct ast_sip_endpoint {
unsigned int suppress_q850_reason_headers;
/*! Ignore 183 if no SDP is present */
unsigned int ignore_183_without_sdp;
/*! Enable STIR/SHAKEN support on this endpoint */
/*! Set which STIR/SHAKEN behaviors we want on this endpoint */
unsigned int stir_shaken;
/*! Should we authenticate OPTIONS requests per RFC 3261? */
unsigned int allow_unauthenticated_options;

25
include/asterisk/res_stir_shaken.h
View File

@@ -29,6 +29,13 @@ enum ast_stir_shaken_verification_result {
AST_STIR_SHAKEN_VERIFY_PASSED, /*! Signature verified and contents match signaling */
};
/*! Different from ast_stir_shaken_verification_result. Used to determine why ast_stir_shaken_verify returned NULL */
enum ast_stir_shaken_verify_failure_reason {
AST_STIR_SHAKEN_VERIFY_FAILED_MEMORY_ALLOC, /*! Memory allocation failure */
AST_STIR_SHAKEN_VERIFY_FAILED_TO_GET_CERT, /*! Failed to get the credentials to verify */
AST_STIR_SHAKEN_VERIFY_FAILED_SIGNATURE_VALIDATION, /*! Failed validating the signature */
};
struct ast_stir_shaken_payload;
struct ast_json;
@@ -87,6 +94,24 @@ int ast_stir_shaken_add_verification(struct ast_channel *chan, const char *ident
struct ast_stir_shaken_payload *ast_stir_shaken_verify(const char *header, const char *payload, const char *signature,
const char *algorithm, const char *public_cert_url);
/*!
* \brief Same as ast_stir_shaken_verify, but will populate a struct with additional information on failure
*
* \note failure_code will be written to in this function
*
* \param header The payload header
* \param payload The payload section
* \param signature The payload signature
* \param algorithm The signature algorithm
* \param public_cert_url The public key URL
* \param failure_code Additional failure information
*
* \retval ast_stir_shaken_payload on success
* \retval NULL on failure
*/
struct ast_stir_shaken_payload *ast_stir_shaken_verify2(const char *header, const char *payload, const char *signature,
const char *algorithm, const char *public_cert_url, int *failure_code);
/*!
* \brief Retrieve the stir/shaken sorcery context
*