Commit Graph

101 Commits

Author SHA1 Message Date
Joshua C. Colp
f97e9aed85 pjsip: Add TLS transport reload support for certificate and key.
This change adds support using the pjsip_tls_transport_restart
function for reloading the TLS certificate and key, if the filenames
remain unchanged. This is useful for Let's Encrypt and other
situations. Note that no restart of the transport will occur if
the certificate and key remain unchanged.

ASTERISK-30186

Change-Id: I9bc95a6bf791830a9491ad9fa43c17d4010028d0
2022-09-09 18:41:02 -05:00
George Joseph
cdbd973ecd Geolocation: chan_pjsip Capability Preview
This commit adds res_pjsip_geolocation which gives chan_pjsip
the ability to use the core geolocation capabilities.

This commit message is intentionally short because this isn't
a simple capability.  See the documentation at
https://wiki.asterisk.org/wiki/display/AST/Geolocation
for more information.

THE CAPABILITIES IMPLEMENTED HERE MAY CHANGE BASED ON
USER FEEDBACK!

ASTERISK-30128

Change-Id: Ie2e2bcd87243c2cfabc43eb823d4427c7086f4d9
2022-07-12 09:02:52 -05:00
Kevin Harwell
0ddbf6bc45 res_pjsip: allow TLS verification of wildcard cert-bearing servers
Rightly the use of wildcards in certificates is disallowed in accordance
with RFC5922. However, RFC2818 does make some allowances with regards to
their use when using subject alt names with DNS name types.

As such this patch creates a new setting for TLS transports called
'allow_wildcard_certs', which when it and 'verify_server' are both enabled
allows DNS name types, as well as the common name that start with '*.'
to match as a wildcard.

For instance: *.example.com
will match for: foo.example.com

Partial matching is not allowed, e.g. f*.example.com, foo.*.com, etc...
And the starting wildcard only matches for a single level.

For instance: *.example.com
will NOT match for: foo.bar.example.com

The new setting is disabled by default.

ASTERISK-30072 #close

Change-Id: If0be3fdab2e09c2a66bb54824fca406ebaac3da4
2022-06-30 16:54:16 -05:00
Naveen Albert
b81fbbc6dc res_pjsip_outbound_registration: Make max random delay configurable.
Currently, PJSIP will randomly wait up to 10 seconds for each
outbound registration's initial attempt. The reason for this
is to avoid having all outbound registrations attempt to register
simultaneously.

This can create limitations with the test suite where we need to
be able to receive inbound calls potentially within 10 seconds of
starting up. For instance, we might register to another server
and then try to receive a call through the registration, but if
the registration hasn't happened yet, this will fail, and hence
this inconsistent behavior can cause tests to fail. Ultimately,
this requires a smaller random value because there may be no good
reason to wait for up to 10 seconds in these circumstances.

To address this, a new config option is introduced which makes this
maximum delay configurable. This allows, for instance, this to be
set to a very small value in test systems to ensure that registrations
happen immediately without an unnecessary delay, and can be used more
generally to control how "tight" the initial outbound registrations
are.

ASTERISK-29965 #close

Change-Id: Iab989a8e94323e645f3a21cbb6082287c7b2f3fd
2022-06-09 03:44:43 -05:00
Mark Petersen
16e59db514 chan_pjsip: add allow_sending_180_after_183 option
added new global config option "allow_sending_180_after_183"
that if enabled will preserve 180 after a 183

ASTERISK-29842

Change-Id: I8a53f8c35595b6d16d8e86e241b5f110d92f3d18
2022-04-26 16:37:55 -05:00
Joshua C. Colp
09e8667fa5 res_pjsip: Always set async_operations to 1.
The async_operations setting on a transport configures how
many simultaneous incoming packets the transport can handle
when multiple threads are polling and waiting on the transport.
As we only use a single thread this was needlessly creating
incoming packets when set to a non-default value, wasting memory.

ASTERISK-30006

Change-Id: I1915973ef352862dc2852a6ba4cfce2ed536e68f
2022-04-26 11:31:34 -05:00
Ben Ford
11accf8064 AST-2022-002 - res_stir_shaken/curl: Add ACL checks for Identity header.
Adds a new configuration option, stir_shaken_profile, in pjsip.conf that
can be specified on a per endpoint basis. This option will reference a
stir_shaken_profile that can be configured in stir_shaken.conf. The type
of this option must be 'profile'. The stir_shaken option can be
specified on this object with the same values as before (attest, verify,
on), but it cannot be off since having the profile itself implies wanting
STIR/SHAKEN support. You can also specify an ACL from acl.conf (along
with permit and deny lines in the object itself) that will be used to
limit what interfaces Asterisk will attempt to retrieve information from
when reading the Identity header.

ASTERISK-29476

Change-Id: I87fa61f78a9ea0cd42530691a30da3c781842406
2022-04-14 16:59:07 -05:00
Alexei Gradinari
e2423c6f49 res_pjsip_pubsub: provide a display name for RLS subscriptions
Whereas BLFs allow to show a display name for each RLS entry,
the asterisk provides only the extension now.
This is not end user friendly.

This commit adds a new resource_list option, resource_display_name,
to indicate whether display name of resource or the resource name being
provided for RLS entries.
If this option is enabled, the Display Name will be provided.
This option is disabled by default to remain the previous behavior.
If the 'event' set to 'presence' or 'dialog' the non-empty HINT name
will be set as the Display Name.
The 'message-summary' is not supported yet.

ASTERISK-29891 #close

Change-Id: Ic5306bd5a7c73d03f5477fe235e9b0f41c69c681
2022-02-23 15:20:25 -06:00
Sean Bright
de0c29de55 res_pjsip.c: Correct minor typos in 'realm' documentation.
Change-Id: I886936b808def5540d40071321e72f6bfa19063a
2022-02-03 16:59:34 -06:00
Matthew Kern
15e432220c res_pjsip_t38: bind UDPTL sessions like RTP
In res_pjsip_sdp_rtp, the bind_rtp_to_media_address option and the
fallback use of the transport's bind address solve problems sending
media on systems that cannot send ipv4 packets on ipv6 sockets, and
certain other situations. This change extends both of these behaviors
to UDPTL sessions as well in res_pjsip_t38, to fix fax-specific
problems on these systems, introducing a new option
endpoint/t38_bind_udptl_to_media_address.

ASTERISK-29402

Change-Id: I87220c0e9cdd2fe9d156846cb906debe08c63557
2021-10-06 08:54:27 -05:00
Joseph Nadiv
4368764032 res_pjsip_registrar: Remove unavailable contacts if exceeds max_contacts
The behavior of max_contacts and remove_existing are connected.  If
remove_existing is enabled, the soonest expiring contacts are removed.
This may occur when there is an unavailable contact.  Similarly,
when remove_existing is not enabled, registrations from good
endpoints are rejected in favor of retaining unavailable contacts.

This commit adds a new AOR option remove_unavailable, and the effect
of this setting will depend on remove_existing.  If remove_existing
is set to no, we will still remove unavailable contacts when they
exceed max_contacts, if there are any. If remove_existing is set to
yes, we will prioritize the removal of unavailable contacts before
those that are expiring soonest.

ASTERISK-29525

Change-Id: Ia2711b08f2b4d1177411b1be23e970d7fdff5784
2021-09-24 09:48:47 -05:00
George Joseph
655ee680cd res_pjsip_outbound_authenticator_digest: Be tolerant of RFC8760 UASs
RFC7616 and RFC8760 allow more than one WWW-Authenticate or
Proxy-Authenticate header per realm, each with different digest
algorithms (including new ones like SHA-256 and SHA-512-256).
Thankfully however a UAS can NOT send back multiple Authenticate
headers for the same realm with the same digest algorithm.  The
UAS is also supposed to send the headers in order of preference
with the first one being the most preferred.  We're supposed to
send an Authorization header for the first one we encounter for a
realm that we can support.

The UAS can also send multiple realms, especially when it's a
proxy that has forked the request in which case the proxy will
aggregate all of the Authenticate headers and then send them all
back to the UAC.

It doesn't stop there though... Each realm can require a
different username from the others.  There's also nothing
preventing each digest algorithm from having a unique password
although I'm not sure if that adds any benefit.

So now... For each Authenticate header we encounter, we have to
determine if we support the digest algorithm and, if not, just
skip the header.  We then have to find an auth object that
matches the realm AND the digest algorithm or find a wildcard
object that matches the digest algorithm. If we find one, we add
it to the results vector and read the next Authenticate header.
If the next header is for the same realm AND we already added an
auth object for that realm, we skip the header. Otherwise we
repeat the process for the next header.

In the end, we'll have accumulated a list of credentials we can
pass to pjproject that it can use to add Authentication headers
to a request.

NOTE: Neither we nor pjproject can currently handle digest
algorithms other than MD5.  We don't even have a place for it in
the ast_sip_auth object. For this reason, we just skip processing
any Authenticate header that's not MD5.  When we support the
others, we'll move the check into the loop that searches the
objects.

Changes:

 * Added a new API ast_sip_retrieve_auths_vector() that takes in
   a vector of auth ids (usually supplied on a call to
   ast_sip_create_request_with_auth()) and populates another
   vector with the actual objects.

 * Refactored res_pjsip_outbound_authenticator_digest to handle
   multiple Authenticate headers and set the stage for handling
   additional digest algorithms.

 * Added a pjproject patch that allows them to ignore digest
   algorithms they don't support.  This patch has already been
   merged upstream.

 * Updated documentation for auth objects in the XML and
   in pjsip.conf.sample.

 * Although res_pjsip_authenticator_digest isn't affected
   by this change, some debugging and a testsuite AMI event
   was added to facilitate testing.

Discovered during OpenSIPit 2021.

ASTERISK-29397

Change-Id: I3aef5ce4fe1d27e48d61268520f284d15d650281
2021-05-20 14:21:02 -05:00
Sean Bright
d2dcd15bd8 res_pjsip.c: OPTIONS processing can now optionally skip authentication
ASTERISK-27477 #close

Change-Id: I68f6715bba92a525149e35d142a49377a34a1193
2021-04-29 07:45:04 -05:00
George Joseph
5f3d96a765 res_pjsip: Update documentation for the auth object
Change-Id: I2f76867ce02ec611964925159be099de83346e38
2021-04-21 08:30:43 -06:00
Joshua C. Colp
412b385de5 res_pjsip: Adjust outgoing offer call pref.
This changes the outgoing offer call preference
default option to match the behavior of previous
versions of Asterisk.

The additional advanced codec negotiation options
have also been removed from the sample configuration
and marked as reserved for future functionality in
XML documentation.

The codec preference options have also been fixed to
enforce local codec configuration.

ASTERISK-29109

Change-Id: Iad19347bd5f3d89900c15ecddfebf5e20950a1c2
2020-10-13 11:14:04 -05:00
Alexander Traud
217449a1e5 samples: Fix keep_alive_interval default in pjsip.conf.
Since ASTERISK_27978 the default is not off but 90 seconds. That change
happened because ASTERISK_27347 disabled the keep-alives in the bundled
PJProject and Asterisk should behave the same as before.

Change-Id: Ie63dc558ade6a5a2b969c30a4bd492d63730dc46
2020-08-28 14:13:57 -05:00
George Joseph
802aa97fa0 ACN: Configuration renaming for pjsip endpoint
This change renames the codec preference endpoint options.
incoming_offer_codec_prefs becomes codec_prefs_incoming_offer
to keep the options together when showing an endpoint.

Change-Id: I6202965b4723777f22a83afcbbafcdafb1d11c8d
2020-08-06 10:50:26 -05:00
Ben Ford
5fbed5af24 res_stir_shaken: Add stir_shaken option and general improvements.
Added a new configuration option for PJSIP endpoints - stir_shaken. If
set to yes, then STIR/SHAKEN support will be added to inbound and
outbound INVITEs. The default is no. Alembic has been updated to include
this option.

Previously the dialplan function was not trimming the whitespace from
the parameters it recieved. Now it does.

Also added a conditional that, when TEST_FRAMEWORK is enabled, the
timestamp in the identity header will be overlooked. This is just for
testing, since the testsuite will rely on a SIPp scenario with a preset
identity header to trigger the MISMATCH result.

Change-Id: I43d67f1489b8c1c5729ed3ca8d71e35ddf438df1
2020-07-10 09:57:09 -05:00
George Joseph
2d22e34206 ACN: res_pjsip endpoint options
This commit adds the endpoint options required to control
Advanced Codec Negotiation.

incoming_offer_codec_prefs
outgoing_offer_codec_prefs
incoming_answer_codec_prefs
outgoing_answer_codec_prefs

The documentation may need tweaking and some additional edits
added, especially for the "answer" prefs.  That'll be handled
when things finalize.

This commit is safe to merge as it doens't alter any existing
functionality nor does it alter the previous codec negotiation
work which may now be obsolete.

Change-Id: I920ba925d7dd36430dfd2ebd9d82d23f123d0e11
2020-07-08 09:03:58 -05:00
sungtae kim
81b5e4a73f res_pjsip.c: Added disable_rport option for pjsip.conf
Currently when the pjsip making an outgoing request, it keep adding the
rport parameter in a request message as a default.

This causes unexpected rport handle at the other end.

Added option for disable this behaviour in the pjsip.conf.

This is a system option, but working as a gloabl option.

ASTERISK-28959

Change-Id: I9596675e52a742774738b5aad5d1fec32f477abc
2020-07-07 15:20:05 -05:00
George Joseph
2ee455958e codec_negotiation: Implement outgoing_call_offer_pref
Based on this new endpoint setting, a joint list of preferred codecs
between those received from the Asterisk core (remote), and those
specified in the endpoint's "allow" parameter (local) is created and
is used to create the outgoing SDP offer.

* Add outgoing_call_offer_pref to pjsip_configuration (endpoint)

* Add "call_direction" to res_pjsip_session.

* Update pjsip_session_caps.c to make the functions more generic
  so they could be used for both incoming and outgoing.

* Update ast_sip_session_create_outgoing to create the
  pending_media_state->topology with the results of
  ast_sip_session_create_joint_call_stream().

* The endpoint "preferred_codec_only" option now automatically sets
  AST_SIP_CALL_CODEC_PREF_FIRST in incoming_call_offer_pref.

* A helper function ast_stream_get_format_count() was added to
  streams to return the current count of formats.

ASTERISK-28777

Change-Id: Id4ec0b4a906c2ae5885bf947f101c59059935437
2020-04-06 08:00:49 -05:00
Kevin Harwell
06dada3f01 codec negotiation: add incoming_call_offer_prefs option
Add a new option, incoming_call_offer_pref, to res_pjsip endpoints that
specifies the preferred order of codecs after receiving an offer.

This patch does the following:

  Adds a new enumeration, ast_sip_call_codec_pref, used by the the new
configuration option that's added to the endpoint media structure.

  Adds a new ast_sip_session_caps structure that's set for each session media
object.

  Creates a new file, res_pjsip_session_caps that "implements" the new
structure and option, and is compiled into the res_pjsip_session library.

ASTERISK-28756 #close

Change-Id: I35e7a2a0c236cfb6bd9cdf89539f57a1ffefc76f
2020-03-03 14:51:14 -06:00
Sean Bright
312abaa1fe res_pjsip_endpoint_identifier_ip.c: Add port matching support
Adds source port matching support when IP matching is used:

  [example]
  type = identify
  match = 1.2.3.4:5060/32, 1.2.3.4:6000/32, asterisk.org:4444

If the IP matches but the source port does not, we reject and search for
alternatives. SRV lookups are still performed if enabled (srv_lookups = yes),
unless the configured FQDN includes a port number in which case just a host
lookup is performed.

ASTERISK-28639 #close
Reported by: Mitch Claborn

Change-Id: I256d5bd5d478b95f526e2f80ace31b690eebba92
2020-01-08 08:37:53 -06:00
Dan Cropp
cffa2a74cb res_pjsip: Added a norefersub configuration setting
Added a new PJSIP global setting called norefersub.
Default is true to keep support working as before.

res_pjsip_refer:  Configures PJSIP norefersub capability accordingly.

Checks the PJSIP global setting value.
If it is true (default) it adds the norefersub capability to PJSIP.
If it is false (disabled) it does not add the norefersub capability
to PJSIP.

This is useful for Cisco switches that do not follow RFC4488.

ASTERISK-28375 #close
Reported-by: Dan Cropp

Change-Id: I0b1c28ebc905d881f4a16e752715487a688b30e9
2019-04-17 10:18:40 -05:00
Torrey Searle
4661c08549 chan_pjsip: add a flag to ignore 183 responses if no SDP present
chan_sip will always ignore 183 responses that do not contain SDP
however, chan_pjsip will currently always translate it into a
183 with SDP.  This new flag allows chan_pjsip to have the same
behavior as chan_sip.

ASTERISK-28322 #close

Change-Id: If81cfaa17c11b6ac703e3d71696f259d86c6be4a
2019-03-08 14:16:30 -05:00
Sean Bright
7b02a9617c samples: Fix comment typo in pjsip.conf.sample
Change-Id: I84a45c3d9fd26ca61aca99927eec83b57f1de857
2019-03-07 16:06:38 -06:00
George Joseph
c2adeb9dc2 taskprocessor: Enable subsystems and overload by subsystem
To prevent one subsystem's taskprocessors from causing others
to stall, new capabilities have been added to taskprocessors.

* Any taskprocessor name that has a '/' will have the part
  before the '/' saved as its "subsystem".
  Examples:
  "sorcery/acl-0000006a" and "sorcery/aor-00000019"
  will be grouped to subsystem "sorcery".
  "pjsip/distributor-00000025" and "pjsip/distributor-00000026"
  will bn grouped to subsystem "pjsip".
  Taskprocessors with no '/' have an empty subsystem.

* When a taskprocessor enters high-water alert status and it
  has a non-empty subsystem, the subsystem alert count will
  be incremented.

* When a taskprocessor leaves high-water alert status and it
  has a non-empty subsystem, the subsystem alert count will be
  decremented.

* A new api ast_taskprocessor_get_subsystem_alert() has been
  added that returns the number of taskprocessors in alert for
  the subsystem.

* A new CLI command "core show taskprocessor alerted subsystems"
  has been added.

* A new unit test was addded.

REMINDER: The taskprocessor code itself doesn't take any action
based on high-water alerts or overloading.  It's up to taskprocessor
users to check and take action themselves.  Currently only the pjsip
distributor does this.

* A new pjsip/global option "taskprocessor_overload_trigger"
  has been added that allows the user to select the trigger
  mechanism the distributor uses to pause accepting new requests.
  "none": Don't pause on any overload condition.
  "global": Pause on ANY taskprocessor overload (the default and
  current behavior)
  "pjsip_only": Pause only on pjsip taskprocessor overloads.

* The core pjsip pool was renamed from "SIP" to "pjsip" so it can
  be properly grouped into the "pjsip" subsystem.

* stasis taskprocessor names were changed to "stasis" as the
  subsystem.

* Sorcery core taskprocessor names were changed to "sorcery" to
  match the object taskprocessors.

Change-Id: I8c19068bb2fc26610a9f0b8624bdf577a04fcd56
2019-02-20 11:51:08 -06:00
Alexei Gradinari
f0546d1d87 res_pjsip: add option to enable ContactStatus event when contact is updated
The commit I2f97ebfa79969a36a97bb7b9afd5b6268cf1a07d removed sending out
the ContactStatus AMI event when a contact is updated.
Thist change broke things which rely on old behavior.

This patch adds a new PJSIP global configuration option
'send_contact_status_on_update_registration' to be able to preserve old
ContactStatus behavior.
By default new behavior, i.e. the ContactStatus event will not be sent when a
device refreshes its registration.

Change-Id: I706adf7584e7077eb6bde6d9799ca408bc82ce46
2019-01-11 10:52:18 -05:00
Alexei Gradinari
eee935983b pjsip: new endpoint's options to control Connected Line updates
This patch adds new options 'trust_connected_line' and 'send_connected_line'
to the endpoint.

The option 'trust_connected_line' is to control if connected line updates
are accepted from this endpoint.

The option 'send_connected_line' is to control if connected line updates
can be sent to this endpoint.

The default value is 'yes' for both options.

Change-Id: I16af967815efd904597ec2f033337e4333d097cd
2018-10-30 10:39:28 -05:00
Nick French
37b2e68628 res_pjsip: Implement additional SIP RFCs for Google Voice trunk compatability
This change implements a few different generic things which were brought
on by Google Voice SIP.

1.  The concept of flow transports have been introduced.  These are
configurable transports in pjsip.conf which can be used to reference a
flow of signaling to a target.  These have runtime configuration that can
be changed by the signaling itself (such as Service-Routes and
P-Preferred-Identity).  When used these guarantee an individual connection
(in the case of TCP or TLS) even if multiple flow transports exist to the
same target.

2.  Service-Routes (RFC 3608) support has been added to the outbound
registration module which when received will be stored on the flow
transport and used for requests referencing it.

3.  P-Associated-URI / P-Preferred-Identity (RFC 3325) support has been
added to the outbound registration module.  If a P-Associated-URI header
is received it will be used on requests as the P-Preferred-Identity.

4.  Configurable outbound extension support has been added to the outbound
registration module.  When set the extension will be placed in the
Supported header.

5.  Header parameters can now be configured on an outbound registration
which will be placed in the Contact header.

6.  Google specific OAuth / Bearer token authentication
(draft-ietf-sipcore-sip-authn-02) has been added to the outbound
registration module.

All functionality changes are controlled by pjsip.conf configuration
options and do not affect non-configured pjsip endpoints otherwise.

ASTERISK-27971 #close

Change-Id: Id214c2d1c550a41fcf564b7df8f3da7be565bd58
2018-10-24 07:51:25 -05:00
Corey Farrell
63ca367ab9 Sample configs: Fix pjsip.conf syntax error.
It is valid for a config file to be empty or contain only comments, but
not valid for a config value to be set when no uncommented context
exists.  This caused an error to be loged numerous times during start
when loading the default pjsip.conf.

Change-Id: Icf3b0d69b4ecb6e935eecd43c99ed8b32a5a1cf6
2018-08-09 16:28:39 -04:00
Richard Mudgett
e6bb2efaab res_pjsip: Update endpoint transport option documentation.
Change-Id: I5394fdff6a296efc8e1695a156e616acd932ae52
2018-07-19 16:40:24 -05:00
George Joseph
8f42447c68 res_pjsip: Add 'suppress_q850_reason_headers' option to endpoint
A new option 'suppress_q850_reason_headers' has been added to the
endpoint object. Some devices can't accept multiple Reason headers and
get confused when both 'SIP' and 'Q.850' Reason headers are received.
This option allows the 'Q.850' Reason header to be suppressed.
The default value is 'no'.

ASTERISK-27949
Reported-by: Ross Beer

Change-Id: I54cf37a827d77de2079256bb3de7e90fa5e1deb1
2018-07-06 07:03:45 -06:00
Joshua Colp
de5144e751 pjsip: Clarify certificate configuration for Websocket.
The Websocket transport uses the built-in HTTP server. As a result
the TLS configuration is done in http.conf and not in pjsip.conf.

This change adds a warning if this is configured in pjsip.conf and
also clarifies in the sample configuration file.

Change-Id: I187d994d328c3ed274b6754fd4c2a4955bdc6dd9
2018-07-03 07:56:45 -05:00
George Joseph
880fbff6b7 res_pjsip_session: Add ability to accept multiple sdp answers
pjproject by default currently will follow media forked during an INVITE
on outbound calls if the To tag is different on a subsequent response as
that on an earlier response.  We handle this correctly.  There have
been reported cases where the To tag is the same but we still need to
follow the media.  The pjproject patch in this commit adds the
capability to sip_inv and also adds the capability to control it at
runtime.  The original "different tag" behavior was always controllable
at runtime but we never did anything with it and left it to default to
TRUE.

So, along with the pjproject patch, this commit adds options to both the
system and endpoint objects to control the two behaviors, and a small
logic change to session_inv_on_media_update in res_pjsip_session to
control the behavior at the endpoint level.

The default behavior for "different tags" remains the same at TRUE and
the default for "same tag" is FALSE.

Change-Id: I64d071942b79adb2f0a4e13137389b19404fe3d6
ASTERISK-27936
Reported-by: Ross Beer
2018-06-26 07:05:34 -06:00
Richard Mudgett
8494e78010 res_pjsip: Split type=identify to IP address and SIP header matching priorities
The type=identify endpoint identification method can match by IP address
and by SIP header.  However, the SIP header matching has limited
usefulness because you cannot specify the SIP header matching priority
relative to the IP address matching.  All the matching happens at the same
priority and the order of evaluating the identify sections is
indeterminate.  e.g., If you had two type=identify sections where one
matches by IP address for endpoint alice and the other matches by SIP
header for endpoint bob then you couldn't predict which endpoint is
matched when a request comes in that matches both.

* Extract the SIP header matching criteria into its own "header" endpoint
identification method so the user can specify the relative priority of the
SIP header and the IP address matching criteria in the global
endpoint_identifier_order option.  The "ip" endpoint identification method
now only matches by IP address.

ASTERISK-27491

Change-Id: I9df142a575b7e1e3471b7cda5d3ea156cef08095
2018-01-16 12:50:34 -06:00
Richard Mudgett
8f3167c5f1 res_pjsip.c: Update the endpoint identification documentation.
* Endpoint identify_by documentation.
* IP/Header endpoint identifier documentation.

Change-Id: Id92f00b495acca7be945daf749d2abd7f76a0b5a
2018-01-09 13:38:59 -06:00
Sean Bright
04d3785a79 dtls: Add support for ephemeral DTLS certificates.
This mimics the behavior of Chrome and Firefox and creates an ephemeral
X.509 certificate for each DTLS session.

Currently, the only supported key type is ECDSA because of its faster
generation time, but other key types can be added in the future as
necessary.

ASTERISK-27395

Change-Id: I5122e5f4b83c6320cc17407a187fcf491daf30b4
2017-11-06 08:11:48 -05:00
Joshua Colp
9e1fbab382 res_pjsip: Add 'ip' as a valid option to 'identify_by' on endpoint.
When the identify_by option on an endpoint is set to ip it will
only be identified using the res_pjsip_endpoint_identifier_ip module.
This ensures that it is not mistakenly matched using the username of
the From header. To ensure behavior has not changed the default has
been changed to "username,ip" for the identify_by option.

ASTERISK-27206

Change-Id: I2170b86a7f7e221b4f00bf14aa1ef1ac5b050bbd
2017-10-25 18:14:03 +00:00
Richard Mudgett
fb19799b62 res_pjsip_registrar.c: Update remove_existing AOR contact handling.
When "rewrite_contact" is enabled, the "max_contacts" count option can
block re-registrations because the source port from the endpoint can be
random.  When the re-registration is blocked, the endpoint may give up
re-registering and require manual intervention.

* The "remove_existing" option now allows a registration to succeed by
displacing any existing contacts that now exceed the "max_contacts" count.
Any removed contacts are the next to expire.  The behaviour change is
beneficial when "rewrite_contact" is enabled and "max_contacts" is greater
than one.  The removed contact is likely the old contact created by
"rewrite_contact" that the device is refreshing.

ASTERISK-27192

Change-Id: I64c107a10b70db1697d17136051ae6bf22b5314b
2017-10-09 12:52:30 -05:00
George Joseph
d178f497d2 res_pjsip: Filter out non SIP(S) requests
Incoming requests with non sip(s) URIs in the Request, To, From
or Contact URIs are now rejected with
PJSIP_SC_UNSUPPORTED_URI_SCHEME (416).  This is performed in
pjsip_message_filter (formerly pjsip_message_ip_updater) and is
done at pjproject's "TRANSPORT" layer before a request can even
reach the distributor.

URIs read by res_pjsip_outbound_publish from pjsip.conf are now
also checked for both length and sip(s) scheme.  Those URIs read
by outbound registration and aor were already being checked for
scheme but their error messages needed to be updated to include
scheme failure as well as length failure.

Change-Id: Ibb2f9f1d2dc7549da562af4cbd9156c44ffdd460
2017-09-14 14:18:42 -05:00
George Joseph
446d48fd49 res_pjsip: Add handling for incoming unsolicited MWI NOTIFY
A new endpoint parameter "incoming_mwi_mailbox" allows Asterisk to
receive unsolicited MWI NOTIFY requests and make them available to
other modules via the stasis message bus.

res_pjsip_pubsub has a new handler "pubsub_on_rx_mwi_notify_request"
that parses a simple-message-summary body and, if
endpoint->incoming_mwi_account is set, calls ast_publish_mwi_state
with the voice-message counts from the message.

Change-Id: I08bae3d16e77af48fcccc2c936acce8fc0ef0f3c
2017-09-13 09:24:28 -05:00
Kevin Harwell
7da6ddda30 res_pjsip: Add "webrtc" configuration option
This patch creates a new configuration option called "webrtc". When enabled it
defaults and enables the following options that are needed in order for webrtc
to work in Asterisk:

  rtcp-mux, use_avpf, ice_support, and use_received_transport=enabled
  media_encryption=dtls
  dtls_verify=fingerprint
  dtls_setup=actpass

When "webrtc" is enabled, this patch also parses the "msid" media level
attribute from an SDP. It will also appropriately add it onto the outgoing
session when applicable.

Lastly, when "webrtc" is enabled h264 RTCP FIR feedback frames are now sent.

ASTERISK-27119 #close

Change-Id: I5ec02e07c5d5b9ad86a34fdf31bf2f9da9aac6fd
2017-07-13 18:19:35 -05:00
George Joseph
c0c99c7618 chan_pjsip: Fix ability to send UPDATE on COLP
When connected_line_method is "invite", we're supposed to determine
if the client can support UPDATE and if it can, send UPDATE instead
of INVITE to avoid the SDP renegotiation.  Not only was pjproject
not setting the PJSIP_INV_SUPPORT_UPDATE flag, we were testing
that invite_tsx wasn't NULL which isn't always the case.

* Updated chan_pjsip/update_connected_line_information to drop the
  requirement that invite_tsx isn't NULL.
* Submitted patch to pjproject sip_inv.c that sets the
  PJSIP_INV_SUPPORT_UPDATE flag correctly.
* Updated pjsip.conf.sample to clarify what happens when "invite"
  is specified.

ASTERISK-27095

Change-Id: Ic2381b3567b8052c616d96fbe79564c530e81560
2017-06-29 15:45:58 -05:00
Mark Michelson
45df25a579 chan_pjsip: Add support for multiple streams of the same type.
The stream topology (list of streams and order) is now stored with the
configured PJSIP endpoints and used during the negotiation process.

Media negotiation state information has been changed to be stored
in a separate object. Two of these objects exist at any one time
on a session. The active media state information is what was previously
negotiated and the pending media state information is what the
media state will become if negotiation succeeds. Streams and other
state information is stored in this object using the index (or
position) of each individual stream for easy lookup.

The ability for a media type handler to specify a callback for
writing has been added as well as the ability to add file
descriptors with a callback which is invoked when data is available
to be read on them. This allows media logic to live outside of
the chan_pjsip module.

Direct media has been changed so that only the first audio and
video stream are directly connected. In the future once the RTP
engine glue API has been updated to know about streams each individual
stream can be directly connected as appropriate.

Media negotiation itself will currently answer all the provided streams
on an offer within configured limits and on an offer will use the
topology created as a result of the disallow/allow codec lines.

If a stream has been removed or declined we will now mark it as such
within the resulting SDP.

Applications can now also request that the stream topology change.
If we are told to do so we will limit any provided formats to the ones
configured on the endpoint and send a re-invite with the new topology.

Two new configuration options have also been added to PJSIP endpoints:

max_audio_streams: determines the maximum number of audio streams to
offer/accept from an endpoint. Defaults to 1.

max_video_streams: determines the maximum number of video streams to
offer/accept from an endpoint. Defaults to 1.

ASTERISK-27076

Change-Id: I8afd8dd2eb538806a39b887af0abd046266e14c7
2017-06-28 18:36:29 +00:00
Alexei Gradinari
7a46309d3d res_pjsip: New endpoint option "notify_early_inuse_ringing"
This option was added to control whether to notify dialog-info state
'early' or 'confirmed' on Ringing when already INUSE.
The value "yes" is useful for some SIP phones (Cisco SPA)
to be able to indicate and pick up ringing devices.

ASTERISK-26919 #close

Change-Id: Ie050bc30023543c7dfb4365c5be3ce58c738c711
2017-06-16 11:25:07 -05:00
Alexei Gradinari
808f299808 res_pjsip: New endpoint option "refer_blind_progress"
This option was added to turn off notifying the progress details
on Blind Transfer. If this option is not set then the chan_pjsip
will send NOTIFY "200 OK" immediately after "202 Accepted".

Some SIP phones like Mitel/Aastra or Snom keep the line busy until
receive "200 OK".

ASTERISK-26333 #close

Change-Id: Id606fbff2e02e967c02138457badc399144720f2
2017-05-11 10:50:35 -05:00
George Joseph
40e9d5e8b7 sample_config: Add samples for pubsub to pjsip.conf.sample
Added:
 * outbound-publish
 * resource_list
 * inbound-publication
 * asterisk-publication

Change-Id: I65043a896c35483f30a92d30b5b118359af7ba5a
2017-04-05 14:53:20 -05:00
Richard Begg
6b7697ed48 res_pjsip_session: Enable RFC3578 overlap dialing support.
Support for RFC3578 overlap dialling (i.e. 484 Response to partially matched
destinations) as currently provided by chan_sip is missing from res_pjsip.
This patch adds a new endpoint attribute (allow_overlap) [defaults to yes]
which when set to yes enables 484 responses to partial destination
matches rather than the current 404.

ASTERISK-26864

Change-Id: Iea444da3ee7c7d4f1fde1d01d138a3d7b0fe40f6
2017-03-22 11:26:48 +00:00
George Joseph
5013d8f5d3 res_pjsip: Symmetric transports
A new transport parameter 'symmetric_transport' has been added.

When a request from a dynamic contact comes in on a transport with
this option set to 'yes', the transport name will be saved and used
for subsequent outgoing requests like OPTIONS, NOTIFY and INVITE.
It's saved as a contact uri parameter named 'x-ast-txp' and will
display with the contact uri in CLI, AMI, and ARI output.  On the
outgoing request, if a transport wasn't explicitly set on the
endpoint AND the request URI is not a hostname, the saved transport
will be used and the 'x-ast-txp' parameter stripped from the
outgoing packet.

* config_transport was modified to accept and store the new parameter.

* config_transport/transport_apply was updated to store the transport
  name in the pjsip_transport->info field using the pjsip_transport->pool
  on UDP transports.

* A 'multihomed_on_rx_message' function was added to
  pjsip_message_ip_updater that, for incoming requests, retrieves the
  transport name from pjsip_transport->info and retrieves the transport.
  If transport->symmetric_transport is set, an 'x-ast-txp' uri parameter
  containing the transport name is added to the incoming Contact header.

* An 'ast_sip_get_transport_name' function was added to res_pjsip.
  It takes an ast_sip_endpoint and a pjsip_sip_uri and returns a
  transport name if endpoint->transport is set or if there's an
  'x-ast-txp' parameter on the uri and the uri host is an ipv4 or
  ipv6 address.  Otherwise it returns NULL.

* An 'ast_sip_dlg_set_transport' function was added to res_pjsip
  which takes an ast_sip_endpoint, a pjsip_dialog, and an optional
  pjsip_tpselector.  It calls ast_sip_get_transport_name() and if
  a non-NULL is returned, sets the selector and sets the transport
  on the dialog.  If a selector was passed in, it's updated.

* res_pjsip/ast_sip_create_dialog_uac and ast_sip_create_dialog_uas
  were modified to call ast_sip_dlg_set_transport() instead of their
  original logic.

* res_pjsip/create_out_of_dialog_request was modified to call
  ast_sip_get_transport_name() and pjsip_tx_data_set_transport()
  instead of its original logic.

* Existing transport logic was removed from endpt_send_request
  since that can only be called after a create_out_of_dialog_request.

* res_pjsip/ast_sip_create_rdata was converted to a wrapper around
  a new 'ast_sip_create_rdata_with_contact' function which allows
  a contact_uri to be specified in addition to the existing
  parameters.  (See below)

* res_pjsip_pubsub/internal_pjsip_evsub_send_request was eliminated
  since all it did was transport selection and that is now done in
  ast_sip_create_dialog_uac and ast_sip_create_dialog_uas.

* 'contact_uri' was added to subscription_persistence.  This was
  necessary because although the parsed rdata contact header has the
  x-ast-txp parameter added (if appropriate),
  subscription_persistence_update stores the raw packet which
  doesn't have it.  subscription_persistence_recreate was then
  updated to call ast_sip_create_rdata_with_contact with the
  persisted contact_uri so the recreated subscription has the
  correct transport info to send the NOTIFYs.

* res_pjsip_session/internal_pjsip_inv_send_msg was eliminated since
  all it did was transport selection and that is now done in
  ast_sip_create_dialog_uac.

* pjsip_message_ip_updater/multihomed_on_tx_message was updated
  to remove all traces of the x-ast-txp parameter from the
  outgoing headers.

NOTE:  This change does NOT modify the behavior of permanent
contacts specified on an aor.  To do so would require that the
permanent contact's contact uri be updated with the x-ast-txp
parameter and the aor sorcery object updated.  If we need to
persue this, we need to think about cloning permanent contacts into
the same store as the dynamic ones on an aor load so they can be
updated without disturbing the originally configured value.

You CAN add the x-ast-txp parameter to a permanent contact's uri
but it would be much simpler to just set endpoint->transport.

Change-Id: I4ee1f51473da32ca54b877cd158523efcef9655f
2017-03-16 09:49:07 -06:00