#include <curl/curl.h>
#include <sys/stat.h>
#include <jwt.h>
#include <regex.h>
#include "asterisk.h"
#include "asterisk/channel.h"
#include "asterisk/cli.h"
#include "asterisk/config.h"
#include "asterisk/module.h"
#include "asterisk/sorcery.h"
#include "asterisk/astdb.h"
#include "asterisk/conversions.h"
#include "asterisk/utils.h"
#include "asterisk/paths.h"
#include "asterisk/logger.h"
#include "asterisk/acl.h"
#include "asterisk/time.h"
#include "asterisk/localtime.h"
#include "asterisk/crypto.h"
#include "asterisk/json.h"
#include "stir_shaken.h"

Include dependency graph for verification.c:

Macros
#define	_TRACE_PREFIX_ "v",__LINE__, ""

#define	ASN1_TAG_TNAUTH_SPC 0

#define	ASN1_TAG_TNAUTH_TN 2

#define	ASN1_TAG_TNAUTH_TN_RANGE 1

#define	AST_DB_FAMILY "STIR_SHAKEN"

#define	BEGIN_CERTIFICATE_STR "-----BEGIN CERTIFICATE-----"

#define	DUMP_X5U_MATCH()

#define	FULL_URL_REGEX "^([a-zA-Z]+)://(([^@]+@[^:]+):)?(([^:/?]+)\|([0-9.]+)\|([[][0-9a-fA-F:]+[]]))(:([0-9]+))?(/([^#\\?]+))?(\\?([^#]+))?(#(.*))?"

#define	FULL_URL_REGEX_GROUPS 15

#define	get_match_string(__x5u, __pmatch, __i)

#define	IS_GET_OBJ_ERR(ret) (ret & 0x80)

#define	URL_MATCH_FRAGMENT 15

#define	URL_MATCH_HOST 4

#define	URL_MATCH_PATH 11

#define	URL_MATCH_PORT 9

#define	URL_MATCH_QUERY 13

#define	URL_MATCH_SCHEME 1

#define	URL_MATCH_USERPASS 3

Functions
static int	add_cert_expiration_to_astdb (struct ast_stir_shaken_vs_ctx cert, const char cache_control_header, const char *expires_header)

static int	add_cert_key_to_astdb (struct ast_stir_shaken_vs_ctx cert, const char cache_control_hdr, const char *expires_hdr)

enum ast_stir_shaken_vs_response_code	ast_stir_shaken_vs_ctx_add_date_hdr (struct ast_stir_shaken_vs_ctx ctx, const char date_hdr)
	Add the received Date header value to the VS context. More...

enum ast_stir_shaken_vs_response_code	ast_stir_shaken_vs_ctx_add_identity_hdr (struct ast_stir_shaken_vs_ctx ctx, const char identity_hdr)
	Add the received Identity header value to the VS context. More...

enum ast_stir_shaken_vs_response_code	ast_stir_shaken_vs_ctx_create (const char caller_id, struct ast_channel chan, const char profile_name, const char tag, struct ast_stir_shaken_vs_ctx **ctxout)
	Create Verification Service context. More...

void	ast_stir_shaken_vs_ctx_set_response_code (struct ast_stir_shaken_vs_ctx *ctx, enum ast_stir_shaken_vs_response_code vs_rc)
	Sets response code on VS context. More...

const char *	ast_stir_shaken_vs_get_caller_id (struct ast_stir_shaken_vs_ctx *ctx)
	Get caller_id from context. More...

enum stir_shaken_failure_action_enum	ast_stir_shaken_vs_get_failure_action (struct ast_stir_shaken_vs_ctx *ctx)
	Get failure_action from context. More...

int	ast_stir_shaken_vs_get_use_rfc9410_responses (struct ast_stir_shaken_vs_ctx *ctx)
	Get use_rfc9410_responses from context. More...

enum ast_stir_shaken_vs_response_code	ast_stir_shaken_vs_verify (struct ast_stir_shaken_vs_ctx *ctx)
	Perform incoming call verification. More...

static enum ast_stir_shaken_vs_response_code	check_cert (struct ast_stir_shaken_vs_ctx *ctx)

static enum ast_stir_shaken_vs_response_code	check_date_header (struct ast_stir_shaken_vs_ctx *ctx)

static enum ast_stir_shaken_vs_response_code	check_tn_auth_list (struct ast_stir_shaken_vs_ctx *ctx)

static int	check_x5u_url (struct ast_stir_shaken_vs_ctx ctx, const char x5u)

static void	cleanup_cert_from_astdb_and_fs (struct ast_stir_shaken_vs_ctx *ctx)

static void	ctx_destructor (void *obj)

static enum ast_stir_shaken_vs_response_code	ctx_populate (struct ast_stir_shaken_vs_ctx *ctx)

static int	is_cert_cache_entry_expired (char *expiration)

static enum ast_stir_shaken_vs_response_code	retrieve_cert_from_cache (struct ast_stir_shaken_vs_ctx *ctx)

static enum ast_stir_shaken_vs_response_code	retrieve_cert_from_url (struct ast_stir_shaken_vs_ctx *ctx)

static enum ast_stir_shaken_vs_response_code	retrieve_verification_cert (struct ast_stir_shaken_vs_ctx *ctx)

int	vs_load ()
	Load the stir/shaken verification service. More...

int	vs_reload ()
	Reload the stir/shaken verification service. More...

const char *	vs_response_code_to_str (enum ast_stir_shaken_vs_response_code vs_rc)
	Return string version of VS response code. More...

int	vs_unload ()
	Unload the stir/shaken verification service. More...

Variables
static regex_t	url_match_regex

static const char *	vs_rc_map []

Macro Definition Documentation

◆ _TRACE_PREFIX_

#define _TRACE_PREFIX_ "v",__LINE__, ""

Definition at line 26 of file verification.c.

◆ ASN1_TAG_TNAUTH_SPC

#define ASN1_TAG_TNAUTH_SPC 0

Definition at line 247 of file verification.c.

◆ ASN1_TAG_TNAUTH_TN

#define ASN1_TAG_TNAUTH_TN 2

Definition at line 249 of file verification.c.

◆ ASN1_TAG_TNAUTH_TN_RANGE

#define ASN1_TAG_TNAUTH_TN_RANGE 1

Definition at line 248 of file verification.c.

◆ AST_DB_FAMILY

#define AST_DB_FAMILY "STIR_SHAKEN"

Definition at line 46 of file verification.c.

◆ BEGIN_CERTIFICATE_STR

#define BEGIN_CERTIFICATE_STR "-----BEGIN CERTIFICATE-----"

Definition at line 51 of file verification.c.

◆ DUMP_X5U_MATCH

#define DUMP_X5U_MATCH ( )

Definition at line 812 of file verification.c.

◆ FULL_URL_REGEX

#define FULL_URL_REGEX "^([a-zA-Z]+)://(([^@]+@[^:]+):)?(([^:/?]+)|([0-9.]+)|([[][0-9a-fA-F:]+[]]))(:([0-9]+))?(/([^#\\?]+))?(\\?([^#]+))?(#(.*))?"

Definition at line 773 of file verification.c.

◆ FULL_URL_REGEX_GROUPS

#define FULL_URL_REGEX_GROUPS 15

Definition at line 774 of file verification.c.

◆ get_match_string

#define get_match_string	(	__x5u,
		__pmatch,
		__i
	)

Definition at line 800 of file verification.c.

◆ IS_GET_OBJ_ERR

#define IS_GET_OBJ_ERR ( ret ) (ret & 0x80)

Definition at line 251 of file verification.c.

◆ URL_MATCH_FRAGMENT

#define URL_MATCH_FRAGMENT 15

Definition at line 798 of file verification.c.

◆ URL_MATCH_HOST

#define URL_MATCH_HOST 4

Definition at line 794 of file verification.c.

◆ URL_MATCH_PATH

#define URL_MATCH_PATH 11

Definition at line 796 of file verification.c.

◆ URL_MATCH_PORT

#define URL_MATCH_PORT 9

Definition at line 795 of file verification.c.

◆ URL_MATCH_QUERY

#define URL_MATCH_QUERY 13

Definition at line 797 of file verification.c.

◆ URL_MATCH_SCHEME

#define URL_MATCH_SCHEME 1

Definition at line 792 of file verification.c.

◆ URL_MATCH_USERPASS

#define URL_MATCH_USERPASS 3

Definition at line 793 of file verification.c.

Function Documentation

◆ add_cert_expiration_to_astdb()

static int add_cert_expiration_to_astdb	(	struct ast_stir_shaken_vs_ctx *	cert,
		const char *	cache_control_header,
		const char *	expires_header
	)

static

Definition at line 112 of file verification.c.

{
    RAII_VAR(struct verification_cfg *, cfg, vs_get_cfg(), ao2_cleanup);
 
    char time_buf[32];
    time_t current_time = time(NULL);
    time_t max_age_hdr = 0;
    time_t expires_hdr = 0;
    ASN1_TIME *notAfter = NULL;
    time_t cert_expires = 0;
    time_t config_expires = 0;
    time_t expires = 0;
    int rc = 0;
 
    config_expires = current_time + cfg->vcfg_common.max_cache_entry_age;
 
    if (!ast_strlen_zero(cache_control_header)) {
        char *str_max_age;
 
        str_max_age = strstr(cache_control_header, "s-maxage");
        if (!str_max_age) {
            str_max_age = strstr(cache_control_header, "max-age");
        }
 
        if (str_max_age) {
            unsigned int m;
            char *equal = strchr(str_max_age, '=');
            if (equal && !ast_str_to_uint(equal + 1, &m)) {
                max_age_hdr = current_time + m;
            }
        }
    }
 
    if (!ast_strlen_zero(expires_header)) {
        struct ast_tm expires_time;
 
        ast_strptime(expires_header, "%a, %d %b %Y %T %z", &expires_time);
        expires_time.tm_isdst = -1;
        expires_hdr = ast_mktime(&expires_time, "GMT").tv_sec;
    }
 
    notAfter = X509_get_notAfter(cert->xcert);
    cert_expires = crypto_asn_time_as_time_t(notAfter);
 
    /*
     * ATIS-1000074 says:
     * The STI-VS shall implement the cache behavior described in
     * [Ref 10]. If the HTTP response does not include any recognized
     * caching directives or indicates caching for less than 24 hours,
     * then the STI-VS should cache the HTTP response for 24 hours.
     *
     * Basically, they're saying "cache for 24 hours unless the HTTP
     * response says to cache for longer."  Instead of the fixed 24
     * hour minumum, however, we'll use max_cache_entry_age instead.
     *
     * We got all the possible values of expires so let's find the
     * highest value greater than the configured max_cache_entry_age.
     */
 
    /* The default */
    expires = config_expires;
 
    if (max_age_hdr > expires) {
        expires = max_age_hdr;
    }
 
    if (expires_hdr > expires) {
        expires = expires_hdr;
    }
 
    /*
     * However...  Don't cache for longer than the
     * certificate is actually valid.
     */
    if (cert_expires && cert_expires < expires) {
        expires = cert_expires;
    }
 
    snprintf(time_buf, sizeof(time_buf), "%ld", expires);
 
    rc = ast_db_put(cert->hash_family, "expiration", time_buf);
    if (rc == 0) {
        strcpy(cert->expiration, time_buf); /* safe */
    }
 
    return rc;
}

References ao2_cleanup, ast_db_put(), ast_mktime(), ast_str_to_uint(), ast_strlen_zero(), ast_strptime(), crypto_asn_time_as_time_t(), ast_stir_shaken_vs_ctx::expiration, ast_stir_shaken_vs_ctx::hash_family, NULL, RAII_VAR, ast_tm::tm_isdst, vs_get_cfg(), and ast_stir_shaken_vs_ctx::xcert.

Referenced by add_cert_key_to_astdb().

◆ add_cert_key_to_astdb()

static int add_cert_key_to_astdb	(	struct ast_stir_shaken_vs_ctx *	cert,
		const char *	cache_control_hdr,
		const char *	expires_hdr
	)

static

Definition at line 201 of file verification.c.

{
    int rc = 0;
 
    rc = ast_db_put(cert->url_family, cert->public_url, cert->hash);
    if (rc) {
        return rc;
    }
    rc = ast_db_put(cert->hash_family, "path", cert->filename);
    if (rc) {
        ast_db_del(cert->url_family, cert->public_url);
        return rc;
    }
 
    rc = add_cert_expiration_to_astdb(cert, cache_control_hdr, expires_hdr);
    if (rc) {
        ast_db_del(cert->url_family, cert->public_url);
        ast_db_del(cert->hash_family, "path");
    }
 
    return rc;
}

References add_cert_expiration_to_astdb(), ast_db_del(), ast_db_put(), ast_stir_shaken_vs_ctx::filename, ast_stir_shaken_vs_ctx::hash, ast_stir_shaken_vs_ctx::hash_family, ast_stir_shaken_vs_ctx::public_url, and ast_stir_shaken_vs_ctx::url_family.

Referenced by retrieve_cert_from_url().

◆ ast_stir_shaken_vs_ctx_add_date_hdr()

enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_add_date_hdr	(	struct ast_stir_shaken_vs_ctx *	ctx,
		const char *	date_hdr
	)

Add the received Date header value to the VS context.

Parameters

ctx	VS context
date_hdr	Date header value

Return values

AST_STIR_SHAKEN_VS_SUCCESS	if successful
Other	AST_STIR_SHAKEN_VS errors.

Definition at line 613 of file verification.c.

{
    return ast_string_field_set(ctx, date_hdr, date_hdr) == 0 ?
        AST_STIR_SHAKEN_VS_SUCCESS : AST_STIR_SHAKEN_VS_INTERNAL_ERROR;
}

References AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, and ast_string_field_set.

Referenced by stir_shaken_incoming_request().

◆ ast_stir_shaken_vs_ctx_add_identity_hdr()

enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_add_identity_hdr	(	struct ast_stir_shaken_vs_ctx *	ctx,
		const char *	identity_hdr
	)

Add the received Identity header value to the VS context.

Parameters

ctx	VS context
identity_hdr	Identity header value

Return values

AST_STIR_SHAKEN_VS_SUCCESS	if successful
Other	AST_STIR_SHAKEN_VS errors.

Definition at line 605 of file verification.c.

{
    return ast_string_field_set(ctx, identity_hdr, identity_hdr) == 0 ?
        AST_STIR_SHAKEN_VS_SUCCESS : AST_STIR_SHAKEN_VS_INTERNAL_ERROR;
}

References AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, and ast_string_field_set.

Referenced by stir_shaken_incoming_request().

◆ ast_stir_shaken_vs_ctx_create()

enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_create	(	const char *	caller_id,
		struct ast_channel *	chan,
		const char *	profile_name,
		const char *	tag,
		struct ast_stir_shaken_vs_ctx **	ctxout
	)

Create Verification Service context.

Parameters

caller_id	Incoming caller id
chan	Incoming channel
profile_name	The profile name on the endpoint May be NULL.
endpoint_behavior	Behavior associated to the specific endpoint
tag	Identifying string to output in log and trace messages.
ctxout	Receives a pointer to the newly created context The caller must release with ao2_ref or ao2_cleanup.

Return values

AST_STIR_SHAKEN_VS_SUCCESS	if successful.
AST_STIR_SHAKEN_VS_DISABLED	if verification is disabled by the endpoint itself, the profile or globally.
Other	AST_STIR_SHAKEN_VS errors.

Definition at line 657 of file verification.c.

{
    RAII_VAR(struct ast_stir_shaken_vs_ctx *, ctx, NULL, ao2_cleanup);
    RAII_VAR(struct profile_cfg *, profile, NULL, ao2_cleanup);
    RAII_VAR(struct verification_cfg *, vs, NULL, ao2_cleanup);
    RAII_VAR(char *, canon_caller_id , canonicalize_tn_alloc(caller_id), ast_free);
 
    const char *t = S_OR(tag, S_COR(chan, ast_channel_name(chan), ""));
    SCOPE_ENTER(3, "%s: Enter\n", t);
 
    vs = vs_get_cfg();
    if (vs->global_disable) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_DISABLED,
            "%s: Globally disabled\n", t);
    }
 
    if (ast_strlen_zero(profile_name)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_DISABLED,
            "%s: Disabled due to missing profile name\n", t);
    }
 
    profile = eprofile_get_cfg(profile_name);
    if (!profile) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_DISABLED,
        LOG_ERROR, "%s: No profile for profile name '%s'.  Call will continue\n", tag,
            profile_name);
    }
 
    if (!PROFILE_ALLOW_VERIFY(profile)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_DISABLED,
            "%s: Disabled by profile '%s'\n", t, profile_name);
    }
 
    if (ast_strlen_zero(tag)) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_ARGUMENTS,
            LOG_ERROR, "%s: Must provide tag\n", t);
    }
 
    ctx = ao2_alloc_options(sizeof(*ctx), ctx_destructor,
        AO2_ALLOC_OPT_LOCK_NOLOCK);
    if (!ctx) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR);
    }
    if (ast_string_field_init(ctx, 1024) != 0) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR);
    }
 
    if (ast_string_field_set(ctx, tag, tag) != 0) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR);
    }
 
    ctx->chan = chan;
    if (ast_string_field_set(ctx, caller_id, canon_caller_id) != 0) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR);
    }
 
    /* Transfer references to ctx */
    ctx->eprofile = profile;
    profile = NULL;
 
    ao2_ref(ctx, +1);
    *ctxout = ctx;
    SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_SUCCESS, "%s: Done\n", t);
}

References AO2_ALLOC_OPT_LOCK_NOLOCK, ao2_alloc_options, ao2_cleanup, ao2_ref, ast_channel_name(), ast_free, AST_STIR_SHAKEN_VS_DISABLED, AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_INVALID_ARGUMENTS, AST_STIR_SHAKEN_VS_SUCCESS, ast_string_field_init, ast_string_field_set, ast_strlen_zero(), ast_stir_shaken_vs_ctx::caller_id, canonicalize_tn_alloc(), ast_stir_shaken_vs_ctx::chan, ctx_destructor(), eprofile_get_cfg(), LOG_ERROR, NULL, PROFILE_ALLOW_VERIFY, RAII_VAR, S_COR, S_OR, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, and vs_get_cfg().

Referenced by stir_shaken_incoming_request().

◆ ast_stir_shaken_vs_ctx_set_response_code()

void ast_stir_shaken_vs_ctx_set_response_code	(	struct ast_stir_shaken_vs_ctx *	ctx,
		enum ast_stir_shaken_vs_response_code	vs_rc
	)

Sets response code on VS context.

Parameters

ctx	VS context
vs_rc	ast_stir_shaken_vs_response_code to set

Definition at line 639 of file verification.c.

{
    ctx->failure_reason = vs_rc;
}

References ast_stir_shaken_vs_ctx::failure_reason.

Referenced by process_failure().

◆ ast_stir_shaken_vs_get_caller_id()

const char * ast_stir_shaken_vs_get_caller_id ( struct ast_stir_shaken_vs_ctx * ctx )

Get caller_id from context.

Parameters

ctx	VS context

Return values

Caller ID or NULL

Definition at line 633 of file verification.c.

{
    return ctx->caller_id;
}

References ast_stir_shaken_vs_ctx::caller_id.

Referenced by stir_shaken_incoming_request().

◆ ast_stir_shaken_vs_get_failure_action()

enum stir_shaken_failure_action_enum ast_stir_shaken_vs_get_failure_action ( struct ast_stir_shaken_vs_ctx * ctx )

Get failure_action from context.

Parameters

ctx	VS context

Return values

ast_stir_shaken_failure_action

Definition at line 621 of file verification.c.

{
    return ctx->eprofile->vcfg_common.stir_shaken_failure_action;
}

References ast_stir_shaken_vs_ctx::eprofile, verification_cfg_common::stir_shaken_failure_action, and profile_cfg::vcfg_common.

Referenced by process_failure().

◆ ast_stir_shaken_vs_get_use_rfc9410_responses()

int ast_stir_shaken_vs_get_use_rfc9410_responses ( struct ast_stir_shaken_vs_ctx * ctx )

Get use_rfc9410_responses from context.

Parameters

ctx	VS context

Return values

1	if true
0	if false

Definition at line 627 of file verification.c.

{
    return ctx->eprofile->vcfg_common.use_rfc9410_responses;
}

References ast_stir_shaken_vs_ctx::eprofile, verification_cfg_common::use_rfc9410_responses, and profile_cfg::vcfg_common.

Referenced by process_failure().

◆ ast_stir_shaken_vs_verify()

enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_verify ( struct ast_stir_shaken_vs_ctx * ctx )

Perform incoming call verification.

Parameters

ctx	VS context

Return values

AST_STIR_SHAKEN_AS_SUCCESS	if successful
Other	AST_STIR_SHAKEN_AS errors.

Definition at line 884 of file verification.c.

{
    RAII_VAR(char *, jwt_encoded, NULL, ast_free);
    RAII_VAR(jwt_t *, jwt, NULL, jwt_free);
    RAII_VAR(struct ast_json *, grants, NULL, ast_json_unref);
    char *p = NULL;
    char *grants_str = NULL;
    const char *x5u;
    const char *ppt_header = NULL;
    const char *grant = NULL;
    time_t now_s = time(NULL);
    time_t iat;
    struct ast_json *grant_obj = NULL;
    int len;
    int rc;
    enum ast_stir_shaken_vs_response_code vs_rc;
    SCOPE_ENTER(3, "%s: Verifying\n", ctx ? ctx->tag : "NULL");
 
    if (!ctx) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR, LOG_ERROR,
            "%s: No context object!\n", "NULL");
    }
 
    if (ast_strlen_zero(ctx->identity_hdr)) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR, LOG_ERROR,
            "%s: No identity header in ctx\n", ctx->tag);
    }
 
    p = strchr(ctx->identity_hdr, ';');
    len = p - ctx->identity_hdr + 1;
    jwt_encoded = ast_malloc(len);
    if (!jwt_encoded) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR, LOG_ERROR,
            "%s: Failed to allocate memory for encoded jwt\n", ctx->tag);
    }
 
    memcpy(jwt_encoded, ctx->identity_hdr, len);
    jwt_encoded[len - 1] = '\0';
 
    jwt_decode(&jwt, jwt_encoded, NULL, 0);
 
    ppt_header = jwt_get_header(jwt, "ppt");
    if (!ppt_header || strcmp(ppt_header, STIR_SHAKEN_PPT)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_PPT, "%s: %s\n",
            ctx->tag, vs_response_code_to_str(AST_STIR_SHAKEN_VS_INVALID_OR_NO_PPT));
    }
 
    vs_rc = check_date_header(ctx);
    if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
        SCOPE_EXIT_LOG_RTN_VALUE(vs_rc, LOG_ERROR,
            "%s: Date header verification failed\n", ctx->tag);
    }
 
    x5u = jwt_get_header(jwt, "x5u");
    if (ast_strlen_zero(x5u)) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U, LOG_ERROR,
            "%s: No x5u in Identity header\n", ctx->tag);
    }
 
    rc = check_x5u_url(ctx, x5u);
    if (rc != AST_STIR_SHAKEN_VS_SUCCESS) {
        SCOPE_EXIT_RTN_VALUE(vs_rc,
            "%s: x5u URL verification failed\n", ctx->tag);
    }
 
    ast_trace(3, "%s: Decoded enough to get x5u: '%s'\n", ctx->tag, x5u);
    if (ast_string_field_set(ctx, public_url, x5u) != 0) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR, LOG_ERROR,
            "%s: Failed to set public_url '%s'\n", ctx->tag, x5u);
    }
 
    iat = jwt_get_grant_int(jwt, "iat");
    if (iat == 0) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_NO_IAT, LOG_ERROR,
            "%s: No 'iat' in Identity header\n", ctx->tag);
    }
    ast_trace(1, "date_hdr: %zu  iat: %zu  diff: %zu\n",
        ctx->date_hdr_time, iat, ctx->date_hdr_time - iat);
    if (iat + ctx->eprofile->vcfg_common.max_iat_age < now_s) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_IAT_EXPIRED,
            "%s: iat %ld older than %u seconds\n", ctx->tag,
            iat, ctx->eprofile->vcfg_common.max_iat_age);
    }
    ctx->validity_check_time = iat;
 
    vs_rc = ctx_populate(ctx);
    if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
        SCOPE_EXIT_LOG_RTN_VALUE(vs_rc, LOG_ERROR,
            "%s: Unable to populate ctx\n", ctx->tag);
    }
 
    vs_rc = retrieve_verification_cert(ctx);
    if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
        SCOPE_EXIT_LOG_RTN_VALUE(vs_rc, LOG_ERROR,
            "%s: Could not get valid cert from '%s'\n", ctx->tag, ctx->public_url);
    }
 
    jwt_free(jwt);
    jwt = NULL;
 
    rc = jwt_decode(&jwt, jwt_encoded, ctx->raw_key, ctx->raw_key_len);
    if (rc != 0) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_SIGNATURE_VALIDATION,
            LOG_ERROR, "%s: Signature validation failed for '%s'\n",
            ctx->tag, ctx->public_url);
    }
 
    ast_trace(1, "%s: Decoding succeeded\n", ctx->tag);
 
    ppt_header = jwt_get_header(jwt, "alg");
    if (!ppt_header || strcmp(ppt_header, STIR_SHAKEN_ENCRYPTION_ALGORITHM)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_ALG,
            "%s: %s\n", ctx->tag,
            vs_response_code_to_str(AST_STIR_SHAKEN_VS_INVALID_OR_NO_ALG));
    }
 
    ppt_header = jwt_get_header(jwt, "ppt");
    if (!ppt_header || strcmp(ppt_header, STIR_SHAKEN_PPT)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_PPT,
            "%s: %s\n", ctx->tag,
            vs_response_code_to_str(AST_STIR_SHAKEN_VS_INVALID_OR_NO_PPT));
    }
 
    ppt_header = jwt_get_header(jwt, "typ");
    if (!ppt_header || strcmp(ppt_header, STIR_SHAKEN_TYPE)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_TYP,
            "%s: %s\n", ctx->tag,
            vs_response_code_to_str(AST_STIR_SHAKEN_VS_INVALID_OR_NO_TYP));
    }
 
    grants_str = jwt_get_grants_json(jwt, NULL);
    if (ast_strlen_zero(grants_str)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_GRANTS,
            "%s: %s\n", ctx->tag,
            vs_response_code_to_str(AST_STIR_SHAKEN_VS_INVALID_OR_NO_GRANTS));
    }
    ast_trace(1, "grants: %s\n", grants_str);
    grants = ast_json_load_string(grants_str, NULL);
    ast_std_free(grants_str);
    if (!grants) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_GRANTS,
            "%s: %s\n", ctx->tag,
            vs_response_code_to_str(AST_STIR_SHAKEN_VS_INVALID_OR_NO_GRANTS));
    }
 
    grant = ast_json_object_string_get(grants, "attest");
    if (ast_strlen_zero(grant)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_ATTEST,
            "%s: No 'attest' in Identity header\n", ctx->tag);
    }
    if (grant[0] < 'A' || grant[0] > 'C') {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_ATTEST,
            "%s: Invalid attest value '%s'\n", ctx->tag, grant);
    }
    ast_string_field_set(ctx, attestation, grant);
    ast_trace(1, "got attest: %s\n", grant);
 
    grant_obj = ast_json_object_get(grants, "dest");
    if (!grant_obj) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_NO_DEST_TN,
            "%s: No 'dest' in Identity header\n", ctx->tag);
    }
    if (TRACE_ATLEAST(3)) {
        char *otn = ast_json_dump_string(grant_obj);
        ast_trace(1, "got dest: %s\n", otn);
        ast_json_free(otn);
    }
 
    grant_obj = ast_json_object_get(grants, "orig");
    if (!grant_obj) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_NO_ORIG_TN,
            "%s: No 'orig' in Identity header\n", ctx->tag);
    }
    if (TRACE_ATLEAST(3)) {
        char *otn = ast_json_dump_string(grant_obj);
        ast_trace(1, "got orig: %s\n", otn);
        ast_json_free(otn);
    }
    grant = ast_json_object_string_get(grant_obj, "tn");
    if (!grant) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_NO_ORIG_TN,
            "%s: No 'orig.tn' in Indentity header\n", ctx->tag);
    }
    ast_string_field_set(ctx, orig_tn, grant);
    if (strcmp(ctx->caller_id, ctx->orig_tn) != 0) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_CID_ORIG_TN_MISMATCH,
            "%s: Mismatched cid '%s' and orig_tn '%s'\n", ctx->tag,
            ctx->caller_id, grant);
    }
 
    grant = ast_json_object_string_get(grants, "origid");
    if (ast_strlen_zero(grant)) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_NO_ORIGID,
            "%s: No 'origid' in Identity header\n", ctx->tag);
    }
 
    SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_SUCCESS,
        "%s: verification succeeded\n", ctx->tag);
}

Referenced by stir_shaken_incoming_request().

◆ check_cert()

static enum ast_stir_shaken_vs_response_code check_cert ( struct ast_stir_shaken_vs_ctx * ctx )

static

Definition at line 326 of file verification.c.

{
    RAII_VAR(char *, CN, NULL, ast_free);
    int res = 0;
    const char *err_msg;
    SCOPE_ENTER(3, "%s: Validating cert '%s'\n", ctx->tag, ctx->public_url);
 
    CN = crypto_get_cert_subject(ctx->xcert, "CN");
    if (!CN) {
        CN = crypto_get_cert_subject(ctx->xcert, NULL);
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID,
            LOG_ERROR, "%s: Cert '%s' has no commonName(CN) in Subject '%s'\n",
            ctx->tag, ctx->public_url, CN);
    }
 
    res = ast_string_field_set(ctx, cert_cn, CN);
    if (res != 0) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR);
    }
 
    ast_trace(3,"%s: Checking ctx against CA ctx\n", ctx->tag);
    res = crypto_is_cert_trusted(ctx->eprofile->vcfg_common.tcs, ctx->xcert, &err_msg);
    if (!res) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_NOT_TRUSTED,
            LOG_ERROR, "%s: Cert '%s' not trusted: %s\n",
            ctx->tag, ctx->public_url, err_msg);
    }
 
    ast_trace(3,"%s: Attempting to get the raw pubkey\n", ctx->tag);
    ctx->raw_key_len = crypto_get_raw_pubkey_from_cert(ctx->xcert,
        &ctx->raw_key);
    if (ctx->raw_key_len <= 0) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_NO_RAW_KEY,
            LOG_ERROR, "%s: Unable to extract raw public key from '%s'\n",
            ctx->tag, ctx->public_url);
    }
 
    ast_trace(3,"%s: Checking cert '%s' validity dates\n",
        ctx->tag, ctx->public_url);
    if (!crypto_is_cert_time_valid(ctx->xcert, ctx->validity_check_time)) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_DATE_INVALID,
            LOG_ERROR, "%s: Cert '%s' dates not valid\n",
            ctx->tag, ctx->public_url);
    }
 
    SCOPE_EXIT_RTN_VALUE(check_tn_auth_list(ctx),
        "%s: Cert '%s' with SPC: %s CN: %s is valid\n",
        ctx->tag, ctx->public_url, ctx->cert_spc, ctx->cert_cn);
}

Referenced by retrieve_cert_from_cache(), and retrieve_cert_from_url().

◆ check_date_header()

static enum ast_stir_shaken_vs_response_code check_date_header ( struct ast_stir_shaken_vs_ctx * ctx )

static

Definition at line 724 of file verification.c.

{
    struct ast_tm date_hdr_tm;
    struct timeval date_hdr_timeval;
    struct timeval current_timeval;
    char *remainder;
    char timezone[80] = { 0 };
    int64_t time_diff;
    SCOPE_ENTER(3, "%s: Checking date header: '%s'\n",
        ctx->tag, ctx->date_hdr);
 
    if (!(remainder = ast_strptime(ctx->date_hdr, "%a, %d %b %Y %T", &date_hdr_tm))) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_DATE_HDR_PARSE_FAILURE,
            LOG_ERROR, "%s: Failed to parse: '%s'\n",
            ctx->tag, ctx->date_hdr);
    }
 
    sscanf(remainder, "%79s", timezone);
 
    if (ast_strlen_zero(timezone)) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_DATE_HDR_PARSE_FAILURE,
            LOG_ERROR, "%s: A timezone is required: '%s'\n",
            ctx->tag, ctx->date_hdr);
    }
 
    date_hdr_timeval = ast_mktime(&date_hdr_tm, timezone);
    ctx->date_hdr_time = date_hdr_timeval.tv_sec;
    current_timeval = ast_tvnow();
 
    time_diff = ast_tvdiff_ms(current_timeval, date_hdr_timeval);
    ast_trace(3, "%zu  %zu  %zu %d\n", current_timeval.tv_sec,
        date_hdr_timeval.tv_sec,
        (current_timeval.tv_sec - date_hdr_timeval.tv_sec), (int)time_diff);
    if (time_diff < 0) {
        /* An INVITE from the future! */
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_DATE_HDR_EXPIRED,
            LOG_ERROR, "%s: Future date: '%s'\n",
            ctx->tag, ctx->date_hdr);
    } else if (time_diff > (ctx->eprofile->vcfg_common.max_date_header_age * 1000)) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_DATE_HDR_EXPIRED,
            LOG_ERROR, "%s: More than %u seconds old: '%s'\n",
            ctx->tag, ctx->eprofile->vcfg_common.max_date_header_age, ctx->date_hdr);
    }
 
    SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_SUCCESS,
        "%s: Success: '%s'\n", ctx->tag, ctx->date_hdr);
}

References ast_mktime(), AST_STIR_SHAKEN_VS_DATE_HDR_EXPIRED, AST_STIR_SHAKEN_VS_DATE_HDR_PARSE_FAILURE, AST_STIR_SHAKEN_VS_SUCCESS, ast_strlen_zero(), ast_strptime(), ast_trace, ast_tvdiff_ms(), ast_tvnow(), ast_stir_shaken_vs_ctx::date_hdr, ast_stir_shaken_vs_ctx::date_hdr_time, ast_stir_shaken_vs_ctx::eprofile, LOG_ERROR, verification_cfg_common::max_date_header_age, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, and profile_cfg::vcfg_common.

Referenced by ast_stir_shaken_vs_verify().

◆ check_tn_auth_list()

static enum ast_stir_shaken_vs_response_code check_tn_auth_list ( struct ast_stir_shaken_vs_ctx * ctx )

static

Definition at line 254 of file verification.c.

{
    ASN1_OCTET_STRING *tn_exten;
    const unsigned char* octet_str_data = NULL;
    long xlen;
    int tag, xclass;
    int ret;
    SCOPE_ENTER(3, "%s: Checking TNAuthList in cert '%s'\n", ctx->tag, ctx->public_url);
 
    tn_exten = crypto_get_cert_extension_data(ctx->xcert, get_tn_auth_nid(), NULL);
    if (!tn_exten) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_NO_TN_AUTH_EXT,
            LOG_ERROR, "%s: Cert '%s' doesn't have a TNAuthList extension\n",
            ctx->tag, ctx->public_url);
    }
    octet_str_data = tn_exten->data;
 
    /* The first call to ASN1_get_object should return a SEQUENCE */
    ret = ASN1_get_object(&octet_str_data, &xlen, &tag, &xclass, tn_exten->length);
    if (IS_GET_OBJ_ERR(ret)) {
        crypto_log_openssl(LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension\n",
            ctx->tag, ctx->public_url);
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_NO_TN_AUTH_EXT);
    }
 
    if (ret != V_ASN1_CONSTRUCTED || tag != V_ASN1_SEQUENCE) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_NO_TN_AUTH_EXT,
            LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension (tag %d != V_ASN1_SEQUENCE)\n",
            ctx->tag, ctx->public_url, tag);
    }
 
    /*
     * The second call to ASN1_get_object should return one of
     * the following tags defined in RFC8226 section 9:
     *
     * ASN1_TAG_TNAUTH_SPC 0
     * ASN1_TAG_TNAUTH_TN_RANGE 1
     * ASN1_TAG_TNAUTH_TN 2
     *
     * ATIS-1000080 however limits this to only ASN1_TAG_TNAUTH_SPC
     *
     */
    ret = ASN1_get_object(&octet_str_data, &xlen, &tag, &xclass, tn_exten->length);
    if (IS_GET_OBJ_ERR(ret)) {
        crypto_log_openssl(LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension\n",
            ctx->tag, ctx->public_url);
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_NO_TN_AUTH_EXT);
    }
 
    if (ret != V_ASN1_CONSTRUCTED || tag != ASN1_TAG_TNAUTH_SPC) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_NO_SPC_IN_TN_AUTH_EXT,
            LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension (tag %d != ASN1_TAG_TNAUTH_SPC(0))\n",
            ctx->tag, ctx->public_url, tag);
    }
 
    /* The third call to ASN1_get_object should contain the SPC */
    ret = ASN1_get_object(&octet_str_data, &xlen, &tag, &xclass, tn_exten->length);
    if (ret != 0) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_NO_SPC_IN_TN_AUTH_EXT,
            LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension (no SPC)\n",
            ctx->tag, ctx->public_url);
    }
 
    if (ast_string_field_set(ctx, cert_spc, (char *)octet_str_data) != 0) {
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR);
    }
 
    SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_SUCCESS, "%s: Cert '%s' with SPC: %s CN: %s has valid TNAuthList\n",
        ctx->tag, ctx->public_url, ctx->cert_spc, ctx->cert_cn);
}

References ASN1_TAG_TNAUTH_SPC, AST_STIR_SHAKEN_VS_CERT_NO_SPC_IN_TN_AUTH_EXT, AST_STIR_SHAKEN_VS_CERT_NO_TN_AUTH_EXT, AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, ast_string_field_set, ast_stir_shaken_vs_ctx::cert_cn, ast_stir_shaken_vs_ctx::cert_spc, crypto_get_cert_extension_data(), crypto_log_openssl(), get_tn_auth_nid(), IS_GET_OBJ_ERR, LOG_ERROR, NULL, ast_stir_shaken_vs_ctx::public_url, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, and ast_stir_shaken_vs_ctx::xcert.

Referenced by check_cert().

◆ check_x5u_url()

static int check_x5u_url	(	struct ast_stir_shaken_vs_ctx *	ctx,
		const char *	x5u
	)

static

Definition at line 826 of file verification.c.

{
    int max_groups = url_match_regex.re_nsub + 1;
    regmatch_t pmatch[max_groups];
    int rc;
    SCOPE_ENTER(3, "%s: Checking x5u '%s'\n", ctx->tag, x5u);
 
    rc = regexec(&url_match_regex, x5u, max_groups, pmatch, 0);
    if (rc) {
        char regex_error[512];
        regerror(rc, &url_match_regex, regex_error, sizeof(regex_error));
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U, LOG_ERROR,
            "%s: x5u '%s' in Identity header failed basic URL validation: %s\n",
            ctx->tag, x5u, regex_error);
    }
 
    if (ctx->eprofile->vcfg_common.relax_x5u_port_scheme_restrictions
        != relax_x5u_port_scheme_restrictions_YES) {
        const char *scheme = get_match_string(x5u, pmatch, URL_MATCH_SCHEME);
        const char *port = get_match_string(x5u, pmatch, URL_MATCH_PORT);
 
        if (!ast_strings_equal(scheme, "https")) {
            DUMP_X5U_MATCH();
            SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U, LOG_ERROR,
                "%s: x5u '%s': scheme '%s' not https\n",
                ctx->tag, x5u, scheme);
        }
        if (!ast_strlen_zero(port)) {
            if (!ast_strings_equal(port, "443")
                || !ast_strings_equal(port, "8443")) {
                DUMP_X5U_MATCH();
                SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U, LOG_ERROR,
                    "%s: x5u '%s': port '%s' not port 443 or 8443\n",
                    ctx->tag, x5u, port);
            }
        }
    }
 
    if (ctx->eprofile->vcfg_common.relax_x5u_path_restrictions
        != relax_x5u_path_restrictions_YES) {
        const char *userpass = get_match_string(x5u, pmatch, URL_MATCH_USERPASS);
        const char *qs = get_match_string(x5u, pmatch, URL_MATCH_QUERY);
        const char *frag = get_match_string(x5u, pmatch, URL_MATCH_FRAGMENT);
 
        if (!ast_strlen_zero(userpass) || !ast_strlen_zero(qs)
            || !ast_strlen_zero(frag)) {
            DUMP_X5U_MATCH();
            SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U, LOG_ERROR,
                "%s: x5u '%s' contains user:password, query parameters or fragment\n",
                ctx->tag, x5u);
        }
    }
 
    return 0;
}

References AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U, ast_strings_equal(), ast_strlen_zero(), DUMP_X5U_MATCH, ast_stir_shaken_vs_ctx::eprofile, get_match_string, LOG_ERROR, verification_cfg_common::relax_x5u_path_restrictions, verification_cfg_common::relax_x5u_port_scheme_restrictions, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, URL_MATCH_FRAGMENT, URL_MATCH_PORT, URL_MATCH_QUERY, url_match_regex, URL_MATCH_SCHEME, URL_MATCH_USERPASS, and profile_cfg::vcfg_common.

Referenced by ast_stir_shaken_vs_verify().

◆ cleanup_cert_from_astdb_and_fs()

static void cleanup_cert_from_astdb_and_fs ( struct ast_stir_shaken_vs_ctx * ctx )

static

Definition at line 97 of file verification.c.

{
    if (ast_db_exists(ctx->hash_family, "path") || ast_db_exists(ctx->hash_family, "expiration")) {
        ast_db_deltree(ctx->hash_family, NULL);
    }
 
    if (ast_db_exists(ctx->url_family, ctx->public_url)) {
        ast_db_del(ctx->url_family, ctx->public_url);
    }
 
    /* Remove the actual file from the system */
    remove(ctx->filename);
}

References ast_db_del(), ast_db_deltree(), ast_db_exists(), ast_stir_shaken_vs_ctx::filename, ast_stir_shaken_vs_ctx::hash_family, NULL, ast_stir_shaken_vs_ctx::public_url, remove, and ast_stir_shaken_vs_ctx::url_family.

Referenced by retrieve_cert_from_cache().

◆ ctx_destructor()

static void ctx_destructor ( void * obj )

static

Definition at line 646 of file verification.c.

{
    struct ast_stir_shaken_vs_ctx *ctx = obj;
 
    ao2_cleanup(ctx->eprofile);
    ast_free(ctx->raw_key);
    ast_string_field_free_memory(ctx);
    X509_free(ctx->xcert);
}

References ao2_cleanup, ast_free, ast_string_field_free_memory, ast_stir_shaken_vs_ctx::eprofile, ast_stir_shaken_vs_ctx::raw_key, and ast_stir_shaken_vs_ctx::xcert.

Referenced by ast_stir_shaken_vs_ctx_create().

◆ ctx_populate()

static enum ast_stir_shaken_vs_response_code ctx_populate ( struct ast_stir_shaken_vs_ctx * ctx )

static

Definition at line 548 of file verification.c.

{
    char hash[41];
 
    ast_sha1_hash(hash, ctx->public_url);
    if (ast_string_field_set(ctx, hash, hash) != 0) {
        return AST_STIR_SHAKEN_VS_INTERNAL_ERROR;
    }
 
    if (ast_string_field_build(ctx, filename, "%s/%s.pem",
        ctx->eprofile->vcfg_common.cert_cache_dir, hash) != 0) {
        return AST_STIR_SHAKEN_VS_INTERNAL_ERROR;
    }
 
    if (ast_string_field_build(ctx, hash_family, "%s/hash/%s",
        AST_DB_FAMILY, hash) != 0) {
        return AST_STIR_SHAKEN_VS_INTERNAL_ERROR;
    }
 
    if (ast_string_field_build(ctx, url_family, "%s/url", AST_DB_FAMILY) != 0) {
        return AST_STIR_SHAKEN_VS_INTERNAL_ERROR;
    }
 
    return AST_STIR_SHAKEN_VS_SUCCESS;
}

References AST_DB_FAMILY, ast_sha1_hash(), AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, ast_string_field_build, ast_string_field_set, verification_cfg_common::cert_cache_dir, ast_stir_shaken_vs_ctx::eprofile, ast_stir_shaken_vs_ctx::public_url, and profile_cfg::vcfg_common.

Referenced by ast_stir_shaken_vs_verify().

◆ is_cert_cache_entry_expired()

static int is_cert_cache_entry_expired ( char * expiration )

static

Definition at line 225 of file verification.c.

{
    struct timeval current_time = ast_tvnow();
    struct timeval expires = { .tv_sec = 0, .tv_usec = 0 };
    int res = 0;
    SCOPE_ENTER(3, "Checking for cache expiration: %s\n", expiration);
 
    if (ast_strlen_zero(expiration)) {
        SCOPE_EXIT_RTN_VALUE(1, "No expiration date provided\n");
    }
 
    if (ast_str_to_ulong(expiration, (unsigned long *)&expires.tv_sec)) {
        SCOPE_EXIT_RTN_VALUE(1, "Couldn't convert expiration string '%s' to ulong",
            expiration);
    }
    ast_trace(2, "Expiration comparison: exp: %" PRIu64 "  curr: %" PRIu64 "  Diff: %" PRIu64 ".\n",
        expires.tv_sec, current_time.tv_sec, expires.tv_sec - current_time.tv_sec);
 
    res = (ast_tvcmp(current_time, expires) == -1 ? 0 : 1);
    SCOPE_EXIT_RTN_VALUE(res , "entry was %sexpired\n", res ? "" : "not ");
}

References ast_str_to_ulong(), ast_strlen_zero(), ast_trace, ast_tvcmp(), ast_tvnow(), SCOPE_ENTER, and SCOPE_EXIT_RTN_VALUE.

Referenced by retrieve_cert_from_cache().

◆ retrieve_cert_from_cache()

static enum ast_stir_shaken_vs_response_code retrieve_cert_from_cache ( struct ast_stir_shaken_vs_ctx * ctx )

static

Definition at line 490 of file verification.c.

{
    int rc = 0;
    enum ast_stir_shaken_vs_response_code vs_rc;
 
    SCOPE_ENTER(2, "%s: Attempting to retrieve cert '%s' from cache\n",
        ctx->tag, ctx->public_url);
 
    if (!ast_db_exists(ctx->hash_family, "path")) {
        cleanup_cert_from_astdb_and_fs(ctx);
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_CACHE_MISS,
            "%s: No cert found in astdb for '%s'\n",
            ctx->tag, ctx->public_url);
    }
 
    rc = ast_db_get(ctx->hash_family, "expiration", ctx->expiration, sizeof(ctx->expiration));
    if (rc) {
        cleanup_cert_from_astdb_and_fs(ctx);
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_CACHE_MISS,
            "%s: No cert found in astdb for '%s'\n",
            ctx->tag, ctx->public_url);
    }
 
    if (!ast_file_is_readable(ctx->filename)) {
        cleanup_cert_from_astdb_and_fs(ctx);
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_CACHE_MISS,
            "%s: Cert file '%s' was not found or was not readable for '%s'\n",
            ctx->tag, ctx->filename, ctx->public_url);
    }
 
    if (is_cert_cache_entry_expired(ctx->expiration)) {
        cleanup_cert_from_astdb_and_fs(ctx);
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_CACHE_EXPIRED,
            "%s: Cert file '%s' cache entry was expired for '%s'\n",
            ctx->tag, ctx->filename, ctx->public_url);
    }
 
    ctx->xcert = crypto_load_cert_from_file(ctx->filename);
    if (!ctx->xcert) {
        cleanup_cert_from_astdb_and_fs(ctx);
        SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID,
            "%s: Cert file '%s' was not parseable as an X509 certificate for '%s'\n",
            ctx->tag, ctx->filename, ctx->public_url);
    }
 
    vs_rc = check_cert(ctx);
    if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
        X509_free(ctx->xcert);
        ctx->xcert = NULL;
        SCOPE_EXIT_RTN_VALUE(vs_rc, "%s: Cert '%s' failed validity checks\n",
            ctx->tag, ctx->public_url);
    }
 
    SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_SUCCESS,
        "%s: Cert '%s' successfully retrieved from cache\n",
        ctx->tag, ctx->public_url);
}

References ast_db_exists(), ast_db_get(), ast_file_is_readable(), AST_STIR_SHAKEN_VS_CERT_CACHE_EXPIRED, AST_STIR_SHAKEN_VS_CERT_CACHE_MISS, AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID, AST_STIR_SHAKEN_VS_SUCCESS, check_cert(), cleanup_cert_from_astdb_and_fs(), crypto_load_cert_from_file(), ast_stir_shaken_vs_ctx::expiration, ast_stir_shaken_vs_ctx::filename, ast_stir_shaken_vs_ctx::hash_family, is_cert_cache_entry_expired(), NULL, ast_stir_shaken_vs_ctx::public_url, SCOPE_ENTER, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, and ast_stir_shaken_vs_ctx::xcert.

Referenced by retrieve_verification_cert().

◆ retrieve_cert_from_url()

static enum ast_stir_shaken_vs_response_code retrieve_cert_from_url ( struct ast_stir_shaken_vs_ctx * ctx )

static

Definition at line 377 of file verification.c.

{
    FILE *cert_file;
    long http_code;
    int rc = 0;
    enum ast_stir_shaken_vs_response_code vs_rc;
    RAII_VAR(struct curl_header_data *, header_data,
        ast_calloc(1, sizeof(*header_data)), curl_header_data_free);
    RAII_VAR(struct curl_write_data *, write_data,
        ast_calloc(1, sizeof(*write_data)), curl_write_data_free);
    RAII_VAR(struct curl_open_socket_data *, open_socket_data,
        ast_calloc(1, sizeof(*open_socket_data)), curl_open_socket_data_free);
 
    const char *cache_control;
    const char *expires;
    SCOPE_ENTER(2, "%s: Attempting to retrieve '%s' from net\n",
        ctx->tag, ctx->public_url);
 
    if (!header_data || !write_data || !open_socket_data) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR,
            LOG_ERROR, "%s: Unable to allocate memory for curl '%s' transaction\n",
            ctx->tag, ctx->public_url);
    }
 
    header_data->debug_info = ast_strdup(ctx->public_url);
    write_data->debug_info = ast_strdup(ctx->public_url);
    write_data->max_download_bytes = 8192;
    write_data->stream_buffer = NULL;
    open_socket_data->debug_info = ast_strdup(ctx->public_url);
    open_socket_data->acl = ctx->eprofile->vcfg_common.acl;
 
    if (!header_data->debug_info || !write_data->debug_info ||
        !open_socket_data->debug_info) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR,
            LOG_ERROR, "%s: Unable to allocate memory for curl '%s' transaction\n",
            ctx->tag, ctx->public_url);
    }
 
    http_code = curler(ctx->public_url,
        ctx->eprofile->vcfg_common.curl_timeout,
        write_data, header_data, open_socket_data);
 
    if (http_code / 100 != 2) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_RETRIEVAL_FAILURE,
            LOG_ERROR, "%s: Failed to retrieve cert %s: code %ld\n",
            ctx->tag, ctx->public_url, http_code);
    }
 
    if (!ast_begins_with(write_data->stream_buffer, BEGIN_CERTIFICATE_STR)) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID,
            LOG_ERROR, "%s: Cert '%s' contains invalid data\n",
            ctx->tag, ctx->public_url);
    }
 
    ctx->xcert = crypto_load_cert_from_memory(write_data->stream_buffer,
        write_data->stream_bytes_downloaded);
    if (!ctx->xcert) {
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID,
            LOG_ERROR, "%s: Cert '%s' was not parseable as an X509 certificate\n",
            ctx->tag, ctx->public_url);
    }
 
    vs_rc = check_cert(ctx);
    if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
        X509_free(ctx->xcert);
        ctx->xcert = NULL;
        SCOPE_EXIT_RTN_VALUE(vs_rc, "%s: Cert '%s' failed validity checks\n",
            ctx->tag, ctx->public_url);
    }
 
    cert_file = fopen(ctx->filename, "w");
    if (!cert_file) {
        X509_free(ctx->xcert);
        ctx->xcert = NULL;
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR,
            LOG_ERROR, "%s: Failed to write cert %s: file '%s' %s (%d)\n",
            ctx->tag, ctx->public_url, ctx->filename, strerror(errno), errno);
    }
 
    rc = fputs(write_data->stream_buffer, cert_file);
    fclose(cert_file);
    if (rc == EOF) {
        X509_free(ctx->xcert);
        ctx->xcert = NULL;
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR,
            LOG_ERROR, "%s: Failed to write cert %s: file '%s' %s (%d)\n",
            ctx->tag, ctx->public_url, ctx->filename, strerror(errno), errno);
    }
 
    ast_trace(2, "%s: Cert '%s' written to file '%s'\n",
        ctx->tag, ctx->public_url, ctx->filename);
 
    ast_trace(2, "%s: Adding cert '%s' to astdb",
        ctx->tag, ctx->public_url);
    cache_control = ast_variable_find_in_list(header_data->headers, "cache-control");
    expires = ast_variable_find_in_list(header_data->headers, "expires");
 
    rc = add_cert_key_to_astdb(ctx, cache_control, expires);
    if (rc) {
        X509_free(ctx->xcert);
        ctx->xcert = NULL;
        SCOPE_EXIT_LOG_RTN_VALUE(AST_STIR_SHAKEN_VS_INTERNAL_ERROR,
            LOG_ERROR, "%s: Unable to add cert '%s' to ASTDB\n",
            ctx->tag, ctx->public_url);
    }
 
    SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_SUCCESS,
        "%s: Cert '%s' successfully retrieved from internet and cached\n",
        ctx->tag, ctx->public_url);
}

References verification_cfg_common::acl, add_cert_key_to_astdb(), ast_begins_with(), ast_calloc, AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID, AST_STIR_SHAKEN_VS_CERT_RETRIEVAL_FAILURE, AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, ast_strdup, ast_trace, ast_variable_find_in_list(), BEGIN_CERTIFICATE_STR, check_cert(), crypto_load_cert_from_memory(), curl_header_data_free(), curl_open_socket_data_free(), verification_cfg_common::curl_timeout, curl_write_data_free(), curler(), ast_stir_shaken_vs_ctx::eprofile, errno, ast_stir_shaken_vs_ctx::filename, LOG_ERROR, NULL, ast_stir_shaken_vs_ctx::public_url, RAII_VAR, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, profile_cfg::vcfg_common, and ast_stir_shaken_vs_ctx::xcert.

Referenced by retrieve_verification_cert().

◆ retrieve_verification_cert()

static enum ast_stir_shaken_vs_response_code retrieve_verification_cert ( struct ast_stir_shaken_vs_ctx * ctx )

static

Definition at line 576 of file verification.c.

{
    enum ast_stir_shaken_vs_response_code rc = AST_STIR_SHAKEN_VS_SUCCESS;
    SCOPE_ENTER(3, "%s: Retrieving cert '%s'\n", ctx->tag, ctx->public_url);
 
    ast_trace(1, "%s: Checking cache for cert '%s'\n", ctx->tag, ctx->public_url);
    rc = retrieve_cert_from_cache(ctx);
    if (rc == AST_STIR_SHAKEN_VS_SUCCESS) {
        SCOPE_EXIT_RTN_VALUE(rc, "%s: Using cert '%s' from cache\n",
            ctx->tag, ctx->public_url);;
    }
 
    ast_trace(1, "%s: No valid cert for '%s' available in cache\n",
        ctx->tag, ctx->public_url);
    ast_trace(1, "%s: Retrieving cert directly from url '%s'\n",
        ctx->tag, ctx->public_url);
 
    rc = retrieve_cert_from_url(ctx);
    if (rc == AST_STIR_SHAKEN_VS_SUCCESS) {
        SCOPE_EXIT_RTN_VALUE(rc, "%s: Using cert '%s' from internet\n",
            ctx->tag, ctx->public_url);
    }
 
    SCOPE_EXIT_LOG_RTN_VALUE(rc, LOG_ERROR,
        "%s: Unable to retrieve cert '%s' from cache or internet\n",
        ctx->tag, ctx->public_url);
}

References AST_STIR_SHAKEN_VS_SUCCESS, ast_trace, LOG_ERROR, ast_stir_shaken_vs_ctx::public_url, retrieve_cert_from_cache(), retrieve_cert_from_url(), SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, and ast_stir_shaken_vs_ctx::tag.

Referenced by ast_stir_shaken_vs_verify().

◆ vs_load()

int vs_load ( void )

Load the stir/shaken verification service.

Return values

0	on success
-1	on error

Definition at line 1101 of file verification.c.

{
    int rc = 0;
 
    if (vs_config_load()) {
        return AST_MODULE_LOAD_DECLINE;
    }
 
    rc = regcomp(&url_match_regex, FULL_URL_REGEX, REG_EXTENDED);
    if (rc) {
        char regex_error[512];
        regerror(rc, &url_match_regex, regex_error, sizeof(regex_error));
        ast_log(LOG_ERROR, "Verification service URL regex failed to compile: %s\n", regex_error);
        vs_unload();
        return AST_MODULE_LOAD_DECLINE;
    }
    if (url_match_regex.re_nsub != FULL_URL_REGEX_GROUPS) {
        ast_log(LOG_ERROR, "The verification service URL regex was updated without updating FULL_URL_REGEX_GROUPS\n");
        vs_unload();
        return AST_MODULE_LOAD_DECLINE;
    }
 
    return AST_MODULE_LOAD_SUCCESS;
}

References ast_log, AST_MODULE_LOAD_DECLINE, AST_MODULE_LOAD_SUCCESS, FULL_URL_REGEX, FULL_URL_REGEX_GROUPS, LOG_ERROR, url_match_regex, vs_config_load(), and vs_unload().

Referenced by common_config_load().

◆ vs_reload()

int vs_reload ( void )

Reload the stir/shaken verification service.

Return values

0	on success
-1	on error

Definition at line 1084 of file verification.c.

{
    vs_config_reload();
 
    return 0;
}

References vs_config_reload().

Referenced by common_config_reload().

◆ vs_response_code_to_str()

const char * vs_response_code_to_str ( enum ast_stir_shaken_vs_response_code vs_rc )

Return string version of VS response code.

Parameters

vs_rc

Returns: Response string

Definition at line 90 of file verification.c.

{
    return ARRAY_IN_BOUNDS(vs_rc, vs_rc_map) ?
        vs_rc_map[vs_rc] : NULL;
}

References ARRAY_IN_BOUNDS, NULL, and vs_rc_map.

Referenced by ast_stir_shaken_vs_verify(), and func_read().

◆ vs_unload()

int vs_unload ( void )

Unload the stir/shaken verification service.

Return values

0	on success
-1	on error

Definition at line 1091 of file verification.c.

{
    vs_config_unload();
    if (url_match_regex.re_nsub > 0) {
        regfree(&url_match_regex);
    }
 
    return 0;
}

References url_match_regex, and vs_config_unload().

Referenced by common_config_unload(), and vs_load().

Variable Documentation

◆ url_match_regex

regex_t url_match_regex

static

Definition at line 48 of file verification.c.

Referenced by check_x5u_url(), vs_load(), and vs_unload().

◆ vs_rc_map

const char* vs_rc_map[]

static

Definition at line 53 of file verification.c.

Referenced by vs_response_code_to_str().

Macros

Functions

Variables

Macro Definition Documentation

◆ _TRACE_PREFIX_

◆ ASN1_TAG_TNAUTH_SPC

◆ ASN1_TAG_TNAUTH_TN

◆ ASN1_TAG_TNAUTH_TN_RANGE

◆ AST_DB_FAMILY

◆ BEGIN_CERTIFICATE_STR

◆ DUMP_X5U_MATCH

◆ FULL_URL_REGEX

◆ FULL_URL_REGEX_GROUPS

◆ get_match_string

◆ IS_GET_OBJ_ERR

◆ URL_MATCH_FRAGMENT

◆ URL_MATCH_HOST

◆ URL_MATCH_PATH

◆ URL_MATCH_PORT

◆ URL_MATCH_QUERY

◆ URL_MATCH_SCHEME

◆ URL_MATCH_USERPASS

Function Documentation

◆ add_cert_expiration_to_astdb()

◆ add_cert_key_to_astdb()

◆ ast_stir_shaken_vs_ctx_add_date_hdr()

◆ ast_stir_shaken_vs_ctx_add_identity_hdr()

◆ ast_stir_shaken_vs_ctx_create()

◆ ast_stir_shaken_vs_ctx_set_response_code()

◆ ast_stir_shaken_vs_get_caller_id()

◆ ast_stir_shaken_vs_get_failure_action()

◆ ast_stir_shaken_vs_get_use_rfc9410_responses()

◆ ast_stir_shaken_vs_verify()

◆ check_cert()

◆ check_date_header()

◆ check_tn_auth_list()

◆ check_x5u_url()

◆ cleanup_cert_from_astdb_and_fs()

◆ ctx_destructor()

◆ ctx_populate()

◆ is_cert_cache_entry_expired()

◆ retrieve_cert_from_cache()

◆ retrieve_cert_from_url()

◆ retrieve_verification_cert()

◆ vs_load()

◆ vs_reload()

◆ vs_response_code_to_str()

◆ vs_unload()

Variable Documentation

◆ url_match_regex

◆ vs_rc_map