Asterisk - The Open Source Telephony Project GIT-master-f3e88d3
Macros | Functions | Variables
verification.c File Reference
#include <curl/curl.h>
#include <sys/stat.h>
#include <jwt.h>
#include <jansson.h>
#include <regex.h>
#include "asterisk.h"
#include "asterisk/channel.h"
#include "asterisk/cli.h"
#include "asterisk/config.h"
#include "asterisk/module.h"
#include "asterisk/sorcery.h"
#include "asterisk/astdb.h"
#include "asterisk/conversions.h"
#include "asterisk/utils.h"
#include "asterisk/paths.h"
#include "asterisk/logger.h"
#include "asterisk/acl.h"
#include "asterisk/time.h"
#include "asterisk/localtime.h"
#include "asterisk/crypto.h"
#include "asterisk/json.h"
#include "stir_shaken.h"
Include dependency graph for verification.c:

Go to the source code of this file.

Macros

#define _TRACE_PREFIX_   "v",__LINE__, ""
 
#define ASN1_TAG_TNAUTH_SPC   0
 
#define ASN1_TAG_TNAUTH_TN   2
 
#define ASN1_TAG_TNAUTH_TN_RANGE   1
 
#define AST_DB_FAMILY   "STIR_SHAKEN"
 
#define BEGIN_CERTIFICATE_STR   "-----BEGIN CERTIFICATE-----"
 
#define DUMP_X5U_MATCH()
 
#define FULL_URL_REGEX   "^([a-zA-Z]+)://(([^@]+@[^:]+):)?(([^:/?]+)|([0-9.]+)|([[][0-9a-fA-F:]+[]]))(:([0-9]+))?(/([^#\\?]+))?(\\?([^#]+))?(#(.*))?"
 
#define FULL_URL_REGEX_GROUPS   15
 
#define get_match_string(__x5u, __pmatch, __i)
 
#define IS_GET_OBJ_ERR(ret)   (ret & 0x80)
 
#define URL_MATCH_FRAGMENT   15
 
#define URL_MATCH_HOST   4
 
#define URL_MATCH_PATH   11
 
#define URL_MATCH_PORT   9
 
#define URL_MATCH_QUERY   13
 
#define URL_MATCH_SCHEME   1
 
#define URL_MATCH_USERPASS   3
 

Functions

static int add_cert_expiration_to_astdb (struct ast_stir_shaken_vs_ctx *cert, const char *cache_control_header, const char *expires_header)
 
static int add_cert_key_to_astdb (struct ast_stir_shaken_vs_ctx *cert, const char *cache_control_hdr, const char *expires_hdr)
 
enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_add_date_hdr (struct ast_stir_shaken_vs_ctx *ctx, const char *date_hdr)
 Add the received Date header value to the VS context. More...
 
enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_add_identity_hdr (struct ast_stir_shaken_vs_ctx *ctx, const char *identity_hdr)
 Add the received Identity header value to the VS context. More...
 
enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_create (const char *caller_id, struct ast_channel *chan, const char *profile_name, const char *tag, struct ast_stir_shaken_vs_ctx **ctxout)
 Create Verification Service context. More...
 
void ast_stir_shaken_vs_ctx_set_response_code (struct ast_stir_shaken_vs_ctx *ctx, enum ast_stir_shaken_vs_response_code vs_rc)
 Sets response code on VS context. More...
 
enum stir_shaken_failure_action_enum ast_stir_shaken_vs_get_failure_action (struct ast_stir_shaken_vs_ctx *ctx)
 Get failure_action from context. More...
 
int ast_stir_shaken_vs_get_use_rfc9410_responses (struct ast_stir_shaken_vs_ctx *ctx)
 Get use_rfc9410_responses from context. More...
 
enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_verify (struct ast_stir_shaken_vs_ctx *ctx)
 Perform incoming call verification. More...
 
static enum ast_stir_shaken_vs_response_code check_cert (struct ast_stir_shaken_vs_ctx *ctx)
 
static enum ast_stir_shaken_vs_response_code check_date_header (struct ast_stir_shaken_vs_ctx *ctx)
 
static enum ast_stir_shaken_vs_response_code check_tn_auth_list (struct ast_stir_shaken_vs_ctx *ctx)
 
static int check_x5u_url (struct ast_stir_shaken_vs_ctx *ctx, const char *x5u)
 
static void cleanup_cert_from_astdb_and_fs (struct ast_stir_shaken_vs_ctx *ctx)
 
static void ctx_destructor (void *obj)
 
static enum ast_stir_shaken_vs_response_code ctx_populate (struct ast_stir_shaken_vs_ctx *ctx)
 
static int is_cert_cache_entry_expired (char *expiration)
 
static enum ast_stir_shaken_vs_response_code retrieve_cert_from_cache (struct ast_stir_shaken_vs_ctx *ctx)
 
static enum ast_stir_shaken_vs_response_code retrieve_cert_from_url (struct ast_stir_shaken_vs_ctx *ctx)
 
static enum ast_stir_shaken_vs_response_code retrieve_verification_cert (struct ast_stir_shaken_vs_ctx *ctx)
 
int vs_load ()
 Load the stir/shaken verification service. More...
 
int vs_reload ()
 Reload the stir/shaken verification service. More...
 
const char * vs_response_code_to_str (enum ast_stir_shaken_vs_response_code vs_rc)
 Return string version of VS response code. More...
 
int vs_unload ()
 Unload the stir/shaken verification service. More...
 

Variables

static regex_t url_match_regex
 
static const char * vs_rc_map []
 

Macro Definition Documentation

◆ _TRACE_PREFIX_

#define _TRACE_PREFIX_   "v",__LINE__, ""

Definition at line 27 of file verification.c.

◆ ASN1_TAG_TNAUTH_SPC

#define ASN1_TAG_TNAUTH_SPC   0

Definition at line 247 of file verification.c.

◆ ASN1_TAG_TNAUTH_TN

#define ASN1_TAG_TNAUTH_TN   2

Definition at line 249 of file verification.c.

◆ ASN1_TAG_TNAUTH_TN_RANGE

#define ASN1_TAG_TNAUTH_TN_RANGE   1

Definition at line 248 of file verification.c.

◆ AST_DB_FAMILY

#define AST_DB_FAMILY   "STIR_SHAKEN"

Definition at line 47 of file verification.c.

◆ BEGIN_CERTIFICATE_STR

#define BEGIN_CERTIFICATE_STR   "-----BEGIN CERTIFICATE-----"

Definition at line 52 of file verification.c.

◆ DUMP_X5U_MATCH

#define DUMP_X5U_MATCH ( )

Definition at line 811 of file verification.c.

◆ FULL_URL_REGEX

#define FULL_URL_REGEX   "^([a-zA-Z]+)://(([^@]+@[^:]+):)?(([^:/?]+)|([0-9.]+)|([[][0-9a-fA-F:]+[]]))(:([0-9]+))?(/([^#\\?]+))?(\\?([^#]+))?(#(.*))?"

Definition at line 772 of file verification.c.

◆ FULL_URL_REGEX_GROUPS

#define FULL_URL_REGEX_GROUPS   15

Definition at line 773 of file verification.c.

◆ get_match_string

#define get_match_string (   __x5u,
  __pmatch,
  __i 
)

Definition at line 799 of file verification.c.

◆ IS_GET_OBJ_ERR

#define IS_GET_OBJ_ERR (   ret)    (ret & 0x80)

Definition at line 251 of file verification.c.

◆ URL_MATCH_FRAGMENT

#define URL_MATCH_FRAGMENT   15

Definition at line 797 of file verification.c.

◆ URL_MATCH_HOST

#define URL_MATCH_HOST   4

Definition at line 793 of file verification.c.

◆ URL_MATCH_PATH

#define URL_MATCH_PATH   11

Definition at line 795 of file verification.c.

◆ URL_MATCH_PORT

#define URL_MATCH_PORT   9

Definition at line 794 of file verification.c.

◆ URL_MATCH_QUERY

#define URL_MATCH_QUERY   13

Definition at line 796 of file verification.c.

◆ URL_MATCH_SCHEME

#define URL_MATCH_SCHEME   1

Definition at line 791 of file verification.c.

◆ URL_MATCH_USERPASS

#define URL_MATCH_USERPASS   3

Definition at line 792 of file verification.c.

Function Documentation

◆ add_cert_expiration_to_astdb()

static int add_cert_expiration_to_astdb ( struct ast_stir_shaken_vs_ctx cert,
const char *  cache_control_header,
const char *  expires_header 
)
static

Definition at line 112 of file verification.c.

114{
116
117 char time_buf[32];
118 time_t current_time = time(NULL);
119 time_t max_age_hdr = 0;
120 time_t expires_hdr = 0;
121 ASN1_TIME *notAfter = NULL;
122 time_t cert_expires = 0;
123 time_t config_expires = 0;
124 time_t expires = 0;
125 int rc = 0;
126
127 config_expires = current_time + cfg->vcfg_common.max_cache_entry_age;
128
129 if (!ast_strlen_zero(cache_control_header)) {
130 char *str_max_age;
131
132 str_max_age = strstr(cache_control_header, "s-maxage");
133 if (!str_max_age) {
134 str_max_age = strstr(cache_control_header, "max-age");
135 }
136
137 if (str_max_age) {
138 unsigned int m;
139 char *equal = strchr(str_max_age, '=');
140 if (equal && !ast_str_to_uint(equal + 1, &m)) {
141 max_age_hdr = current_time + m;
142 }
143 }
144 }
145
146 if (!ast_strlen_zero(expires_header)) {
147 struct ast_tm expires_time;
148
149 ast_strptime(expires_header, "%a, %d %b %Y %T %z", &expires_time);
150 expires_time.tm_isdst = -1;
151 expires_hdr = ast_mktime(&expires_time, "GMT").tv_sec;
152 }
153
154 notAfter = X509_get_notAfter(cert->xcert);
155 cert_expires = crypto_asn_time_as_time_t(notAfter);
156
157 /*
158 * ATIS-1000074 says:
159 * The STI-VS shall implement the cache behavior described in
160 * [Ref 10]. If the HTTP response does not include any recognized
161 * caching directives or indicates caching for less than 24 hours,
162 * then the STI-VS should cache the HTTP response for 24 hours.
163 *
164 * Basically, they're saying "cache for 24 hours unless the HTTP
165 * response says to cache for longer." Instead of the fixed 24
166 * hour minumum, however, we'll use max_cache_entry_age instead.
167 *
168 * We got all the possible values of expires so let's find the
169 * highest value greater than the configured max_cache_entry_age.
170 */
171
172 /* The default */
173 expires = config_expires;
174
175 if (max_age_hdr > expires) {
176 expires = max_age_hdr;
177 }
178
179 if (expires_hdr > expires) {
180 expires = expires_hdr;
181 }
182
183 /*
184 * However... Don't cache for longer than the
185 * certificate is actually valid.
186 */
187 if (cert_expires && cert_expires < expires) {
188 expires = cert_expires;
189 }
190
191 snprintf(time_buf, sizeof(time_buf), "%ld", expires);
192
193 rc = ast_db_put(cert->hash_family, "expiration", time_buf);
194 if (rc == 0) {
195 strcpy(cert->expiration, time_buf); /* safe */
196 }
197
198 return rc;
199}
int ast_db_put(const char *family, const char *key, const char *value)
Store value addressed by family/key.
Definition: main/db.c:342
#define ao2_cleanup(obj)
Definition: astobj2.h:1934
struct verification_cfg * vs_get_cfg(void)
int ast_str_to_uint(const char *str, unsigned int *res)
Convert the given string to an unsigned integer.
Definition: conversions.c:56
time_t crypto_asn_time_as_time_t(ASN1_TIME *at)
Return a time_t for an ASN1_TIME.
Definition: crypto_utils.c:431
struct timeval ast_mktime(struct ast_tm *const tmp, const char *zone)
Timezone-independent version of mktime(3).
Definition: localtime.c:2357
char * ast_strptime(const char *s, const char *format, struct ast_tm *tm)
Special version of strptime(3) which places the answer in the common structure ast_tm....
Definition: localtime.c:2550
#define NULL
Definition: resample.c:96
static force_inline int attribute_pure ast_strlen_zero(const char *s)
Definition: strings.h:65
const ast_string_field hash_family
Definition: verification.h:39
#define RAII_VAR(vartype, varname, initval, dtor)
Declare a variable that will call a destructor function when it goes out of scope.
Definition: utils.h:941

References ao2_cleanup, ast_db_put(), ast_mktime(), ast_str_to_uint(), ast_strlen_zero(), ast_strptime(), crypto_asn_time_as_time_t(), ast_stir_shaken_vs_ctx::expiration, ast_stir_shaken_vs_ctx::hash_family, NULL, RAII_VAR, ast_tm::tm_isdst, vs_get_cfg(), and ast_stir_shaken_vs_ctx::xcert.

Referenced by add_cert_key_to_astdb().

◆ add_cert_key_to_astdb()

static int add_cert_key_to_astdb ( struct ast_stir_shaken_vs_ctx cert,
const char *  cache_control_hdr,
const char *  expires_hdr 
)
static

Definition at line 201 of file verification.c.

203{
204 int rc = 0;
205
206 rc = ast_db_put(cert->url_family, cert->public_url, cert->hash);
207 if (rc) {
208 return rc;
209 }
210 rc = ast_db_put(cert->hash_family, "path", cert->filename);
211 if (rc) {
212 ast_db_del(cert->url_family, cert->public_url);
213 return rc;
214 }
215
216 rc = add_cert_expiration_to_astdb(cert, cache_control_hdr, expires_hdr);
217 if (rc) {
218 ast_db_del(cert->url_family, cert->public_url);
219 ast_db_del(cert->hash_family, "path");
220 }
221
222 return rc;
223}
int ast_db_del(const char *family, const char *key)
Delete entry in astdb.
Definition: main/db.c:476
const ast_string_field public_url
Definition: verification.h:39
const ast_string_field hash
Definition: verification.h:39
const ast_string_field filename
Definition: verification.h:39
const ast_string_field url_family
Definition: verification.h:39
static int add_cert_expiration_to_astdb(struct ast_stir_shaken_vs_ctx *cert, const char *cache_control_header, const char *expires_header)
Definition: verification.c:112

References add_cert_expiration_to_astdb(), ast_db_del(), ast_db_put(), ast_stir_shaken_vs_ctx::filename, ast_stir_shaken_vs_ctx::hash, ast_stir_shaken_vs_ctx::hash_family, ast_stir_shaken_vs_ctx::public_url, and ast_stir_shaken_vs_ctx::url_family.

Referenced by retrieve_cert_from_url().

◆ ast_stir_shaken_vs_ctx_add_date_hdr()

enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_add_date_hdr ( struct ast_stir_shaken_vs_ctx ctx,
const char *  date_hdr 
)

Add the received Date header value to the VS context.

Parameters
ctxVS context
date_hdrDate header value
Return values
AST_STIR_SHAKEN_VS_SUCCESSif successful
OtherAST_STIR_SHAKEN_VS errors.

Definition at line 613 of file verification.c.

615{
616 return ast_string_field_set(ctx, date_hdr, date_hdr) == 0 ?
618}
@ AST_STIR_SHAKEN_VS_SUCCESS
@ AST_STIR_SHAKEN_VS_INTERNAL_ERROR
#define ast_string_field_set(x, field, data)
Set a field to a simple string value.
Definition: stringfields.h:521

References AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, and ast_string_field_set.

Referenced by stir_shaken_incoming_request().

◆ ast_stir_shaken_vs_ctx_add_identity_hdr()

enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_add_identity_hdr ( struct ast_stir_shaken_vs_ctx ctx,
const char *  identity_hdr 
)

Add the received Identity header value to the VS context.

Parameters
ctxVS context
identity_hdrIdentity header value
Return values
AST_STIR_SHAKEN_VS_SUCCESSif successful
OtherAST_STIR_SHAKEN_VS errors.

Definition at line 605 of file verification.c.

607{
608 return ast_string_field_set(ctx, identity_hdr, identity_hdr) == 0 ?
610}

References AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, and ast_string_field_set.

Referenced by stir_shaken_incoming_request().

◆ ast_stir_shaken_vs_ctx_create()

enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_ctx_create ( const char *  caller_id,
struct ast_channel chan,
const char *  profile_name,
const char *  tag,
struct ast_stir_shaken_vs_ctx **  ctxout 
)

Create Verification Service context.

Parameters
caller_idIncoming caller id
chanIncoming channel
profile_nameThe profile name on the endpoint May be NULL.
endpoint_behaviorBehavior associated to the specific endpoint
tagIdentifying string to output in log and trace messages.
ctxoutReceives a pointer to the newly created context The caller must release with ao2_ref or ao2_cleanup.
Return values
AST_STIR_SHAKEN_VS_SUCCESSif successful.
AST_STIR_SHAKEN_VS_DISABLEDif verification is disabled by the endpoint itself, the profile or globally.
OtherAST_STIR_SHAKEN_VS errors.

Definition at line 651 of file verification.c.

654{
656 RAII_VAR(struct profile_cfg *, profile, NULL, ao2_cleanup);
658 RAII_VAR(char *, canon_caller_id , canonicalize_tn_alloc(caller_id), ast_free);
659
660 const char *t = S_OR(tag, S_COR(chan, ast_channel_name(chan), ""));
661 SCOPE_ENTER(3, "%s: Enter\n", t);
662
663 if (ast_strlen_zero(tag)) {
665 LOG_ERROR, "%s: Must provide tag\n", t);
666 }
667
668 if (ast_strlen_zero(canon_caller_id)) {
670 LOG_ERROR, "%s: Must provide caller_id\n", t);
671 }
672
673 if (ast_strlen_zero(profile_name)) {
675 "%s: Disabled due to missing profile name\n", t);
676 }
677
678 vs = vs_get_cfg();
679 if (vs->global_disable) {
681 "%s: Globally disabled\n", t);
682 }
683
684 profile = eprofile_get_cfg(profile_name);
685 if (!profile) {
687 LOG_ERROR, "%s: No profile for profile name '%s'. Call will continue\n", tag,
688 profile_name);
689 }
690
691 if (!PROFILE_ALLOW_VERIFY(profile)) {
693 "%s: Disabled by profile\n", t);
694 }
695
696 ctx = ao2_alloc_options(sizeof(*ctx), ctx_destructor,
698 if (!ctx) {
700 }
701 if (ast_string_field_init(ctx, 1024) != 0) {
703 }
704
705 if (ast_string_field_set(ctx, tag, tag) != 0) {
707 }
708
709 ctx->chan = chan;
710 if (ast_string_field_set(ctx, caller_id, canon_caller_id) != 0) {
712 }
713
714 /* Transfer references to ctx */
715 ctx->eprofile = profile;
716 profile = NULL;
717
718 ao2_ref(ctx, +1);
719 *ctxout = ctx;
721}
#define ast_free(a)
Definition: astmm.h:180
@ AO2_ALLOC_OPT_LOCK_NOLOCK
Definition: astobj2.h:367
#define ao2_ref(o, delta)
Reference/unreference an object and return the old refcount.
Definition: astobj2.h:459
#define ao2_alloc_options(data_size, destructor_fn, options)
Definition: astobj2.h:404
const char * ast_channel_name(const struct ast_channel *chan)
char * canonicalize_tn_alloc(const char *tn)
Canonicalize a TN into nre buffer.
struct profile_cfg * eprofile_get_cfg(const char *id)
#define PROFILE_ALLOW_VERIFY(__profile)
#define SCOPE_EXIT_RTN_VALUE(__return_value,...)
#define SCOPE_EXIT_LOG_RTN_VALUE(__value, __log_level,...)
#define SCOPE_ENTER(level,...)
#define LOG_ERROR
@ AST_STIR_SHAKEN_VS_INVALID_ARGUMENTS
@ AST_STIR_SHAKEN_VS_DISABLED
#define ast_string_field_init(x, size)
Initialize a field pool and fields.
Definition: stringfields.h:359
#define S_OR(a, b)
returns the equivalent of logic or for strings: first one if not empty, otherwise second one.
Definition: strings.h:80
#define S_COR(a, b, c)
returns the equivalent of logic or for strings, with an additional boolean check: second one if not e...
Definition: strings.h:87
Profile configuration for stir/shaken.
static void ctx_destructor(void *obj)
Definition: verification.c:640

References AO2_ALLOC_OPT_LOCK_NOLOCK, ao2_alloc_options, ao2_cleanup, ao2_ref, ast_channel_name(), ast_free, AST_STIR_SHAKEN_VS_DISABLED, AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_INVALID_ARGUMENTS, AST_STIR_SHAKEN_VS_SUCCESS, ast_string_field_init, ast_string_field_set, ast_strlen_zero(), ast_stir_shaken_vs_ctx::caller_id, canonicalize_tn_alloc(), ast_stir_shaken_vs_ctx::chan, ctx_destructor(), eprofile_get_cfg(), LOG_ERROR, NULL, PROFILE_ALLOW_VERIFY, RAII_VAR, S_COR, S_OR, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, and vs_get_cfg().

Referenced by stir_shaken_incoming_request().

◆ ast_stir_shaken_vs_ctx_set_response_code()

void ast_stir_shaken_vs_ctx_set_response_code ( struct ast_stir_shaken_vs_ctx ctx,
enum ast_stir_shaken_vs_response_code  vs_rc 
)

Sets response code on VS context.

Parameters
ctxVS context
vs_rcast_stir_shaken_vs_response_code to set

Definition at line 633 of file verification.c.

636{
637 ctx->failure_reason = vs_rc;
638}
enum ast_stir_shaken_vs_response_code failure_reason
Definition: verification.h:48

References ast_stir_shaken_vs_ctx::failure_reason.

Referenced by process_failure().

◆ ast_stir_shaken_vs_get_failure_action()

enum stir_shaken_failure_action_enum ast_stir_shaken_vs_get_failure_action ( struct ast_stir_shaken_vs_ctx ctx)

Get failure_action from context.

Parameters
ctxVS context
Return values
ast_stir_shaken_failure_action

Definition at line 621 of file verification.c.

623{
625}
struct profile_cfg * eprofile
Definition: verification.h:40
struct verification_cfg_common vcfg_common
enum stir_shaken_failure_action_enum stir_shaken_failure_action

References ast_stir_shaken_vs_ctx::eprofile, verification_cfg_common::stir_shaken_failure_action, and profile_cfg::vcfg_common.

Referenced by process_failure().

◆ ast_stir_shaken_vs_get_use_rfc9410_responses()

int ast_stir_shaken_vs_get_use_rfc9410_responses ( struct ast_stir_shaken_vs_ctx ctx)

Get use_rfc9410_responses from context.

Parameters
ctxVS context
Return values
1if true
0if false

Definition at line 627 of file verification.c.

629{
631}
enum use_rfc9410_responses_enum use_rfc9410_responses

References ast_stir_shaken_vs_ctx::eprofile, verification_cfg_common::use_rfc9410_responses, and profile_cfg::vcfg_common.

Referenced by process_failure().

◆ ast_stir_shaken_vs_verify()

enum ast_stir_shaken_vs_response_code ast_stir_shaken_vs_verify ( struct ast_stir_shaken_vs_ctx ctx)

Perform incoming call verification.

Parameters
ctxVS context
Return values
AST_STIR_SHAKEN_AS_SUCCESSif successful
OtherAST_STIR_SHAKEN_AS errors.

Definition at line 883 of file verification.c.

884{
885 RAII_VAR(char *, jwt_encoded, NULL, ast_free);
886 RAII_VAR(jwt_t *, jwt, NULL, jwt_free);
887 RAII_VAR(struct ast_json *, grants, NULL, ast_json_unref);
888 char *p = NULL;
889 char *grants_str = NULL;
890 const char *x5u;
891 const char *ppt_header = NULL;
892 const char *grant = NULL;
893 time_t now_s = time(NULL);
894 time_t iat;
895 struct ast_json *grant_obj = NULL;
896 int len;
897 int rc;
899 SCOPE_ENTER(3, "%s: Verifying\n", ctx ? ctx->tag : "NULL");
900
901 if (!ctx) {
903 "%s: No context object!\n", "NULL");
904 }
905
906 if (ast_strlen_zero(ctx->identity_hdr)) {
908 "%s: No identity header in ctx\n", ctx->tag);
909 }
910
911 p = strchr(ctx->identity_hdr, ';');
912 len = p - ctx->identity_hdr + 1;
913 jwt_encoded = ast_malloc(len);
914 if (!jwt_encoded) {
916 "%s: Failed to allocate memory for encoded jwt\n", ctx->tag);
917 }
918
919 memcpy(jwt_encoded, ctx->identity_hdr, len);
920 jwt_encoded[len - 1] = '\0';
921
922 jwt_decode(&jwt, jwt_encoded, NULL, 0);
923
924 ppt_header = jwt_get_header(jwt, "ppt");
925 if (!ppt_header || strcmp(ppt_header, STIR_SHAKEN_PPT)) {
928 }
929
930 vs_rc = check_date_header(ctx);
931 if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
933 "%s: Date header verification failed\n", ctx->tag);
934 }
935
936 x5u = jwt_get_header(jwt, "x5u");
937 if (ast_strlen_zero(x5u)) {
939 "%s: No x5u in Identity header\n", ctx->tag);
940 }
941
942 rc = check_x5u_url(ctx, x5u);
943 if (rc != AST_STIR_SHAKEN_VS_SUCCESS) {
945 "%s: x5u URL verification failed\n", ctx->tag);
946 }
947
948 ast_trace(3, "%s: Decoded enough to get x5u: '%s'\n", ctx->tag, x5u);
949 if (ast_string_field_set(ctx, public_url, x5u) != 0) {
951 "%s: Failed to set public_url '%s'\n", ctx->tag, x5u);
952 }
953
954 iat = jwt_get_grant_int(jwt, "iat");
955 if (iat == 0) {
957 "%s: No 'iat' in Identity header\n", ctx->tag);
958 }
959 ast_trace(1, "date_hdr: %zu iat: %zu diff: %zu\n",
960 ctx->date_hdr_time, iat, ctx->date_hdr_time - iat);
961 if (iat + ctx->eprofile->vcfg_common.max_iat_age < now_s) {
963 "%s: iat %ld older than %u seconds\n", ctx->tag,
964 iat, ctx->eprofile->vcfg_common.max_iat_age);
965 }
966 ctx->validity_check_time = iat;
967
968 vs_rc = ctx_populate(ctx);
969 if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
971 "%s: Unable to populate ctx\n", ctx->tag);
972 }
973
974 vs_rc = retrieve_verification_cert(ctx);
975 if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
977 "%s: Could not get valid cert from '%s'\n", ctx->tag, ctx->public_url);
978 }
979
980 jwt_free(jwt);
981 jwt = NULL;
982
983 rc = jwt_decode(&jwt, jwt_encoded, ctx->raw_key, ctx->raw_key_len);
984 if (rc != 0) {
986 LOG_ERROR, "%s: Signature validation failed for '%s'\n",
987 ctx->tag, ctx->public_url);
988 }
989
990 ast_trace(1, "%s: Decoding succeeded\n", ctx->tag);
991
992 ppt_header = jwt_get_header(jwt, "alg");
993 if (!ppt_header || strcmp(ppt_header, STIR_SHAKEN_ENCRYPTION_ALGORITHM)) {
995 "%s: %s\n", ctx->tag,
997 }
998
999 ppt_header = jwt_get_header(jwt, "ppt");
1000 if (!ppt_header || strcmp(ppt_header, STIR_SHAKEN_PPT)) {
1002 "%s: %s\n", ctx->tag,
1004 }
1005
1006 ppt_header = jwt_get_header(jwt, "typ");
1007 if (!ppt_header || strcmp(ppt_header, STIR_SHAKEN_TYPE)) {
1009 "%s: %s\n", ctx->tag,
1011 }
1012
1013 grants_str = jwt_get_grants_json(jwt, NULL);
1014 if (ast_strlen_zero(grants_str)) {
1016 "%s: %s\n", ctx->tag,
1018 }
1019 ast_trace(1, "grants: %s\n", grants_str);
1020 grants = ast_json_load_string(grants_str, NULL);
1021 ast_std_free(grants_str);
1022 if (!grants) {
1024 "%s: %s\n", ctx->tag,
1026 }
1027
1028 grant = ast_json_object_string_get(grants, "attest");
1029 if (ast_strlen_zero(grant)) {
1031 "%s: No 'attest' in Identity header\n", ctx->tag);
1032 }
1033 if (grant[0] < 'A' || grant[0] > 'C') {
1035 "%s: Invalid attest value '%s'\n", ctx->tag, grant);
1036 }
1037 ast_string_field_set(ctx, attestation, grant);
1038 ast_trace(1, "got attest: %s\n", grant);
1039
1040 grant_obj = ast_json_object_get(grants, "dest");
1041 if (!grant_obj) {
1043 "%s: No 'dest' in Identity header\n", ctx->tag);
1044 }
1045 if (TRACE_ATLEAST(3)) {
1046 char *otn = ast_json_dump_string(grant_obj);
1047 ast_trace(1, "got dest: %s\n", otn);
1048 ast_json_free(otn);
1049 }
1050
1051 grant_obj = ast_json_object_get(grants, "orig");
1052 if (!grant_obj) {
1054 "%s: No 'orig' in Identity header\n", ctx->tag);
1055 }
1056 if (TRACE_ATLEAST(3)) {
1057 char *otn = ast_json_dump_string(grant_obj);
1058 ast_trace(1, "got orig: %s\n", otn);
1059 ast_json_free(otn);
1060 }
1061 grant = ast_json_object_string_get(grant_obj, "tn");
1062 if (!grant) {
1064 "%s: No 'orig.tn' in Indentity header\n", ctx->tag);
1065 }
1066 ast_string_field_set(ctx, orig_tn, grant);
1067 if (strcmp(ctx->caller_id, ctx->orig_tn) != 0) {
1069 "%s: Mismatched cid '%s' and orig_tn '%s'\n", ctx->tag,
1070 ctx->caller_id, grant);
1071 }
1072
1073 grant = ast_json_object_string_get(grants, "origid");
1074 if (ast_strlen_zero(grant)) {
1076 "%s: No 'origid' in Identity header\n", ctx->tag);
1077 }
1078
1080 "%s: verification succeeded\n", ctx->tag);
1081}
void ast_std_free(void *ptr)
Definition: astmm.c:1734
#define ast_malloc(len)
A wrapper for malloc()
Definition: astmm.h:191
static int len(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t buflen)
#define TRACE_ATLEAST(level)
#define ast_trace(level,...)
#define ast_json_object_string_get(object, key)
Get a string field from a JSON object.
Definition: json.h:600
void ast_json_unref(struct ast_json *value)
Decrease refcount on value. If refcount reaches zero, value is freed.
Definition: json.c:73
void ast_json_free(void *p)
Asterisk's custom JSON allocator. Exposed for use by unit tests.
Definition: json.c:52
#define ast_json_dump_string(root)
Encode a JSON value to a compact string.
Definition: json.h:810
struct ast_json * ast_json_load_string(const char *input, struct ast_json_error *error)
Parse null terminated string into a JSON object or array.
Definition: json.c:567
struct ast_json * ast_json_object_get(struct ast_json *object, const char *key)
Get a field from a JSON object.
Definition: json.c:407
ast_stir_shaken_vs_response_code
@ AST_STIR_SHAKEN_VS_INVALID_OR_NO_ATTEST
@ AST_STIR_SHAKEN_VS_INVALID_OR_NO_TYP
@ AST_STIR_SHAKEN_VS_CID_ORIG_TN_MISMATCH
@ AST_STIR_SHAKEN_VS_NO_DEST_TN
@ AST_STIR_SHAKEN_VS_IAT_EXPIRED
@ AST_STIR_SHAKEN_VS_SIGNATURE_VALIDATION
@ AST_STIR_SHAKEN_VS_INVALID_OR_NO_ALG
@ AST_STIR_SHAKEN_VS_NO_ORIGID
@ AST_STIR_SHAKEN_VS_NO_IAT
@ AST_STIR_SHAKEN_VS_NO_ORIG_TN
@ AST_STIR_SHAKEN_VS_INVALID_OR_NO_PPT
@ AST_STIR_SHAKEN_VS_INVALID_OR_NO_GRANTS
@ AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U
#define STIR_SHAKEN_ENCRYPTION_ALGORITHM
Definition: stir_shaken.h:28
#define STIR_SHAKEN_PPT
Definition: stir_shaken.h:29
#define STIR_SHAKEN_TYPE
Definition: stir_shaken.h:30
Abstract JSON element (object, array, string, int, ...).
const ast_string_field orig_tn
Definition: verification.h:39
unsigned char * raw_key
Definition: verification.h:45
const ast_string_field tag
Definition: verification.h:39
const ast_string_field identity_hdr
Definition: verification.h:39
const ast_string_field caller_id
Definition: verification.h:39
static int check_x5u_url(struct ast_stir_shaken_vs_ctx *ctx, const char *x5u)
Definition: verification.c:825
const char * vs_response_code_to_str(enum ast_stir_shaken_vs_response_code vs_rc)
Return string version of VS response code.
Definition: verification.c:90
static enum ast_stir_shaken_vs_response_code retrieve_verification_cert(struct ast_stir_shaken_vs_ctx *ctx)
Definition: verification.c:576
static enum ast_stir_shaken_vs_response_code check_date_header(struct ast_stir_shaken_vs_ctx *ctx)
Definition: verification.c:723
static enum ast_stir_shaken_vs_response_code ctx_populate(struct ast_stir_shaken_vs_ctx *ctx)
Definition: verification.c:548

References ast_free, ast_json_dump_string, ast_json_free(), ast_json_load_string(), ast_json_object_get(), ast_json_object_string_get, ast_json_unref(), ast_malloc, ast_std_free(), AST_STIR_SHAKEN_VS_CID_ORIG_TN_MISMATCH, AST_STIR_SHAKEN_VS_IAT_EXPIRED, AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_INVALID_OR_NO_ALG, AST_STIR_SHAKEN_VS_INVALID_OR_NO_ATTEST, AST_STIR_SHAKEN_VS_INVALID_OR_NO_GRANTS, AST_STIR_SHAKEN_VS_INVALID_OR_NO_PPT, AST_STIR_SHAKEN_VS_INVALID_OR_NO_TYP, AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U, AST_STIR_SHAKEN_VS_NO_DEST_TN, AST_STIR_SHAKEN_VS_NO_IAT, AST_STIR_SHAKEN_VS_NO_ORIG_TN, AST_STIR_SHAKEN_VS_NO_ORIGID, AST_STIR_SHAKEN_VS_SIGNATURE_VALIDATION, AST_STIR_SHAKEN_VS_SUCCESS, ast_string_field_set, ast_strlen_zero(), ast_trace, ast_stir_shaken_vs_ctx::caller_id, check_date_header(), check_x5u_url(), ctx_populate(), ast_stir_shaken_vs_ctx::date_hdr_time, ast_stir_shaken_vs_ctx::eprofile, ast_stir_shaken_vs_ctx::identity_hdr, len(), LOG_ERROR, verification_cfg_common::max_iat_age, NULL, ast_stir_shaken_vs_ctx::orig_tn, ast_stir_shaken_vs_ctx::public_url, RAII_VAR, ast_stir_shaken_vs_ctx::raw_key, ast_stir_shaken_vs_ctx::raw_key_len, retrieve_verification_cert(), SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, STIR_SHAKEN_ENCRYPTION_ALGORITHM, STIR_SHAKEN_PPT, STIR_SHAKEN_TYPE, ast_stir_shaken_vs_ctx::tag, TRACE_ATLEAST, ast_stir_shaken_vs_ctx::validity_check_time, profile_cfg::vcfg_common, and vs_response_code_to_str().

Referenced by stir_shaken_incoming_request().

◆ check_cert()

static enum ast_stir_shaken_vs_response_code check_cert ( struct ast_stir_shaken_vs_ctx ctx)
static

Definition at line 326 of file verification.c.

328{
329 RAII_VAR(char *, CN, NULL, ast_free);
330 int res = 0;
331 const char *err_msg;
332 SCOPE_ENTER(3, "%s: Validating cert '%s'\n", ctx->tag, ctx->public_url);
333
334 CN = crypto_get_cert_subject(ctx->xcert, "CN");
335 if (!CN) {
338 LOG_ERROR, "%s: Cert '%s' has no commonName(CN) in Subject '%s'\n",
339 ctx->tag, ctx->public_url, CN);
340 }
341
342 res = ast_string_field_set(ctx, cert_cn, CN);
343 if (res != 0) {
345 }
346
347 ast_trace(3,"%s: Checking ctx against CA ctx\n", ctx->tag);
348 res = crypto_is_cert_trusted(ctx->eprofile->vcfg_common.tcs, ctx->xcert, &err_msg);
349 if (!res) {
351 LOG_ERROR, "%s: Cert '%s' not trusted: %s\n",
352 ctx->tag, ctx->public_url, err_msg);
353 }
354
355 ast_trace(3,"%s: Attempting to get the raw pubkey\n", ctx->tag);
357 &ctx->raw_key);
358 if (ctx->raw_key_len <= 0) {
360 LOG_ERROR, "%s: Unable to extract raw public key from '%s'\n",
361 ctx->tag, ctx->public_url);
362 }
363
364 ast_trace(3,"%s: Checking cert '%s' validity dates\n",
365 ctx->tag, ctx->public_url);
368 LOG_ERROR, "%s: Cert '%s' dates not valid\n",
369 ctx->tag, ctx->public_url);
370 }
371
373 "%s: Cert '%s' with SPC: %s CN: %s is valid\n",
374 ctx->tag, ctx->public_url, ctx->cert_spc, ctx->cert_cn);
375}
int crypto_is_cert_trusted(struct crypto_cert_store *store, X509 *cert, const char **err_msg)
Check if the cert is trusted.
Definition: crypto_utils.c:402
int crypto_get_raw_pubkey_from_cert(X509 *cert, unsigned char **buffer)
Retrieve RAW public key from cert.
Definition: crypto_utils.c:279
char * crypto_get_cert_subject(X509 *cert, const char *short_name)
Returns the Subject (or component of Subject) from a certificate.
Definition: crypto_utils.c:448
int crypto_is_cert_time_valid(X509 *cert, time_t reftime)
Check if the reftime is within the cert's valid dates.
Definition: crypto_utils.c:383
@ AST_STIR_SHAKEN_VS_CERT_DATE_INVALID
@ AST_STIR_SHAKEN_VS_NO_RAW_KEY
@ AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID
@ AST_STIR_SHAKEN_VS_CERT_NOT_TRUSTED
const ast_string_field cert_cn
Definition: verification.h:39
const ast_string_field cert_spc
Definition: verification.h:39
struct crypto_cert_store * tcs
static enum ast_stir_shaken_vs_response_code check_tn_auth_list(struct ast_stir_shaken_vs_ctx *ctx)
Definition: verification.c:254

References ast_free, AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID, AST_STIR_SHAKEN_VS_CERT_DATE_INVALID, AST_STIR_SHAKEN_VS_CERT_NOT_TRUSTED, AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_NO_RAW_KEY, ast_string_field_set, ast_trace, ast_stir_shaken_vs_ctx::cert_cn, ast_stir_shaken_vs_ctx::cert_spc, check_tn_auth_list(), crypto_get_cert_subject(), crypto_get_raw_pubkey_from_cert(), crypto_is_cert_time_valid(), crypto_is_cert_trusted(), ast_stir_shaken_vs_ctx::eprofile, LOG_ERROR, NULL, ast_stir_shaken_vs_ctx::public_url, RAII_VAR, ast_stir_shaken_vs_ctx::raw_key, ast_stir_shaken_vs_ctx::raw_key_len, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, verification_cfg_common::tcs, ast_stir_shaken_vs_ctx::validity_check_time, profile_cfg::vcfg_common, and ast_stir_shaken_vs_ctx::xcert.

Referenced by retrieve_cert_from_cache(), and retrieve_cert_from_url().

◆ check_date_header()

static enum ast_stir_shaken_vs_response_code check_date_header ( struct ast_stir_shaken_vs_ctx ctx)
static

Definition at line 723 of file verification.c.

725{
726 struct ast_tm date_hdr_tm;
727 struct timeval date_hdr_timeval;
728 struct timeval current_timeval;
729 char *remainder;
730 char timezone[80] = { 0 };
731 int64_t time_diff;
732 SCOPE_ENTER(3, "%s: Checking date header: '%s'\n",
733 ctx->tag, ctx->date_hdr);
734
735 if (!(remainder = ast_strptime(ctx->date_hdr, "%a, %d %b %Y %T", &date_hdr_tm))) {
737 LOG_ERROR, "%s: Failed to parse: '%s'\n",
738 ctx->tag, ctx->date_hdr);
739 }
740
741 sscanf(remainder, "%79s", timezone);
742
743 if (ast_strlen_zero(timezone)) {
745 LOG_ERROR, "%s: A timezone is required: '%s'\n",
746 ctx->tag, ctx->date_hdr);
747 }
748
749 date_hdr_timeval = ast_mktime(&date_hdr_tm, timezone);
750 ctx->date_hdr_time = date_hdr_timeval.tv_sec;
751 current_timeval = ast_tvnow();
752
753 time_diff = ast_tvdiff_ms(current_timeval, date_hdr_timeval);
754 ast_trace(3, "%zu %zu %zu %d\n", current_timeval.tv_sec,
755 date_hdr_timeval.tv_sec,
756 (current_timeval.tv_sec - date_hdr_timeval.tv_sec), (int)time_diff);
757 if (time_diff < 0) {
758 /* An INVITE from the future! */
760 LOG_ERROR, "%s: Future date: '%s'\n",
761 ctx->tag, ctx->date_hdr);
762 } else if (time_diff > (ctx->eprofile->vcfg_common.max_date_header_age * 1000)) {
764 LOG_ERROR, "%s: More than %u seconds old: '%s'\n",
766 }
767
769 "%s: Success: '%s'\n", ctx->tag, ctx->date_hdr);
770}
@ AST_STIR_SHAKEN_VS_DATE_HDR_EXPIRED
@ AST_STIR_SHAKEN_VS_DATE_HDR_PARSE_FAILURE
const ast_string_field date_hdr
Definition: verification.h:39
unsigned int max_date_header_age
int64_t ast_tvdiff_ms(struct timeval end, struct timeval start)
Computes the difference (in milliseconds) between two struct timeval instances.
Definition: time.h:107
struct timeval ast_tvnow(void)
Returns current timeval. Meant to replace calls to gettimeofday().
Definition: time.h:159

References ast_mktime(), AST_STIR_SHAKEN_VS_DATE_HDR_EXPIRED, AST_STIR_SHAKEN_VS_DATE_HDR_PARSE_FAILURE, AST_STIR_SHAKEN_VS_SUCCESS, ast_strlen_zero(), ast_strptime(), ast_trace, ast_tvdiff_ms(), ast_tvnow(), ast_stir_shaken_vs_ctx::date_hdr, ast_stir_shaken_vs_ctx::date_hdr_time, ast_stir_shaken_vs_ctx::eprofile, LOG_ERROR, verification_cfg_common::max_date_header_age, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, and profile_cfg::vcfg_common.

Referenced by ast_stir_shaken_vs_verify().

◆ check_tn_auth_list()

static enum ast_stir_shaken_vs_response_code check_tn_auth_list ( struct ast_stir_shaken_vs_ctx ctx)
static

Definition at line 254 of file verification.c.

255{
256 ASN1_OCTET_STRING *tn_exten;
257 const unsigned char* octet_str_data = NULL;
258 long xlen;
259 int tag, xclass;
260 int ret;
261 SCOPE_ENTER(3, "%s: Checking TNAuthList in cert '%s'\n", ctx->tag, ctx->public_url);
262
264 if (!tn_exten) {
266 LOG_ERROR, "%s: Cert '%s' doesn't have a TNAuthList extension\n",
267 ctx->tag, ctx->public_url);
268 }
269 octet_str_data = tn_exten->data;
270
271 /* The first call to ASN1_get_object should return a SEQUENCE */
272 ret = ASN1_get_object(&octet_str_data, &xlen, &tag, &xclass, tn_exten->length);
273 if (IS_GET_OBJ_ERR(ret)) {
274 crypto_log_openssl(LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension\n",
275 ctx->tag, ctx->public_url);
277 }
278
279 if (ret != V_ASN1_CONSTRUCTED || tag != V_ASN1_SEQUENCE) {
281 LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension (tag %d != V_ASN1_SEQUENCE)\n",
282 ctx->tag, ctx->public_url, tag);
283 }
284
285 /*
286 * The second call to ASN1_get_object should return one of
287 * the following tags defined in RFC8226 section 9:
288 *
289 * ASN1_TAG_TNAUTH_SPC 0
290 * ASN1_TAG_TNAUTH_TN_RANGE 1
291 * ASN1_TAG_TNAUTH_TN 2
292 *
293 * ATIS-1000080 however limits this to only ASN1_TAG_TNAUTH_SPC
294 *
295 */
296 ret = ASN1_get_object(&octet_str_data, &xlen, &tag, &xclass, tn_exten->length);
297 if (IS_GET_OBJ_ERR(ret)) {
298 crypto_log_openssl(LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension\n",
299 ctx->tag, ctx->public_url);
301 }
302
303 if (ret != V_ASN1_CONSTRUCTED || tag != ASN1_TAG_TNAUTH_SPC) {
305 LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension (tag %d != ASN1_TAG_TNAUTH_SPC(0))\n",
306 ctx->tag, ctx->public_url, tag);
307 }
308
309 /* The third call to ASN1_get_object should contain the SPC */
310 ret = ASN1_get_object(&octet_str_data, &xlen, &tag, &xclass, tn_exten->length);
311 if (ret != 0) {
313 LOG_ERROR, "%s: Cert '%s' has malformed TNAuthList extension (no SPC)\n",
314 ctx->tag, ctx->public_url);
315 }
316
317 if (ast_string_field_set(ctx, cert_spc, (char *)octet_str_data) != 0) {
319 }
320
321 SCOPE_EXIT_RTN_VALUE(AST_STIR_SHAKEN_VS_SUCCESS, "%s: Cert '%s' with SPC: %s CN: %s has valid TNAuthList\n",
322 ctx->tag, ctx->public_url, ctx->cert_spc, ctx->cert_cn);
323}
void crypto_log_openssl(int level, char *file, int line, const char *function, const char *fmt,...)
Print a log message with any OpenSSL errors appended.
Definition: crypto_utils.c:41
ASN1_OCTET_STRING * crypto_get_cert_extension_data(X509 *cert, int nid, const char *short_name)
Return the data from a specific extension in a cert.
Definition: crypto_utils.c:103
int get_tn_auth_nid(void)
Retrieves the OpenSSL NID for the TN Auth list extension.
@ AST_STIR_SHAKEN_VS_CERT_NO_SPC_IN_TN_AUTH_EXT
@ AST_STIR_SHAKEN_VS_CERT_NO_TN_AUTH_EXT
#define IS_GET_OBJ_ERR(ret)
Definition: verification.c:251
#define ASN1_TAG_TNAUTH_SPC
Definition: verification.c:247

References ASN1_TAG_TNAUTH_SPC, AST_STIR_SHAKEN_VS_CERT_NO_SPC_IN_TN_AUTH_EXT, AST_STIR_SHAKEN_VS_CERT_NO_TN_AUTH_EXT, AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, ast_string_field_set, ast_stir_shaken_vs_ctx::cert_cn, ast_stir_shaken_vs_ctx::cert_spc, crypto_get_cert_extension_data(), crypto_log_openssl(), get_tn_auth_nid(), IS_GET_OBJ_ERR, LOG_ERROR, NULL, ast_stir_shaken_vs_ctx::public_url, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, and ast_stir_shaken_vs_ctx::xcert.

Referenced by check_cert().

◆ check_x5u_url()

static int check_x5u_url ( struct ast_stir_shaken_vs_ctx ctx,
const char *  x5u 
)
static

Definition at line 825 of file verification.c.

827{
828 int max_groups = url_match_regex.re_nsub + 1;
829 regmatch_t pmatch[max_groups];
830 int rc;
831 SCOPE_ENTER(3, "%s: Checking x5u '%s'\n", ctx->tag, x5u);
832
833 rc = regexec(&url_match_regex, x5u, max_groups, pmatch, 0);
834 if (rc) {
835 char regex_error[512];
836 regerror(rc, &url_match_regex, regex_error, sizeof(regex_error));
838 "%s: x5u '%s' in Identity header failed basic URL validation: %s\n",
839 ctx->tag, x5u, regex_error);
840 }
841
843 != relax_x5u_port_scheme_restrictions_YES) {
844 const char *scheme = get_match_string(x5u, pmatch, URL_MATCH_SCHEME);
845 const char *port = get_match_string(x5u, pmatch, URL_MATCH_PORT);
846
847 if (!ast_strings_equal(scheme, "https")) {
850 "%s: x5u '%s': scheme '%s' not https\n",
851 ctx->tag, x5u, scheme);
852 }
853 if (!ast_strlen_zero(port)) {
854 if (!ast_strings_equal(port, "443")
855 || !ast_strings_equal(port, "8443")) {
858 "%s: x5u '%s': port '%s' not port 443 or 8443\n",
859 ctx->tag, x5u, port);
860 }
861 }
862 }
863
865 != relax_x5u_path_restrictions_YES) {
866 const char *userpass = get_match_string(x5u, pmatch, URL_MATCH_USERPASS);
867 const char *qs = get_match_string(x5u, pmatch, URL_MATCH_QUERY);
868 const char *frag = get_match_string(x5u, pmatch, URL_MATCH_FRAGMENT);
869
870 if (!ast_strlen_zero(userpass) || !ast_strlen_zero(qs)
871 || !ast_strlen_zero(frag)) {
874 "%s: x5u '%s' contains user:password, query parameters or fragment\n",
875 ctx->tag, x5u);
876 }
877 }
878
879 return 0;
880}
int ast_strings_equal(const char *str1, const char *str2)
Compare strings for equality checking for NULL.
Definition: strings.c:238
enum relax_x5u_path_restrictions_enum relax_x5u_path_restrictions
enum relax_x5u_port_scheme_restrictions_enum relax_x5u_port_scheme_restrictions
static regex_t url_match_regex
Definition: verification.c:49
#define URL_MATCH_USERPASS
Definition: verification.c:792
#define URL_MATCH_SCHEME
Definition: verification.c:791
#define URL_MATCH_PORT
Definition: verification.c:794
#define get_match_string(__x5u, __pmatch, __i)
Definition: verification.c:799
#define URL_MATCH_FRAGMENT
Definition: verification.c:797
#define DUMP_X5U_MATCH()
Definition: verification.c:811
#define URL_MATCH_QUERY
Definition: verification.c:796

References AST_STIR_SHAKEN_VS_INVALID_OR_NO_X5U, ast_strings_equal(), ast_strlen_zero(), DUMP_X5U_MATCH, ast_stir_shaken_vs_ctx::eprofile, get_match_string, LOG_ERROR, verification_cfg_common::relax_x5u_path_restrictions, verification_cfg_common::relax_x5u_port_scheme_restrictions, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, URL_MATCH_FRAGMENT, URL_MATCH_PORT, URL_MATCH_QUERY, url_match_regex, URL_MATCH_SCHEME, URL_MATCH_USERPASS, and profile_cfg::vcfg_common.

Referenced by ast_stir_shaken_vs_verify().

◆ cleanup_cert_from_astdb_and_fs()

static void cleanup_cert_from_astdb_and_fs ( struct ast_stir_shaken_vs_ctx ctx)
static

Definition at line 97 of file verification.c.

99{
100 if (ast_db_exists(ctx->hash_family, "path") || ast_db_exists(ctx->hash_family, "expiration")) {
102 }
103
104 if (ast_db_exists(ctx->url_family, ctx->public_url)) {
105 ast_db_del(ctx->url_family, ctx->public_url);
106 }
107
108 /* Remove the actual file from the system */
109 remove(ctx->filename);
110}
int ast_db_deltree(const char *family, const char *keytree)
Delete one or more entries in astdb.
Definition: main/db.c:536
int ast_db_exists(const char *family, const char *key)
Check if family/key exitsts.
Definition: main/db.c:444
#define remove

References ast_db_del(), ast_db_deltree(), ast_db_exists(), ast_stir_shaken_vs_ctx::filename, ast_stir_shaken_vs_ctx::hash_family, NULL, ast_stir_shaken_vs_ctx::public_url, remove, and ast_stir_shaken_vs_ctx::url_family.

Referenced by retrieve_cert_from_cache().

◆ ctx_destructor()

static void ctx_destructor ( void *  obj)
static

Definition at line 640 of file verification.c.

641{
642 struct ast_stir_shaken_vs_ctx *ctx = obj;
643
644 ao2_cleanup(ctx->eprofile);
645 ast_free(ctx->raw_key);
647 X509_free(ctx->xcert);
648}
#define ast_string_field_free_memory(x)
free all memory - to be called before destroying the object
Definition: stringfields.h:374

References ao2_cleanup, ast_free, ast_string_field_free_memory, ast_stir_shaken_vs_ctx::eprofile, ast_stir_shaken_vs_ctx::raw_key, and ast_stir_shaken_vs_ctx::xcert.

Referenced by ast_stir_shaken_vs_ctx_create().

◆ ctx_populate()

static enum ast_stir_shaken_vs_response_code ctx_populate ( struct ast_stir_shaken_vs_ctx ctx)
static

Definition at line 548 of file verification.c.

550{
551 char hash[41];
552
553 ast_sha1_hash(hash, ctx->public_url);
554 if (ast_string_field_set(ctx, hash, hash) != 0) {
556 }
557
558 if (ast_string_field_build(ctx, filename, "%s/%s.pem",
559 ctx->eprofile->vcfg_common.cert_cache_dir, hash) != 0) {
561 }
562
563 if (ast_string_field_build(ctx, hash_family, "%s/hash/%s",
564 AST_DB_FAMILY, hash) != 0) {
566 }
567
568 if (ast_string_field_build(ctx, url_family, "%s/url", AST_DB_FAMILY) != 0) {
570 }
571
573}
#define ast_string_field_build(x, field, fmt, args...)
Set a field to a complex (built) value.
Definition: stringfields.h:555
const ast_string_field cert_cache_dir
void ast_sha1_hash(char *output, const char *input)
Produces SHA1 hash based on input string.
Definition: utils.c:266
#define AST_DB_FAMILY
Definition: verification.c:47

References AST_DB_FAMILY, ast_sha1_hash(), AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, ast_string_field_build, ast_string_field_set, verification_cfg_common::cert_cache_dir, ast_stir_shaken_vs_ctx::eprofile, ast_stir_shaken_vs_ctx::public_url, and profile_cfg::vcfg_common.

Referenced by ast_stir_shaken_vs_verify().

◆ is_cert_cache_entry_expired()

static int is_cert_cache_entry_expired ( char *  expiration)
static

Definition at line 225 of file verification.c.

226{
227 struct timeval current_time = ast_tvnow();
228 struct timeval expires = { .tv_sec = 0, .tv_usec = 0 };
229 int res = 0;
230 SCOPE_ENTER(3, "Checking for cache expiration: %s\n", expiration);
231
232 if (ast_strlen_zero(expiration)) {
233 SCOPE_EXIT_RTN_VALUE(1, "No expiration date provided\n");
234 }
235
236 if (ast_str_to_ulong(expiration, (unsigned long *)&expires.tv_sec)) {
237 SCOPE_EXIT_RTN_VALUE(1, "Couldn't convert expiration string '%s' to ulong",
238 expiration);
239 }
240 ast_trace(2, "Expiration comparison: exp: %" PRIu64 " curr: %" PRIu64 " Diff: %" PRIu64 ".\n",
241 expires.tv_sec, current_time.tv_sec, expires.tv_sec - current_time.tv_sec);
242
243 res = (ast_tvcmp(current_time, expires) == -1 ? 0 : 1);
244 SCOPE_EXIT_RTN_VALUE(res , "entry was %sexpired\n", res ? "" : "not ");
245}
int ast_str_to_ulong(const char *str, unsigned long *res)
Convert the given string to an unsigned long.
Definition: conversions.c:80
int ast_tvcmp(struct timeval _a, struct timeval _b)
Compress two struct timeval instances returning -1, 0, 1 if the first arg is smaller,...
Definition: time.h:137

References ast_str_to_ulong(), ast_strlen_zero(), ast_trace, ast_tvcmp(), ast_tvnow(), SCOPE_ENTER, and SCOPE_EXIT_RTN_VALUE.

Referenced by retrieve_cert_from_cache().

◆ retrieve_cert_from_cache()

static enum ast_stir_shaken_vs_response_code retrieve_cert_from_cache ( struct ast_stir_shaken_vs_ctx ctx)
static

Definition at line 490 of file verification.c.

491{
492 int rc = 0;
494
495 SCOPE_ENTER(2, "%s: Attempting to retrieve cert '%s' from cache\n",
496 ctx->tag, ctx->public_url);
497
498 if (!ast_db_exists(ctx->hash_family, "path")) {
501 "%s: No cert found in astdb for '%s'\n",
502 ctx->tag, ctx->public_url);
503 }
504
505 rc = ast_db_get(ctx->hash_family, "expiration", ctx->expiration, sizeof(ctx->expiration));
506 if (rc) {
509 "%s: No cert found in astdb for '%s'\n",
510 ctx->tag, ctx->public_url);
511 }
512
513 if (!ast_file_is_readable(ctx->filename)) {
516 "%s: Cert file '%s' was not found or was not readable for '%s'\n",
517 ctx->tag, ctx->filename, ctx->public_url);
518 }
519
523 "%s: Cert file '%s' cache entry was expired for '%s'\n",
524 ctx->tag, ctx->filename, ctx->public_url);
525 }
526
528 if (!ctx->xcert) {
531 "%s: Cert file '%s' was not parseable as an X509 certificate for '%s'\n",
532 ctx->tag, ctx->filename, ctx->public_url);
533 }
534
535 vs_rc = check_cert(ctx);
536 if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
537 X509_free(ctx->xcert);
538 ctx->xcert = NULL;
539 SCOPE_EXIT_RTN_VALUE(vs_rc, "%s: Cert '%s' failed validity checks\n",
540 ctx->tag, ctx->public_url);
541 }
542
544 "%s: Cert '%s' successfully retrieved from cache\n",
545 ctx->tag, ctx->public_url);
546}
int ast_db_get(const char *family, const char *key, char *value, int valuelen)
Get key value specified by family/key.
Definition: main/db.c:427
X509 * crypto_load_cert_from_file(const char *filename)
Load an X509 Cert from a file.
Definition: crypto_utils.c:161
@ AST_STIR_SHAKEN_VS_CERT_CACHE_MISS
@ AST_STIR_SHAKEN_VS_CERT_CACHE_EXPIRED
int ast_file_is_readable(const char *filename)
Test that a file exists and is readable by the effective user.
Definition: utils.c:3107
static int is_cert_cache_entry_expired(char *expiration)
Definition: verification.c:225
static enum ast_stir_shaken_vs_response_code check_cert(struct ast_stir_shaken_vs_ctx *ctx)
Definition: verification.c:326
static void cleanup_cert_from_astdb_and_fs(struct ast_stir_shaken_vs_ctx *ctx)
Definition: verification.c:97

References ast_db_exists(), ast_db_get(), ast_file_is_readable(), AST_STIR_SHAKEN_VS_CERT_CACHE_EXPIRED, AST_STIR_SHAKEN_VS_CERT_CACHE_MISS, AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID, AST_STIR_SHAKEN_VS_SUCCESS, check_cert(), cleanup_cert_from_astdb_and_fs(), crypto_load_cert_from_file(), ast_stir_shaken_vs_ctx::expiration, ast_stir_shaken_vs_ctx::filename, ast_stir_shaken_vs_ctx::hash_family, is_cert_cache_entry_expired(), NULL, ast_stir_shaken_vs_ctx::public_url, SCOPE_ENTER, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, and ast_stir_shaken_vs_ctx::xcert.

Referenced by retrieve_verification_cert().

◆ retrieve_cert_from_url()

static enum ast_stir_shaken_vs_response_code retrieve_cert_from_url ( struct ast_stir_shaken_vs_ctx ctx)
static

Definition at line 377 of file verification.c.

379{
380 FILE *cert_file;
381 long http_code;
382 int rc = 0;
386 RAII_VAR(struct curl_write_data *, write_data,
387 ast_calloc(1, sizeof(*write_data)), curl_write_data_free);
388 RAII_VAR(struct curl_open_socket_data *, open_socket_data,
389 ast_calloc(1, sizeof(*open_socket_data)), curl_open_socket_data_free);
390
391 const char *cache_control;
392 const char *expires;
393 SCOPE_ENTER(2, "%s: Attempting to retrieve '%s' from net\n",
394 ctx->tag, ctx->public_url);
395
396 if (!header_data || !write_data || !open_socket_data) {
398 LOG_ERROR, "%s: Unable to allocate memory for curl '%s' transaction\n",
399 ctx->tag, ctx->public_url);
400 }
401
402 header_data->debug_info = ast_strdup(ctx->public_url);
403 write_data->debug_info = ast_strdup(ctx->public_url);
404 write_data->max_download_bytes = 8192;
405 write_data->stream_buffer = NULL;
406 open_socket_data->debug_info = ast_strdup(ctx->public_url);
407 open_socket_data->acl = ctx->eprofile->vcfg_common.acl;
408
409 if (!header_data->debug_info || !write_data->debug_info ||
410 !open_socket_data->debug_info) {
412 LOG_ERROR, "%s: Unable to allocate memory for curl '%s' transaction\n",
413 ctx->tag, ctx->public_url);
414 }
415
416 http_code = curler(ctx->public_url,
418 write_data, header_data, open_socket_data);
419
420 if (http_code / 100 != 2) {
422 LOG_ERROR, "%s: Failed to retrieve cert %s: code %ld\n",
423 ctx->tag, ctx->public_url, http_code);
424 }
425
426 if (!ast_begins_with(write_data->stream_buffer, BEGIN_CERTIFICATE_STR)) {
428 LOG_ERROR, "%s: Cert '%s' contains invalid data\n",
429 ctx->tag, ctx->public_url);
430 }
431
432 ctx->xcert = crypto_load_cert_from_memory(write_data->stream_buffer,
433 write_data->stream_bytes_downloaded);
434 if (!ctx->xcert) {
436 LOG_ERROR, "%s: Cert '%s' was not parseable as an X509 certificate\n",
437 ctx->tag, ctx->public_url);
438 }
439
440 vs_rc = check_cert(ctx);
441 if (vs_rc != AST_STIR_SHAKEN_VS_SUCCESS) {
442 X509_free(ctx->xcert);
443 ctx->xcert = NULL;
444 SCOPE_EXIT_RTN_VALUE(vs_rc, "%s: Cert '%s' failed validity checks\n",
445 ctx->tag, ctx->public_url);
446 }
447
448 cert_file = fopen(ctx->filename, "w");
449 if (!cert_file) {
450 X509_free(ctx->xcert);
451 ctx->xcert = NULL;
453 LOG_ERROR, "%s: Failed to write cert %s: file '%s' %s (%d)\n",
454 ctx->tag, ctx->public_url, ctx->filename, strerror(errno), errno);
455 }
456
457 rc = fputs(write_data->stream_buffer, cert_file);
458 fclose(cert_file);
459 if (rc == EOF) {
460 X509_free(ctx->xcert);
461 ctx->xcert = NULL;
463 LOG_ERROR, "%s: Failed to write cert %s: file '%s' %s (%d)\n",
464 ctx->tag, ctx->public_url, ctx->filename, strerror(errno), errno);
465 }
466
467 ast_trace(2, "%s: Cert '%s' written to file '%s'\n",
468 ctx->tag, ctx->public_url, ctx->filename);
469
470 ast_trace(2, "%s: Adding cert '%s' to astdb",
471 ctx->tag, ctx->public_url);
472 cache_control = ast_variable_find_in_list(header_data->headers, "cache-control");
473 expires = ast_variable_find_in_list(header_data->headers, "expires");
474
475 rc = add_cert_key_to_astdb(ctx, cache_control, expires);
476 if (rc) {
477 X509_free(ctx->xcert);
478 ctx->xcert = NULL;
480 LOG_ERROR, "%s: Unable to add cert '%s' to ASTDB\n",
481 ctx->tag, ctx->public_url);
482 }
483
485 "%s: Cert '%s' successfully retrieved from internet and cached\n",
486 ctx->tag, ctx->public_url);
487}
#define ast_strdup(str)
A wrapper for strdup()
Definition: astmm.h:241
#define ast_calloc(num, len)
A wrapper for calloc()
Definition: astmm.h:202
X509 * crypto_load_cert_from_memory(const char *buffer, size_t size)
Load an X509 Cert from a NULL terminated buffer.
Definition: crypto_utils.c:185
void curl_write_data_free(void *obj)
Definition: curl_utils.c:134
void curl_header_data_free(void *obj)
Definition: curl_utils.c:26
void curl_open_socket_data_free(void *obj)
Definition: curl_utils.c:193
long curler(const char *url, int request_timeout, struct curl_write_data *write_data, struct curl_header_data *header_data, struct curl_open_socket_data *open_socket_data)
Perform a curl request.
Definition: curl_utils.c:232
const char * ast_variable_find_in_list(const struct ast_variable *list, const char *variable)
Gets the value of a variable from a variable list by name.
Definition: main/config.c:919
int errno
@ AST_STIR_SHAKEN_VS_CERT_RETRIEVAL_FAILURE
static int force_inline attribute_pure ast_begins_with(const char *str, const char *prefix)
Checks whether a string begins with another.
Definition: strings.h:97
Context structure passed to ast_curl_header_default_cb.
Definition: curl_utils.h:163
Context structure passed to ast_curl_open_socket_default_cb.
Definition: curl_utils.h:341
Context structure passed to ast_curl_write_default_cb.
Definition: curl_utils.h:245
Data structure used for ast_sip_push_task_wait_serializer
struct ast_acl_list * acl
static int add_cert_key_to_astdb(struct ast_stir_shaken_vs_ctx *cert, const char *cache_control_hdr, const char *expires_hdr)
Definition: verification.c:201
#define BEGIN_CERTIFICATE_STR
Definition: verification.c:52

References verification_cfg_common::acl, add_cert_key_to_astdb(), ast_begins_with(), ast_calloc, AST_STIR_SHAKEN_VS_CERT_CONTENTS_INVALID, AST_STIR_SHAKEN_VS_CERT_RETRIEVAL_FAILURE, AST_STIR_SHAKEN_VS_INTERNAL_ERROR, AST_STIR_SHAKEN_VS_SUCCESS, ast_strdup, ast_trace, ast_variable_find_in_list(), BEGIN_CERTIFICATE_STR, check_cert(), crypto_load_cert_from_memory(), curl_header_data_free(), curl_open_socket_data_free(), verification_cfg_common::curl_timeout, curl_write_data_free(), curler(), ast_stir_shaken_vs_ctx::eprofile, errno, ast_stir_shaken_vs_ctx::filename, LOG_ERROR, NULL, ast_stir_shaken_vs_ctx::public_url, RAII_VAR, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, ast_stir_shaken_vs_ctx::tag, profile_cfg::vcfg_common, and ast_stir_shaken_vs_ctx::xcert.

Referenced by retrieve_verification_cert().

◆ retrieve_verification_cert()

static enum ast_stir_shaken_vs_response_code retrieve_verification_cert ( struct ast_stir_shaken_vs_ctx ctx)
static

Definition at line 576 of file verification.c.

577{
579 SCOPE_ENTER(3, "%s: Retrieving cert '%s'\n", ctx->tag, ctx->public_url);
580
581 ast_trace(1, "%s: Checking cache for cert '%s'\n", ctx->tag, ctx->public_url);
582 rc = retrieve_cert_from_cache(ctx);
583 if (rc == AST_STIR_SHAKEN_VS_SUCCESS) {
584 SCOPE_EXIT_RTN_VALUE(rc, "%s: Using cert '%s' from cache\n",
585 ctx->tag, ctx->public_url);;
586 }
587
588 ast_trace(1, "%s: No valid cert for '%s' available in cache\n",
589 ctx->tag, ctx->public_url);
590 ast_trace(1, "%s: Retrieving cert directly from url '%s'\n",
591 ctx->tag, ctx->public_url);
592
593 rc = retrieve_cert_from_url(ctx);
594 if (rc == AST_STIR_SHAKEN_VS_SUCCESS) {
595 SCOPE_EXIT_RTN_VALUE(rc, "%s: Using cert '%s' from internet\n",
596 ctx->tag, ctx->public_url);
597 }
598
600 "%s: Unable to retrieve cert '%s' from cache or internet\n",
601 ctx->tag, ctx->public_url);
602}
static enum ast_stir_shaken_vs_response_code retrieve_cert_from_url(struct ast_stir_shaken_vs_ctx *ctx)
Definition: verification.c:377
static enum ast_stir_shaken_vs_response_code retrieve_cert_from_cache(struct ast_stir_shaken_vs_ctx *ctx)
Definition: verification.c:490

References AST_STIR_SHAKEN_VS_SUCCESS, ast_trace, LOG_ERROR, ast_stir_shaken_vs_ctx::public_url, retrieve_cert_from_cache(), retrieve_cert_from_url(), SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, and ast_stir_shaken_vs_ctx::tag.

Referenced by ast_stir_shaken_vs_verify().

◆ vs_load()

int vs_load ( void  )

Load the stir/shaken verification service.

Return values
0on success
-1on error

Definition at line 1100 of file verification.c.

1101{
1102 int rc = 0;
1103
1104 if (vs_config_load()) {
1106 }
1107
1108 rc = regcomp(&url_match_regex, FULL_URL_REGEX, REG_EXTENDED);
1109 if (rc) {
1110 char regex_error[512];
1111 regerror(rc, &url_match_regex, regex_error, sizeof(regex_error));
1112 ast_log(LOG_ERROR, "Verification service URL regex failed to compile: %s\n", regex_error);
1113 vs_unload();
1115 }
1116 if (url_match_regex.re_nsub != FULL_URL_REGEX_GROUPS) {
1117 ast_log(LOG_ERROR, "The verification service URL regex was updated without updating FULL_URL_REGEX_GROUPS\n");
1118 vs_unload();
1120 }
1121
1123}
#define ast_log
Definition: astobj2.c:42
int vs_config_load(void)
@ AST_MODULE_LOAD_SUCCESS
Definition: module.h:70
@ AST_MODULE_LOAD_DECLINE
Module has failed to load, may be in an inconsistent state.
Definition: module.h:78
#define FULL_URL_REGEX_GROUPS
Definition: verification.c:773
#define FULL_URL_REGEX
Definition: verification.c:772
int vs_unload()
Unload the stir/shaken verification service.

References ast_log, AST_MODULE_LOAD_DECLINE, AST_MODULE_LOAD_SUCCESS, FULL_URL_REGEX, FULL_URL_REGEX_GROUPS, LOG_ERROR, url_match_regex, vs_config_load(), and vs_unload().

Referenced by common_config_load().

◆ vs_reload()

int vs_reload ( void  )

Reload the stir/shaken verification service.

Return values
0on success
-1on error

Definition at line 1083 of file verification.c.

1084{
1086
1087 return 0;
1088}
int vs_config_reload(void)

References vs_config_reload().

Referenced by common_config_reload().

◆ vs_response_code_to_str()

const char * vs_response_code_to_str ( enum ast_stir_shaken_vs_response_code  vs_rc)

Return string version of VS response code.

Parameters
vs_rc
Returns
Response string

Definition at line 90 of file verification.c.

92{
93 return ARRAY_IN_BOUNDS(vs_rc, vs_rc_map) ?
94 vs_rc_map[vs_rc] : NULL;
95}
#define ARRAY_IN_BOUNDS(v, a)
Checks to see if value is within the bounds of the given array.
Definition: utils.h:687
static const char * vs_rc_map[]
Definition: verification.c:54

References ARRAY_IN_BOUNDS, NULL, and vs_rc_map.

Referenced by ast_stir_shaken_vs_verify(), and func_read().

◆ vs_unload()

int vs_unload ( void  )

Unload the stir/shaken verification service.

Return values
0on success
-1on error

Definition at line 1090 of file verification.c.

1091{
1093 if (url_match_regex.re_nsub > 0) {
1094 regfree(&url_match_regex);
1095 }
1096
1097 return 0;
1098}
int vs_config_unload(void)

References url_match_regex, and vs_config_unload().

Referenced by common_config_unload(), and vs_load().

Variable Documentation

◆ url_match_regex

regex_t url_match_regex
static

Definition at line 49 of file verification.c.

Referenced by check_x5u_url(), vs_load(), and vs_unload().

◆ vs_rc_map

const char* vs_rc_map[]
static

Definition at line 54 of file verification.c.

Referenced by vs_response_code_to_str().