common_config.c File Reference

#include "asterisk.h"
#include "asterisk/cli.h"
#include "asterisk/logger.h"
#include "asterisk/module.h"
#include "asterisk/utils.h"
#include "asterisk/stasis.h"
#include "asterisk/security_events.h"
#include "stir_shaken.h"

Include dependency graph for common_config.c:

Go to the source code of this file.

Data Structures
struct	enum_name_xref_entry

Macros
#define	AST_API_MODULE
#define	generate_bool_handler_functions(param_name)
#define	generate_enum_string_functions(param_name, default_value, ...)
#define	print_acl_cert_store(cfg, a, max_name_len)

Functions
char *	canonicalize_tn (const char *tn, char *dest_tn)
	Canonicalize a TN. More...
char *	canonicalize_tn_alloc (const char *tn)
	Canonicalize a TN into nre buffer. More...
static char *	cli_verify_cert (struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
int	common_config_load (void)
int	common_config_reload (void)
int	common_config_unload (void)
int	config_object_cli_show (void *obj, void *arg, void *data, int flags)
	Output configuration settings to the Asterisk CLI. More...
char *	config_object_tab_complete_name (const char *word, struct ao2_container *container)
	Tab completion for name matching with STIR/SHAKEN CLI commands. More...
	generate_bool_handler_functions (check_tn_cert_public_url)
	generate_bool_handler_functions (load_system_certs)
	generate_bool_handler_functions (relax_x5u_path_restrictions)
	generate_bool_handler_functions (relax_x5u_port_scheme_restrictions)
	generate_bool_handler_functions (send_mky)
	generate_bool_handler_functions (use_rfc9410_responses)
	generate_enum_string_functions (attest_level, UNKNOWN, {attest_level_NOT_SET, "not_set"}, {attest_level_A, "A"}, {attest_level_B, "B"}, {attest_level_C, "C"},)
	generate_enum_string_functions (endpoint_behavior, OFF, {endpoint_behavior_OFF, "off"}, {endpoint_behavior_OFF, "none"}, {endpoint_behavior_ATTEST, "attest"}, {endpoint_behavior_VERIFY, "verify"}, {endpoint_behavior_ON, "on"}, {endpoint_behavior_ON, "both"})
	generate_enum_string_functions (stir_shaken_failure_action, CONTINUE, {stir_shaken_failure_action_CONTINUE, "continue"}, {stir_shaken_failure_action_REJECT_REQUEST, "reject_request"}, {stir_shaken_failure_action_CONTINUE_RETURN_REASON, "continue_return_reason"},)
struct ast_sorcery *	get_sorcery (void)
	Retrieve the stir/shaken sorcery context. More...
static void	named_acl_changed_cb (void *data, struct stasis_subscription *sub, struct stasis_message *message)
static void	print_acl (int fd, struct ast_acl_list *acl_list, const char *prefix)
static const char *	translate_value (const char *val)

Variables
static struct ast_cli_entry	cli_commands []
struct stasis_subscription *	named_acl_changed_sub = NULL
static struct ast_sorcery *	sorcery

Macro Definition Documentation

AST_API_MODULE

#define AST_API_MODULE

Definition at line 28 of file common_config.c.

generate_bool_handler_functions

#define generate_bool_handler_functions

(

param_name

)

Definition at line 39 of file common_config.c.

generate_enum_string_functions

#define generate_enum_string_functions	(		param_name,
			default_value,
			...
	)

Definition at line 77 of file common_config.c.

print_acl_cert_store

#define print_acl_cert_store	(		cfg,
			a,
			max_name_len
	)

Definition at line 151 of file common_config.c.

Function Documentation

canonicalize_tn()

char * canonicalize_tn	(	const char *	tn,
		char *	dest_tn
	)

Canonicalize a TN.

Parameters

tn	TN to canonicalize
dest_tn	Pointer to destination buffer to receive the new TN

Return values

dest_tn

or NULL on failure

Definition at line 266 of file common_config.c.

{
    int i;
    const char *s = tn;
    size_t len = tn ? strlen(tn) : 0;
    char *new_tn = dest_tn;
    SCOPE_ENTER(3, "tn: %s\n", S_OR(tn, "(null)"));
 
    if (ast_strlen_zero(tn)) {
        *dest_tn = '\0';
        SCOPE_EXIT_RTN_VALUE(NULL, "Empty TN\n");
    }
 
    if (!dest_tn) {
        SCOPE_EXIT_RTN_VALUE(NULL, "No destination buffer\n");
    }
 
    for (i = 0; i < len; i++) {
        if (isdigit(*s) || *s == '#' || *s == '*') { /* Only characters allowed */
            *new_tn++ = *s;
        }
        s++;
    }
    *new_tn = '\0';
    SCOPE_EXIT_RTN_VALUE(dest_tn, "Canonicalized '%s' -> '%s'\n", tn, dest_tn);
}

References ast_strlen_zero(), len(), NULL, S_OR, SCOPE_ENTER, and SCOPE_EXIT_RTN_VALUE.

Referenced by canonicalize_tn_alloc().

canonicalize_tn_alloc()

char * canonicalize_tn_alloc

(

const char *

tn

)

Canonicalize a TN into nre buffer.

Parameters

tn	TN to canonicalize

Return values

dest_tn

(which must be freed with ast_free) or NULL on failure

Definition at line 293 of file common_config.c.

{
    char *canon_tn = ast_strlen_zero(tn) ? NULL : ast_malloc(strlen(tn) + 1);
    if (!canon_tn) {
        return NULL;
    }
    return canonicalize_tn(tn, canon_tn);
}

References ast_malloc, ast_strlen_zero(), canonicalize_tn(), and NULL.

Referenced by ast_stir_shaken_as_ctx_create(), and ast_stir_shaken_vs_ctx_create().

cli_verify_cert()

static char * cli_verify_cert ( struct ast_cli_entry *  e, int  cmd, struct ast_cli_args *  a  )

static

Definition at line 302 of file common_config.c.

{
    RAII_VAR(struct profile_cfg *, profile, NULL, ao2_cleanup);
    RAII_VAR(struct verification_cfg *, vs_cfg, NULL, ao2_cleanup);
    struct crypto_cert_store *tcs;
    X509 *cert = NULL;
    const char *errmsg = NULL;
 
    switch(cmd) {
    case CLI_INIT:
        e->command = "stir_shaken verify certificate_file";
        e->usage =
            "Usage: stir_shaken verify certificate_file <certificate_file> [ <profile> ]\n"
            "       Verify an external certificate file against the global or profile verification store\n";
        return NULL;
    case CLI_GENERATE:
        if (a->pos == 4) {
            return config_object_tab_complete_name(a->word, profile_get_all());
        } else {
            return NULL;
        }
    }
 
    if (a->argc < 4) {
        return CLI_SHOWUSAGE;
    }
 
    if (a->argc == 5) {
        profile = profile_get_cfg(a->argv[4]);
        if (!profile) {
            ast_cli(a->fd, "Profile %s doesn't exist\n", a->argv[4]);
            return CLI_SUCCESS;
        }
        if (!profile->vcfg_common.tcs) {
            ast_cli(a->fd,"Profile %s doesn't have a certificate store\n", a->argv[4]);
            return CLI_SUCCESS;
        }
        tcs = profile->vcfg_common.tcs;
    } else {
        vs_cfg = vs_get_cfg();
        if (!vs_cfg) {
            ast_cli(a->fd, "No verification store found\n");
            return CLI_SUCCESS;
        }
        tcs = vs_cfg->vcfg_common.tcs;
    }
 
    cert = crypto_load_cert_from_file(a->argv[3]);
    if (!cert) {
        ast_cli(a->fd, "Failed to load certificate from %s.  See log for details\n", a->argv[3]);
        return CLI_SUCCESS;
    }
 
    if (crypto_is_cert_trusted(tcs, cert, &errmsg)) {
        ast_cli(a->fd, "Certificate %s trusted\n", a->argv[3]);
    } else {
        ast_cli(a->fd, "Certificate %s NOT trusted: %s\n", a->argv[3], errmsg);
    }
    X509_free(cert);
 
    return CLI_SUCCESS;
}

References a, ao2_cleanup, ast_cli(), CLI_GENERATE, CLI_INIT, CLI_SHOWUSAGE, CLI_SUCCESS, ast_cli_entry::command, config_object_tab_complete_name(), crypto_is_cert_trusted(), crypto_load_cert_from_file(), NULL, profile_get_all(), profile_get_cfg(), RAII_VAR, ast_cli_entry::usage, and vs_get_cfg().

common_config_load()

int common_config_load

(

void

)

Definition at line 420 of file common_config.c.

{
    SCOPE_ENTER(2, "Stir Shaken Load\n");
 
    if (!(sorcery = ast_sorcery_open())) {
        common_config_unload();
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken sorcery load failed\n");
    }
 
    if (vs_load()) {
        common_config_unload();
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken VS load failed\n");
    }
 
    if (as_load()) {
        common_config_unload();
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken AS load failed\n");
    }
 
    if (tn_config_load()) {
        common_config_unload();
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken TN load failed\n");
    }
 
    if (profile_load()) {
        common_config_unload();
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken profile load failed\n");
    }
 
    if (!named_acl_changed_sub) {
        named_acl_changed_sub = stasis_subscribe(ast_security_topic(),
            named_acl_changed_cb, NULL);
        if (!named_acl_changed_sub) {
            common_config_unload();
            SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken acl change subscribe failed\n");
        }
        stasis_subscription_accept_message_type(
            named_acl_changed_sub, ast_named_acl_change_type());
    }
 
    ast_cli_register_multiple(cli_commands, ARRAY_LEN(cli_commands));
 
    SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_SUCCESS, "Stir Shaken Load Done\n");
}

References ARRAY_LEN, as_load(), ast_cli_register_multiple, AST_MODULE_LOAD_DECLINE, AST_MODULE_LOAD_SUCCESS, ast_named_acl_change_type(), ast_security_topic(), ast_sorcery_open, cli_commands, common_config_unload(), named_acl_changed_cb(), named_acl_changed_sub, NULL, profile_load(), SCOPE_ENTER, SCOPE_EXIT_RTN_VALUE, sorcery, stasis_subscribe, stasis_subscription_accept_message_type(), tn_config_load(), and vs_load().

Referenced by load_module().

common_config_reload()

int common_config_reload

(

void

)

Definition at line 369 of file common_config.c.

{
    SCOPE_ENTER(2, "Stir Shaken Reload\n");
    if (vs_reload()) {
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken VS Reload failed\n");
    }
 
    if (as_reload()) {
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken AS Reload failed\n");
    }
 
    if (tn_config_reload()) {
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken TN Reload failed\n");
    }
 
    if (profile_reload()) {
        SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_DECLINE, "Stir Shaken Profile Reload failed\n");
    }
 
    SCOPE_EXIT_RTN_VALUE(AST_MODULE_LOAD_SUCCESS, "Stir Shaken Reload Done\n");
}

References as_reload(), AST_MODULE_LOAD_DECLINE, AST_MODULE_LOAD_SUCCESS, profile_reload(), SCOPE_ENTER, SCOPE_EXIT_RTN_VALUE, tn_config_reload(), and vs_reload().

Referenced by named_acl_changed_cb(), and reload_module().

common_config_unload()

int common_config_unload

(

void

)

Definition at line 391 of file common_config.c.

{
    ast_cli_unregister_multiple(cli_commands, ARRAY_LEN(cli_commands));
 
    profile_unload();
    tn_config_unload();
    as_unload();
    vs_unload();
 
    if (named_acl_changed_sub) {
        stasis_unsubscribe(named_acl_changed_sub);
        named_acl_changed_sub = NULL;
    }
    ast_sorcery_unref(sorcery);
    sorcery = NULL;
 
    return 0;
}

References ARRAY_LEN, as_unload(), ast_cli_unregister_multiple(), ast_sorcery_unref, cli_commands, named_acl_changed_sub, NULL, profile_unload(), sorcery, stasis_unsubscribe(), tn_config_unload(), and vs_unload().

Referenced by common_config_load(), and unload_module().

config_object_cli_show()

int config_object_cli_show	(	void *	obj,
		void *	arg,
		void *	data,
		int	flags
	)

Output configuration settings to the Asterisk CLI.

Parameters

obj	A sorcery object containing configuration data
arg	Asterisk CLI argument object
flags	ao2 container flags

Return values

0

Definition at line 172 of file common_config.c.

{
    struct ast_cli_args *a = arg;
    struct config_object_cli_data *cli_data = data;
    struct ast_variable *options;
    struct ast_variable *i;
    const char *title = NULL;
    const char *cfg_name = NULL;
    int max_name_len = 0;
 
    if (!obj) {
        ast_cli(a->fd, "No stir/shaken configuration found\n");
        return 0;
    }
 
    if (!ast_strlen_zero(cli_data->title)) {
        title = cli_data->title;
    } else {
        title = ast_sorcery_object_get_type(obj);
    }
    max_name_len = strlen(title);
 
    if (cli_data->object_type == config_object_type_profile
        || cli_data->object_type == config_object_type_tn) {
        cfg_name = ast_sorcery_object_get_id(obj);
        max_name_len += strlen(cfg_name) + 2 /* ": " */;
    }
 
    options = ast_variable_list_sort(ast_sorcery_objectset_create2(
        get_sorcery(), obj, AST_HANDLER_ONLY_STRING));
    if (!options) {
        return 0;
    }
 
    for (i = options; i; i = i->next) {
        int nlen = strlen(i->name);
        max_name_len = (nlen > max_name_len) ? nlen : max_name_len;
    }
 
    ast_cli(a->fd, "\n==============================================================================\n");
    if (ast_strlen_zero(cfg_name))  {
        ast_cli(a->fd, "%s\n", title);
    } else {
        ast_cli(a->fd, "%s: %s\n", title, cfg_name);
    }
    ast_cli(a->fd, "------------------------------------------------------------------------------\n");
 
    for (i = options; i; i = i->next) {
        if (!ast_strings_equal(i->name, "x5u_acl")) {
            ast_cli(a->fd, "%-*s: %s\n", max_name_len, i->name,
                translate_value(i->value));
        }
    }
 
    ast_variables_destroy(options);
 
    if (cli_data->object_type == config_object_type_profile) {
        struct profile_cfg *cfg = obj;
        print_acl_cert_store(cfg, a, max_name_len);
    } else if (cli_data->object_type == config_object_type_verification) {
        struct verification_cfg *cfg = obj;
        print_acl_cert_store(cfg, a, max_name_len);
    }
    ast_cli(a->fd, "---------------------------------------------\n\n"); \
 
    return 0;
}

References a, ast_cli(), AST_HANDLER_ONLY_STRING, ast_sorcery_object_get_id(), ast_sorcery_object_get_type(), ast_sorcery_objectset_create2(), ast_strings_equal(), ast_strlen_zero(), ast_variable_list_sort(), ast_variables_destroy(), config_object_type_profile, config_object_type_tn, config_object_type_verification, get_sorcery(), ast_variable::name, ast_variable::next, NULL, config_object_cli_data::object_type, options, print_acl_cert_store, config_object_cli_data::title, translate_value(), and ast_variable::value.

Referenced by attestation_show(), cli_eprofile_show(), cli_eprofile_show_all(), cli_profile_show(), cli_profile_show_all(), cli_tn_show(), cli_tn_show_all(), and cli_verification_show().

config_object_tab_complete_name()

char * config_object_tab_complete_name	(	const char *	word,
		struct ao2_container *	container
	)

Tab completion for name matching with STIR/SHAKEN CLI commands.

Parameters

word	The word to tab complete on
container	The sorcery container to iterate through

Return values

The	tab completion options

Definition at line 240 of file common_config.c.

{
    void *obj;
    struct ao2_iterator it;
    int wordlen = strlen(word);
    int ret;
 
    it = ao2_iterator_init(container, 0);
    while ((obj = ao2_iterator_next(&it))) {
        if (!strncasecmp(word, ast_sorcery_object_get_id(obj), wordlen)) {
            ret = ast_cli_completion_add(ast_strdup(ast_sorcery_object_get_id(obj)));
            if (ret) {
                ao2_ref(obj, -1);
                break;
            }
        }
        ao2_ref(obj, -1);
    }
    ao2_iterator_destroy(&it);
 
    return NULL;
}

References ao2_iterator_destroy(), ao2_iterator_init(), ao2_iterator_next, ao2_ref, ast_cli_completion_add(), ast_sorcery_object_get_id(), ast_strdup, container, and NULL.

Referenced by cli_eprofile_show(), cli_profile_show(), cli_tn_show(), and cli_verify_cert().

generate_bool_handler_functions() [1/6]

generate_bool_handler_functions

(

check_tn_cert_public_url

)

generate_bool_handler_functions() [2/6]

generate_bool_handler_functions

(

load_system_certs

)

generate_bool_handler_functions() [3/6]

generate_bool_handler_functions

(

relax_x5u_path_restrictions

)

generate_bool_handler_functions() [4/6]

generate_bool_handler_functions

(

relax_x5u_port_scheme_restrictions

)

generate_bool_handler_functions() [5/6]

generate_bool_handler_functions

(

send_mky

)

generate_bool_handler_functions() [6/6]

generate_bool_handler_functions

(

use_rfc9410_responses

)

generate_enum_string_functions() [1/3]

generate_enum_string_functions	(	attest_level	,
		UNKNOWN	,
		{attest_level_NOT_SET, "not_set"}	,
		{attest_level_A, "A"}	,
		{attest_level_B, "B"}	,
		{attest_level_C, "C"}
	)

generate_enum_string_functions() [2/3]

generate_enum_string_functions	(	endpoint_behavior	,
		OFF	,
		{endpoint_behavior_OFF, "off"}	,
		{endpoint_behavior_OFF, "none"}	,
		{endpoint_behavior_ATTEST, "attest"}	,
		{endpoint_behavior_VERIFY, "verify"}	,
		{endpoint_behavior_ON, "on"}	,
		{endpoint_behavior_ON, "both"}
	)

generate_enum_string_functions() [3/3]

generate_enum_string_functions	(	stir_shaken_failure_action	,
		CONTINUE	,
		{stir_shaken_failure_action_CONTINUE, "continue"}	,
		{stir_shaken_failure_action_REJECT_REQUEST, "reject_request"}	,
		{stir_shaken_failure_action_CONTINUE_RETURN_REASON, "continue_return_reason"}
	)

References stir_shaken_failure_action_CONTINUE.

get_sorcery()

struct ast_sorcery * get_sorcery

(

void

)

Retrieve the stir/shaken sorcery context.

Return values

The	stir/shaken sorcery context

Definition at line 34 of file common_config.c.

{
    return sorcery;
}

References sorcery.

Referenced by as_config_load(), as_config_reload(), as_get_cfg(), as_is_config_loaded(), config_object_cli_show(), create_effective_profile(), eprofile_get_all(), eprofile_get_cfg(), get_tn_all(), profile_get_all(), profile_get_cfg(), profile_load(), profile_reload(), tn_config_load(), tn_config_reload(), tn_get_cfg(), tn_get_etn(), vs_config_load(), vs_config_reload(), vs_get_cfg(), and vs_is_config_loaded().

named_acl_changed_cb()

static void named_acl_changed_cb ( void *  data, struct stasis_subscription *  sub, struct stasis_message *  message  )

static

Definition at line 410 of file common_config.c.

{
    if (stasis_message_type(message) != ast_named_acl_change_type()) {
        return;
    }
    ast_log(LOG_NOTICE, "Named acl changed.  Reloading verification and profile\n");
    common_config_reload();
}

References ast_log, ast_named_acl_change_type(), common_config_reload(), LOG_NOTICE, and stasis_message_type().

Referenced by common_config_load().

print_acl()

static void print_acl ( int  fd, struct ast_acl_list *  acl_list, const char *  prefix  )

static

Definition at line 135 of file common_config.c.

{
    struct ast_acl *acl;
 
    AST_LIST_LOCK(acl_list);
    AST_LIST_TRAVERSE(acl_list, acl, list) {
        if (ast_strlen_zero(acl->name)) {
            ast_cli(fd, "%s(permit/deny)\n", prefix);
        } else {
            ast_cli(fd, "%s%s\n", prefix, acl->name);
        }
        ast_ha_output(fd, acl->acl, prefix);
    }
    AST_LIST_UNLOCK(acl_list);
}

References ast_acl::acl, ast_cli(), ast_ha_output(), AST_LIST_LOCK, AST_LIST_TRAVERSE, AST_LIST_UNLOCK, ast_strlen_zero(), ast_acl::list, and prefix.

translate_value()

static const char * translate_value ( const char *  val )

static

Definition at line 124 of file common_config.c.

{
    if (val[0] == '0'
        || val[0] == '\0'
        || strcmp(val, "not_set") == 0) {
        return "";
    }
 
    return val;
}

Referenced by config_object_cli_show().

Variable Documentation

cli_commands

struct ast_cli_entry cli_commands[]

static

Initial value:

= {
    { .handler =  cli_verify_cert , .summary =  "Verify a certificate file against the global or a profile verification store" ,},
}

Definition at line 365 of file common_config.c.

Referenced by common_config_load(), and common_config_unload().

named_acl_changed_sub

struct stasis_subscription* named_acl_changed_sub = NULL

Definition at line 32 of file common_config.c.

Referenced by common_config_load(), and common_config_unload().

sorcery

struct ast_sorcery* sorcery

static

Definition at line 31 of file common_config.c.

Referenced by common_config_load(), common_config_unload(), and get_sorcery().