verification_config.c File Reference

#include "asterisk.h"
#include "asterisk/cli.h"
#include "stir_shaken.h"

Include dependency graph for verification_config.c:

Go to the source code of this file.

Macros
#define	CONFIG_TYPE   "verification"
#define	DEFAULT_ca_file   NULL
#define	DEFAULT_ca_path   NULL
#define	DEFAULT_crl_file   NULL
#define	DEFAULT_crl_path   NULL
#define	DEFAULT_curl_timeout   2
#define	DEFAULT_global_disable   0
#define	DEFAULT_load_system_certs   load_system_certs_NO
#define	DEFAULT_max_cache_entry_age   3600
#define	DEFAULT_max_cache_size   1000
#define	DEFAULT_max_date_header_age   15
#define	DEFAULT_max_iat_age   15
#define	DEFAULT_relax_x5u_path_restrictions   relax_x5u_path_restrictions_NO
#define	DEFAULT_relax_x5u_port_scheme_restrictions   relax_x5u_port_scheme_restrictions_NO
#define	DEFAULT_stir_shaken_failure_action   stir_shaken_failure_action_CONTINUE
#define	DEFAULT_use_rfc9410_responses   use_rfc9410_responses_NO
#define	STIR_SHAKEN_DIR_NAME   "stir_shaken"

Functions
static char *	cli_verification_show (struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
	generate_vcfg_common_sorcery_handlers (verification_cfg)
void	vcfg_cleanup (struct verification_cfg_common *vcfg_common)
static void *	verification_alloc (const char *name)
static int	verification_apply (const struct ast_sorcery *sorcery, void *obj)
static void	verification_destructor (void *obj)
int	vs_check_common_config (const char *id, struct verification_cfg_common *vcfg_common)
int	vs_config_load (void)
int	vs_config_reload (void)
int	vs_config_unload (void)
int	vs_copy_cfg_common (const char *id, struct verification_cfg_common *cfg_dst, struct verification_cfg_common *cfg_src)
struct verification_cfg *	vs_get_cfg (void)
int	vs_is_config_loaded (void)

Variables
static char	DEFAULT_cert_cache_dir [PATH_MAX]
static struct verification_cfg *	empty_cfg = NULL
static char *	special_addresses []
static struct ast_cli_entry	verification_cli []

Macro Definition Documentation

CONFIG_TYPE

#define CONFIG_TYPE   "verification"

Definition at line 24 of file verification_config.c.

DEFAULT_ca_file

#define DEFAULT_ca_file   NULL

Definition at line 28 of file verification_config.c.

DEFAULT_ca_path

#define DEFAULT_ca_path   NULL

Definition at line 29 of file verification_config.c.

DEFAULT_crl_file

#define DEFAULT_crl_file   NULL

Definition at line 30 of file verification_config.c.

DEFAULT_crl_path

#define DEFAULT_crl_path   NULL

Definition at line 31 of file verification_config.c.

DEFAULT_curl_timeout

#define DEFAULT_curl_timeout   2

Definition at line 34 of file verification_config.c.

DEFAULT_global_disable

#define DEFAULT_global_disable   0

Definition at line 26 of file verification_config.c.

DEFAULT_load_system_certs

#define DEFAULT_load_system_certs   load_system_certs_NO

Definition at line 43 of file verification_config.c.

DEFAULT_max_cache_entry_age

#define DEFAULT_max_cache_entry_age   3600

Definition at line 37 of file verification_config.c.

DEFAULT_max_cache_size

#define DEFAULT_max_cache_size   1000

Definition at line 38 of file verification_config.c.

DEFAULT_max_date_header_age

#define DEFAULT_max_date_header_age   15

Definition at line 36 of file verification_config.c.

DEFAULT_max_iat_age

#define DEFAULT_max_iat_age   15

Definition at line 35 of file verification_config.c.

DEFAULT_relax_x5u_path_restrictions

#define DEFAULT_relax_x5u_path_restrictions   relax_x5u_path_restrictions_NO

Definition at line 42 of file verification_config.c.

DEFAULT_relax_x5u_port_scheme_restrictions

#define DEFAULT_relax_x5u_port_scheme_restrictions   relax_x5u_port_scheme_restrictions_NO

Definition at line 41 of file verification_config.c.

DEFAULT_stir_shaken_failure_action

#define DEFAULT_stir_shaken_failure_action   stir_shaken_failure_action_CONTINUE

Definition at line 39 of file verification_config.c.

DEFAULT_use_rfc9410_responses

#define DEFAULT_use_rfc9410_responses   use_rfc9410_responses_NO

Definition at line 40 of file verification_config.c.

STIR_SHAKEN_DIR_NAME

#define STIR_SHAKEN_DIR_NAME   "stir_shaken"

Definition at line 47 of file verification_config.c.

Function Documentation

cli_verification_show()

static char * cli_verification_show ( struct ast_cli_entry *  e, int  cmd, struct ast_cli_args *  a  )

static

Definition at line 335 of file verification_config.c.

{
    struct verification_cfg *cfg;
    struct config_object_cli_data data = {
        .title = "Default Verification",
        .object_type = config_object_type_verification,
    };
 
    switch(cmd) {
    case CLI_INIT:
        e->command = "stir_shaken show verification";
        e->usage =
            "Usage: stir_shaken show verification\n"
            "       Show the stir/shaken verification settings\n";
        return NULL;
    case CLI_GENERATE:
        return NULL;
    }
 
    if (a->argc != 3) {
        return CLI_SHOWUSAGE;
    }
 
    cfg = vs_get_cfg();
    config_object_cli_show(cfg, a, &data, 0);
 
    ao2_cleanup(cfg);
 
    return CLI_SUCCESS;
}

References a, ao2_cleanup, CLI_GENERATE, CLI_INIT, CLI_SHOWUSAGE, CLI_SUCCESS, ast_cli_entry::command, config_object_cli_show(), config_object_type_verification, NULL, config_object_cli_data::title, ast_cli_entry::usage, and vs_get_cfg().

generate_vcfg_common_sorcery_handlers()

generate_vcfg_common_sorcery_handlers

(

verification_cfg

)

vcfg_cleanup()

void vcfg_cleanup

(

struct verification_cfg_common *

vcfg_common

)

Definition at line 71 of file verification_config.c.

{
    if (!vcfg_common) {
        return;
    }
    ast_string_field_free_memory(vcfg_common);
    if (vcfg_common->tcs) {
        crypto_free_cert_store(vcfg_common->tcs);
    }
    ast_free_acl_list(vcfg_common->acl);
}

References verification_cfg_common::acl, ast_free_acl_list(), ast_string_field_free_memory, crypto_free_cert_store, verification_cfg_common::tcs, and verification_cfg::vcfg_common.

Referenced by profile_destructor(), and verification_destructor().

verification_alloc()

static void * verification_alloc ( const char *  name )

static

Definition at line 90 of file verification_config.c.

{
    struct verification_cfg *cfg;
 
    cfg = ast_sorcery_generic_alloc(sizeof(*cfg), verification_destructor);
    if (!cfg) {
        return NULL;
    }
 
    if (ast_string_field_init(cfg, 1024)) {
        ao2_ref(cfg, -1);
        return NULL;
    }
 
    /*
     * The memory for vcfg_common actually comes from cfg
     * due to the weirdness of the STRFLDSET macro used with
     * sorcery.  We just use a token amount of memory in
     * this call so the initialize doesn't fail.
     */
    if (ast_string_field_init(&cfg->vcfg_common, 8)) {
        ao2_ref(cfg, -1);
        return NULL;
    }
 
    return cfg;
}

References ao2_ref, ast_sorcery_generic_alloc(), ast_string_field_init, NULL, verification_cfg::vcfg_common, and verification_destructor().

Referenced by vs_config_load(), and vs_config_reload().

verification_apply()

static int verification_apply ( const struct ast_sorcery *  sorcery, void *  obj  )

static

Definition at line 297 of file verification_config.c.

{
    struct verification_cfg *cfg = obj;
    const char *id = ast_sorcery_object_get_id(cfg);
 
    if (vs_check_common_config("verification", &cfg->vcfg_common) !=0) {
        return -1;
    }
 
    if (!cfg->vcfg_common.acl) {
        int error = 0;
        int ignore;
        int i;
 
        ast_append_acl("permit", "0.0.0.0/0", &cfg->vcfg_common.acl, &error, &ignore);
        if (error) {
            ast_free_acl_list(cfg->vcfg_common.acl);
            cfg->vcfg_common.acl = NULL;
            ast_log(LOG_ERROR, "%s: Unable to create default acl rule for '%s: %s'\n",
                id, "permit", "0.0.0.0/0");
            return -1;
        }
 
        for (i = 0; i < ARRAY_LEN(special_addresses); i++) {
            ast_append_acl("deny", special_addresses[i], &cfg->vcfg_common.acl, &error, &ignore);
            if (error) {
                ast_free_acl_list(cfg->vcfg_common.acl);
                cfg->vcfg_common.acl = NULL;
                ast_log(LOG_ERROR, "%s: Unable to create default acl rule for '%s: %s'\n",
                    id, "deny", special_addresses[i]);
                return -1;
            }
        }
    }
 
    return 0;
}

References verification_cfg_common::acl, ARRAY_LEN, ast_append_acl(), ast_free_acl_list(), ast_log, ast_sorcery_object_get_id(), error(), sip_to_pjsip::ignore(), LOG_ERROR, NULL, special_addresses, verification_cfg::vcfg_common, and vs_check_common_config().

Referenced by vs_config_load().

verification_destructor()

static void verification_destructor ( void *  obj )

static

Definition at line 83 of file verification_config.c.

{
    struct verification_cfg *cfg = obj;
    ast_string_field_free_memory(cfg);
    vcfg_cleanup(&cfg->vcfg_common);
}

References ast_string_field_free_memory, vcfg_cleanup(), and verification_cfg::vcfg_common.

Referenced by verification_alloc().

vs_check_common_config()

int vs_check_common_config	(	const char *	id,
		struct verification_cfg_common *	vcfg_common
	)

Definition at line 158 of file verification_config.c.

{
    SCOPE_ENTER(3, "%s: Checking common config\n", id);
 
    if (!ast_strlen_zero(vcfg_common->ca_file)
        && !ast_file_is_readable(vcfg_common->ca_file)) {
        SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
            "%s: ca_file '%s' not found, or is unreadable\n",
            id, vcfg_common->ca_file);
    }
 
    if (!ast_strlen_zero(vcfg_common->ca_path)
        && !ast_file_is_readable(vcfg_common->ca_path)) {
        SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
            "%s: ca_path '%s' not found, or is unreadable\n",
            id, vcfg_common->ca_path);
    }
 
    if (!ast_strlen_zero(vcfg_common->crl_file)
        && !ast_file_is_readable(vcfg_common->crl_file)) {
        SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
            "%s: crl_file '%s' not found, or is unreadable\n",
            id, vcfg_common->crl_file);
    }
 
    if (!ast_strlen_zero(vcfg_common->crl_path)
        && !ast_file_is_readable(vcfg_common->crl_path)) {
        SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
            "%s: crl_path '%s' not found, or is unreadable\n",
            id, vcfg_common->crl_path);
    }
 
    if (!ast_strlen_zero(vcfg_common->ca_file)
        || !ast_strlen_zero(vcfg_common->ca_path)) {
        int rc = 0;
 
        if (!vcfg_common->tcs) {
            vcfg_common->tcs = crypto_create_cert_store();
            if (!vcfg_common->tcs) {
                SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
                    "%s: Unable to create CA cert store\n", id);
            }
        }
        rc = crypto_load_cert_store(vcfg_common->tcs,
            vcfg_common->ca_file, vcfg_common->ca_path);
        if (rc != 0) {
            SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
                "%s: Unable to load CA cert store from '%s' or '%s'\n",
                id, vcfg_common->ca_file, vcfg_common->ca_path);
        }
    }
 
    if (!ast_strlen_zero(vcfg_common->crl_file)
        || !ast_strlen_zero(vcfg_common->crl_path)) {
        int rc = 0;
 
        if (!vcfg_common->tcs) {
            vcfg_common->tcs = crypto_create_cert_store();
            if (!vcfg_common->tcs) {
                SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
                    "%s: Unable to create CA cert store\n", id);
            }
        }
        rc = crypto_load_cert_store(vcfg_common->tcs,
            vcfg_common->crl_file, vcfg_common->crl_path);
        if (rc != 0) {
            SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
                "%s: Unable to load CA CRL store from '%s' or '%s'\n",
                id, vcfg_common->crl_file, vcfg_common->crl_path);
        }
    }
 
    if (vcfg_common->tcs) {
        if (ENUM_BOOL(vcfg_common->load_system_certs, load_system_certs)) {
            X509_STORE_set_default_paths(vcfg_common->tcs->store);
        }
 
        if (!ast_strlen_zero(vcfg_common->crl_file)
            || !ast_strlen_zero(vcfg_common->crl_path)) {
            X509_STORE_set_flags(vcfg_common->tcs->store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
        }
    }
 
    if (!ast_strlen_zero(vcfg_common->cert_cache_dir)) {
        FILE *fp;
        char *testfile;
 
        if (ast_asprintf(&testfile, "%s/testfile", vcfg_common->cert_cache_dir) <= 0) {
            SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
                "%s: Unable to allocate memory for testfile\n", id);
        }
 
        fp = fopen(testfile, "w+");
        if (!fp) {
            ast_free(testfile);
            SCOPE_EXIT_LOG_RTN_VALUE(-1, LOG_ERROR,
                "%s: cert_cache_dir '%s' was not writable\n",
                id, vcfg_common->cert_cache_dir);
        }
        fclose(fp);
        remove(testfile);
        ast_free(testfile);
    }
 
    SCOPE_EXIT_RTN_VALUE(0, "%s: Done\n", id);
}

References ast_asprintf, ast_file_is_readable(), ast_free, ast_strlen_zero(), verification_cfg_common::ca_file, verification_cfg_common::ca_path, verification_cfg_common::cert_cache_dir, verification_cfg_common::crl_file, verification_cfg_common::crl_path, crypto_create_cert_store(), crypto_load_cert_store(), ENUM_BOOL, verification_cfg_common::load_system_certs, LOG_ERROR, remove, SCOPE_ENTER, SCOPE_EXIT_LOG_RTN_VALUE, SCOPE_EXIT_RTN_VALUE, crypto_cert_store::store, verification_cfg_common::tcs, and verification_cfg::vcfg_common.

Referenced by profile_apply(), and verification_apply().

vs_config_load()

int vs_config_load

(

void

)

Definition at line 398 of file verification_config.c.

{
    struct ast_sorcery *sorcery = get_sorcery();
 
    snprintf(DEFAULT_cert_cache_dir, sizeof(DEFAULT_cert_cache_dir), "%s/keys/%s/cache",
        ast_config_AST_DATA_DIR, STIR_SHAKEN_DIR_NAME);
 
    ast_sorcery_apply_default(sorcery, CONFIG_TYPE, "config",
        "stir_shaken.conf,criteria=type=" CONFIG_TYPE ",single_object=yes,explicit_name=" CONFIG_TYPE);
 
    if (ast_sorcery_object_register(sorcery, CONFIG_TYPE, verification_alloc,
            NULL, verification_apply)) {
        ast_log(LOG_ERROR, "stir/shaken - failed to register '%s' sorcery object\n", CONFIG_TYPE);
        return -1;
    }
 
    ast_sorcery_object_field_register_nodoc(sorcery, CONFIG_TYPE, "type", "",
        OPT_NOOP_T, 0, 0);
 
    ast_sorcery_object_field_register(sorcery, CONFIG_TYPE, "global_disable",
        DEFAULT_global_disable ? "yes" : "no",
        OPT_YESNO_T, 1, FLDSET(struct verification_cfg, global_disable));
 
    register_common_verification_fields(sorcery, verification_cfg, CONFIG_TYPE,);
 
    ast_sorcery_load_object(sorcery, CONFIG_TYPE);
 
    if (!vs_is_config_loaded()) {
        ast_log(LOG_WARNING,"Stir/Shaken verification service disabled.  Either there were errors in the 'verification' object in stir_shaken.conf or it was missing altogether.\n");
    }
    if (!empty_cfg) {
        empty_cfg = verification_alloc(CONFIG_TYPE);
        if (!empty_cfg) {
            return -1;
        }
        empty_cfg->global_disable = 1;
    }
 
    ast_cli_register_multiple(verification_cli,
        ARRAY_LEN(verification_cli));
 
    return 0;
}

References ARRAY_LEN, ast_cli_register_multiple, ast_config_AST_DATA_DIR, ast_log, ast_sorcery_apply_default, ast_sorcery_load_object(), ast_sorcery_object_field_register, ast_sorcery_object_field_register_nodoc, ast_sorcery_object_register, CONFIG_TYPE, DEFAULT_cert_cache_dir, DEFAULT_global_disable, empty_cfg, FLDSET, get_sorcery(), verification_cfg::global_disable, LOG_ERROR, LOG_WARNING, NULL, OPT_NOOP_T, OPT_YESNO_T, register_common_verification_fields, sorcery, STIR_SHAKEN_DIR_NAME, verification_alloc(), verification_apply(), verification_cli, and vs_is_config_loaded().

Referenced by vs_load().

vs_config_reload()

int vs_config_reload

(

void

)

Definition at line 370 of file verification_config.c.

{
    struct ast_sorcery *sorcery = get_sorcery();
    ast_sorcery_force_reload_object(sorcery, CONFIG_TYPE);
 
    if (!vs_is_config_loaded()) {
        ast_log(LOG_WARNING,"Stir/Shaken verification service disabled.  Either there were errors in the 'verification' object in stir_shaken.conf or it was missing altogether.\n");
    }
    if (!empty_cfg) {
        empty_cfg = verification_alloc(CONFIG_TYPE);
        if (!empty_cfg) {
            return -1;
        }
        empty_cfg->global_disable = 1;
    }
 
    return 0;
}

References ast_log, ast_sorcery_force_reload_object(), CONFIG_TYPE, empty_cfg, get_sorcery(), verification_cfg::global_disable, LOG_WARNING, sorcery, verification_alloc(), and vs_is_config_loaded().

Referenced by vs_reload().

vs_config_unload()

int vs_config_unload

(

void

)

Definition at line 389 of file verification_config.c.

{
    ast_cli_unregister_multiple(verification_cli,
        ARRAY_LEN(verification_cli));
    ao2_cleanup(empty_cfg);
 
    return 0;
}

References ao2_cleanup, ARRAY_LEN, ast_cli_unregister_multiple(), empty_cfg, and verification_cli.

Referenced by vs_unload().

vs_copy_cfg_common()

int vs_copy_cfg_common	(	const char *	id,
		struct verification_cfg_common *	cfg_dst,
		struct verification_cfg_common *	cfg_src
	)

Definition at line 118 of file verification_config.c.

{
    int rc = 0;
 
    if (!cfg_dst || !cfg_src) {
        return -1;
    }
 
    if (!cfg_dst->tcs && cfg_src->tcs) {
        cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, ca_file);
        cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, ca_path);
        cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, crl_file);
        cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, crl_path);
        ao2_bump(cfg_src->tcs);
        cfg_dst->tcs = cfg_src->tcs;
    }
 
    cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, cert_cache_dir);
 
    cfg_uint_copy(cfg_dst, cfg_src, curl_timeout);
    cfg_uint_copy(cfg_dst, cfg_src, max_iat_age);
    cfg_uint_copy(cfg_dst, cfg_src, max_date_header_age);
    cfg_uint_copy(cfg_dst, cfg_src, max_cache_entry_age);
    cfg_uint_copy(cfg_dst, cfg_src, max_cache_size);
 
    cfg_enum_copy(cfg_dst, cfg_src, stir_shaken_failure_action);
    cfg_enum_copy(cfg_dst, cfg_src, use_rfc9410_responses);
    cfg_enum_copy(cfg_dst, cfg_src, relax_x5u_port_scheme_restrictions);
    cfg_enum_copy(cfg_dst, cfg_src, relax_x5u_path_restrictions);
    cfg_enum_copy(cfg_dst, cfg_src, load_system_certs);
 
    if (cfg_src->acl) {
        ast_free_acl_list(cfg_dst->acl);
        cfg_dst->acl = ast_duplicate_acl_list(cfg_src->acl);
    }
 
    return rc;
}

References verification_cfg_common::acl, ao2_bump, ast_duplicate_acl_list(), ast_free_acl_list(), cfg_enum_copy, cfg_sf_copy_wrapper, cfg_uint_copy, and verification_cfg_common::tcs.

Referenced by create_effective_profile().

vs_get_cfg()

struct verification_cfg * vs_get_cfg

(

void

)

Definition at line 49 of file verification_config.c.

{
    struct verification_cfg *cfg = ast_sorcery_retrieve_by_id(get_sorcery(),
        CONFIG_TYPE, CONFIG_TYPE);
    if (cfg) {
        return cfg;
    }
 
    return empty_cfg ? ao2_bump(empty_cfg) : NULL;
}

References ao2_bump, ast_sorcery_retrieve_by_id(), CONFIG_TYPE, empty_cfg, get_sorcery(), and NULL.

Referenced by add_cert_expiration_to_astdb(), ast_stir_shaken_vs_ctx_create(), cli_verification_show(), and create_effective_profile().

vs_is_config_loaded()

int vs_is_config_loaded

(

void

)

Definition at line 60 of file verification_config.c.

{
    struct verification_cfg *cfg = ast_sorcery_retrieve_by_id(get_sorcery(),
        CONFIG_TYPE, CONFIG_TYPE);
    ao2_cleanup(cfg);
 
    return !!cfg;
}

References ao2_cleanup, ast_sorcery_retrieve_by_id(), CONFIG_TYPE, and get_sorcery().

Referenced by vs_config_load(), and vs_config_reload().

Variable Documentation

DEFAULT_cert_cache_dir

char DEFAULT_cert_cache_dir[PATH_MAX]

static

Definition at line 32 of file verification_config.c.

Referenced by vs_config_load().

empty_cfg

struct verification_cfg* empty_cfg = NULL

static

Definition at line 45 of file verification_config.c.

Referenced by vs_config_load(), vs_config_reload(), vs_config_unload(), and vs_get_cfg().

special_addresses

char* special_addresses[]

static

Definition at line 266 of file verification_config.c.

Referenced by verification_apply().

verification_cli

struct ast_cli_entry verification_cli[]

static

Initial value:

= {
    { .handler =  cli_verification_show , .summary =  "Show stir/shaken verification configuration" ,},
}

Definition at line 366 of file verification_config.c.

Referenced by vs_config_load(), and vs_config_unload().