Asterisk - The Open Source Telephony Project GIT-master-55f4e6d
verification_config.c
Go to the documentation of this file.
1/*
2 * Asterisk -- An open source telephony toolkit.
3 *
4 * Copyright (C) 2023, Sangoma Technologies Corporation
5 *
6 * George Joseph <gjoseph@digium.com>
7 *
8 * See http://www.asterisk.org for more information about
9 * the Asterisk project. Please do not directly contact
10 * any of the maintainers of this project for assistance;
11 * the project provides a web site, mailing lists and IRC
12 * channels for your use.
13 *
14 * This program is free software, distributed under the terms of
15 * the GNU General Public License Version 2. See the LICENSE file
16 * at the top of the source tree.
17 */
18
19#include "asterisk.h"
20
21#include "asterisk/cli.h"
22#include "stir_shaken.h"
23
24#define CONFIG_TYPE "verification"
25
26#define DEFAULT_global_disable 0
27
28#define DEFAULT_ca_file NULL
29#define DEFAULT_ca_path NULL
30#define DEFAULT_crl_file NULL
31#define DEFAULT_crl_path NULL
33
34#define DEFAULT_curl_timeout 2
35#define DEFAULT_max_iat_age 15
36#define DEFAULT_max_date_header_age 15
37#define DEFAULT_max_cache_entry_age 3600
38#define DEFAULT_max_cache_size 1000
39#define DEFAULT_stir_shaken_failure_action stir_shaken_failure_action_CONTINUE
40#define DEFAULT_use_rfc9410_responses use_rfc9410_responses_NO
41#define DEFAULT_relax_x5u_port_scheme_restrictions relax_x5u_port_scheme_restrictions_NO
42#define DEFAULT_relax_x5u_path_restrictions relax_x5u_path_restrictions_NO
43#define DEFAULT_load_system_certs load_system_certs_NO
44
46
47#define STIR_SHAKEN_DIR_NAME "stir_shaken"
48
50{
53 if (cfg) {
54 return cfg;
55 }
56
57 return empty_cfg ? ao2_bump(empty_cfg) : NULL;
58}
59
61{
64 ao2_cleanup(cfg);
65
66 return !!cfg;
67}
68
70
72{
73 if (!vcfg_common) {
74 return;
75 }
77 if (vcfg_common->tcs) {
79 }
81}
82
83static void verification_destructor(void *obj)
84{
85 struct verification_cfg *cfg = obj;
88}
89
90static void *verification_alloc(const char *name)
91{
92 struct verification_cfg *cfg;
93
95 if (!cfg) {
96 return NULL;
97 }
98
99 if (ast_string_field_init(cfg, 1024)) {
100 ao2_ref(cfg, -1);
101 return NULL;
102 }
103
104 /*
105 * The memory for vcfg_common actually comes from cfg
106 * due to the weirdness of the STRFLDSET macro used with
107 * sorcery. We just use a token amount of memory in
108 * this call so the initialize doesn't fail.
109 */
110 if (ast_string_field_init(&cfg->vcfg_common, 8)) {
111 ao2_ref(cfg, -1);
112 return NULL;
113 }
114
115 return cfg;
116}
117
118int vs_copy_cfg_common(const char *id, struct verification_cfg_common *cfg_dst,
119 struct verification_cfg_common *cfg_src)
120{
121 int rc = 0;
122
123 if (!cfg_dst || !cfg_src) {
124 return -1;
125 }
126
127 if (!cfg_dst->tcs && cfg_src->tcs) {
128 cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, ca_file);
129 cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, ca_path);
130 cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, crl_file);
131 cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, crl_path);
132 ao2_bump(cfg_src->tcs);
133 cfg_dst->tcs = cfg_src->tcs;
134 }
135
136 cfg_sf_copy_wrapper(id, cfg_dst, cfg_src, cert_cache_dir);
137
138 cfg_uint_copy(cfg_dst, cfg_src, curl_timeout);
139 cfg_uint_copy(cfg_dst, cfg_src, max_iat_age);
140 cfg_uint_copy(cfg_dst, cfg_src, max_date_header_age);
141 cfg_uint_copy(cfg_dst, cfg_src, max_cache_entry_age);
142 cfg_uint_copy(cfg_dst, cfg_src, max_cache_size);
143
144 cfg_enum_copy(cfg_dst, cfg_src, stir_shaken_failure_action);
145 cfg_enum_copy(cfg_dst, cfg_src, use_rfc9410_responses);
146 cfg_enum_copy(cfg_dst, cfg_src, relax_x5u_port_scheme_restrictions);
147 cfg_enum_copy(cfg_dst, cfg_src, relax_x5u_path_restrictions);
148 cfg_enum_copy(cfg_dst, cfg_src, load_system_certs);
149
150 if (cfg_src->acl) {
151 ast_free_acl_list(cfg_dst->acl);
152 cfg_dst->acl = ast_duplicate_acl_list(cfg_src->acl);
153 }
154
155 return rc;
156}
157
158int vs_check_common_config(const char *id,
160{
161 SCOPE_ENTER(3, "%s: Checking common config\n", id);
162
166 "%s: ca_file '%s' not found, or is unreadable\n",
167 id, vcfg_common->ca_file);
168 }
169
173 "%s: ca_path '%s' not found, or is unreadable\n",
174 id, vcfg_common->ca_path);
175 }
176
180 "%s: crl_file '%s' not found, or is unreadable\n",
181 id, vcfg_common->crl_file);
182 }
183
187 "%s: crl_path '%s' not found, or is unreadable\n",
188 id, vcfg_common->crl_path);
189 }
190
193 int rc = 0;
194
195 if (!vcfg_common->tcs) {
197 if (!vcfg_common->tcs) {
199 "%s: Unable to create CA cert store\n", id);
200 }
201 }
204 if (rc != 0) {
206 "%s: Unable to load CA cert store from '%s' or '%s'\n",
208 }
209 }
210
213 int rc = 0;
214
215 if (!vcfg_common->tcs) {
217 if (!vcfg_common->tcs) {
219 "%s: Unable to create CA cert store\n", id);
220 }
221 }
224 if (rc != 0) {
226 "%s: Unable to load CA CRL store from '%s' or '%s'\n",
228 }
229 }
230
231 if (vcfg_common->tcs) {
232 if (ENUM_BOOL(vcfg_common->load_system_certs, load_system_certs)) {
233 X509_STORE_set_default_paths(vcfg_common->tcs->store);
234 }
235
238 X509_STORE_set_flags(vcfg_common->tcs->store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
239 }
240 }
241
243 FILE *fp;
244 char *testfile;
245
246 if (ast_asprintf(&testfile, "%s/testfile", vcfg_common->cert_cache_dir) <= 0) {
248 "%s: Unable to allocate memory for testfile\n", id);
249 }
250
251 fp = fopen(testfile, "w+");
252 if (!fp) {
253 ast_free(testfile);
255 "%s: cert_cache_dir '%s' was not writable\n",
257 }
258 fclose(fp);
259 remove(testfile);
260 ast_free(testfile);
261 }
262
263 SCOPE_EXIT_RTN_VALUE(0, "%s: Done\n", id);
264}
265
266static char *special_addresses[] = {
267 "0.0.0.0/8",
268 "10.0.0.0/8",
269 "100.64.0.0/10",
270 "127.0.0.0/8",
271 "169.254.0.0/16",
272 "172.16.0.0/12",
273 "192.0.0.0/24",
274 "192.0.0.0/29",
275 "192.88.99.0/24",
276 "192.168.0.0/16",
277 "198.18.0.0/15",
278 "198.51.100.0/24",
279 "203.0.113.0/24",
280 "240.0.0.0/4",
281 "255.255.255.255/32",
282 "::1/128",
283 "::/128",
284/* "64:ff9b::/96", IPv4-IPv6 translation addresses should probably not be blocked by default */
285/* "::ffff:0:0/96", IPv4 mapped addresses should probably not be blocked by default */
286 "100::/64",
287 "2001::/23",
288 "2001::/32",
289 "2001:2::/48",
290 "2001:db8::/32",
291 "2001:10::/28",
292/* "2002::/16", 6to4 should problably not be blocked by default */
293 "fc00::/7",
294 "fe80::/10",
295};
296
297static int verification_apply(const struct ast_sorcery *sorcery, void *obj)
298{
299 struct verification_cfg *cfg = obj;
300 const char *id = ast_sorcery_object_get_id(cfg);
301
302 if (vs_check_common_config("verification", &cfg->vcfg_common) !=0) {
303 return -1;
304 }
305
306 if (!cfg->vcfg_common.acl) {
307 int error = 0;
308 int ignore;
309 int i;
310
311 ast_append_acl("permit", "0.0.0.0/0", &cfg->vcfg_common.acl, &error, &ignore);
312 if (error) {
314 cfg->vcfg_common.acl = NULL;
315 ast_log(LOG_ERROR, "%s: Unable to create default acl rule for '%s: %s'\n",
316 id, "permit", "0.0.0.0/0");
317 return -1;
318 }
319
320 for (i = 0; i < ARRAY_LEN(special_addresses); i++) {
322 if (error) {
324 cfg->vcfg_common.acl = NULL;
325 ast_log(LOG_ERROR, "%s: Unable to create default acl rule for '%s: %s'\n",
326 id, "deny", special_addresses[i]);
327 return -1;
328 }
329 }
330 }
331
332 return 0;
333}
334
335static char *cli_verification_show(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
336{
337 struct verification_cfg *cfg;
338 struct config_object_cli_data data = {
339 .title = "Default Verification",
340 .object_type = config_object_type_verification,
341 };
342
343 switch(cmd) {
344 case CLI_INIT:
345 e->command = "stir_shaken show verification";
346 e->usage =
347 "Usage: stir_shaken show verification\n"
348 " Show the stir/shaken verification settings\n";
349 return NULL;
350 case CLI_GENERATE:
351 return NULL;
352 }
353
354 if (a->argc != 3) {
355 return CLI_SHOWUSAGE;
356 }
357
358 cfg = vs_get_cfg();
359 config_object_cli_show(cfg, a, &data, 0);
360
361 ao2_cleanup(cfg);
362
363 return CLI_SUCCESS;
364}
365
367 AST_CLI_DEFINE(cli_verification_show, "Show stir/shaken verification configuration"),
368};
369
371{
372 struct ast_sorcery *sorcery = get_sorcery();
374
375 if (!vs_is_config_loaded()) {
376 ast_log(LOG_WARNING,"Stir/Shaken verification service disabled. Either there were errors in the 'verification' object in stir_shaken.conf or it was missing altogether.\n");
377 }
378 if (!empty_cfg) {
380 if (!empty_cfg) {
381 return -1;
382 }
384 }
385
386 return 0;
387}
388
390{
394
395 return 0;
396}
397
399{
400 struct ast_sorcery *sorcery = get_sorcery();
401
402 snprintf(DEFAULT_cert_cache_dir, sizeof(DEFAULT_cert_cache_dir), "%s/keys/%s/cache",
404
406 "stir_shaken.conf,criteria=type=" CONFIG_TYPE ",single_object=yes,explicit_name=" CONFIG_TYPE);
407
410 ast_log(LOG_ERROR, "stir/shaken - failed to register '%s' sorcery object\n", CONFIG_TYPE);
411 return -1;
412 }
413
415 OPT_NOOP_T, 0, 0);
416
418 DEFAULT_global_disable ? "yes" : "no",
419 OPT_YESNO_T, 1, FLDSET(struct verification_cfg, global_disable));
420
422
424
425 if (!vs_is_config_loaded()) {
426 ast_log(LOG_WARNING,"Stir/Shaken verification service disabled. Either there were errors in the 'verification' object in stir_shaken.conf or it was missing altogether.\n");
427 }
428 if (!empty_cfg) {
430 if (!empty_cfg) {
431 return -1;
432 }
434 }
435
438
439 return 0;
440}
void ast_append_acl(const char *sense, const char *stuff, struct ast_acl_list **path, int *error, int *named_acl_flag)
Add a rule to an ACL struct.
Definition: acl.c:429
struct ast_acl_list * ast_free_acl_list(struct ast_acl_list *acl)
Free a list of ACLs.
Definition: acl.c:233
struct ast_acl_list * ast_duplicate_acl_list(struct ast_acl_list *original)
Duplicates the contests of a list of lists of host access rules.
Definition: acl.c:315
Asterisk main include file. File version handling, generic pbx functions.
#define PATH_MAX
Definition: asterisk.h:40
#define ast_free(a)
Definition: astmm.h:180
#define ast_asprintf(ret, fmt,...)
A wrapper for asprintf()
Definition: astmm.h:267
#define ast_log
Definition: astobj2.c:42
#define ao2_cleanup(obj)
Definition: astobj2.h:1934
#define ao2_ref(o, delta)
Reference/unreference an object and return the old refcount.
Definition: astobj2.h:459
#define ao2_bump(obj)
Bump refcount on an AO2 object by one, returning the object.
Definition: astobj2.h:480
Standard Command Line Interface.
#define CLI_SHOWUSAGE
Definition: cli.h:45
#define CLI_SUCCESS
Definition: cli.h:44
int ast_cli_unregister_multiple(struct ast_cli_entry *e, int len)
Unregister multiple commands.
Definition: clicompat.c:30
#define AST_CLI_DEFINE(fn, txt,...)
Definition: cli.h:197
@ CLI_INIT
Definition: cli.h:152
@ CLI_GENERATE
Definition: cli.h:153
#define ast_cli_register_multiple(e, len)
Register multiple commands.
Definition: cli.h:265
int config_object_cli_show(void *obj, void *arg, void *data, int flags)
Output configuration settings to the Asterisk CLI.
struct ast_sorcery * get_sorcery(void)
Retrieve the stir/shaken sorcery context.
Definition: common_config.c:34
@ config_object_type_verification
#define cfg_uint_copy(__cfg_dst, __cfg_src, __field)
cfg_uint_copy
#define cfg_sf_copy_wrapper(id, __cfg_dst, __cfg_src, __field)
cfg_copy_wrapper
#define register_common_verification_fields(sorcery, object, CONFIG_TYPE, nodoc)
#define ENUM_BOOL(__enum1, __field)
#define cfg_enum_copy(__cfg_dst, __cfg_src, __field)
cfg_enum_copy
#define FLDSET(type,...)
Convert a struct and list of fields to an argument list of field offsets.
@ OPT_NOOP_T
Type for a default handler that should do nothing.
@ OPT_YESNO_T
Type for default option handler for bools (ast_true/ast_false)
struct crypto_cert_store * crypto_create_cert_store(void)
Create an empty X509 store.
Definition: crypto_utils.c:315
int crypto_load_cert_store(struct crypto_cert_store *store, const char *file, const char *path)
Load an X509 Store with either certificates or CRLs.
Definition: crypto_utils.c:333
#define crypto_free_cert_store(store)
Free an X509 store.
Definition: crypto_utils.h:180
static const char name[]
Definition: format_mp3.c:68
#define SCOPE_EXIT_RTN_VALUE(__return_value,...)
#define SCOPE_EXIT_LOG_RTN_VALUE(__value, __log_level,...)
#define SCOPE_ENTER(level,...)
#define LOG_ERROR
#define LOG_WARNING
#define remove
def ignore(key=None, val=None, section=None, pjsip=None, nmapped=None, type='endpoint')
Definition: sip_to_pjsip.py:48
const char * ast_config_AST_DATA_DIR
Definition: options.c:158
static struct ast_sorcery * sorcery
#define NULL
Definition: resample.c:96
const char * ast_sorcery_object_get_id(const void *object)
Get the unique identifier of a sorcery object.
Definition: sorcery.c:2317
#define ast_sorcery_object_field_register_nodoc(sorcery, type, name, default_val, opt_type, flags,...)
Register a field within an object without documentation.
Definition: sorcery.h:987
void * ast_sorcery_retrieve_by_id(const struct ast_sorcery *sorcery, const char *type, const char *id)
Retrieve an object using its unique identifier.
Definition: sorcery.c:1853
#define ast_sorcery_object_register(sorcery, type, alloc, transform, apply)
Register an object type.
Definition: sorcery.h:837
void ast_sorcery_load_object(const struct ast_sorcery *sorcery, const char *type)
Inform any wizards of a specific object type to load persistent objects.
Definition: sorcery.c:1393
void * ast_sorcery_generic_alloc(size_t size, ao2_destructor_fn destructor)
Allocate a generic sorcery capable object.
Definition: sorcery.c:1728
#define ast_sorcery_object_field_register(sorcery, type, name, default_val, opt_type, flags,...)
Register a field within an object.
Definition: sorcery.h:955
void ast_sorcery_force_reload_object(const struct ast_sorcery *sorcery, const char *type)
Inform any wizards of a specific object type to reload persistent objects even if no changes determin...
Definition: sorcery.c:1457
#define ast_sorcery_apply_default(sorcery, type, name, data)
Definition: sorcery.h:476
#define ast_string_field_init(x, size)
Initialize a field pool and fields.
Definition: stringfields.h:359
#define ast_string_field_free_memory(x)
free all memory - to be called before destroying the object
Definition: stringfields.h:374
static force_inline int attribute_pure ast_strlen_zero(const char *s)
Definition: strings.h:65
descriptor for a cli entry.
Definition: cli.h:171
char * command
Definition: cli.h:186
const char * usage
Definition: cli.h:177
Full structure for sorcery.
Definition: sorcery.c:230
X509_STORE * store
Definition: crypto_utils.h:171
Verification Service configuration for stir/shaken.
struct crypto_cert_store * tcs
const ast_string_field cert_cache_dir
const ast_string_field ca_path
const ast_string_field crl_file
const ast_string_field crl_path
enum load_system_certs_enum load_system_certs
const ast_string_field ca_file
struct ast_acl_list * acl
struct verification_cfg_common vcfg_common
static struct test_val a
int error(const char *format,...)
Definition: utils/frame.c:999
int ast_file_is_readable(const char *filename)
Test that a file exists and is readable by the effective user.
Definition: utils.c:3107
#define ARRAY_LEN(a)
Definition: utils.h:666
static int verification_apply(const struct ast_sorcery *sorcery, void *obj)
void vcfg_cleanup(struct verification_cfg_common *vcfg_common)
int vs_config_reload(void)
static struct ast_cli_entry verification_cli[]
generate_vcfg_common_sorcery_handlers(verification_cfg)
int vs_is_config_loaded(void)
static void verification_destructor(void *obj)
#define STIR_SHAKEN_DIR_NAME
static char * cli_verification_show(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
struct verification_cfg * vs_get_cfg(void)
static void * verification_alloc(const char *name)
int vs_copy_cfg_common(const char *id, struct verification_cfg_common *cfg_dst, struct verification_cfg_common *cfg_src)
static char DEFAULT_cert_cache_dir[PATH_MAX]
#define DEFAULT_global_disable
int vs_config_load(void)
static struct verification_cfg * empty_cfg
int vs_config_unload(void)
int vs_check_common_config(const char *id, struct verification_cfg_common *vcfg_common)
static char * special_addresses[]
#define CONFIG_TYPE