security_agreements.c File Reference

Interact with security agreement negotiations and mechanisms. More...

#include "asterisk.h"
#include <pjsip.h>
#include "asterisk/res_pjsip.h"

Include dependency graph for security_agreements.c:

Go to the source code of this file.

Functions
int	ast_sip_add_security_headers (struct ast_sip_security_mechanism_vector *security_mechanisms, const char *header_name, int add_qval, pjsip_tx_data *tdata)
	Add security headers to transmission data.
void	ast_sip_header_to_security_mechanism (const pjsip_generic_string_hdr *hdr, struct ast_sip_security_mechanism_vector *security_mechanisms)
	Append to security mechanism vector from SIP header.
void	ast_sip_remove_headers_by_name_and_value (pjsip_msg *msg, const pj_str_t *hdr_name, const char *value)
	Removes all headers of a specific name and value from a pjsip_msg.
int	ast_sip_security_mechanism_vector_init (struct ast_sip_security_mechanism_vector *security_mechanisms, const char *value)
	Initialize security mechanism vector from string of security mechanisms.
int	ast_sip_security_mechanisms_to_str (const struct ast_sip_security_mechanism_vector *security_mechanisms, int add_qvalue, char **buf)
	Writes the security mechanisms of an endpoint into a buffer as a string and returns the buffer.
void	ast_sip_security_mechanisms_vector_copy (struct ast_sip_security_mechanism_vector *dst, const struct ast_sip_security_mechanism_vector *src)
	Duplicate a security mechanism.
void	ast_sip_security_mechanisms_vector_destroy (struct ast_sip_security_mechanism_vector *security_mechanisms)
	Free contents of a security mechanism vector.
int	ast_sip_str_to_security_mechanism (struct ast_sip_security_mechanism **security_mechanism, const char *value)
	Allocate a security mechanism from a string.
static float	parse_qvalue (const char *q_value)
static void	security_mechanism_destroy (struct ast_sip_security_mechanism *mech)
static int	security_mechanism_to_str (const struct ast_sip_security_mechanism *security_mechanism, int add_qvalue, char **buf)
static struct ast_sip_security_mechanism *	security_mechanisms_alloc (size_t n_params)
static struct ast_sip_security_mechanism *	security_mechanisms_copy (const struct ast_sip_security_mechanism *src)
static int	str_to_security_mechanism_type (const char *security_mechanism)

Variables
static char *	mechanism_str []

Detailed Description

Interact with security agreement negotiations and mechanisms.

Author

Maximilian Fridrich m.fri.nosp@m.dric.nosp@m.h@com.nosp@m.mend.nosp@m..com

Definition in file security_agreements.c.

Function Documentation

ast_sip_add_security_headers()

int ast_sip_add_security_headers	(	struct ast_sip_security_mechanism_vector *	security_mechanisms,
		const char *	header_name,
		int	add_qval,
		pjsip_tx_data *	tdata
	)

Add security headers to transmission data.

Parameters

security_mechanisms	Vector of security mechanisms.
header_name	The header name under which to add the security mechanisms. One of Security-Client, Security-Server, Security-Verify.
add_qval	If zero, don't add the q-value to the header.
tdata	The transmission data.

Return values

0	Success
non-zero	Failure

Definition at line 290 of file security_agreements.c.

                                                                     {
    struct ast_sip_security_mechanism *mech;
    char *buf;
    int mech_cnt;
    int i;
    int add_qvalue = 1;
    static const pj_str_t proxy_require = { "Proxy-Require", 13 };
    static const pj_str_t require = { "Require", 7 };
 
    if (!security_mechanisms || !tdata) {
        return EINVAL;
    }
 
    if (!strcmp(header_name, "Security-Client")) {
        add_qvalue = 0;
    } else if (strcmp(header_name, "Security-Server") &&
            strcmp(header_name, "Security-Verify")) {
        return EINVAL;
    }
    /* If we're adding Security-Client headers, don't add q-value
     * even if the function caller requested it. */
    add_qvalue = add_qvalue && add_qval;
 
    mech_cnt = AST_VECTOR_SIZE(security_mechanisms);
    for (i = 0; i < mech_cnt; ++i) {
        mech = AST_VECTOR_GET(security_mechanisms, i);
        if (security_mechanism_to_str(mech, add_qvalue, &buf)) {
            continue;
        }
        ast_sip_add_header(tdata, header_name, buf);
        ast_free(buf);
    }
 
    if (pjsip_msg_find_hdr_by_name(tdata->msg, &require, NULL) == NULL) {
        ast_sip_add_header(tdata, "Require", "mediasec");
    }
    if (pjsip_msg_find_hdr_by_name(tdata->msg, &proxy_require, NULL) == NULL) {
        ast_sip_add_header(tdata, "Proxy-Require", "mediasec");
    }
    return 0;
}

References ast_free, ast_sip_add_header(), AST_VECTOR_GET, AST_VECTOR_SIZE, buf, NULL, and security_mechanism_to_str().

Referenced by add_outgoing_request_headers(), and add_security_headers().

ast_sip_header_to_security_mechanism()

void ast_sip_header_to_security_mechanism	(	const pjsip_generic_string_hdr *	hdr,
		struct ast_sip_security_mechanism_vector *	security_mechanisms
	)

Append to security mechanism vector from SIP header.

Parameters

hdr	The header of the security mechanisms.
security_mechanisms	Vector of security mechanisms to append to. Header name must be one of Security-Client, Security-Server, Security-Verify.

Definition at line 333 of file security_agreements.c.

                                                                       {
 
    struct ast_sip_security_mechanism *mech;
    char buf[512];
    char *hdr_val;
    char *mechanism;
 
    if (!security_mechanisms || !hdr) {
        return;
    }
 
    if (pj_stricmp2(&hdr->name, "Security-Client") && pj_stricmp2(&hdr->name, "Security-Server") &&
            pj_stricmp2(&hdr->name, "Security-Verify")) {
        return;
    }
 
    ast_copy_pj_str(buf, &hdr->hvalue, sizeof(buf));
    hdr_val = ast_skip_blanks(buf);
 
    while ((mechanism = ast_strsep(&hdr_val, ',', AST_STRSEP_ALL))) {
        if (!ast_sip_str_to_security_mechanism(&mech, mechanism)) {
            AST_VECTOR_APPEND(security_mechanisms, mech);
        }
    }
}

References ast_copy_pj_str(), ast_sip_str_to_security_mechanism(), ast_skip_blanks(), ast_strsep(), AST_STRSEP_ALL, AST_VECTOR_APPEND, and buf.

Referenced by contact_add_security_headers_to_status(), and handle_registration_response().

ast_sip_remove_headers_by_name_and_value()

void ast_sip_remove_headers_by_name_and_value	(	pjsip_msg *	msg,
		const pj_str_t *	hdr_name,
		const char *	value
	)

Removes all headers of a specific name and value from a pjsip_msg.

Parameters

msg	PJSIP message from which to remove headers.
hdr_name	Name of the header to remove.
value	Optional string value of the header to remove. If NULL, remove all headers of given hdr_name.

Definition at line 203 of file security_agreements.c.

{
    struct pjsip_generic_string_hdr *hdr = pjsip_msg_find_hdr_by_name(msg, hdr_name, NULL);
    for (; hdr; hdr = pjsip_msg_find_hdr_by_name(msg, hdr_name, hdr->next)) {
        if (value == NULL || !pj_strcmp2(&hdr->hvalue, value)) {
            pj_list_erase(hdr);
        }
        if (hdr->next == hdr) {
            break;
        }
    }
}

References NULL, and value.

Referenced by add_security_headers().

ast_sip_security_mechanism_vector_init()

int ast_sip_security_mechanism_vector_init	(	struct ast_sip_security_mechanism_vector *	security_mechanism,
		const char *	value
	)

Initialize security mechanism vector from string of security mechanisms.

Parameters

security_mechanism	Pointer to vector of security mechanisms to initialize.
value	String of security mechanisms as defined in RFC 3329.

Return values

0	Success
non-zero	Failure

Definition at line 360 of file security_agreements.c.

{
    char *val = value ? ast_strdupa(value) : NULL;
    struct ast_sip_security_mechanism *mech;
    char *mechanism;
 
    ast_sip_security_mechanisms_vector_destroy(security_mechanisms);
    if (AST_VECTOR_INIT(security_mechanisms, 1)) {
        return -1;
    }
 
    if (!val) {
        return 0;
    }
 
    while ((mechanism = ast_strsep(&val, ',', AST_STRSEP_ALL))) {
        if (!ast_sip_str_to_security_mechanism(&mech, mechanism)) {
            AST_VECTOR_APPEND(security_mechanisms, mech);
        }
    }
 
    return 0;
}

References ast_sip_security_mechanisms_vector_destroy(), ast_sip_str_to_security_mechanism(), ast_strdupa, ast_strsep(), AST_STRSEP_ALL, AST_VECTOR_APPEND, AST_VECTOR_INIT, NULL, and value.

Referenced by security_mechanism_handler(), and security_mechanisms_handler().

ast_sip_security_mechanisms_to_str()

int ast_sip_security_mechanisms_to_str	(	const struct ast_sip_security_mechanism_vector *	security_mechanisms,
		int	add_qvalue,
		char **	buf
	)

Writes the security mechanisms of an endpoint into a buffer as a string and returns the buffer.

Note

The buffer must be freed by the caller.

Parameters

endpoint	Pointer to endpoint.
add_qvalue	If non-zero, the q-value is printed as well
buf	The buffer to write the string into

Return values

0	Success
non-zero	Failure

Definition at line 162 of file security_agreements.c.

{
    size_t vec_size;
    struct ast_sip_security_mechanism *mech;
    char *tmp_buf;
    RAII_VAR(struct ast_str *, str, ast_str_create(MAX_OBJECT_FIELD), ast_free);
    size_t i;
    int rc = 0;
 
    if (str == NULL) {
        return ENOMEM;
    }
 
    if (!security_mechanisms) {
        return -1;
    }
 
    vec_size = AST_VECTOR_SIZE(security_mechanisms);
    if (vec_size == 0) {
        return -1;
    }
 
    for (i = 0; i < vec_size; ++i) {
        mech = AST_VECTOR_GET(security_mechanisms, i);
        rc = security_mechanism_to_str(mech, add_qvalue, &tmp_buf);
        if (rc) {
            return rc;
        }
        rc = ast_str_append(&str, 0, "%s, ", tmp_buf);
        ast_free(tmp_buf);
        if (rc <= 0) {
            return ENOMEM;
        }
    }
 
    /* ast_str_truncate removes the trailing ", " on the last mechanism */
    *buf = ast_strdup(ast_str_truncate(str, -2));
 
    return 0;
}

References ast_free, ast_str_append(), ast_str_create, ast_str_truncate(), ast_strdup, AST_VECTOR_GET, AST_VECTOR_SIZE, buf, MAX_OBJECT_FIELD, NULL, RAII_VAR, security_mechanism_to_str(), and str.

Referenced by security_mechanism_to_str(), and security_mechanism_to_str().

ast_sip_security_mechanisms_vector_copy()

void ast_sip_security_mechanisms_vector_copy	(	struct ast_sip_security_mechanism_vector *	dst,
		const struct ast_sip_security_mechanism_vector *	src
	)

Duplicate a security mechanism.

Parameters

dst	Security mechanism to duplicate to.
src	Security mechanism to duplicate.

Definition at line 81 of file security_agreements.c.

{
    struct ast_sip_security_mechanism *mech;
    int i;
 
    ast_sip_security_mechanisms_vector_destroy(dst);
    for (i = 0; i < AST_VECTOR_SIZE(src); i++) {
        mech = AST_VECTOR_GET(src, i);
        AST_VECTOR_APPEND(dst, security_mechanisms_copy(mech));
    }
};

References ast_sip_security_mechanisms_vector_destroy(), AST_VECTOR_APPEND, AST_VECTOR_GET, AST_VECTOR_SIZE, and security_mechanisms_copy().

Referenced by sip_contact_status_copy(), and sip_outbound_registration_perform().

ast_sip_security_mechanisms_vector_destroy()

void ast_sip_security_mechanisms_vector_destroy

(

struct ast_sip_security_mechanism_vector *

security_mechanisms

)

Free contents of a security mechanism vector.

Parameters

security_mechanisms

Vector whose contents are to be freed

Definition at line 94 of file security_agreements.c.

{
    if (!security_mechanisms) {
        return;
    }
 
    AST_VECTOR_RESET(security_mechanisms, security_mechanism_destroy);
    AST_VECTOR_FREE(security_mechanisms);
}

References AST_VECTOR_FREE, AST_VECTOR_RESET, and security_mechanism_destroy().

Referenced by ast_sip_security_mechanism_vector_init(), ast_sip_security_mechanisms_vector_copy(), endpoint_destructor(), handle_client_state_destruction(), sip_contact_status_dtor(), sip_outbound_registration_destroy(), and sip_outbound_registration_perform().

ast_sip_str_to_security_mechanism()

int ast_sip_str_to_security_mechanism	(	struct ast_sip_security_mechanism **	security_mechanism,
		const char *	value
	)

Allocate a security mechanism from a string.

Parameters

security_mechanism	Pointer-pointer to the security mechanism to allocate.
value	The security mechanism string as defined in RFC 3329 (section 2.2) in the form <mechanism_name>;q=<q_value>;<mechanism_parameters>

Return values

0	Success
non-zero	Failure

Definition at line 242 of file security_agreements.c.

                                                                                                                 {
    struct ast_sip_security_mechanism *mech;
    char *param;
    char *tmp;
    char *mechanism = ast_strdupa(value);
    int err = 0;
    int type = -1;
 
    mech = security_mechanisms_alloc(1);
    if (!mech) {
        err = ENOMEM;
        goto out;
    }
 
    tmp = ast_strsep(&mechanism, ';', AST_STRSEP_ALL);
    type = str_to_security_mechanism_type(tmp);
    if (type == -1) {
        err = EINVAL;
        goto out;
    }
 
    mech->type = type;
    while ((param = ast_strsep(&mechanism, ';', AST_STRSEP_ALL))) {
        if (!param) {
            err = EINVAL;
            goto out;
        }
        if (!strncmp(param, "q=", 2)) {
            mech->qvalue = parse_qvalue(&param[2]);
            if (mech->qvalue < 0.0) {
                err = EINVAL;
                goto out;
            }
            continue;
        }
        param = ast_strdup(param);
        AST_VECTOR_APPEND(&mech->mechanism_parameters, param);
    }
 
    *security_mechanism = mech;
 
out:
    if (err && (mech != NULL)) {
        security_mechanism_destroy(mech);
    }
    return err;
}

References ast_strdup, ast_strdupa, ast_strsep(), AST_STRSEP_ALL, AST_VECTOR_APPEND, ast_sip_security_mechanism::mechanism_parameters, NULL, out, parse_qvalue(), ast_sip_security_mechanism::qvalue, security_mechanism_destroy(), security_mechanisms_alloc(), str_to_security_mechanism_type(), type, ast_sip_security_mechanism::type, and value.

Referenced by ast_sip_header_to_security_mechanism(), ast_sip_security_mechanism_vector_init(), and rfc3329_incoming_response().

parse_qvalue()

static float parse_qvalue ( const char *  q_value )

static

Definition at line 225 of file security_agreements.c.

                                               {
    char *end;
    float ret = strtof(q_value, &end);
 
    if (end == q_value) {
        /* Not a number. */
        return -1.0;
    } else if ('\0' != *end) {
        /* Extra character at end of input. */
        return -1.0;
    } else if (ret > 1.0 || ret < 0.0) {
        /* Out of valid range. */
        return -1.0;
    }
    return ret;
}

References end.

Referenced by ast_sip_str_to_security_mechanism().

security_mechanism_destroy()

static void security_mechanism_destroy ( struct ast_sip_security_mechanism *  mech )

static

Definition at line 74 of file security_agreements.c.

{
    AST_VECTOR_RESET(&mech->mechanism_parameters, ast_free);
    AST_VECTOR_FREE(&mech->mechanism_parameters);
    ast_free(mech);
}

References ast_free, AST_VECTOR_FREE, AST_VECTOR_RESET, and ast_sip_security_mechanism::mechanism_parameters.

Referenced by ast_sip_security_mechanisms_vector_destroy(), and ast_sip_str_to_security_mechanism().

security_mechanism_to_str()

static int security_mechanism_to_str ( const struct ast_sip_security_mechanism *  security_mechanism, int  add_qvalue, char **  buf  )

static

Definition at line 124 of file security_agreements.c.

{
    size_t size;
    int i;
    int rc = 0;
    RAII_VAR(struct ast_str *, str, ast_str_create(MAX_OBJECT_FIELD), ast_free);
 
    if (str == NULL) {
        return ENOMEM;
    }
 
    if (security_mechanism == NULL) {
        return EINVAL;
    }
 
    rc = ast_str_set(&str, 0, "%s", mechanism_str[security_mechanism->type]);
    if (rc <= 0) {
        return ENOMEM;
    }
    if (add_qvalue) {
        rc = ast_str_append(&str, 0, ";q=%f.4", security_mechanism->qvalue);
        if (rc <= 0) {
            return ENOMEM;
        }
    }
 
    size = AST_VECTOR_SIZE(&security_mechanism->mechanism_parameters);
    for (i = 0; i < size; ++i) {
        rc = ast_str_append(&str, 0, ";%s", AST_VECTOR_GET(&security_mechanism->mechanism_parameters, i));
        if (rc <= 0) {
            return ENOMEM;
        }
    }
 
    *buf = ast_strdup(ast_str_buffer(str));
    return 0;
}

References ast_free, ast_str_append(), ast_str_buffer(), ast_str_create, ast_str_set(), ast_strdup, AST_VECTOR_GET, AST_VECTOR_SIZE, buf, MAX_OBJECT_FIELD, ast_sip_security_mechanism::mechanism_parameters, mechanism_str, NULL, ast_sip_security_mechanism::qvalue, RAII_VAR, str, and ast_sip_security_mechanism::type.

Referenced by ast_sip_add_security_headers(), and ast_sip_security_mechanisms_to_str().

security_mechanisms_alloc()

static struct ast_sip_security_mechanism * security_mechanisms_alloc ( size_t  n_params )

static

Definition at line 33 of file security_agreements.c.

{
    struct ast_sip_security_mechanism *mech;
 
    mech = ast_calloc(1, sizeof(struct ast_sip_security_mechanism));
    if (mech == NULL) {
        return NULL;
    }
    mech->qvalue = 0.0;
    if (AST_VECTOR_INIT(&mech->mechanism_parameters, n_params) != 0) {
        ast_free(mech);
        return NULL;
    }
 
    return mech;
}

References ast_calloc, ast_free, AST_VECTOR_INIT, ast_sip_security_mechanism::mechanism_parameters, NULL, and ast_sip_security_mechanism::qvalue.

Referenced by ast_sip_str_to_security_mechanism(), and security_mechanisms_copy().

security_mechanisms_copy()

static struct ast_sip_security_mechanism * security_mechanisms_copy ( const struct ast_sip_security_mechanism *  src )

static

Definition at line 50 of file security_agreements.c.

{
    struct ast_sip_security_mechanism *dst = NULL;
    int i, n_params;
    char *param;
 
    n_params = AST_VECTOR_SIZE(&src->mechanism_parameters);
 
    dst = security_mechanisms_alloc(n_params);
    if (dst == NULL) {
        return NULL;
    }
    dst->type = src->type;
    dst->qvalue = src->qvalue;
 
    for (i = 0; i < n_params; i++) {
        param = ast_strdup(AST_VECTOR_GET(&src->mechanism_parameters, i));
        AST_VECTOR_APPEND(&dst->mechanism_parameters, param);
    }
 
    return dst;
}

References ast_strdup, AST_VECTOR_APPEND, AST_VECTOR_GET, AST_VECTOR_SIZE, ast_sip_security_mechanism::mechanism_parameters, NULL, ast_sip_security_mechanism::qvalue, security_mechanisms_alloc(), and ast_sip_security_mechanism::type.

Referenced by ast_sip_security_mechanisms_vector_copy().

str_to_security_mechanism_type()

static int str_to_security_mechanism_type ( const char *  security_mechanism )

static

Definition at line 112 of file security_agreements.c.

                                                                          {
    int i = 0;
 
    for (i = 0; i < ARRAY_LEN(mechanism_str); i++) {
        if (!strcasecmp(security_mechanism, mechanism_str[i])) {
            return i;
        }
    }
 
    return -1;
}

References ARRAY_LEN, and mechanism_str.

Referenced by ast_sip_str_to_security_mechanism().

Variable Documentation

mechanism_str

char* mechanism_str[]

static

Definition at line 104 of file security_agreements.c.

                               {
    [AST_SIP_SECURITY_MECH_NONE] = "none",
    [AST_SIP_SECURITY_MECH_MSRP_TLS] = "msrp-tls",
    [AST_SIP_SECURITY_MECH_SDES_SRTP] = "sdes-srtp",
    [AST_SIP_SECURITY_MECH_DTLS_SRTP] = "dtls-srtp",
};

Referenced by security_mechanism_to_str(), and str_to_security_mechanism_type().