1 /* 2 * Copyright (c) 2007 iptelorg GmbH 3 * 4 * This file is part of Kamailio, a free SIP server. 5 * 6 * Kamailio is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 2 of the License, or 9 * (at your option) any later version 10 * 11 * Kamailio is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, write to the Free Software 18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 */ 20 21 22 /*! 23 * \file 24 * \brief SIP-router auth-identity :: Module interface 25 * \ingroup auth-identity 26 * Module: \ref auth-identity 27 */ 28 29 #ifndef AUTH_IDENT_H 30 #define AUTH_IDENT_H 31 32 #include <openssl/x509.h> 33 #include <curl/curl.h> 34 35 #include "../../core/locking.h" 36 #include "../../core/mem/mem.h" 37 #include "../../core/parser/msg_parser.h" /* struct sip_msg */ 38 #include "../../core/str.h" /* struct str */ 39 #include "../../core/parser/parse_identity.h" 40 #include "../../core/parser/parse_identityinfo.h" 41 #include "../../core/parser/parse_date.h" 42 43 #define NEW_RSA_PROC 44 45 #define AUTH_DBG_LEVEL L_DBG 46 47 #define AUTH_URL_LENGTH 512 48 #define CERTIFICATE_URL_LENGTH AUTH_URL_LENGTH 49 #define CERTIFICATE_LENGTH 8*1024 50 #define DGST_STR_INIT_SIZE 8*1024 51 #define HASH_STR_SIZE 1024 52 #define AUTH_TIME_FORMAT "%a, %d %b %Y %H:%M:%S GMT" 53 #define AUTH_TIME_LENGTH 64 54 #define AUTH_CONTENTLENGTH_LENGTH AUTH_TIME_LENGTH 55 #define AUTH_DOMAIN_LENGTH 256 56 #define IDENTITY_INFO_FIRST_PART "Identity-Info: <" 57 #define IDENTITY_INFO_LAST_PART ">;alg=rsa-sha1\r\n" 58 59 #define IDENTITY_FIRST_PART "Identity: \"" 60 #define IDENTITY_LAST_PART "\"\r\n" 61 62 #define ITEM_IN_BUCKET_LIMIT 8 63 64 #define CERTIFICATE_TABLE_ENTRIES (2<<10) 65 #define CERTIFICATE_TABLE_ITEM_LIMIT CERTIFICATE_TABLE_ENTRIES*ITEM_IN_BUCKET_LIMIT*2 66 67 /* callid table garbage collector defines */ 68 #define CALLID_GARBAGE_COLLECTOR_INTERVAL 10 69 70 #define CALLID_TABLE_ENTRIES (2<<13) 71 #define CALLID_TABLE_ITEM_LIMIT CALLID_TABLE_ENTRIES*ITEM_IN_BUCKET_LIMIT*2 72 73 #define AUTH_MSG_VALIDITY_TIME 3600 74 #define AUTH_MSG_TO_AUTH_VALIDITY_TIME 600 75 76 #define BEGIN_PEM_CERT "-----BEGIN CERTIFICATE-----" 77 #define BEGIN_PEM_CERT_LEN (sizeof(BEGIN_PEM_CERT) - 1) 78 79 enum msg_part { 80 DS_FROM = 1, 81 DS_TO, 82 DS_CALLID, 83 DS_CSEQ, 84 DS_DATE, 85 DS_CONTACT, 86 DS_BODY 87 }; 88 89 enum msg_part_flag { 90 DS_REQUIRED = 0, 91 DS_NOTREQUIRED = 1 92 }; 93 94 typedef int (msg_part_proc)(str *, str *, struct sip_msg *); 95 typedef void (msg_part_free_proc)(void); 96 97 typedef struct _dgst_part { 98 int itype; 99 msg_part_proc *pfunc; 100 msg_part_free_proc *pfreefunc; 101 int iflag; 102 } dgst_part; 103 104 enum dgststr_asm_flags { 105 AUTH_ADD_DATE = 1, 106 AUTH_INCOMING_BODY = 1<<1, 107 AUTH_OUTGOING_BODY = 1<<2 108 }; 109 110 enum proc_ret_val { 111 AUTH_OK, 112 AUTH_NOTFOUND, 113 AUTH_FOUND, 114 AUTH_ERROR 115 }; 116 117 118 typedef struct _dstr { 119 str sd; 120 int size; 121 } dynstr; 122 123 int app2dynstr(dynstr *sout, str *s2app); 124 int app2dynchr(dynstr *sout, char capp); 125 int cpy2dynstr(dynstr *sout, str *s2app); 126 int initdynstr(dynstr *sout, int isize); 127 #define free_dynstr(sdyn) if ((sdyn)->sd.s) { pkg_free((sdyn)->sd.s); (sdyn)->size=0; } 128 #define resetstr_dynstr(sdyn) (sdyn)->sd.len=0 129 #define getstr_dynstr(sdyn) (sdyn)->sd 130 131 132 /* Table declarations */ 133 /* 134 fleast(s1, s2) return values: 135 1 s2 is less than s1 136 0 s1 and s2 are equal 137 -1 s1 is less than s2 138 -2 s1 is the least 139 -3 s2 is the least 140 141 fcmp(s1, s2) return values: 142 0 s1 and s2 are the same 143 any other s1 and s2 are not the same 144 145 fgc(s1) return values: 146 1 s1 is garbage 147 0 s1 is not garbage 148 */ 149 typedef int (table_item_cmp)(const void *, const void *); 150 typedef void (table_item_free)(const void *); 151 typedef void (table_item_searchinit)(); 152 typedef int (table_item_gc)(const void *); /* garbage collector function */ 153 typedef struct item { 154 void *pdata; 155 unsigned int uhash; 156 struct item *pnext; 157 struct item *pprev; 158 } titem; 159 typedef struct bucket { 160 titem *pfirst; 161 titem *plast; 162 gen_lock_t lock; 163 } tbucket; 164 typedef struct table { 165 unsigned int unum; /* number of items */ 166 unsigned int ubuckets; /* number of buckets */ 167 unsigned int uitemlim; /* maximum of items */ 168 gen_lock_t lock; /* lock for unum modifiing */ 169 table_item_cmp *fcmp; /* compare function (used by search) */ 170 table_item_searchinit *fsearchinit; /* init function (used by least item search, garbage collect) */ 171 table_item_cmp *fleast; /* init function (used by least item search) */ 172 table_item_free *ffree; /* free function */ 173 table_item_gc *fgc; /* garbage signer function */ 174 tbucket *entries; 175 } ttable; 176 177 178 int init_table(ttable **ptable, 179 unsigned int ubucknum, 180 unsigned int uitemlim, 181 table_item_cmp *fcmp, 182 table_item_searchinit *searchinit, 183 table_item_cmp *fleast, 184 table_item_free *ffree, 185 table_item_gc *fgc); 186 void free_table(ttable *ptable); 187 void garbage_collect(ttable *ptable, int ihashstart, int ihashend); 188 189 /* Certificate table declarations */ 190 typedef struct cert_item { 191 str surl; 192 str scertpem; 193 time_t ivalidbefore; /* expiration time */ 194 unsigned int uaccessed; 195 } tcert_item; 196 int cert_item_cmp(const void *s1, const void *s2); 197 void cert_item_init(); 198 int cert_item_least(const void *s1, const void *s2); 199 void cert_item_free(const void *sitem); 200 int get_cert_from_table(ttable *ptable, str *skey, tcert_item *ptarget); 201 int addcert2table(ttable *ptable, tcert_item *pcert); 202 203 /* Call-ID table declarations */ 204 typedef struct dlg_item { 205 str sftag; /* tag of the From header */ 206 unsigned int ucseq; /* number part of the cseq */ 207 struct dlg_item *pnext; /* next dialog concerned the same call-id */ 208 } tdlg_item; 209 210 typedef struct cid_item { 211 str scid; /* call-id of the message */ 212 time_t ivalidbefore; /* the later expiration time among dialogs concerned this call-id*/ 213 tdlg_item *pdlgs; /* Cseqs and From tags */ 214 } tcid_item; 215 int proc_cid(ttable *ptable, 216 str *scid, 217 str *sftag, 218 unsigned int ucseq, 219 time_t ivalidbefore); 220 int cid_item_cmp(const void *s1, const void *s2); 221 int cid_item_least(const void *s1, const void *s2); 222 void cid_item_free(const void *sitem); 223 void cid_item_init(); 224 int cid_item_gc(); 225 226 /* cURL functions */ 227 size_t curlmem_cb(void *ptr, size_t size, size_t nmemb, void *data); 228 int download_cer(str *suri, CURL *hcurl); 229 230 /* OpenSSL, Base64 functions */ 231 int retrieve_x509(X509 **pcert, str *scert, int bacceptpem); 232 int check_x509_subj(X509 *pcert, str* sdom); 233 int verify_x509(X509 *pcert, X509_STORE *pcacerts); 234 int rsa_sha1_dec (char *sencedsha, int iencedshalen, 235 char *ssha, int sshasize, int *ishalen, 236 X509 *pcertx509); 237 int rsa_sha1_enc (dynstr *sdigeststr, 238 dynstr *senc, 239 dynstr *sencb64, 240 RSA *hmyprivkey); 241 void base64decode(char* src_buf, int src_len, char* tgt_buf, int* tgt_len); 242 void base64encode(char* src_buf, int src_len, char* tgt_buf, int* tgt_len); 243 int x509_get_notafter(time_t *tout, X509 *pcert); 244 int x509_get_notbefore(time_t *tout, X509 *pcert); 245 246 /* Common functions */ 247 int digeststr_asm(dynstr *sout, struct sip_msg *msg, str *sdate, int iflags); 248 249 int fromhdr_proc(str *sout, str *soutopt, struct sip_msg *msg); 250 int cseqhdr_proc(str *sout, str *soutopt, struct sip_msg *msg); 251 int callidhdr_proc(str *sout, str *soutopt, struct sip_msg *msg); 252 int datehdr_proc(str *sout, str *soutopt, struct sip_msg *msg); 253 int identityhdr_proc(str *sout, str *soutopt, struct sip_msg *msg); 254 int identityinfohdr_proc(str *sout, str *soutopt, struct sip_msg *msg); 255 256 int append_date(str *sdate, int idatesize, time_t *tout, struct sip_msg *msg); 257 int append_hf(struct sip_msg* msg, char *str1, enum _hdr_types_t type); 258 259 #endif 260