Skip to content
Snippets Groups Projects
  • Ben Ford's avatar
    3927f79c
    res_stir_shaken: Add inbound INVITE support. · 3927f79c
    Ben Ford authored
    Integrated STIR/SHAKEN support with incoming INVITES. Upon receiving an
    INVITE, the Identity header is retrieved, parsing the message to verify
    the signature. If any of the parsing fails,
    AST_STIR_SHAKEN_VERIFY_NOT_PRESENT will be added to the channel for this
    caller ID. If verification itself fails,
    AST_STIR_SHAKEN_VERIFY_SIGNATURE_FAILED will be added. If anything in
    the payload does not line up with the SIP signaling,
    AST_STIR_SHAKEN_VERIFY_MISMATCH will be added. If all of the above steps
    pass, then AST_STIR_SHAKEN_VERIFY_PASSED will be added, completing the
    verification process.
    
    A new config option has been added to the general section for
    stir_shaken.conf. "signature_timeout" is the amount of time a signature
    will be considered valid. If an INVITE is received and the amount of
    time between when it was received and when it was signed is greater than
    signature_timeout, verification will fail.
    
    Some changes were also made to signing and verification. There was an
    error where the whole JSON string was being signed rather than the
    header combined with the payload. This has been changed to sign the
    correct thing. Verification has been changed to do this as well, and the
    unit tests have been updated to reflect these changes.
    
    A couple of utility functions have also been added. One decodes a BASE64
    string and returns the decoded string, doing all the length calculations
    for you. The other retrieves a string value from a header in a rdata
    object.
    
    Change-Id: I855f857be3d1c63b64812ac35d9ce0534085b913
    3927f79c
    History
    res_stir_shaken: Add inbound INVITE support.
    Ben Ford authored
    Integrated STIR/SHAKEN support with incoming INVITES. Upon receiving an
    INVITE, the Identity header is retrieved, parsing the message to verify
    the signature. If any of the parsing fails,
    AST_STIR_SHAKEN_VERIFY_NOT_PRESENT will be added to the channel for this
    caller ID. If verification itself fails,
    AST_STIR_SHAKEN_VERIFY_SIGNATURE_FAILED will be added. If anything in
    the payload does not line up with the SIP signaling,
    AST_STIR_SHAKEN_VERIFY_MISMATCH will be added. If all of the above steps
    pass, then AST_STIR_SHAKEN_VERIFY_PASSED will be added, completing the
    verification process.
    
    A new config option has been added to the general section for
    stir_shaken.conf. "signature_timeout" is the amount of time a signature
    will be considered valid. If an INVITE is received and the amount of
    time between when it was received and when it was signed is greater than
    signature_timeout, verification will fail.
    
    Some changes were also made to signing and verification. There was an
    error where the whole JSON string was being signed rather than the
    header combined with the payload. This has been changed to sign the
    correct thing. Verification has been changed to do this as well, and the
    unit tests have been updated to reflect these changes.
    
    A couple of utility functions have also been added. One decodes a BASE64
    string and returns the decoded string, doing all the length calculations
    for you. The other retrieves a string value from a header in a rdata
    object.
    
    Change-Id: I855f857be3d1c63b64812ac35d9ce0534085b913