[asterisk-bugs] [JIRA] (ASTERISK-30407) res_stir_shaken: Ordering of JSON fields incorrect, and tn lacks canonicalization

[Sean Bright (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-30407?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=261255#comment-261255 ] 

Sean Bright commented on ASTERISK-30407:
----------------------------------------

bq. Apparently that is the correct order - But you wouldn't know it by the RFC's definition

[Section 9|https://www.rfc-editor.org/rfc/rfc8225.html#section-9] says:

bq. JSON objects MUST have the keys ordered lexicographically by the Unicode \[UNICODE] code points of the member names.


> res_stir_shaken: Ordering of JSON fields incorrect, and tn lacks canonicalization
> ---------------------------------------------------------------------------------
>
>                 Key: ASTERISK-30407
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-30407
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_stir_shaken
>    Affects Versions: 16.30.0
>            Reporter: Luke Escude
>
> So a number of carriers have starting complaining about how we're signing STIR/SHAKEN stuff, and it turns out the stir_shaken module is indeed not doing it according to the RFC.
> They're complaining about 2 issues:
> 1. The order of the fields is incorrect
> 2. The '+' sign in the phone numbers needs to be removed (they're calling it "canonicalization")
> Here's an example output from stir_shaken.conf:
> {
>   "dest": {
>     "tn": [
>       "+1NPANXXXXXX"
>     ]
>   },
>   "orig": {
>     "tn": "1NPANXXXXXX"
>   },
>   "attest": "A",
>   "origid": "e391c481-510b-46ff-a7d0-4c8fcff2436b",
>   "iat": 167458XXXX
> }
> The field order is definitely noncompliant with the RFC, and I do see the + sign they're referring to, in the dest.tn field.
> Reference: https://www.rfc-editor.org/rfc/rfc8225.html#section-9 



--
This message was sent by Atlassian JIRA
(v6.2#6252)