[asterisk-commits] russell: branch group/security_events r199581 - in /team/group/security_event...

SVN commits to the Asterisk project asterisk-commits at lists.digium.com
Mon Jun 8 07:20:41 CDT 2009


Author: russell
Date: Mon Jun  8 07:20:38 2009
New Revision: 199581

URL: http://svn.asterisk.org/svn-view/asterisk?view=rev&rev=199581
Log:
Add support and test code for unexpected address security event

Modified:
    team/group/security_events/include/asterisk/security_events_defs.h
    team/group/security_events/main/security_events.c
    team/group/security_events/security_events.txt
    team/group/security_events/tests/test_security_events.c

Modified: team/group/security_events/include/asterisk/security_events_defs.h
URL: http://svn.asterisk.org/svn-view/asterisk/team/group/security_events/include/asterisk/security_events_defs.h?view=diff&rev=199581&r1=199580&r2=199581
==============================================================================
--- team/group/security_events/include/asterisk/security_events_defs.h (original)
+++ team/group/security_events/include/asterisk/security_events_defs.h Mon Jun  8 07:20:38 2009
@@ -99,6 +99,10 @@
 	 * \brief FYI FWIW, Successful authentication has occurred
 	 */
 	AST_SECURITY_EVENT_SUCCESSFUL_AUTH,
+	/*!
+	 * \brief An unexpected source address was seen for a session in progress
+	 */
+	AST_SECURITY_EVENT_UNEXPECTED_ADDR,
 	/* \brief This _must_ stay at the end. */
 	AST_SECURITY_EVENT_NUM_TYPES
 };
@@ -622,6 +626,54 @@
 	struct ast_security_event_ipv4_addr remote_addr;
 };
 
+/*!
+ * \brief Unexpected source address for a session in progress
+ */
+struct ast_security_event_unexpected_addr {
+	/*!
+	 * \brief Event descriptor version
+	 * \note This _must_ be changed if this event descriptor is changed.
+	 */
+	#define AST_SECURITY_EVENT_UNEXPECTED_ADDR_VERSION 1
+	/*! \brief Common security event descriptor elements */
+	struct ast_security_event_common common;
+	/*!
+	 * \brief Module, Normally the AST_MODULE define
+	 * \note optional
+	 */
+	const char *module;
+	/*!
+	 * \brief Account ID, specific to the service type
+	 * \note required
+	 */
+	const char *account_id;
+	/*!
+	 * \brief Session ID, specific to the service type
+	 * \note required
+	 */
+	const char *session_id;
+	/*!
+	 * \brief Session timeval, when the session started
+	 * \note optional
+	 */
+	const struct timeval *session_tv;
+	/*!
+	 * \brief Local address the request came in on
+	 * \note required
+	 */
+	struct ast_security_event_ipv4_addr local_addr;
+	/*!
+	 * \brief Remote address the request came from
+	 * \note required
+	 */
+	struct ast_security_event_ipv4_addr remote_addr;
+	/*!
+	 * \brief Expected remote address
+	 * \note required
+	 */
+	struct ast_security_event_ipv4_addr expected_addr;
+};
+
 #if defined(__cplusplus) || defined(c_plusplus)
 }
 #endif

Modified: team/group/security_events/main/security_events.c
URL: http://svn.asterisk.org/svn-view/asterisk/team/group/security_events/main/security_events.c?view=diff&rev=199581&r1=199580&r2=199581
==============================================================================
--- team/group/security_events/main/security_events.c (original)
+++ team/group/security_events/main/security_events.c Mon Jun  8 07:20:38 2009
@@ -261,18 +261,41 @@
 		{ AST_EVENT_IE_SEVERITY, 0 },
 		{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
 		{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
-		{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(inval_acct_id, account_id) },
-		{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(inval_acct_id, session_id) },
-		{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(inval_acct_id, local_addr) },
-		{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(inval_acct_id, remote_addr) },
-		{ AST_EVENT_IE_END, 0 }
-	},
-	.optional_ies = {
-		{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(inval_acct_id, module) },
-		{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(inval_acct_id, session_tv) },
-		{ AST_EVENT_IE_END, 0 }
-	},
-},
+		{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(successful_auth, account_id) },
+		{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(successful_auth, session_id) },
+		{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(successful_auth, local_addr) },
+		{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(successful_auth, remote_addr) },
+		{ AST_EVENT_IE_END, 0 }
+	},
+	.optional_ies = {
+		{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(successful_auth, module) },
+		{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(successful_auth, session_tv) },
+		{ AST_EVENT_IE_END, 0 }
+	},
+},
+
+[AST_SECURITY_EVENT_UNEXPECTED_ADDR] = {
+	.name     = "UnexpectedAddress",
+	.version  = AST_SECURITY_EVENT_UNEXPECTED_ADDR_VERSION,
+	.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
+	.required_ies = {
+		{ AST_EVENT_IE_EVENT_TV, 0 },
+		{ AST_EVENT_IE_SEVERITY, 0 },
+		{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
+		{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
+		{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(unexpected_addr, account_id) },
+		{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(unexpected_addr, session_id) },
+		{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(unexpected_addr, local_addr) },
+		{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(unexpected_addr, remote_addr) },
+		{ AST_EVENT_IE_EXPECTED_ADDR, SEC_EVT_FIELD(unexpected_addr, expected_addr) },
+		{ AST_EVENT_IE_END, 0 }
+	},
+	.optional_ies = {
+		{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(unexpected_addr, module) },
+		{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(unexpected_addr, session_tv) },
+		{ AST_EVENT_IE_END, 0 }
+	},
+}
 
 #undef SEC_EVT_FIELD
 
@@ -454,6 +477,7 @@
 	}
 	case AST_EVENT_IE_LOCAL_ADDR:
 	case AST_EVENT_IE_REMOTE_ADDR:
+	case AST_EVENT_IE_EXPECTED_ADDR:
 	{
 		const struct ast_security_event_ipv4_addr *addr;
 

Modified: team/group/security_events/security_events.txt
URL: http://svn.asterisk.org/svn-view/asterisk/team/group/security_events/security_events.txt?view=diff&rev=199581&r1=199580&r2=199581
==============================================================================
--- team/group/security_events/security_events.txt (original)
+++ team/group/security_events/security_events.txt Mon Jun  8 07:20:38 2009
@@ -208,7 +208,7 @@
 Content: This is the security event sub-type.
 Values: FailedACL, InvalidAccountID, CallLimit, MemoryLimit, LoadAverageLimit,
         RequestNotSupported, RequestNotAllowed, AuthMethodNotAllowed,
-        ReqBadFormat
+        ReqBadFormat, UnexpectedAddress
 
 IE: EventVersion
 Content: This is a numeric value that indicates when updates are made to the

Modified: team/group/security_events/tests/test_security_events.c
URL: http://svn.asterisk.org/svn-view/asterisk/team/group/security_events/tests/test_security_events.c?view=diff&rev=199581&r1=199580&r2=199581
==============================================================================
--- team/group/security_events/tests/test_security_events.c (original)
+++ team/group/security_events/tests/test_security_events.c Mon Jun  8 07:20:38 2009
@@ -46,6 +46,7 @@
 static void evt_gen_auth_method_not_allowed(void);
 static void evt_gen_req_bad_format(void);
 static void evt_gen_successful_auth(void);
+static void evt_gen_unexpected_addr(void);
 
 typedef void (*evt_generator)(void);
 static const evt_generator evt_generators[AST_SECURITY_EVENT_NUM_TYPES] = {
@@ -59,6 +60,7 @@
 	[AST_SECURITY_EVENT_AUTH_METHOD_NOT_ALLOWED] = evt_gen_auth_method_not_allowed,
 	[AST_SECURITY_EVENT_REQ_BAD_FORMAT]          = evt_gen_req_bad_format,
 	[AST_SECURITY_EVENT_SUCCESSFUL_AUTH]         = evt_gen_successful_auth,
+	[AST_SECURITY_EVENT_UNEXPECTED_ADDR]         = evt_gen_unexpected_addr,
 };
 
 static void evt_gen_failed_acl(void)
@@ -437,6 +439,53 @@
 	sin_remote.sin_port = htons(1234);
 
 	ast_security_event_report(AST_SEC_EVT(&successful_auth));
+}
+
+static void evt_gen_unexpected_addr(void)
+{
+	struct sockaddr_in sin_local = {
+		.sin_family = AF_INET
+	};
+	struct sockaddr_in sin_remote = {
+		.sin_family = AF_INET
+	};
+	struct sockaddr_in sin_expected = {
+		.sin_family = AF_INET
+	};
+	struct timeval session_tv = ast_tvnow();
+	struct ast_security_event_unexpected_addr unexpected_addr = {
+		.common.event_type = AST_SECURITY_EVENT_UNEXPECTED_ADDR,
+		.common.version    = AST_SECURITY_EVENT_UNEXPECTED_ADDR_VERSION,
+		.common.service    = "TEST",
+
+		.module     = AST_MODULE,
+		.account_id = "CoolUser",
+		.session_id = "Session789",
+		.session_tv = &session_tv,
+		.local_addr = {
+			.sin  = &sin_local,
+			.transport  = AST_SECURITY_EVENT_TRANSPORT_UDP,
+		},
+		.remote_addr = {
+			.sin = &sin_remote,
+			.transport  = AST_SECURITY_EVENT_TRANSPORT_UDP,
+		},
+		.expected_addr = {
+			.sin = &sin_expected,
+			.transport  = AST_SECURITY_EVENT_TRANSPORT_UDP,
+		},
+	};
+
+	inet_aton("10.1.2.3", &sin_local.sin_addr);
+	sin_local.sin_port = htons(4321);
+
+	inet_aton("10.1.2.4", &sin_remote.sin_addr);
+	sin_remote.sin_port = htons(1234);
+
+	inet_aton("10.1.2.5", &sin_expected.sin_addr);
+	sin_expected.sin_port = htons(2343);
+
+	ast_security_event_report(AST_SEC_EVT(&unexpected_addr));
 }
 
 static void gen_events(struct ast_cli_args *a)




More information about the asterisk-commits mailing list