[asterisk-commits] qwell: branch qwell/fun_with_transports r387105 - in /team/qwell/fun_with_tra...
SVN commits to the Asterisk project
asterisk-commits at lists.digium.com
Wed May 1 12:10:24 CDT 2013
Author: qwell
Date: Wed May 1 12:10:20 2013
New Revision: 387105
URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=387105
Log:
Add SDES SRTP support to res_sip
Pull large parts of the SRTP negotiation and key management code out of
chan_sip so that they can be accessed by res_sip and add SDES SRTP
support to res_sip including support for mid-call key changes. This
feature can be activated by setting media_encryption=sdes on the
endpoint (dtls will come later).
This patch also adds support for AVPF via the use_avpf endpoint
setting.
Review: https://reviewboard.asterisk.org/r/2468
(closes issue ASTERISK-21416)
Patch-By: Kinsey Moore <kmoore at digium.com>
........
Merged revisions 387097 from http://svn.asterisk.org/svn/asterisk/team/group/pimp_my_sip
Added:
team/qwell/fun_with_transports/include/asterisk/sdp_srtp.h
- copied unchanged from r387097, team/group/pimp_my_sip/include/asterisk/sdp_srtp.h
team/qwell/fun_with_transports/main/sdp_srtp.c
- copied unchanged from r387097, team/group/pimp_my_sip/main/sdp_srtp.c
Removed:
team/qwell/fun_with_transports/channels/sip/include/sdp_crypto.h
team/qwell/fun_with_transports/channels/sip/include/srtp.h
team/qwell/fun_with_transports/channels/sip/sdp_crypto.c
team/qwell/fun_with_transports/channels/sip/srtp.c
Modified:
team/qwell/fun_with_transports/ (props changed)
team/qwell/fun_with_transports/channels/chan_sip.c
team/qwell/fun_with_transports/channels/sip/include/sip.h
team/qwell/fun_with_transports/configs/res_sip.conf.sample
team/qwell/fun_with_transports/include/asterisk/res_sip.h
team/qwell/fun_with_transports/include/asterisk/res_sip_session.h
team/qwell/fun_with_transports/res/res_sip/sip_configuration.c
team/qwell/fun_with_transports/res/res_sip_sdp_rtp.c
team/qwell/fun_with_transports/res/res_sip_session.c
Propchange: team/qwell/fun_with_transports/
------------------------------------------------------------------------------
--- svnmerge-integrated (original)
+++ svnmerge-integrated Wed May 1 12:10:20 2013
@@ -1,1 +1,1 @@
-/team/group/pimp_my_sip:1-386866,386868-387077 /trunk:1-386489,386540-386541
+/team/group/pimp_my_sip:1-386866,386868-387077,387097 /trunk:1-386489,386540-386541
Modified: team/qwell/fun_with_transports/channels/chan_sip.c
URL: http://svnview.digium.com/svn/asterisk/team/qwell/fun_with_transports/channels/chan_sip.c?view=diff&rev=387105&r1=387104&r2=387105
==============================================================================
--- team/qwell/fun_with_transports/channels/chan_sip.c (original)
+++ team/qwell/fun_with_transports/channels/chan_sip.c Wed May 1 12:10:20 2013
@@ -286,8 +286,7 @@
#include "sip/include/config_parser.h"
#include "sip/include/reqresp_parser.h"
#include "sip/include/sip_utils.h"
-#include "sip/include/srtp.h"
-#include "sip/include/sdp_crypto.h"
+#include "asterisk/sdp_srtp.h"
#include "asterisk/ccss.h"
#include "asterisk/xml.h"
#include "sip/include/dialog.h"
@@ -1487,8 +1486,7 @@
static void handle_response(struct sip_pvt *p, int resp, const char *rest, struct sip_request *req, uint32_t seqno);
/*------ SRTP Support -------- */
-static int setup_srtp(struct sip_srtp **srtp);
-static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct sip_srtp **srtp, const char *a);
+static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp, const char *a);
/*------ T38 Support --------- */
static int transmit_response_with_t38_sdp(struct sip_pvt *p, char *msg, struct sip_request *req, int retrans);
@@ -5913,7 +5911,7 @@
}
/*! \brief Initialize DTLS-SRTP support on an RTP instance */
-static int dialog_initialize_dtls_srtp(const struct sip_pvt *dialog, struct ast_rtp_instance *rtp, struct sip_srtp **srtp)
+static int dialog_initialize_dtls_srtp(const struct sip_pvt *dialog, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp)
{
struct ast_rtp_engine_dtls *dtls;
@@ -5938,7 +5936,7 @@
return -1;
}
- if (!(*srtp = sip_srtp_alloc())) {
+ if (!(*srtp = ast_sdp_srtp_alloc())) {
ast_log(LOG_ERROR, "Failed to create required SRTP structure on RTP instance '%p'\n",
rtp);
return -1;
@@ -6413,17 +6411,17 @@
ast_clear_flag(&p->flags[0], SIP_REINVITE);
}
- if (p->rtp && !p->srtp && setup_srtp(&p->srtp) < 0) {
+ if (p->rtp && !p->srtp && !(p->srtp = ast_sdp_srtp_alloc())) {
ast_log(LOG_WARNING, "SRTP audio setup failed\n");
return -1;
}
- if (p->vrtp && !p->vsrtp && setup_srtp(&p->vsrtp) < 0) {
+ if (p->vrtp && !p->vsrtp && !(p->vsrtp = ast_sdp_srtp_alloc())) {
ast_log(LOG_WARNING, "SRTP video setup failed\n");
return -1;
}
- if (p->trtp && !p->tsrtp && setup_srtp(&p->tsrtp) < 0) {
+ if (p->trtp && !p->tsrtp && !(p->tsrtp = ast_sdp_srtp_alloc())) {
ast_log(LOG_WARNING, "SRTP text setup failed\n");
return -1;
}
@@ -6688,17 +6686,17 @@
destroy_msg_headers(p);
if (p->srtp) {
- sip_srtp_destroy(p->srtp);
+ ast_sdp_srtp_destroy(p->srtp);
p->srtp = NULL;
}
if (p->vsrtp) {
- sip_srtp_destroy(p->vsrtp);
+ ast_sdp_srtp_destroy(p->vsrtp);
p->vsrtp = NULL;
}
if (p->tsrtp) {
- sip_srtp_destroy(p->tsrtp);
+ ast_sdp_srtp_destroy(p->tsrtp);
p->tsrtp = NULL;
}
@@ -10151,7 +10149,7 @@
secure_audio = 1;
if (p->srtp) {
- ast_set_flag(p->srtp, SRTP_CRYPTO_OFFER_OK);
+ ast_set_flag(p->srtp, AST_SRTP_CRYPTO_OFFER_OK);
}
} else if (!strcmp(protocol, "RTP/SAVP") || !strcmp(protocol, "RTP/SAVPF")) {
secure_audio = 1;
@@ -10232,8 +10230,8 @@
} else if (!strcmp(protocol, "UDP/TLS/RTP/SAVP") || !strcmp(protocol, "UDP/TLS/RTP/SAVPF")) {
secure_video = 1;
- if (p->vsrtp || (p->vsrtp = sip_srtp_alloc())) {
- ast_set_flag(p->vsrtp, SRTP_CRYPTO_OFFER_OK);
+ if (p->vsrtp || (p->vsrtp = ast_sdp_srtp_alloc())) {
+ ast_set_flag(p->vsrtp, AST_SRTP_CRYPTO_OFFER_OK);
}
} else if (!strcmp(protocol, "RTP/SAVP") || !strcmp(protocol, "RTP/SAVPF")) {
secure_video = 1;
@@ -10513,7 +10511,7 @@
goto process_sdp_cleanup;
}
- if (secure_audio && !(p->srtp && (ast_test_flag(p->srtp, SRTP_CRYPTO_OFFER_OK)))) {
+ if (secure_audio && !(p->srtp && (ast_test_flag(p->srtp, AST_SRTP_CRYPTO_OFFER_OK)))) {
ast_log(LOG_WARNING, "Can't provide secure audio requested in SDP offer\n");
res = -1;
goto process_sdp_cleanup;
@@ -10525,7 +10523,7 @@
goto process_sdp_cleanup;
}
- if (secure_video && !(p->vsrtp && (ast_test_flag(p->vsrtp, SRTP_CRYPTO_OFFER_OK)))) {
+ if (secure_video && !(p->vsrtp && (ast_test_flag(p->vsrtp, AST_SRTP_CRYPTO_OFFER_OK)))) {
ast_log(LOG_WARNING, "Can't provide secure video requested in SDP offer\n");
res = -1;
goto process_sdp_cleanup;
@@ -12992,52 +12990,14 @@
}
}
-static void get_crypto_attrib(struct sip_pvt *p, struct sip_srtp *srtp, const char **a_crypto)
-{
- int taglen = 80;
-
- /* Set encryption properties */
- if (srtp) {
- if (!srtp->crypto) {
- srtp->crypto = sdp_crypto_setup();
- }
-
- if (p->dtls_cfg.enabled) {
- /* If DTLS-SRTP is enabled the key details will be pulled from TLS */
- return;
- }
-
- /* set the key length based on INVITE or settings */
- if (ast_test_flag(srtp, SRTP_CRYPTO_TAG_80)) {
- taglen = 80;
- } else if (ast_test_flag(&p->flags[2], SIP_PAGE3_SRTP_TAG_32) ||
- ast_test_flag(srtp, SRTP_CRYPTO_TAG_32)) {
- taglen = 32;
- }
-
- if (srtp->crypto && (sdp_crypto_offer(srtp->crypto, taglen) >= 0)) {
- *a_crypto = sdp_crypto_attrib(srtp->crypto);
- }
-
- if (!*a_crypto) {
- ast_log(LOG_WARNING, "No SRTP key management enabled\n");
- }
- }
-}
-
-static char *get_sdp_rtp_profile(const struct sip_pvt *p, unsigned int secure, struct ast_rtp_instance *instance)
-{
- struct ast_rtp_engine_dtls *dtls;
-
- if ((dtls = ast_rtp_instance_get_dtls(instance)) && dtls->active(instance)) {
- return ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF) ? "UDP/TLS/RTP/SAVPF" : "UDP/TLS/RTP/SAVP";
- } else {
- if (ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)) {
- return secure ? "RTP/SAVPF" : "RTP/AVPF";
- } else {
- return secure ? "RTP/SAVP" : "RTP/AVP";
- }
- }
+static char *crypto_get_attrib(struct ast_sdp_srtp *srtp, int dtls_enabled, int default_taglen_32)
+{
+ char *a_crypto;
+ char *orig_crypto = ast_strdupa(ast_sdp_srtp_get_attrib(srtp, dtls_enabled, default_taglen_32));
+ if (ast_asprintf(&a_crypto, "a=crypto:%s\r\n", orig_crypto) == -1) {
+ return NULL;
+ }
+ return a_crypto;
}
/*! \brief Add Session Description Protocol message
@@ -13078,9 +13038,9 @@
struct ast_str *a_video = ast_str_create(256); /* Attributes for video */
struct ast_str *a_text = ast_str_create(256); /* Attributes for text */
struct ast_str *a_modem = ast_str_alloca(1024); /* Attributes for modem */
- const char *a_crypto = NULL;
- const char *v_a_crypto = NULL;
- const char *t_a_crypto = NULL;
+ RAII_VAR(char *, a_crypto, NULL, ast_free);
+ RAII_VAR(char *, v_a_crypto, NULL, ast_free);
+ RAII_VAR(char *, t_a_crypto, NULL, ast_free);
int x;
struct ast_format tmp_fmt;
@@ -13198,9 +13158,11 @@
/* Ok, we need video. Let's add what we need for video and set codecs.
Video is handled differently than audio since we can not transcode. */
if (needvideo) {
- get_crypto_attrib(p, p->vsrtp, &v_a_crypto);
+ v_a_crypto = crypto_get_attrib(p->vsrtp, p->dtls_cfg.enabled,
+ ast_test_flag(&p->flags[2], SIP_PAGE3_SRTP_TAG_32));
ast_str_append(&m_video, 0, "m=video %d %s", ast_sockaddr_port(&vdest),
- get_sdp_rtp_profile(p, v_a_crypto ? 1 : 0, p->vrtp));
+ ast_sdp_get_rtp_profile(v_a_crypto ? 1 : 0, p->vrtp,
+ ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)));
/* Build max bitrate string */
if (p->maxcallbitrate)
@@ -13223,9 +13185,11 @@
if (needtext) {
if (sipdebug_text)
ast_verbose("Lets set up the text sdp\n");
- get_crypto_attrib(p, p->tsrtp, &t_a_crypto);
+ t_a_crypto = crypto_get_attrib(p->tsrtp, p->dtls_cfg.enabled,
+ ast_test_flag(&p->flags[2], SIP_PAGE3_SRTP_TAG_32));
ast_str_append(&m_text, 0, "m=text %d %s", ast_sockaddr_port(&tdest),
- get_sdp_rtp_profile(p, t_a_crypto ? 1 : 0, p->trtp));
+ ast_sdp_get_rtp_profile(t_a_crypto ? 1 : 0, p->trtp,
+ ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)));
if (debug) { /* XXX should I use tdest below ? */
ast_verbose("Text is at %s\n", ast_sockaddr_stringify(&taddr));
}
@@ -13244,9 +13208,11 @@
/* We break with the "recommendation" and send our IP, in order that our
peer doesn't have to ast_gethostbyname() us */
- get_crypto_attrib(p, p->srtp, &a_crypto);
+ a_crypto = crypto_get_attrib(p->srtp, p->dtls_cfg.enabled,
+ ast_test_flag(&p->flags[2], SIP_PAGE3_SRTP_TAG_32));
ast_str_append(&m_audio, 0, "m=audio %d %s", ast_sockaddr_port(&dest),
- get_sdp_rtp_profile(p, a_crypto ? 1 : 0, p->rtp));
+ ast_sdp_get_rtp_profile(a_crypto ? 1 : 0, p->rtp,
+ ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)));
/* Now, start adding audio codecs. These are added in this order:
- First what was requested by the calling channel
@@ -26017,7 +25983,7 @@
transmit_response_with_t38_sdp(p, "200 OK", req, (reinvite ? XMIT_RELIABLE : (req->ignore ? XMIT_UNRELIABLE : XMIT_CRITICAL)));
} else if ((p->t38.state == T38_DISABLED) || (p->t38.state == T38_REJECTED)) {
/* If this is not a re-invite or something to ignore - it's critical */
- if (p->srtp && !ast_test_flag(p->srtp, SRTP_CRYPTO_OFFER_OK)) {
+ if (p->srtp && !ast_test_flag(p->srtp, AST_SRTP_CRYPTO_OFFER_OK)) {
ast_log(LOG_WARNING, "Target does not support required crypto\n");
transmit_response_reliable(p, "488 Not Acceptable Here (crypto)", req);
} else {
@@ -33305,22 +33271,7 @@
} while (0));
}
-/* SRTP */
-static int setup_srtp(struct sip_srtp **srtp)
-{
- if (!ast_rtp_engine_srtp_is_registered()) {
- ast_debug(1, "No SRTP module loaded, can't setup SRTP session.\n");
- return -1;
- }
-
- if (!(*srtp = sip_srtp_alloc())) { /* Allocate SRTP data structure */
- return -1;
- }
-
- return 0;
-}
-
-static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct sip_srtp **srtp, const char *a)
+static int process_crypto(struct sip_pvt *p, struct ast_rtp_instance *rtp, struct ast_sdp_srtp **srtp, const char *a)
{
struct ast_rtp_engine_dtls *dtls;
@@ -33333,26 +33284,27 @@
if (strncasecmp(a, "crypto:", 7)) {
return FALSE;
}
+ /* skip "crypto:" */
+ a += strlen("crypto:");
+
if (!*srtp) {
if (ast_test_flag(&p->flags[0], SIP_OUTGOING)) {
ast_log(LOG_WARNING, "Ignoring unexpected crypto attribute in SDP answer\n");
return FALSE;
}
- if (setup_srtp(srtp) < 0) {
+ if (!(*srtp = ast_sdp_srtp_alloc())) {
return FALSE;
}
}
- if (!(*srtp)->crypto && !((*srtp)->crypto = sdp_crypto_setup())) {
+ if (!(*srtp)->crypto && !((*srtp)->crypto = ast_sdp_crypto_alloc())) {
return FALSE;
}
- if (sdp_crypto_process((*srtp)->crypto, a, rtp, *srtp) < 0) {
+ if (ast_sdp_crypto_process(rtp, *srtp, a) < 0) {
return FALSE;
}
-
- ast_set_flag(*srtp, SRTP_CRYPTO_OFFER_OK);
if ((dtls = ast_rtp_instance_get_dtls(rtp))) {
dtls->stop(rtp);
Modified: team/qwell/fun_with_transports/channels/sip/include/sip.h
URL: http://svnview.digium.com/svn/asterisk/team/qwell/fun_with_transports/channels/sip/include/sip.h?view=diff&rev=387105&r1=387104&r2=387105
==============================================================================
--- team/qwell/fun_with_transports/channels/sip/include/sip.h (original)
+++ team/qwell/fun_with_transports/channels/sip/include/sip.h Wed May 1 12:10:20 2013
@@ -1189,9 +1189,9 @@
AST_LIST_HEAD_NOLOCK(request_queue, sip_request) request_queue; /*!< Requests that arrived but could not be processed immediately */
struct sip_invite_param *options; /*!< Options for INVITE */
struct sip_st_dlg *stimer; /*!< SIP Session-Timers */
- struct sip_srtp *srtp; /*!< Structure to hold Secure RTP session data for audio */
- struct sip_srtp *vsrtp; /*!< Structure to hold Secure RTP session data for video */
- struct sip_srtp *tsrtp; /*!< Structure to hold Secure RTP session data for text */
+ struct ast_sdp_srtp *srtp; /*!< Structure to hold Secure RTP session data for audio */
+ struct ast_sdp_srtp *vsrtp; /*!< Structure to hold Secure RTP session data for video */
+ struct ast_sdp_srtp *tsrtp; /*!< Structure to hold Secure RTP session data for text */
int red; /*!< T.140 RTP Redundancy */
int hangupcause; /*!< Storage of hangupcause copied from our owner before we disconnect from the AST channel (only used at hangup) */
Modified: team/qwell/fun_with_transports/configs/res_sip.conf.sample
URL: http://svnview.digium.com/svn/asterisk/team/qwell/fun_with_transports/configs/res_sip.conf.sample?view=diff&rev=387105&r1=387104&r2=387105
==============================================================================
--- team/qwell/fun_with_transports/configs/res_sip.conf.sample (original)
+++ team/qwell/fun_with_transports/configs/res_sip.conf.sample Wed May 1 12:10:20 2013
@@ -22,3 +22,5 @@
;rtp_ipv6=yes ; Force IPv6 for RTP transport
;rtp_symmetric=yes ; Enable symmetric RTP support
;use_ptime=yes ; Whether to use the ptime value received from the endpoint or not
+;media_encryption=no ; Options for media encryption are no, and sdes
+;use_avpf=no ; Whether to force usage of AVPF transport for this endpoint
Modified: team/qwell/fun_with_transports/include/asterisk/res_sip.h
URL: http://svnview.digium.com/svn/asterisk/team/qwell/fun_with_transports/include/asterisk/res_sip.h?view=diff&rev=387105&r1=387104&r2=387105
==============================================================================
--- team/qwell/fun_with_transports/include/asterisk/res_sip.h (original)
+++ team/qwell/fun_with_transports/include/asterisk/res_sip.h Wed May 1 12:10:20 2013
@@ -264,6 +264,17 @@
* Subsequent session refreshes will be sent no matter the session direction
*/
AST_SIP_DIRECT_MEDIA_GLARE_MITIGATION_INCOMING,
+};
+
+enum ast_sip_session_media_encryption {
+ /*! Invalid media encryption configuration */
+ AST_SIP_MEDIA_TRANSPORT_INVALID = 0,
+ /*! Do not allow any encryption of session media */
+ AST_SIP_MEDIA_ENCRYPT_NONE,
+ /*! Offer SDES-encrypted session media */
+ AST_SIP_MEDIA_ENCRYPT_SDES,
+ /*! Offer encrypted session media with datagram TLS key exchange */
+ AST_SIP_MEDIA_ENCRYPT_DTLS,
};
/*!
@@ -349,6 +360,10 @@
unsigned int send_rpid;
/*! Should unsolicited MWI be aggregated into a single NOTIFY? */
unsigned int aggregate_mwi;
+ /*! Do we use media encryption? what type? */
+ enum ast_sip_session_media_encryption media_encryption;
+ /*! Do we use AVPF exclusively for this endpoint? */
+ unsigned int use_avpf;
};
/*!
Modified: team/qwell/fun_with_transports/include/asterisk/res_sip_session.h
URL: http://svnview.digium.com/svn/asterisk/team/qwell/fun_with_transports/include/asterisk/res_sip_session.h?view=diff&rev=387105&r1=387104&r2=387105
==============================================================================
--- team/qwell/fun_with_transports/include/asterisk/res_sip_session.h (original)
+++ team/qwell/fun_with_transports/include/asterisk/res_sip_session.h Wed May 1 12:10:20 2013
@@ -26,6 +26,8 @@
#include "asterisk/channel.h"
/* Needed for ast_sockaddr struct */
#include "asterisk/netsock.h"
+/* Neeed for ast_sdp_srtp struct */
+#include "asterisk/sdp_srtp.h"
/* Forward declarations */
struct ast_sip_endpoint;
@@ -54,6 +56,8 @@
struct ast_sockaddr direct_media_addr;
/*! \brief SDP handler that setup the RTP */
struct ast_sip_session_sdp_handler *handler;
+ /*! \brief Holds SRTP information */
+ struct ast_sdp_srtp *srtp;
/*! \brief Stream is on hold */
unsigned int held:1;
/*! \brief Stream type this session media handles */
Modified: team/qwell/fun_with_transports/res/res_sip/sip_configuration.c
URL: http://svnview.digium.com/svn/asterisk/team/qwell/fun_with_transports/res/res_sip/sip_configuration.c?view=diff&rev=387105&r1=387104&r2=387105
==============================================================================
--- team/qwell/fun_with_transports/res/res_sip/sip_configuration.c (original)
+++ team/qwell/fun_with_transports/res/res_sip/sip_configuration.c Wed May 1 12:10:20 2013
@@ -274,6 +274,23 @@
struct ast_sip_endpoint *endpoint = obj;
endpoint->id.tag = ast_strdup(var->value);
return endpoint->id.tag ? 0 : -1;
+}
+
+static int media_encryption_handler(const struct aco_option *opt, struct ast_variable *var, void *obj)
+{
+ struct ast_sip_endpoint *endpoint = obj;
+
+ if (!strcasecmp("no", var->value)) {
+ endpoint->media_encryption = AST_SIP_MEDIA_ENCRYPT_NONE;
+ } else if (!strcasecmp("sdes", var->value)) {
+ endpoint->media_encryption = AST_SIP_MEDIA_ENCRYPT_SDES;
+ /*} else if (!strcasecmp("dtls", var->value)) {
+ endpoint->media_encryption = AST_SIP_MEDIA_ENCRYPT_DTLS;*/
+ } else {
+ return -1;
+ }
+
+ return 0;
}
static void *sip_nat_hook_alloc(const char *name)
@@ -351,6 +368,8 @@
ast_sorcery_object_field_register(sip_sorcery, "endpoint", "send_rpid", "no", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, send_rpid));
ast_sorcery_object_field_register(sip_sorcery, "endpoint", "mailboxes", "", OPT_STRINGFIELD_T, 0, STRFLDSET(struct ast_sip_endpoint, mailboxes));
ast_sorcery_object_field_register(sip_sorcery, "endpoint", "aggregate_mwi", "yes", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, aggregate_mwi));
+ ast_sorcery_object_field_register_custom(sip_sorcery, "endpoint", "media_encryption", "no", media_encryption_handler, NULL, 0, 0);
+ ast_sorcery_object_field_register(sip_sorcery, "endpoint", "use_avpf", "no", OPT_BOOL_T, 1, FLDSET(struct ast_sip_endpoint, use_avpf));
if (ast_sip_initialize_sorcery_transport(sip_sorcery)) {
ast_log(LOG_ERROR, "Failed to register SIP transport support with sorcery\n");
Modified: team/qwell/fun_with_transports/res/res_sip_sdp_rtp.c
URL: http://svnview.digium.com/svn/asterisk/team/qwell/fun_with_transports/res/res_sip_sdp_rtp.c?view=diff&rev=387105&r1=387104&r2=387105
==============================================================================
--- team/qwell/fun_with_transports/res/res_sip_sdp_rtp.c (original)
+++ team/qwell/fun_with_transports/res/res_sip_sdp_rtp.c Wed May 1 12:10:20 2013
@@ -47,6 +47,7 @@
#include "asterisk/causes.h"
#include "asterisk/sched.h"
#include "asterisk/acl.h"
+#include "asterisk/sdp_srtp.h"
#include "asterisk/res_sip.h"
#include "asterisk/res_sip_session.h"
@@ -454,6 +455,93 @@
session_media->rtp, pref);
}
+/*! \brief figure out media transport encryption type from the media transport string */
+static enum ast_sip_session_media_encryption get_media_encryption_type(pj_str_t transport)
+{
+ RAII_VAR(char *, transport_str, ast_strndup(transport.ptr, transport.slen), ast_free);
+ if (strstr(transport_str, "UDP/TLS")) {
+ return AST_SIP_MEDIA_ENCRYPT_DTLS;
+ } else if (strstr(transport_str, "SAVP")) {
+ return AST_SIP_MEDIA_ENCRYPT_SDES;
+ } else {
+ return AST_SIP_MEDIA_ENCRYPT_NONE;
+ }
+}
+
+/*!
+ * \brief Checks whether the encryption offered in SDP is compatible with the endpoint's configuration
+ * \internal
+ *
+ * \param endpoint_encryption Media encryption configured for the endpoint
+ * \param stream pjmedia_sdp_media stream description
+ *
+ * \retval AST_SIP_MEDIA_TRANSPORT_INVALID on encryption mismatch
+ * \retval The encryption requested in the SDP
+ */
+static enum ast_sip_session_media_encryption check_endpoint_media_transport(
+ struct ast_sip_endpoint *endpoint,
+ const struct pjmedia_sdp_media *stream)
+{
+ enum ast_sip_session_media_encryption incoming_encryption;
+
+ if (endpoint->use_avpf) {
+ char transport_end = stream->desc.transport.ptr[stream->desc.transport.slen - 1];
+ if (transport_end != 'F') {
+ return AST_SIP_MEDIA_TRANSPORT_INVALID;
+ }
+ }
+
+ incoming_encryption = get_media_encryption_type(stream->desc.transport);
+ if (incoming_encryption == AST_SIP_MEDIA_ENCRYPT_DTLS) {
+ /* DTLS not yet supported */
+ return AST_SIP_MEDIA_TRANSPORT_INVALID;
+ }
+
+ if (incoming_encryption == endpoint->media_encryption) {
+ return incoming_encryption;
+ }
+
+ return AST_SIP_MEDIA_TRANSPORT_INVALID;
+}
+
+static int setup_sdes_srtp(struct ast_sip_session_media *session_media,
+ const struct pjmedia_sdp_media *stream)
+{
+ pjmedia_sdp_attr *attr;
+ RAII_VAR(char *, crypto_str, NULL, ast_free);
+
+ /* check the stream for the required crypto attribute */
+ attr = pjmedia_sdp_media_find_attr2(stream, "crypto", NULL);
+ if (!attr) {
+ return -1;
+ }
+
+ crypto_str = ast_strndup(attr->value.ptr, attr->value.slen);
+ if (!crypto_str) {
+ return -1;
+ }
+
+ if (!session_media->srtp) {
+ session_media->srtp = ast_sdp_srtp_alloc();
+ if (!session_media->srtp) {
+ return -1;
+ }
+ }
+
+ if (!session_media->srtp->crypto) {
+ session_media->srtp->crypto = ast_sdp_crypto_alloc();
+ if (!session_media->srtp->crypto) {
+ return -1;
+ }
+ }
+
+ if (ast_sdp_crypto_process(session_media->rtp, session_media->srtp, crypto_str)) {
+ return -1;
+ }
+
+ return 0;
+}
+
/*! \brief Function which negotiates an incoming media stream */
static int negotiate_incoming_sdp_stream(struct ast_sip_session *session, struct ast_sip_session_media *session_media,
const struct pjmedia_sdp_session *sdp, const struct pjmedia_sdp_media *stream)
@@ -461,12 +549,19 @@
char host[NI_MAXHOST];
RAII_VAR(struct ast_sockaddr *, addrs, NULL, ast_free_ptr);
enum ast_format_type media_type = stream_to_media_type(session_media->stream_type);
+ enum ast_sip_session_media_encryption incoming_encryption;
/* If no type formats have been configured reject this stream */
if (!ast_format_cap_has_type(session->endpoint->codecs, media_type)) {
return 0;
}
+ /* Ensure incoming transport is compatible with the endpoint's configuration */
+ incoming_encryption = check_endpoint_media_transport(session->endpoint, stream);
+ if (incoming_encryption == AST_SIP_MEDIA_TRANSPORT_INVALID) {
+ return -1;
+ }
+
ast_copy_pj_str(host, stream->conn ? &stream->conn->addr : &sdp->conn->addr, sizeof(host));
/* Ensure that the address provided is valid */
@@ -480,7 +575,40 @@
return -1;
}
+ if (incoming_encryption == AST_SIP_MEDIA_ENCRYPT_SDES
+ && setup_sdes_srtp(session_media, stream)) {
+ return -1;
+ }
+
return set_caps(session, session_media, stream);
+}
+
+static int add_crypto_to_stream(struct ast_sip_session *session,
+ struct ast_sip_session_media *session_media,
+ pj_pool_t *pool, pjmedia_sdp_media *media)
+{
+ pj_str_t stmp;
+ pjmedia_sdp_attr *attr;
+ const char *crypto_attribute;
+
+ if (!session_media->srtp && session->endpoint->media_encryption != AST_SIP_MEDIA_ENCRYPT_NONE) {
+ session_media->srtp = ast_sdp_srtp_alloc();
+ if (!session_media->srtp) {
+ return -1;
+ }
+ }
+
+ crypto_attribute = ast_sdp_srtp_get_attrib(session_media->srtp,
+ 0 /* DTLS can not be enabled for res_sip */,
+ 0 /* don't prefer 32byte tag length */);
+ if (!crypto_attribute) {
+ /* No crypto attribute to add */
+ return -1;
+ }
+
+ attr = pjmedia_sdp_attr_create(pool, "crypto", pj_cstr(&stmp, crypto_attribute));
+ media->attr[media->attr_count++] = attr;
+ return 0;
}
/*! \brief Function which creates an outgoing stream */
@@ -491,7 +619,6 @@
static const pj_str_t STR_IN = { "IN", 2 };
static const pj_str_t STR_IP4 = { "IP4", 3};
static const pj_str_t STR_IP6 = { "IP6", 3};
- static const pj_str_t STR_RTP_AVP = { "RTP/AVP", 7 };
static const pj_str_t STR_SENDRECV = { "sendrecv", 8 };
pjmedia_sdp_media *media;
char hostip[PJ_INET6_ADDRSTRLEN+2];
@@ -505,6 +632,7 @@
struct ast_format compat_format;
RAII_VAR(struct ast_format_cap *, caps, NULL, ast_format_cap_destroy);
enum ast_format_type media_type = stream_to_media_type(session_media->stream_type);
+ int crypto_res;
int direct_media_enabled = !ast_sockaddr_isnull(&session_media->direct_media_addr) &&
!ast_format_cap_is_empty(session->direct_media_cap);
@@ -521,9 +649,11 @@
return -1;
}
- /* TODO: This should eventually support SRTP */
+ crypto_res = add_crypto_to_stream(session, session_media, pool, media);
+
media->desc.media = pj_str(session_media->stream_type);
- media->desc.transport = STR_RTP_AVP;
+ media->desc.transport = pj_str(ast_sdp_get_rtp_profile(
+ !crypto_res, session_media->rtp, session->endpoint->use_avpf));
/* Add connection level details */
if (direct_media_enabled) {
Modified: team/qwell/fun_with_transports/res/res_sip_session.c
URL: http://svnview.digium.com/svn/asterisk/team/qwell/fun_with_transports/res/res_sip_session.c?view=diff&rev=387105&r1=387104&r2=387105
==============================================================================
--- team/qwell/fun_with_transports/res/res_sip_session.c (original)
+++ team/qwell/fun_with_transports/res/res_sip_session.c Wed May 1 12:10:20 2013
@@ -40,6 +40,7 @@
#include "asterisk/pbx.h"
#include "asterisk/taskprocessor.h"
#include "asterisk/causes.h"
+#include "asterisk/sdp_srtp.h"
#define SDP_HANDLER_BUCKETS 11
@@ -335,9 +336,32 @@
char media[20];
struct ast_sip_session_sdp_handler *handler;
RAII_VAR(struct sdp_handler_list *, handler_list, NULL, ao2_cleanup);
+ RAII_VAR(struct ast_sip_session_media *, session_media, NULL, ao2_cleanup);
/* We need a null-terminated version of the media string */
ast_copy_pj_str(media, &sdp->media[i]->desc.media, sizeof(media));
+
+ session_media = ao2_find(session->media, media, OBJ_KEY);
+ if (!session_media) {
+ /* if the session_media doesn't exist, there weren't
+ * any handlers at the time of its creation */
+ continue;
+ }
+
+ if (session_media->handler) {
+ int res;
+ handler = session_media->handler;
+ res = handler->negotiate_incoming_sdp_stream(
+ session, session_media, sdp, sdp->media[i]);
+ if (res <= 0) {
+ /* Catastrophic failure or ignored by assigned handler. Abort! */
+ return -1;
+ }
+ if (res > 0) {
+ /* Handled by this handler. Move to the next stream */
+ continue;
+ }
+ }
handler_list = ao2_find(sdp_handlers, media, OBJ_KEY);
if (!handler_list) {
@@ -346,9 +370,7 @@
}
AST_LIST_TRAVERSE(&handler_list->list, handler, next) {
int res;
- RAII_VAR(struct ast_sip_session_media *, session_media, NULL, ao2_cleanup);
- session_media = ao2_find(session->media, handler_list->stream_type, OBJ_KEY);
- if (!session_media || session_media->handler) {
+ if (session_media->handler) {
/* There is only one slot for this stream type and it has already been claimed
* so it will go unhandled */
break;
@@ -858,6 +880,9 @@
struct ast_sip_session_media *session_media = obj;
if (session_media->handler) {
session_media->handler->stream_destroy(session_media);
+ }
+ if (session_media->srtp) {
+ ast_sdp_srtp_destroy(session_media->srtp);
}
}
More information about the asterisk-commits
mailing list