[svn-commits] file: branch certified-11.6 r417724 - in /certified/branches/11.6: ./ channel...
SVN commits to the Digium repositories
svn-commits at lists.digium.com
Tue Jul 1 10:37:15 CDT 2014
Author: file
Date: Tue Jul 1 10:37:11 2014
New Revision: 417724
URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=417724
Log:
Multiple revisions 402345,405234,409129-409130,409565,413008,417141,417677
........
r402345 | kmoore | 2013-11-01 05:31:49 -0700 (Fri, 01 Nov 2013) | 11 lines
chan_sip: Fix RTCP port for SRFLX ICE candidates
This corrects one-way audio between Asterisk and Chrome/jssip as a
result of Asterisk inserting the incorrect RTCP port into RTCP SRFLX
ICE candidates. This also exposes an ICE component enumeration to
extract further details from candidates.
(closes issue ASTERISK-21383)
Reported by: Shaun Clark
Review: https://reviewboard.asterisk.org/r/2967/
........
r405234 | kharwell | 2014-01-09 08:49:55 -0800 (Thu, 09 Jan 2014) | 19 lines
res_rtp_asterisk: Fails to resume WebRTC call from hold
In ast_rtp_ice_start if the ice session create check list failed, start check
was never initiated and ice_started was never set to true. Upon re-entering
the function (for instance, [un]hold) it would try to create the check list
again with duplicate remote candidates.
Fixed so that if the create check list fails the necessary data structures
are properly re-initialized for any subsequent retries.
Note, it was decided to not stop ice support (by calling ast_rtp_ice_stop) on a
check list failure because it possible things might still work. However, a
debug message was added to help with any future troubleshooting.
(closes issue ASTERISK-22911)
Reported by: Vytis Valentinavičius
Patches:
works_on_my_machine.patch uploaded by xytis (license 6558)
........
r409129 | jrose | 2014-02-27 11:19:02 -0800 (Thu, 27 Feb 2014) | 15 lines
res_rtp_asterisk: Fix checklist creating problems in ICE sessions
Prior to this patch, local candidate lists including SRFLX would fail to start
properly when building ICE candidate check lists. This patch fixes that problem
by making sure that each SRFLX candidate is associated with the proper
base address so that the check list can create matches properly.
This patch was written by jcolp. The issue will be left open to await testing
by the issue participants.
(issue ASTERISK-23213)
Reported by: Andrea Suisani
Review: https://reviewboard.asterisk.org/r/3256/
........
r409130 | jrose | 2014-02-27 11:38:10 -0800 (Thu, 27 Feb 2014) | 8 lines
res_rtp_asterisk: correct build error from r409129
Accidentally placed a declaration below functional code
(issue ASTERISK-23213)
Reported by: Andrea Suisani
Review: https://reviewboard.asterisk.org/r/3256/
........
r409565 | jrose | 2014-03-04 08:40:39 -0800 (Tue, 04 Mar 2014) | 9 lines
res_rtp_asterisk: Fix one way audio problems with hold/unhold when using ICE
ICE sessions will now be restarted if sessions are changed to use new sets of
remote candidates.
(closes issue ASTERISK-22911)
Reported by: Vytis Valentinavičius
Review: https://reviewboard.asterisk.org/r/3275/
........
r413008 | mjordan | 2014-04-25 10:47:21 -0700 (Fri, 25 Apr 2014) | 14 lines
res_rtp_asterisk: Add support for DTLS handshake retransmissions
On congested networks, it is possible for the DTLS handshake messages to get
lost. This patch adds a timer to res_rtp_asterisk that will periodically
check to see if the handshake has succeeded. If not, it will retransmit the
DTLS handshake.
Review: https://reviewboard.asterisk.org/r/3337
ASTERISK-23649 #close
Reported by: Nitesh Bansal
patches:
dtls_retransmission.patch uploaded by Nitesh Bansal (License 6418)
........
r417141 | file | 2014-06-23 11:49:14 -0700 (Mon, 23 Jun 2014) | 5 lines
res_rtp_asterisk: Return the length of data written when sending via ICE instead of 0.
ASTERISK-23834 #close
Reported by: Richard Kenner
........
r417677 | file | 2014-06-30 12:42:18 -0700 (Mon, 30 Jun 2014) | 12 lines
res_rtp_asterisk: Add SHA-256 support for DTLS and perform DTLS negotiation on RTCP.
This change fixes up DTLS support in res_rtp_asterisk so it can accept and provide
a SHA-256 fingerprint, so it occurs on RTCP, and so it occurs after ICE negotiation
completes. Configuration options to chan_sip have also been added to allow behavior
to be tweaked (such as forcing the AVP type media transports in SDP).
ASTERISK-22961 #close
Reported by: Jay Jideliov
Review: https://reviewboard.asterisk.org/r/3679/
........
Merged revisions 402345,405234,409129-409130,409565,413008,417141,417677 from http://svn.asterisk.org/svn/asterisk/branches/11
Modified:
certified/branches/11.6/ (props changed)
certified/branches/11.6/UPGRADE.txt
certified/branches/11.6/channels/chan_sip.c
certified/branches/11.6/channels/sip/include/sip.h
certified/branches/11.6/configs/sip.conf.sample
certified/branches/11.6/include/asterisk/rtp_engine.h
certified/branches/11.6/main/rtp_engine.c
certified/branches/11.6/res/res_rtp_asterisk.c
Propchange: certified/branches/11.6/
------------------------------------------------------------------------------
Binary property 'branch-11-merged' - no diff available.
Modified: certified/branches/11.6/UPGRADE.txt
URL: http://svnview.digium.com/svn/asterisk/certified/branches/11.6/UPGRADE.txt?view=diff&rev=417724&r1=417723&r2=417724
==============================================================================
--- certified/branches/11.6/UPGRADE.txt (original)
+++ certified/branches/11.6/UPGRADE.txt Tue Jul 1 10:37:11 2014
@@ -25,6 +25,23 @@
* MixMonitor - system
* MixMonitorMute - call or system
* StopMixMonitor - call or system
+
+* Added a 'force_avp' option for chan_sip. When enabled this option will
+ cause the media transport in the offer or answer SDP to be 'RTP/AVP',
+ 'RTP/AVPF', 'RTP/SAVP', or 'RTP/SAVPF' even if a DTLS stream has been
+ configured. This option can be set to improve interoperability with WebRTC
+ clients that don't use the RFC defined transport for DTLS.
+
+* The 'dtlsverify' option in chan_sip now has additional values besides
+ 'yes' and 'no'. If 'yes' is specified both the certificate and fingerprint
+ will be verified. If 'no' is specified then neither the certificate or
+ fingerprint is verified. If 'certificate' is specified then only the
+ certificate is verified. If 'fingerprint' is specified then only the
+ fingerprint is verified.
+
+* A 'dtlsfingerprint' option has been added to chan_sip which allows the
+ hash to be specified for the DTLS fingerprint placed in SDP. Supported
+ values are 'sha-1' and 'sha-256' with 'sha-256' being the default.
* Added http.conf session_inactivity timer option to close HTTP connections
that aren't doing anything.
Modified: certified/branches/11.6/channels/chan_sip.c
URL: http://svnview.digium.com/svn/asterisk/certified/branches/11.6/channels/chan_sip.c?view=diff&rev=417724&r1=417723&r2=417724
==============================================================================
--- certified/branches/11.6/channels/chan_sip.c (original)
+++ certified/branches/11.6/channels/chan_sip.c Tue Jul 1 10:37:11 2014
@@ -1401,7 +1401,7 @@
static int process_sdp_a_image(const char *a, struct sip_pvt *p);
static void add_ice_to_sdp(struct ast_rtp_instance *instance, struct ast_str **a_buf);
static void add_dtls_to_sdp(struct ast_rtp_instance *instance, struct ast_str **a_buf);
-static void start_ice(struct ast_rtp_instance *instance);
+static void start_ice(struct ast_rtp_instance *instance, int offer);
static void add_codec_to_sdp(const struct sip_pvt *p, struct ast_format *codec,
struct ast_str **m_buf, struct ast_str **a_buf,
int debug, int *min_packet_size);
@@ -10040,12 +10040,21 @@
if (process_sdp_a_dtls(value, p, p->rtp)) {
processed = TRUE;
+ if (p->srtp) {
+ ast_set_flag(p->srtp, SRTP_CRYPTO_OFFER_OK);
+ }
}
if (process_sdp_a_dtls(value, p, p->vrtp)) {
processed = TRUE;
+ if (p->vsrtp) {
+ ast_set_flag(p->vsrtp, SRTP_CRYPTO_OFFER_OK);
+ }
}
if (process_sdp_a_dtls(value, p, p->trtp)) {
processed = TRUE;
+ if (p->tsrtp) {
+ ast_set_flag(p->tsrtp, SRTP_CRYPTO_OFFER_OK);
+ }
}
break;
@@ -10412,7 +10421,11 @@
if (process_sdp_a_ice(value, p, p->rtp)) {
processed = TRUE;
} else if (process_sdp_a_dtls(value, p, p->rtp)) {
+ processed_crypto = TRUE;
processed = TRUE;
+ if (p->srtp) {
+ ast_set_flag(p->srtp, SRTP_CRYPTO_OFFER_OK);
+ }
} else if (process_sdp_a_sendonly(value, &sendonly)) {
processed = TRUE;
} else if (!processed_crypto && process_crypto(p, p->rtp, &p->srtp, value)) {
@@ -10427,7 +10440,11 @@
if (process_sdp_a_ice(value, p, p->vrtp)) {
processed = TRUE;
} else if (process_sdp_a_dtls(value, p, p->vrtp)) {
+ processed_crypto = TRUE;
processed = TRUE;
+ if (p->vsrtp) {
+ ast_set_flag(p->vsrtp, SRTP_CRYPTO_OFFER_OK);
+ }
} else if (!processed_crypto && process_crypto(p, p->vrtp, &p->vsrtp, value)) {
processed_crypto = TRUE;
processed = TRUE;
@@ -10578,7 +10595,7 @@
/* Setup audio address and port */
if (p->rtp) {
if (sa && portno > 0) {
- start_ice(p->rtp);
+ start_ice(p->rtp, (req->method != SIP_RESPONSE) ? 0 : 1);
ast_sockaddr_set_port(sa, portno);
ast_rtp_instance_set_remote_address(p->rtp, sa);
if (debug) {
@@ -10626,7 +10643,7 @@
/* Setup video address and port */
if (p->vrtp) {
if (vsa && vportno > 0) {
- start_ice(p->vrtp);
+ start_ice(p->vrtp, (req->method != SIP_RESPONSE) ? 0 : 1);
ast_sockaddr_set_port(vsa, vportno);
ast_rtp_instance_set_remote_address(p->vrtp, vsa);
if (debug) {
@@ -10644,7 +10661,7 @@
/* Setup text address and port */
if (p->trtp) {
if (tsa && tportno > 0) {
- start_ice(p->trtp);
+ start_ice(p->trtp, (req->method != SIP_RESPONSE) ? 0 : 1);
ast_sockaddr_set_port(tsa, tportno);
ast_rtp_instance_set_remote_address(p->trtp, tsa);
if (debug) {
@@ -10971,7 +10988,7 @@
{
struct ast_rtp_engine_dtls *dtls;
int found = FALSE;
- char value[256], hash[6];
+ char value[256], hash[32];
if (!instance || !p->dtls_cfg.enabled || !(dtls = ast_rtp_instance_get_dtls(instance))) {
return found;
@@ -11003,11 +11020,13 @@
ast_log(LOG_WARNING, "Unsupported connection attribute value '%s' received on dialog '%s'\n",
value, p->callid);
}
- } else if (sscanf(a, "fingerprint: %5s %255s", hash, value) == 2) {
+ } else if (sscanf(a, "fingerprint: %31s %255s", hash, value) == 2) {
found = TRUE;
if (!strcasecmp(hash, "sha-1")) {
dtls->set_fingerprint(instance, AST_RTP_DTLS_HASH_SHA1, value);
+ } else if (!strcasecmp(hash, "sha-256")) {
+ dtls->set_fingerprint(instance, AST_RTP_DTLS_HASH_SHA256, value);
} else {
ast_log(LOG_WARNING, "Unsupported fingerprint hash type '%s' received on dialog '%s'\n",
hash, p->callid);
@@ -12594,7 +12613,13 @@
while ((candidate = ao2_iterator_next(&i))) {
ast_str_append(a_buf, 0, "a=candidate:%s %d %s %d ", candidate->foundation, candidate->id, candidate->transport, candidate->priority);
ast_str_append(a_buf, 0, "%s ", ast_sockaddr_stringify_host(&candidate->address));
- ast_str_append(a_buf, 0, "%s typ ", ast_sockaddr_stringify_port(&candidate->address));
+
+ if (candidate->type == AST_RTP_ICE_CANDIDATE_TYPE_SRFLX
+ && candidate->id == AST_RTP_ICE_COMPONENT_RTCP) {
+ ast_str_append(a_buf, 0, "%d typ ", ast_sockaddr_port(&candidate->address) + 1);
+ } else {
+ ast_str_append(a_buf, 0, "%s typ ", ast_sockaddr_stringify_port(&candidate->address));
+ }
if (candidate->type == AST_RTP_ICE_CANDIDATE_TYPE_HOST) {
ast_str_append(a_buf, 0, "host");
@@ -12619,7 +12644,7 @@
}
/*! \brief Start ICE negotiation on an RTP instance */
-static void start_ice(struct ast_rtp_instance *instance)
+static void start_ice(struct ast_rtp_instance *instance, int offer)
{
struct ast_rtp_engine_ice *ice = ast_rtp_instance_get_ice(instance);
@@ -12627,6 +12652,8 @@
return;
}
+ /* If we are the offerer then we are the controlling agent, otherwise they are */
+ ice->set_role(instance, offer ? AST_RTP_ICE_ROLE_CONTROLLING : AST_RTP_ICE_ROLE_CONTROLLED);
ice->start(instance);
}
@@ -12634,6 +12661,7 @@
static void add_dtls_to_sdp(struct ast_rtp_instance *instance, struct ast_str **a_buf)
{
struct ast_rtp_engine_dtls *dtls;
+ enum ast_rtp_dtls_hash hash;
const char *fingerprint;
if (!instance || !(dtls = ast_rtp_instance_get_dtls(instance)) || !dtls->active(instance)) {
@@ -12668,8 +12696,11 @@
break;
}
- if ((fingerprint = dtls->get_fingerprint(instance, AST_RTP_DTLS_HASH_SHA1))) {
- ast_str_append(a_buf, 0, "a=fingerprint:SHA-1 %s\r\n", fingerprint);
+ hash = dtls->get_fingerprint_hash(instance);
+ fingerprint = dtls->get_fingerprint(instance);
+ if (fingerprint && (hash == AST_RTP_DTLS_HASH_SHA1 || hash == AST_RTP_DTLS_HASH_SHA256)) {
+ ast_str_append(a_buf, 0, "a=fingerprint:%s %s\r\n", hash == AST_RTP_DTLS_HASH_SHA1 ? "SHA-1" : "SHA-256",
+ fingerprint);
}
}
@@ -12977,7 +13008,11 @@
struct ast_rtp_engine_dtls *dtls;
if ((dtls = ast_rtp_instance_get_dtls(instance)) && dtls->active(instance)) {
- return ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF) ? "UDP/TLS/RTP/SAVPF" : "UDP/TLS/RTP/SAVP";
+ if (ast_test_flag(&p->flags[2], SIP_PAGE3_FORCE_AVP)) {
+ return ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF) ? "RTP/SAVPF" : "RTP/SAVP";
+ } else {
+ return ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF) ? "UDP/TLS/RTP/SAVPF" : "UDP/TLS/RTP/SAVP";
+ }
} else {
if (ast_test_flag(&p->flags[2], SIP_PAGE3_USE_AVPF)) {
return secure ? "RTP/SAVPF" : "RTP/AVPF";
@@ -30925,6 +30960,8 @@
ast_set2_flag(&peer->flags[2], ast_true(v->value), SIP_PAGE3_USE_AVPF);
} else if (!strcasecmp(v->name, "icesupport")) {
ast_set2_flag(&peer->flags[2], ast_true(v->value), SIP_PAGE3_ICE_SUPPORT);
+ } else if (!strcasecmp(v->name, "force_avp")) {
+ ast_set2_flag(&peer->flags[2], ast_true(v->value), SIP_PAGE3_FORCE_AVP);
} else {
ast_rtp_dtls_cfg_parse(&peer->dtls_cfg, v->name, v->value);
}
Modified: certified/branches/11.6/channels/sip/include/sip.h
URL: http://svnview.digium.com/svn/asterisk/certified/branches/11.6/channels/sip/include/sip.h?view=diff&rev=417724&r1=417723&r2=417724
==============================================================================
--- certified/branches/11.6/channels/sip/include/sip.h (original)
+++ certified/branches/11.6/channels/sip/include/sip.h Tue Jul 1 10:37:11 2014
@@ -374,10 +374,11 @@
#define SIP_PAGE3_DIRECT_MEDIA_OUTGOING (1 << 4) /*!< DP: Only send direct media reinvites on outgoing calls */
#define SIP_PAGE3_USE_AVPF (1 << 5) /*!< DGP: Support a minimal AVPF-compatible profile */
#define SIP_PAGE3_ICE_SUPPORT (1 << 6) /*!< DGP: Enable ICE support */
+#define SIP_PAGE3_FORCE_AVP (1 << 7) /*!< DGP: Force 'RTP/AVP' for all streams, even DTLS */
#define SIP_PAGE3_FLAGS_TO_COPY \
(SIP_PAGE3_SNOM_AOC | SIP_PAGE3_SRTP_TAG_32 | SIP_PAGE3_NAT_AUTO_RPORT | SIP_PAGE3_NAT_AUTO_COMEDIA | \
- SIP_PAGE3_DIRECT_MEDIA_OUTGOING | SIP_PAGE3_USE_AVPF | SIP_PAGE3_ICE_SUPPORT)
+ SIP_PAGE3_DIRECT_MEDIA_OUTGOING | SIP_PAGE3_USE_AVPF | SIP_PAGE3_ICE_SUPPORT | SIP_PAGE3_FORCE_AVP)
#define CHECK_AUTH_BUF_INITLEN 256
Modified: certified/branches/11.6/configs/sip.conf.sample
URL: http://svnview.digium.com/svn/asterisk/certified/branches/11.6/configs/sip.conf.sample?view=diff&rev=417724&r1=417723&r2=417724
==============================================================================
--- certified/branches/11.6/configs/sip.conf.sample (original)
+++ certified/branches/11.6/configs/sip.conf.sample Tue Jul 1 10:37:11 2014
@@ -1007,6 +1007,8 @@
;avpf=yes ; Enable inter-operability with media streams using the AVPF RTP profile.
; This will cause all offers and answers to use AVPF (or SAVPF). This
; option may be specified at the global or peer scope.
+;force_avp=yes ; Force 'RTP/AVP', 'RTP/AVPF', 'RTP/SAVP', and 'RTP/SAVPF' to be used for
+ ; media streams when appropriate, even if a DTLS stream is present.
;----------------------------------------- REALTIME SUPPORT ------------------------
; For additional information on ARA, the Asterisk Realtime Architecture,
; please read https://wiki.asterisk.org/wiki/display/AST/Realtime+Database+Configuration
@@ -1261,6 +1263,7 @@
; dtlscafile
; dtlscapath
; dtlssetup
+; dtlsfingerprint
;
;------------------------------------------------------------------------------
@@ -1269,7 +1272,11 @@
; DTLS-SRTP support is available if the underlying RTP engine in use supports it.
;
; dtlsenable = yes ; Enable or disable DTLS-SRTP support
-; dtlsverify = yes ; Verify that the provided peer certificate is valid
+; dtlsverify = yes ; Verify that provided peer certificate and fingerprint are valid
+; ; A value of 'yes' will perform both certificate and fingerprint verification
+; ; A value of 'no' will perform no certificate or fingerprint verification
+; ; A value of 'fingerprint' will perform ONLY fingerprint verification
+; ; A value of 'certificate' will perform ONLY certficiate verification
; dtlsrekey = 60 ; Interval at which to renegotiate the TLS session and rekey the SRTP session
; ; If this is not set or the value provided is 0 rekeying will be disabled
; dtlscertfile = file ; Path to certificate file to present
@@ -1284,6 +1291,7 @@
; ; accept connections only), and actpass (we will do both). This value will be used in
; ; the outgoing SDP when offering and for incoming SDP offers when the remote party sends
; ; actpass
+; dtlsfingerprint = sha-1 ; The hash to use for the fingerprint in SDP (valid options are sha-1 and sha-256)
;[sip_proxy]
; For incoming calls only. Example: FWD (Free World Dialup)
Modified: certified/branches/11.6/include/asterisk/rtp_engine.h
URL: http://svnview.digium.com/svn/asterisk/certified/branches/11.6/include/asterisk/rtp_engine.h?view=diff&rev=417724&r1=417723&r2=417724
==============================================================================
--- certified/branches/11.6/include/asterisk/rtp_engine.h (original)
+++ certified/branches/11.6/include/asterisk/rtp_engine.h Tue Jul 1 10:37:11 2014
@@ -322,10 +322,22 @@
AST_RTP_ICE_CANDIDATE_TYPE_RELAYED, /*!< ICE relayed candidate, which represents the address allocated in TURN server. */
};
+/*! \brief ICE component types */
+enum ast_rtp_ice_component_type {
+ AST_RTP_ICE_COMPONENT_RTP = 1,
+ AST_RTP_ICE_COMPONENT_RTCP = 2,
+};
+
+/*! \brief ICE role during negotiation */
+enum ast_rtp_ice_role {
+ AST_RTP_ICE_ROLE_CONTROLLED,
+ AST_RTP_ICE_ROLE_CONTROLLING,
+};
+
/*! \brief Structure for an ICE candidate */
struct ast_rtp_engine_ice_candidate {
char *foundation; /*!< Foundation identifier */
- unsigned int id; /*!< Component identifier */
+ enum ast_rtp_ice_component_type id; /*!< Component identifier */
char *transport; /*!< Transport for the media */
int priority; /*!< Priority which is used if multiple candidates can be used */
struct ast_sockaddr address; /*!< Address of the candidate */
@@ -351,6 +363,8 @@
struct ao2_container *(*get_local_candidates)(struct ast_rtp_instance *instance);
/*! Callback for telling the ICE support that it is talking to an ice-lite implementation */
void (*ice_lite)(struct ast_rtp_instance *instance);
+ /*! Callback for changing our role in negotiation */
+ void (*set_role)(struct ast_rtp_instance *instance, enum ast_rtp_ice_role role);
};
/*! \brief DTLS setup types */
@@ -363,22 +377,31 @@
/*! \brief DTLS connection states */
enum ast_rtp_dtls_connection {
- AST_RTP_DTLS_CONNECTION_NEW, /*!< Endpoint wants to use a new connection */
+ AST_RTP_DTLS_CONNECTION_NEW, /*!< Endpoint wants to use a new connection */
AST_RTP_DTLS_CONNECTION_EXISTING, /*!< Endpoint wishes to use existing connection */
};
/*! \brief DTLS fingerprint hashes */
enum ast_rtp_dtls_hash {
- AST_RTP_DTLS_HASH_SHA1, /*!< SHA-1 fingerprint hash */
+ AST_RTP_DTLS_HASH_SHA256, /*!< SHA-256 fingerprint hash */
+ AST_RTP_DTLS_HASH_SHA1, /*!< SHA-1 fingerprint hash */
+};
+
+/*! \brief DTLS verification settings */
+enum ast_rtp_dtls_verify {
+ AST_RTP_DTLS_VERIFY_NONE = 0, /*!< Don't verify anything */
+ AST_RTP_DTLS_VERIFY_FINGERPRINT = (1 << 0), /*!< Verify the fingerprint */
+ AST_RTP_DTLS_VERIFY_CERTIFICATE = (1 << 1), /*!< Verify the certificate */
};
/*! \brief DTLS configuration structure */
struct ast_rtp_dtls_cfg {
unsigned int enabled:1; /*!< Whether DTLS support is enabled or not */
- unsigned int verify:1; /*!< Whether to request and verify a client certificate when acting as server */
unsigned int rekey; /*!< Interval at which to renegotiate and rekey - defaults to 0 (off) */
enum ast_rtp_dtls_setup default_setup; /*!< Default setup type to use for outgoing */
enum ast_srtp_suite suite; /*!< Crypto suite in use */
+ enum ast_rtp_dtls_hash hash; /*!< Hash to use for fingerprint */
+ enum ast_rtp_dtls_verify verify; /*!< What should be verified */
char *certfile; /*!< Certificate file */
char *pvtfile; /*!< Private key file */
char *cipher; /*!< Cipher to use */
@@ -404,8 +427,10 @@
void (*set_setup)(struct ast_rtp_instance *instance, enum ast_rtp_dtls_setup setup);
/*! Set the remote fingerprint */
void (*set_fingerprint)(struct ast_rtp_instance *instance, enum ast_rtp_dtls_hash hash, const char *fingerprint);
+ /*! Get the local fingerprint hash type */
+ enum ast_rtp_dtls_hash (*get_fingerprint_hash)(struct ast_rtp_instance *instance);
/*! Get the local fingerprint */
- const char *(*get_fingerprint)(struct ast_rtp_instance *instance, enum ast_rtp_dtls_hash hash);
+ const char *(*get_fingerprint)(struct ast_rtp_instance *instance);
};
/*! Structure that represents an RTP stack (engine) */
Modified: certified/branches/11.6/main/rtp_engine.c
URL: http://svnview.digium.com/svn/asterisk/certified/branches/11.6/main/rtp_engine.c?view=diff&rev=417724&r1=417723&r2=417724
==============================================================================
--- certified/branches/11.6/main/rtp_engine.c (original)
+++ certified/branches/11.6/main/rtp_engine.c Tue Jul 1 10:37:11 2014
@@ -2089,7 +2089,17 @@
if (!strcasecmp(name, "dtlsenable")) {
dtls_cfg->enabled = ast_true(value) ? 1 : 0;
} else if (!strcasecmp(name, "dtlsverify")) {
- dtls_cfg->verify = ast_true(value) ? 1 : 0;
+ if (!strcasecmp(value, "yes")) {
+ dtls_cfg->verify = AST_RTP_DTLS_VERIFY_FINGERPRINT | AST_RTP_DTLS_VERIFY_CERTIFICATE;
+ } else if (!strcasecmp(value, "fingerprint")) {
+ dtls_cfg->verify = AST_RTP_DTLS_VERIFY_FINGERPRINT;
+ } else if (!strcasecmp(value, "certificate")) {
+ dtls_cfg->verify = AST_RTP_DTLS_VERIFY_CERTIFICATE;
+ } else if (!strcasecmp(value, "no")) {
+ dtls_cfg->verify = AST_RTP_DTLS_VERIFY_NONE;
+ } else {
+ return -1;
+ }
} else if (!strcasecmp(name, "dtlsrekey")) {
if (sscanf(value, "%30u", &dtls_cfg->rekey) != 1) {
return -1;
@@ -2117,6 +2127,12 @@
} else if (!strcasecmp(value, "actpass")) {
dtls_cfg->default_setup = AST_RTP_DTLS_SETUP_ACTPASS;
}
+ } else if (!strcasecmp(name, "dtlsfingerprint")) {
+ if (!strcasecmp(value, "sha-256")) {
+ dtls_cfg->hash = AST_RTP_DTLS_HASH_SHA256;
+ } else if (!strcasecmp(value, "sha-1")) {
+ dtls_cfg->hash = AST_RTP_DTLS_HASH_SHA1;
+ }
} else {
return -1;
}
@@ -2130,6 +2146,7 @@
dst_cfg->verify = src_cfg->verify;
dst_cfg->rekey = src_cfg->rekey;
dst_cfg->suite = src_cfg->suite;
+ dst_cfg->hash = src_cfg->hash;
dst_cfg->certfile = ast_strdup(src_cfg->certfile);
dst_cfg->pvtfile = ast_strdup(src_cfg->pvtfile);
dst_cfg->cipher = ast_strdup(src_cfg->cipher);
Modified: certified/branches/11.6/res/res_rtp_asterisk.c
URL: http://svnview.digium.com/svn/asterisk/certified/branches/11.6/res/res_rtp_asterisk.c?view=diff&rev=417724&r1=417723&r2=417724
==============================================================================
--- certified/branches/11.6/res/res_rtp_asterisk.c (original)
+++ certified/branches/11.6/res/res_rtp_asterisk.c Tue Jul 1 10:37:11 2014
@@ -70,6 +70,7 @@
#include "asterisk/unaligned.h"
#include "asterisk/module.h"
#include "asterisk/rtp_engine.h"
+#include "asterisk/test.h"
#define MAX_TIMESTAMP_SKEW 640
@@ -176,14 +177,21 @@
#define TRANSPORT_TURN_RTP 3
#define TRANSPORT_TURN_RTCP 4
-#define COMPONENT_RTP 1
-#define COMPONENT_RTCP 2
-
/*! \brief RTP learning mode tracking information */
struct rtp_learning_info {
int max_seq; /*!< The highest sequence number received */
int packets; /*!< The number of remaining packets before the source is accepted */
};
+
+#ifdef HAVE_OPENSSL_SRTP
+struct dtls_details {
+ SSL *ssl; /*!< SSL session */
+ BIO *read_bio; /*!< Memory buffer for reading */
+ BIO *write_bio; /*!< Memory buffer for writing */
+ enum ast_rtp_dtls_setup dtls_setup; /*!< Current setup state */
+ enum ast_rtp_dtls_connection connection; /*!< Whether this is a new or existing connection */
+};
+#endif
/*! \brief RTP session description */
struct ast_rtp {
@@ -268,7 +276,7 @@
pj_turn_state_t turn_state; /*!< Current state of the TURN relay session */
ast_cond_t cond; /*!< Condition for signaling */
unsigned int passthrough:1; /*!< Bit to indicate that the received packet should be passed through */
- unsigned int ice_started:1; /*!< Bit to indicate ICE connectivity checks have started */
+ unsigned int ice_port; /*!< Port that ICE was started with if it was previously started */
char remote_ufrag[256]; /*!< The remote ICE username */
char remote_passwd[256]; /*!< The remote ICE password */
@@ -276,23 +284,25 @@
char local_ufrag[256]; /*!< The local ICE username */
char local_passwd[256]; /*!< The local ICE password */
- struct ao2_container *local_candidates; /*!< The local ICE candidates */
- struct ao2_container *remote_candidates; /*!< The remote ICE candidates */
+ struct ao2_container *ice_local_candidates; /*!< The local ICE candidates */
+ struct ao2_container *ice_active_remote_candidates; /*!< The remote ICE candidates */
+ struct ao2_container *ice_proposed_remote_candidates; /*!< Incoming remote ICE candidates for new session */
+ struct ast_sockaddr ice_original_rtp_addr; /*!< rtp address that ICE started on first session */
#endif
#ifdef HAVE_OPENSSL_SRTP
SSL_CTX *ssl_ctx; /*!< SSL context */
- SSL *ssl; /*!< SSL session */
- BIO *read_bio; /*!< Memory buffer for reading */
- BIO *write_bio; /*!< Memory buffer for writing */
- enum ast_rtp_dtls_setup dtls_setup; /*!< Current setup state */
+ ast_mutex_t dtls_timer_lock; /*!< Lock for synchronization purposes */
+ enum ast_rtp_dtls_verify dtls_verify; /*!< What to verify */
enum ast_srtp_suite suite; /*!< SRTP crypto suite */
+ enum ast_rtp_dtls_hash local_hash; /*!< Local hash used for the fingerprint */
char local_fingerprint[160]; /*!< Fingerprint of our certificate */
+ enum ast_rtp_dtls_hash remote_hash; /*!< Remote hash used for the fingerprint */
unsigned char remote_fingerprint[EVP_MAX_MD_SIZE]; /*!< Fingerprint of the peer certificate */
- enum ast_rtp_dtls_connection connection; /*!< Whether this is a new or existing connection */
- unsigned int dtls_failure:1; /*!< Failure occurred during DTLS negotiation */
unsigned int rekey; /*!< Interval at which to renegotiate and rekey */
int rekeyid; /*!< Scheduled item id for rekeying */
+ int dtlstimerid; /*!< Scheduled item id for DTLS retransmission for RTP */
+ struct dtls_details dtls; /*!< DTLS state information */
#endif
};
@@ -355,6 +365,10 @@
double normdevrtt;
double stdevrtt;
unsigned int rtt_count;
+
+#ifdef HAVE_OPENSSL_SRTP
+ struct dtls_details dtls; /*!< DTLS state information */
+#endif
};
struct rtp_red {
@@ -402,6 +416,7 @@
#ifdef HAVE_OPENSSL_SRTP
static int ast_rtp_activate(struct ast_rtp_instance *instance);
+static void dtls_srtp_check_pending(struct ast_rtp_instance *instance, struct ast_rtp *rtp, int rtcp);
#endif
static int __rtp_sendto(struct ast_rtp_instance *instance, void *buf, size_t size, int flags, struct ast_sockaddr *sa, int rtcp, int *ice, int use_srtp);
@@ -434,17 +449,32 @@
}
}
+static int ice_candidate_cmp(void *obj, void *arg, int flags)
+{
+ struct ast_rtp_engine_ice_candidate *candidate1 = obj, *candidate2 = arg;
+
+ if (strcmp(candidate1->foundation, candidate2->foundation) ||
+ candidate1->id != candidate2->id ||
+ ast_sockaddr_cmp(&candidate1->address, &candidate2->address) ||
+ candidate1->type != candidate1->type) {
+ return 0;
+ }
+
+ return CMP_MATCH | CMP_STOP;
+}
+
static void ast_rtp_ice_add_remote_candidate(struct ast_rtp_instance *instance, const struct ast_rtp_engine_ice_candidate *candidate)
{
struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
struct ast_rtp_engine_ice_candidate *remote_candidate;
- if (!rtp->remote_candidates && !(rtp->remote_candidates = ao2_container_alloc(1, NULL, NULL))) {
+ if (!rtp->ice_proposed_remote_candidates &&
+ !(rtp->ice_proposed_remote_candidates = ao2_container_alloc(1, NULL, ice_candidate_cmp))) {
return;
}
/* If this is going to exceed the maximum number of ICE candidates don't even add it */
- if (ao2_container_count(rtp->remote_candidates) == PJ_ICE_MAX_CAND) {
+ if (ao2_container_count(rtp->ice_proposed_remote_candidates) == PJ_ICE_MAX_CAND) {
return;
}
@@ -460,7 +490,7 @@
ast_sockaddr_copy(&remote_candidate->relay_address, &candidate->relay_address);
remote_candidate->type = candidate->type;
- ao2_link(rtp->remote_candidates, remote_candidate);
+ ao2_link(rtp->ice_proposed_remote_candidates, remote_candidate);
ao2_ref(remote_candidate, -1);
}
@@ -500,6 +530,67 @@
ast_sockaddr_parse(cand_address, pj_sockaddr_print(&rtp->ice->comp[component - 1].valid_check->rcand->addr, address, sizeof(address), 0), 0);
ast_sockaddr_set_port(cand_address, pj_sockaddr_get_port(&rtp->ice->comp[component - 1].valid_check->rcand->addr));
+}
+
+static int ice_create(struct ast_rtp_instance *instance, struct ast_sockaddr *addr,
+ int port, int replace);
+
+static void ast_rtp_ice_stop(struct ast_rtp_instance *instance)
+{
+ struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
+
+ if (!rtp->ice) {
+ return;
+ }
+
+ pj_thread_register_check();
+
+ pj_ice_sess_destroy(rtp->ice);
+ rtp->ice = NULL;
+}
+
+static int ice_reset_session(struct ast_rtp_instance *instance)
+{
+ struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
+ pj_ice_sess_role role = rtp->ice->role;
+ int res;
+
+ ast_rtp_ice_stop(instance);
+
+ res = ice_create(instance, &rtp->ice_original_rtp_addr, rtp->ice_port, 1);
+ if (!res) {
+ /* Preserve the role that the old ICE session used */
+ pj_ice_sess_change_role(rtp->ice, role);
+ }
+
+ return res;
+}
+
+static int ice_candidates_compare(struct ao2_container *left, struct ao2_container *right)
+{
+ struct ao2_iterator i;
+ struct ast_rtp_engine_ice_candidate *right_candidate;
+
+ if (ao2_container_count(left) != ao2_container_count(right)) {
+ return -1;
+ }
+
+ i = ao2_iterator_init(right, 0);
+ while ((right_candidate = ao2_iterator_next(&i))) {
+ struct ast_rtp_engine_ice_candidate *left_candidate = ao2_find(left, right_candidate, OBJ_POINTER);
+
+ if (!left_candidate) {
+ ao2_ref(right_candidate, -1);
+ ao2_iterator_destroy(&i);
+ return -1;
+ }
+
+ ao2_ref(left_candidate, -1);
+ ao2_ref(right_candidate, -1);
+ }
+ ao2_iterator_destroy(&i);
+
+ return 0;
}
static void ast_rtp_ice_start(struct ast_rtp_instance *instance)
@@ -511,13 +602,32 @@
struct ast_rtp_engine_ice_candidate *candidate;
int cand_cnt = 0;
- if (!rtp->ice || !rtp->remote_candidates || rtp->ice_started) {
+ if (!rtp->ice || !rtp->ice_proposed_remote_candidates) {
return;
}
+ /* Check for equivalence in the lists */
+ if (rtp->ice_active_remote_candidates &&
+ !ice_candidates_compare(rtp->ice_proposed_remote_candidates, rtp->ice_active_remote_candidates)) {
+ ao2_cleanup(rtp->ice_proposed_remote_candidates);
+ rtp->ice_proposed_remote_candidates = NULL;
+ return;
+ }
+
+ /* Out with the old, in with the new */
+ ao2_cleanup(rtp->ice_active_remote_candidates);
+ rtp->ice_active_remote_candidates = rtp->ice_proposed_remote_candidates;
+ rtp->ice_proposed_remote_candidates = NULL;
+
+ /* Reset the ICE session. Is this going to work? */
+ if (ice_reset_session(instance)) {
+ ast_log(LOG_NOTICE, "Failed to create replacement ICE session\n");
+ return;
+ }
+
pj_thread_register_check();
- i = ao2_iterator_init(rtp->remote_candidates, 0);
+ i = ao2_iterator_init(rtp->ice_active_remote_candidates, 0);
while ((candidate = ao2_iterator_next(&i)) && (cand_cnt < PJ_ICE_MAX_CAND)) {
pj_str_t address;
@@ -540,26 +650,64 @@
candidates[cand_cnt].type = PJ_ICE_CAND_TYPE_RELAYED;
}
- if (candidate->id == COMPONENT_RTP && rtp->turn_rtp) {
+ if (candidate->id == AST_RTP_ICE_COMPONENT_RTP && rtp->turn_rtp) {
pj_turn_sock_set_perm(rtp->turn_rtp, 1, &candidates[cand_cnt].addr, 1);
- } else if (candidate->id == COMPONENT_RTCP && rtp->turn_rtcp) {
+ } else if (candidate->id == AST_RTP_ICE_COMPONENT_RTCP && rtp->turn_rtcp) {
pj_turn_sock_set_perm(rtp->turn_rtcp, 1, &candidates[cand_cnt].addr, 1);
}
cand_cnt++;
+ ao2_ref(candidate, -1);
}
ao2_iterator_destroy(&i);
- if (pj_ice_sess_create_check_list(rtp->ice, &ufrag, &passwd, ao2_container_count(rtp->remote_candidates), &candidates[0]) == PJ_SUCCESS) {
+ if (pj_ice_sess_create_check_list(rtp->ice, &ufrag, &passwd, ao2_container_count(rtp->ice_active_remote_candidates), &candidates[0]) == PJ_SUCCESS) {
+ ast_test_suite_event_notify("ICECHECKLISTCREATE", "Result: SUCCESS");
pj_ice_sess_start_check(rtp->ice);
pj_timer_heap_poll(timerheap, NULL);
- rtp->ice_started = 1;
rtp->strict_rtp_state = STRICT_RTP_OPEN;
- }
-}
-
-static void ast_rtp_ice_stop(struct ast_rtp_instance *instance)
+ return;
+ }
+
+ ast_test_suite_event_notify("ICECHECKLISTCREATE", "Result: FAILURE");
+
+ /* even though create check list failed don't stop ice as
+ it might still work */
+ ast_debug(1, "Failed to create ICE session check list\n");
+ /* however we do need to reset remote candidates since
+ this function may be re-entered */
+ ao2_ref(rtp->ice_active_remote_candidates, -1);
+ rtp->ice_active_remote_candidates = NULL;
+ rtp->ice->rcand_cnt = rtp->ice->clist.count = 0;
+}
+
+static const char *ast_rtp_ice_get_ufrag(struct ast_rtp_instance *instance)
+{
+ struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
+
+ return rtp->local_ufrag;
+}
+
+static const char *ast_rtp_ice_get_password(struct ast_rtp_instance *instance)
+{
+ struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
+
+ return rtp->local_passwd;
+}
+
+static struct ao2_container *ast_rtp_ice_get_local_candidates(struct ast_rtp_instance *instance)
+{
+ struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
+
+ if (rtp->ice_local_candidates) {
+ ao2_ref(rtp->ice_local_candidates, +1);
+ }
+
+ return rtp->ice_local_candidates;
+}
+
+static void ast_rtp_ice_lite(struct ast_rtp_instance *instance)
{
struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
@@ -569,36 +717,10 @@
pj_thread_register_check();
- pj_ice_sess_destroy(rtp->ice);
- rtp->ice = NULL;
-}
-
-static const char *ast_rtp_ice_get_ufrag(struct ast_rtp_instance *instance)
-{
- struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
-
- return rtp->local_ufrag;
-}
-
-static const char *ast_rtp_ice_get_password(struct ast_rtp_instance *instance)
-{
- struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
-
- return rtp->local_passwd;
-}
-
-static struct ao2_container *ast_rtp_ice_get_local_candidates(struct ast_rtp_instance *instance)
-{
- struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
-
- if (rtp->local_candidates) {
- ao2_ref(rtp->local_candidates, +1);
- }
-
- return rtp->local_candidates;
-}
-
-static void ast_rtp_ice_lite(struct ast_rtp_instance *instance)
+ pj_ice_sess_change_role(rtp->ice, PJ_ICE_SESS_ROLE_CONTROLLING);
+}
+
+static void ast_rtp_ice_set_role(struct ast_rtp_instance *instance, enum ast_rtp_ice_role role)
{
struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
@@ -608,21 +730,8 @@
pj_thread_register_check();
- pj_ice_sess_change_role(rtp->ice, PJ_ICE_SESS_ROLE_CONTROLLING);
-}
-
-static int ice_candidate_cmp(void *obj, void *arg, int flags)
-{
- struct ast_rtp_engine_ice_candidate *candidate1 = obj, *candidate2 = arg;
-
- if ((strcmp(candidate1->foundation, candidate2->foundation)) ||
- (candidate1->id != candidate2->id) ||
- (ast_sockaddr_cmp(&candidate1->address, &candidate2->address)) ||
- (candidate1->type != candidate1->type)) {
- return 0;
- }
-
- return CMP_MATCH | CMP_STOP;
+ pj_ice_sess_change_role(rtp->ice, role == AST_RTP_ICE_ROLE_CONTROLLED ?
+ PJ_ICE_SESS_ROLE_CONTROLLED : PJ_ICE_SESS_ROLE_CONTROLLING);
}
static void ast_rtp_ice_add_cand(struct ast_rtp *rtp, unsigned comp_id, unsigned transport_id, pj_ice_cand_type type, pj_uint16_t local_pref,
@@ -636,7 +745,7 @@
pj_ice_calc_foundation(rtp->ice->pool, &foundation, type, addr);
- if (!rtp->local_candidates && !(rtp->local_candidates = ao2_container_alloc(1, NULL, ice_candidate_cmp))) {
+ if (!rtp->ice_local_candidates && !(rtp->ice_local_candidates = ao2_container_alloc(1, NULL, ice_candidate_cmp))) {
return;
}
@@ -664,13 +773,13 @@
candidate->type = AST_RTP_ICE_CANDIDATE_TYPE_RELAYED;
}
- if ((existing = ao2_find(rtp->local_candidates, candidate, OBJ_POINTER))) {
+ if ((existing = ao2_find(rtp->ice_local_candidates, candidate, OBJ_POINTER))) {
ao2_ref(existing, -1);
ao2_ref(candidate, -1);
return;
}
- if (pj_ice_sess_add_cand(rtp->ice, comp_id, transport_id, type, local_pref, &foundation, addr, addr, rel_addr, addr_len, NULL) != PJ_SUCCESS) {
+ if (pj_ice_sess_add_cand(rtp->ice, comp_id, transport_id, type, local_pref, &foundation, addr, base_addr, rel_addr, addr_len, NULL) != PJ_SUCCESS) {
ao2_ref(candidate, -1);
return;
}
@@ -678,7 +787,7 @@
/* By placing the candidate into the ICE session it will have produced the priority, so update the local candidate with it */
candidate->priority = rtp->ice->lcand[rtp->ice->lcand_cnt - 1].prio;
- ao2_link(rtp->local_candidates, candidate);
+ ao2_link(rtp->ice_local_candidates, candidate);
ao2_ref(candidate, -1);
}
@@ -704,25 +813,83 @@
.get_password = ast_rtp_ice_get_password,
.get_local_candidates = ast_rtp_ice_get_local_candidates,
.ice_lite = ast_rtp_ice_lite,
+ .set_role = ast_rtp_ice_set_role,
};
#endif
#ifdef HAVE_OPENSSL_SRTP
-static void dtls_info_callback(const SSL *ssl, int where, int ret)
-{
- struct ast_rtp *rtp = SSL_get_ex_data(ssl, 0);
-
- /* We only care about alerts */
- if (!(where & SSL_CB_ALERT)) {
- return;
- }
-
- rtp->dtls_failure = 1;
+static int dtls_verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
+{
+ /* We don't want to actually verify the certificate so just accept what they have provided */
+ return 1;
+}
+
+static int dtls_details_initialize(struct dtls_details *dtls, SSL_CTX *ssl_ctx,
+ enum ast_rtp_dtls_setup setup)
+{
+ dtls->dtls_setup = setup;
+
[... 1070 lines stripped ...]
More information about the svn-commits
mailing list