Skip to content

F
freeswitch
提交 f4a72741 authored 作者: Mike Jerris's avatar Mike Jerris
浏览文件
操作

Merge pull request #1682 in FS/freeswitch from ~LAZEDO/freeswitch:proxy-token-acl-port to master 

* commit '6ceb9885':
  FS-9956 [mod_sofia] retain user lookup in blind & acl auth
  FS-11025 [mod_sofia] use ports for acl check
  FS-11025 [core] allow/check ports in network lists
  FS-10746 [mod_sofia] allow authoritative proxy to provide token
上级 bdddbc7a 6ceb9885
全部展开 隐藏空白字符变更
内嵌 并排
正在显示 包含 306 行增加 和 71 行删除
src/include/switch_core.h
浏览文件 @ f4a72741
......@@ -2427,6 +2427,7 @@ SWITCH_DECLARE(const char *) switch_lookup_timezone(const char *tz_name);
SWITCH_DECLARE(switch_status_t) switch_strftime_tz(const char *tz, const char *format, char *date, size_t len, switch_time_t thetime);
SWITCH_DECLARE(switch_status_t) switch_time_exp_tz_name(const char *tz, switch_time_exp_t *tm, switch_time_t thetime);
SWITCH_DECLARE(void) switch_load_network_lists(switch_bool_t reload);
SWITCH_DECLARE(switch_bool_t) switch_check_network_list_ip_port_token(const char *ip_str, int port, const char *list_name, const char **token);
SWITCH_DECLARE(switch_bool_t) switch_check_network_list_ip_token(const char *ip_str, const char *list_name, const char **token);
#define switch_check_network_list_ip(_ip_str, _list_name) switch_check_network_list_ip_token(_ip_str, _list_name, NULL)
SWITCH_DECLARE(void) switch_time_set_monotonic(switch_bool_t enable);
......
src/include/switch_utils.h
浏览文件 @ f4a72741
......@@ -46,6 +46,16 @@ SWITCH_BEGIN_EXTERN_C
#define SWITCH_URL_UNSAFE "\r\n #%&+:;<=>?@[\\]^`{|}\""
#define MAX_NETWORK_PORTS 10
struct switch_network_port_range {
int port;
int ports[MAX_NETWORK_PORTS];
int min_port;
int max_port;
};
typedef struct switch_network_port_range switch_network_port_range_t;
typedef switch_network_port_range_t* switch_network_port_range_p;
static inline char *switch_get_hex_bytes(switch_byte_t *buf, switch_size_t datalen, char *new_buf, switch_size_t new_datalen)
{
......@@ -1270,6 +1280,12 @@ SWITCH_DECLARE(switch_status_t) switch_network_list_add_cidr_token(switch_networ
SWITCH_DECLARE(char *) switch_network_ipv4_mapped_ipv6_addr(const char* ip_str);
SWITCH_DECLARE(switch_status_t) switch_network_list_add_host_mask(switch_network_list_t *list, const char *host, const char *mask_str, switch_bool_t ok);
SWITCH_DECLARE(switch_status_t) switch_network_list_add_cidr_port_token(switch_network_list_t *list, const char *cidr_str, switch_bool_t ok, const char *token, switch_network_port_range_p port);
SWITCH_DECLARE(switch_status_t) switch_network_list_add_host_port_mask(switch_network_list_t *list, const char *host, const char *mask_str, switch_bool_t ok, switch_network_port_range_p port);
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip_port_token(switch_network_list_t *list, uint32_t ip, int port, const char **token);
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip6_port_token(switch_network_list_t *list, ip_t ip, int port, const char **token);
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip_token(switch_network_list_t *list, uint32_t ip, const char **token);
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip6_token(switch_network_list_t *list, ip_t ip, const char **token);
#define switch_network_list_validate_ip(_list, _ip) switch_network_list_validate_ip_token(_list, _ip, NULL);
......
src/mod/endpoints/mod_sofia/mod_sofia.h
浏览文件 @ f4a72741
......@@ -309,6 +309,9 @@ typedef enum {
PFLAG_FIRE_BYE_RESPONSE_EVENTS,
PFLAG_AUTO_INVITE_100,
PFLAG_UPDATE_REFRESHER,
PFLAG_AUTH_REQUIRE_USER,
PFLAG_AUTH_CALLS_ACL_ONLY,
PFLAG_USE_PORT_FOR_ACL_CHECK,
/* No new flags below this line */
PFLAG_MAX
......@@ -786,6 +789,8 @@ struct sofia_profile {
int bind_attempt_interval;
char *proxy_notify_events;
char *proxy_info_content_types;
char *acl_inbound_x_token_header;
char *acl_proxy_x_token_header;
};
......
src/switch_core.c
浏览文件 @ f4a72741
......@@ -1370,7 +1370,7 @@ typedef struct {
static switch_ip_list_t IP_LIST = { 0 };
SWITCH_DECLARE(switch_bool_t) switch_check_network_list_ip_token(const char *ip_str, const char *list_name, const char **token)
SWITCH_DECLARE(switch_bool_t) switch_check_network_list_ip_port_token(const char *ip_str, int port, const char *list_name, const char **token)
{
switch_network_list_t *list;
ip_t ip, mask, net;
......@@ -1398,9 +1398,9 @@ SWITCH_DECLARE(switch_bool_t) switch_check_network_list_ip_token(const char *ip_
if ((list = switch_core_hash_find(IP_LIST.hash, list_name))) {
if (ipv6) {
ok = switch_network_list_validate_ip6_token(list, ip, token);
ok = switch_network_list_validate_ip6_port_token(list, ip, port, token);
} else {
ok = switch_network_list_validate_ip_token(list, ip.v4, token);
ok = switch_network_list_validate_ip_port_token(list, ip.v4, port, token);
}
} else if (strchr(list_name, '/')) {
if (strchr(list_name, ',')) {
......@@ -1443,6 +1443,10 @@ SWITCH_DECLARE(switch_bool_t) switch_check_network_list_ip_token(const char *ip_
return ok;
}
SWITCH_DECLARE(switch_bool_t) switch_check_network_list_ip_token(const char *ip_str, const char *list_name, const char **token)
{
return switch_check_network_list_ip_port_token(ip_str, 0, list_name, token);
}
SWITCH_DECLARE(void) switch_load_network_lists(switch_bool_t reload)
{
......@@ -1589,9 +1593,12 @@ SWITCH_DECLARE(void) switch_load_network_lists(switch_bool_t reload)
for (x_node = switch_xml_child(x_list, "node"); x_node; x_node = x_node->next) {
const char *cidr = NULL, *host = NULL, *mask = NULL, *domain = NULL;
const char *cidr = NULL, *host = NULL, *mask = NULL, *domain = NULL, *port = NULL;
switch_bool_t ok = default_type;
const char *type = switch_xml_attr(x_node, "type");
switch_network_port_range_t port_range;
char *argv[MAX_NETWORK_PORTS] = { 0 };
int argc = 0, i;
if (type) {
ok = switch_true(type);
......@@ -1602,6 +1609,25 @@ SWITCH_DECLARE(void) switch_load_network_lists(switch_bool_t reload)
mask = switch_xml_attr(x_node, "mask");
domain = switch_xml_attr(x_node, "domain");
memset(&port_range, 0, sizeof(switch_network_port_range_t));
if( (port = switch_xml_attr(x_node, "port")) != NULL) {
port_range.port = atoi(port);
}
if( (port = switch_xml_attr(x_node, "ports")) != NULL) {
argc = switch_separate_string((char*)port, ',', argv, (sizeof(argv) / sizeof(argv[0])));
for(i=0; i < argc; i++) {
port_range.ports[i] = atoi(argv[i]);
}
}
if( (port = switch_xml_attr(x_node, "port-min")) != NULL) {
port_range.min_port = atoi(port);
}
if( (port = switch_xml_attr(x_node, "port-max")) != NULL) {
port_range.max_port = atoi(port);
}
if (domain) {
switch_event_t *my_params = NULL;
switch_xml_t x_domain, xml_root;
......@@ -1646,7 +1672,7 @@ SWITCH_DECLARE(void) switch_load_network_lists(switch_bool_t reload)
if (id && user_cidr) {
char *token = switch_mprintf("%s@%s", id, domain);
switch_assert(token);
switch_network_list_add_cidr_token(list, user_cidr, ok, token);
switch_network_list_add_cidr_port_token(list, user_cidr, ok, token, &port_range);
free(token);
}
}
......@@ -1656,13 +1682,13 @@ SWITCH_DECLARE(void) switch_load_network_lists(switch_bool_t reload)
switch_xml_free(xml_root);
} else if (cidr) {
switch_network_list_add_cidr(list, cidr, ok);
switch_network_list_add_cidr_port_token(list, cidr, ok, NULL, &port_range);
} else if (host && mask) {
switch_network_list_add_host_mask(list, host, mask, ok);
switch_network_list_add_host_port_mask(list, host, mask, ok, &port_range);
}
switch_core_hash_insert(IP_LIST.hash, name, list);
}
switch_core_hash_insert(IP_LIST.hash, name, list);
}
}
......
src/switch_utils.c
浏览文件 @ f4a72741
......@@ -54,6 +54,7 @@ struct switch_network_node {
switch_bool_t ok;
char *token;
char *str;
switch_network_port_range_t port_range;
struct switch_network_node *next;
};
typedef struct switch_network_node switch_network_node_t;
......@@ -467,7 +468,8 @@ SWITCH_DECLARE(switch_bool_t) switch_testv6_subnet(ip_t _ip, ip_t _net, ip_t _ma
else return SWITCH_TRUE;
}
}
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip6_token(switch_network_list_t *list, ip_t ip, const char **token)
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip6_port_token(switch_network_list_t *list, ip_t ip, int port, const char **token)
{
switch_network_node_t *node;
switch_bool_t ok = list->default_type;
......@@ -494,7 +496,29 @@ SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip6_token(switch_netw
return ok;
}
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip_token(switch_network_list_t *list, uint32_t ip, const char **token)
SWITCH_DECLARE(switch_bool_t) is_port_in_node(int port, switch_network_node_t *node)
{
if(port == 0)
return SWITCH_TRUE;
if(node->port_range.port != 0 && node->port_range.port != port)
return SWITCH_FALSE;
if(node->port_range.ports[0] != 0) {
int i;
for(i=0; i < MAX_NETWORK_PORTS && node->port_range.ports[i] != 0; i++) {
if(port == node->port_range.ports[i])
return SWITCH_TRUE;
}
return SWITCH_FALSE;
}
if(node->port_range.min_port != 0 || node->port_range.max_port != 0) {
if(port >= node->port_range.min_port && port <= node->port_range.max_port)
return SWITCH_TRUE;
return SWITCH_FALSE;
}
return SWITCH_TRUE;
}
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip_port_token(switch_network_list_t *list, uint32_t ip, int port, const char **token)
{
switch_network_node_t *node;
switch_bool_t ok = list->default_type;
......@@ -502,7 +526,7 @@ SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip_token(switch_netwo
for (node = list->node_head; node; node = node->next) {
if (node->family == AF_INET6) continue; /* want AF_INET */
if (node->bits >= bits && switch_test_subnet(ip, node->ip.v4, node->mask.v4)) {
if (node->bits >= bits && switch_test_subnet(ip, node->ip.v4, node->mask.v4) && is_port_in_node(port, node)) {
if (node->ok) {
ok = SWITCH_TRUE;
} else {
......@@ -520,6 +544,16 @@ SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip_token(switch_netwo
return ok;
}
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip6_token(switch_network_list_t *list, ip_t ip, const char **token)
{
return switch_network_list_validate_ip6_port_token(list, ip, 0, token);
}
SWITCH_DECLARE(switch_bool_t) switch_network_list_validate_ip_token(switch_network_list_t *list, uint32_t ip, const char **token)
{
return switch_network_list_validate_ip_port_token(list, ip, 0, token);
}
SWITCH_DECLARE(char *) switch_network_ipv4_mapped_ipv6_addr(const char* ip_str)
{
/* ipv4 mapped ipv6 address */
......@@ -531,22 +565,52 @@ SWITCH_DECLARE(char *) switch_network_ipv4_mapped_ipv6_addr(const char* ip_str)
return strdup(ip_str + 7);
}
SWITCH_DECLARE(char*) switch_network_port_range_to_string(switch_network_port_range_p port)
{
if (!port) {
return NULL;
}
if (port->port != 0) {
return switch_mprintf("port: %i ", port->port);
}
if (port->ports[0] != 0) {
int i, written = 0;
char buf[MAX_NETWORK_PORTS * 6];
for (i = 0; i < MAX_NETWORK_PORTS && port->ports[i] != 0; i++) {
written += snprintf(buf + written, sizeof(buf) - written, (i != 0 ? ", %u" : "%u"), port->ports[i]);
}
return switch_mprintf("ports: [%s] ", buf);
}
if (port->min_port != 0 || port->max_port != 0) {
return switch_mprintf("port range: [%i-%i] ", port->min_port, port->max_port);
}
return NULL;
}
SWITCH_DECLARE(switch_status_t) switch_network_list_perform_add_cidr_token(switch_network_list_t *list, const char *cidr_str, switch_bool_t ok,
const char *token)
const char *token, switch_network_port_range_p port)
{
ip_t ip, mask;
uint32_t bits;
switch_network_node_t *node;
char *ipv4 = NULL;
char *ports = NULL;
if ((ipv4 = switch_network_ipv4_mapped_ipv6_addr(cidr_str))) {
cidr_str = ipv4;
}
ports = switch_network_port_range_to_string(port);
if (switch_parse_cidr(cidr_str, &ip, &mask, &bits)) {
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Error Adding %s (%s) [%s] to list %s\n",
cidr_str, ok ? "allow" : "deny", switch_str_nil(token), list->name);
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "Error Adding %s %s(%s) [%s] to list %s\n",
cidr_str, ports ? ports : "", ok ? "allow" : "deny", switch_str_nil(token), list->name);
switch_safe_free(ipv4);
switch_safe_free(ports);
return SWITCH_STATUS_GENERR;
}
......@@ -557,6 +621,10 @@ SWITCH_DECLARE(switch_status_t) switch_network_list_perform_add_cidr_token(switc
node->ok = ok;
node->bits = bits;
node->str = switch_core_strdup(list->pool, cidr_str);
if(port) {
memcpy(&node->port_range, port, sizeof(switch_network_port_range_t));
}
if (strchr(cidr_str,':')) {
node->family = AF_INET6;
......@@ -571,14 +639,15 @@ SWITCH_DECLARE(switch_status_t) switch_network_list_perform_add_cidr_token(switc
node->next = list->node_head;
list->node_head = node;
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_NOTICE, "Adding %s (%s) [%s] to list %s\n",
cidr_str, ok ? "allow" : "deny", switch_str_nil(token), list->name);
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_NOTICE, "Adding %s %s(%s) [%s] to list %s\n",
cidr_str, ports ? ports : "", ok ? "allow" : "deny", switch_str_nil(token), list->name);
switch_safe_free(ipv4);
switch_safe_free(ports);
return SWITCH_STATUS_SUCCESS;
}
SWITCH_DECLARE(switch_status_t) switch_network_list_add_cidr_token(switch_network_list_t *list, const char *cidr_str, switch_bool_t ok, const char *token)
SWITCH_DECLARE(switch_status_t) switch_network_list_add_cidr_port_token(switch_network_list_t *list, const char *cidr_str, switch_bool_t ok, const char *token, switch_network_port_range_p port)
{
char *cidr_str_dup = NULL;
switch_status_t status = SWITCH_STATUS_SUCCESS;
......@@ -592,20 +661,25 @@ SWITCH_DECLARE(switch_status_t) switch_network_list_add_cidr_token(switch_networ
if ((argc = switch_separate_string(cidr_str_dup, ',', argv, (sizeof(argv) / sizeof(argv[0]))))) {
for (i = 0; i < argc; i++) {
switch_status_t this_status;
if ((this_status = switch_network_list_perform_add_cidr_token(list, argv[i], ok, token)) != SWITCH_STATUS_SUCCESS) {
if ((this_status = switch_network_list_perform_add_cidr_token(list, argv[i], ok, token, port)) != SWITCH_STATUS_SUCCESS) {
status = this_status;
}
}
}
} else {
status = switch_network_list_perform_add_cidr_token(list, cidr_str, ok, token);
status = switch_network_list_perform_add_cidr_token(list, cidr_str, ok, token, port);
}
switch_safe_free(cidr_str_dup);
return status;
}
SWITCH_DECLARE(switch_status_t) switch_network_list_add_host_mask(switch_network_list_t *list, const char *host, const char *mask_str, switch_bool_t ok)
SWITCH_DECLARE(switch_status_t) switch_network_list_add_cidr_token(switch_network_list_t *list, const char *cidr_str, switch_bool_t ok, const char *token)
{
return switch_network_list_add_cidr_port_token(list, cidr_str, ok, token, NULL);
}
SWITCH_DECLARE(switch_status_t) switch_network_list_add_host_port_mask(switch_network_list_t *list, const char *host, const char *mask_str, switch_bool_t ok, switch_network_port_range_p port)
{
ip_t ip, mask;
switch_network_node_t *node;
......@@ -618,6 +692,9 @@ SWITCH_DECLARE(switch_status_t) switch_network_list_add_host_mask(switch_network
node->ip.v4 = ntohl(ip.v4);
node->mask.v4 = ntohl(mask.v4);
node->ok = ok;
if(port) {
memcpy(&node->port_range, port, sizeof(switch_network_port_range_t));
}
/* http://graphics.stanford.edu/~seander/bithacks.html */
mask.v4 = mask.v4 - ((mask.v4 >> 1) & 0x55555555);
......@@ -632,6 +709,11 @@ SWITCH_DECLARE(switch_status_t) switch_network_list_add_host_mask(switch_network
return SWITCH_STATUS_SUCCESS;
}
SWITCH_DECLARE(switch_status_t) switch_network_list_add_host_mask(switch_network_list_t *list, const char *host, const char *mask_str, switch_bool_t ok)
{
return switch_network_list_add_host_port_mask(list, host, mask_str, ok, NULL);
}
SWITCH_DECLARE(int) switch_parse_cidr(const char *string, ip_t *ip, ip_t *mask, uint32_t *bitp)
{
......
Markdown 格式
0% 或
您添加了 0 人 到此讨论。请谨慎行事。
请先完成此评论的编辑！
请 注册 或者 后发表评论