security.c File Reference

---

Detailed Description

Proxy-CSCF - Gm Security Operations.

IPSec only is now supported and it is transparent in the sense that if the client does not employ it, the functionality is disabled.

The ipsec_P_*.sh scripts are used to control the IPSec and are give as an example for usage with the linux-2.6 kernel. ipsec_tools is required for this (setkey).

Added TLS support

Author:

Dragos Vingarzan vingarzan -at- fokus dot fraunhofer dot de

Definition in file security.c.

#include <signal.h>
#include <stdlib.h>
#include "security.h"
#include "mod.h"
#include "sip.h"
#include "registration.h"
#include "registrar.h"
#include "registrar_subscribe.h"
#include "../../ip_addr.h"
#include "../../data_lump.h"

Go to the source code of this file.

Defines
#define	get_qparam(src, name, dst)
#define	get_param(src, name, dst)
#define	strtoint(src, dest)
Functions
int	get_next_spi ()
	Returns the next unused SPI.
unsigned long	tls_get_session_hash (struct sip_msg *req)
	Looks for the tls session hash.
static int	str_trim (str *s)
	trims the str
static r_security_type	cscf_get_security_type (str security_header_body)
	Looks for the security type in the Security header .
str	cscf_get_pref_security_header (struct sip_msg *req, str header_name, r_security_type *type, float *q)
	Looks for the prefered Security header .
r_contact *	save_contact_security (struct sip_msg *req, str auth, str sec_hdr, r_security_type type, float q)
	Saves the Contact Security information into the P-CSCF registrar for this contact.
int	execute_cmd (char *cmd)
	Executes an external command.
int	P_verify_security (struct sip_msg *req, char *str1, char *str2)
	Process the REGISTER and verify Client-Security.
int	P_security_401 (struct sip_msg *rpl, char *str1, char *str2)
	Process the 401 response for REGISTER and creates the first Security-Associations.
int	P_security_200 (struct sip_msg *rpl, char *str1, char *str2)
	Process the 200 response for REGISTER and creates the first Security-Associations.
void	P_security_drop (r_contact *c, r_security *s)
	Drops the SAs for the given contact.
int	P_check_via_sent_by (struct sip_msg *msg, char *str1, char *str2)
	Checks if the sent-by parameter in the first Via header equals the source IP address of the message.
int	P_follows_via_list (struct sip_msg *rpl, char *str1, char *str2)
	Checks if a response coming from a UE contains the same Via headers sent in the corresponding request.
int	P_enforce_via_list (struct sip_msg *rpl, char *str1, char *str2)
	enforce a response coming from a UE to contain the same Via headers sent in the corresponding request
int	P_add_via_received (struct sip_msg *msg, char *str1, char *str2)
	Adds a received parameter to the first via with the source IP of the message.
int	P_remove_header_tag (struct sip_msg *msg, char *str1, char *str2)
	Remove from <str1> headers the <str2> tag.
int	P_remove_security_client (struct sip_msg *msg, char *str1, char *str2)
	Look for Security-Client and delete it if found.
int	P_remove_security_verify (struct sip_msg *msg, char *str1, char *str2)
	Look for Security-Verify and delete it if found.
int	P_remove_security_headers (struct sip_msg *msg, char *str1, char *str2)
	Removes the Security-Client,Security-Verify headers.
Variables
int	pcscf_use_ipsec
	whether to use or not ipsec
char *	pcscf_ipsec_host
	IP for protected server.
int	pcscf_ipsec_port_c
	PORT for protected client.
int	pcscf_ipsec_port_s
	PORT for protected server.
char *	pcscf_ipsec_P_Inc_Req
	Req E->P.
char *	pcscf_ipsec_P_Out_Rpl
	Rpl E<-P.
char *	pcscf_ipsec_P_Out_Req
	Req E<-P.
char *	pcscf_ipsec_P_Inc_Rpl
	Rpl E->P.
char *	pcscf_ipsec_P_Drop
	Drop.
r_hash_slot *	registrar
	the contacts
int	r_hash_size
	records tables parameters
int	current_spi = 5000
	current SPI value
int	pcscf_use_tls
	whether to use or not tls
int	pcscf_tls_port
	PORT for TLS server.
int	tls_disable
str	s_security_client = {"Security-Client",15}
str	s_security_verify = {"Security-Verify",15}
str	s_security_server_s = {"Security-Server: ",17}
str	s_security_server_e = {"\r\n",2}
static str	s_ck = {"ck=\"",4}
static str	s_ik = {"ik=\"",4}
static str	s_ealg = {"ealg=",5}
static str	s_alg = {"alg=",4}
static str	s_spi_c = {"spi-c=",6}
static str	s_spi_s = {"spi-s=",6}
static str	s_port_c = {"port-c=",7}
static str	s_port_s = {"port-s=",7}
static str	s_des_in = {"des-ede3-cbc",12}
static str	s_des_out = {"3des-cbc",8}
static str	s_aes_in = {"aes-cbc",7}
static str	s_aes_out = {"rijndael-cbc",12}
static str	s_null_out = {"null",4}
static str	s_md5_in = {"hmac-md5-96",11}
static str	s_md5_out = {"hmac-md5",8}
static str	s_sha_in = {"hmac-sha-1-96",13}
static str	s_sha_out = {"hmac-sha1",9}
time_t	time_now
	current time
static str	s_tls = {"tls", 3}
static str	s_ipsec = {"ipsec-3gpp", 10}
static str	s_q = {"q=", 2}
static str	via_hdr_s = {"Via: ",5}
static str	via_hdr_e = {"\r\n",2}
static str	s_received = {";received=",10}
static str	s_received2 = {"received",8}

---

Define Documentation

#define get_qparam	(	src,
		name,
		dst		)

Value:

{\
    int i,j;\
    (dst).s=0;(dst).len=0;\
    for(i=0;i<(src).len-(name).len;i++)\
        if (strncasecmp((src).s+i,(name).s,(name).len)==0){\
            j=i+(name).len;\
            (dst).s = (src).s+j;\
            (dst).len = 0;\
            while(j<(src).len && (src).s[j]!='\"') \
                j++;            \
            (dst).len = j-i-(name).len;\
            break;\
        }       \
}

Definition at line 108 of file security.c.

#define get_param	(	src,
		name,
		dst		)

Value:

{\
    int i,j;\
    (dst).s=0;(dst).len=0;\
    for(i=0;i<(src).len-(name).len;i++)\
        if (strncasecmp((src).s+i,(name).s,(name).len)==0 &&\
            ((src).s[i-1]==' ' ||(src).s[i-1]==';'||(src).s[i-1]=='\t')){\
            j=i+(name).len;\
            (dst).s = (src).s+j;\
            (dst).len = 0;\
            while(j<(src).len && (src).s[j]!=','&& (src).s[j]!=' '&& (src).s[j]!='\t'&& (src).s[j]!=';') \
                j++;            \
            (dst).len = j-i-(name).len;\
            break;\
        }       \
}

Definition at line 124 of file security.c.

#define strtoint	(	src,
		dest		)

Value:

{\
    int i;\
    (dest)=0;\
    for(i=0;i<(src).len;i++)\
        if ((src).s[i]>='0' && (src).s[i]<='9')\
            (dest) = (dest)*10 + (src).s[i] -'0';\
}

Definition at line 141 of file security.c.

Referenced by P_verify_security(), and save_contact_security().

---

Function Documentation

int get_next_spi

(

)

Returns the next unused SPI.

Todo:

• make sure that this SPI is not used at the moment

Returns:

the next SPI

Definition at line 101 of file security.c.

References current_spi.

Referenced by save_contact_security().

{
    return current_spi++;
}

unsigned long tls_get_session_hash

(

struct sip_msg *

req

)

Looks for the tls session hash.

Parameters:

req

- sip msg request

Returns:

tls session hash on success or 0

Definition at line 189 of file security.c.

References get_tls_session_hash, M_NAME, and pcscf_use_tls.

Referenced by P_security_200().

{
    unsigned long s_hash = 0;
    if (!pcscf_use_tls) return 0;
    s_hash = get_tls_session_hash(req);
    if (!s_hash){
        LOG(L_ERR,"ERR:"M_NAME":tls_get_session_hash: Session Hash could not be obtained !\n");
        return 0;
    }
    return s_hash;
}

static int str_trim

(

str *

s

)

[static]

trims the str

Parameters:

s

- str param to trim

Definition at line 205 of file security.c.

{
    int i;
    for (i = 0;i < s->len; i++)
    {
        if (s->s[i] != '\r' && s->s[i] != '\t' && s->s[i] != ' ')
        {
            break;
        }
    }
    s->s = s->s + i;    
    s->len -= i;

    for (i = s->len;i >=0; i--)
    {
        if (s->s[i] == '\r' && s->s[i] == '\t' && s->s[i] == ' ')
        {
            s->len--;
        }
        else
        {
            break;
        }
    }
    return 1;
}

static r_security_type cscf_get_security_type

(

str

security_header_body

)

[static]

Looks for the security type in the Security header .

Parameters:

security_header_body

- input security header

Returns:

the type of security

Definition at line 237 of file security.c.

Referenced by cscf_get_pref_security_header().

{
    str sec_type_s;
    int i;
    
    sec_type_s.s = security_header_body.s;
    sec_type_s.len = security_header_body.len;
    for (i = 0; i< security_header_body.len; i++)
        if (security_header_body.s[i] == ';') {
            sec_type_s.len = i;
            break;
        }   
    str_trim(&sec_type_s);
    if (sec_type_s.len==s_tls.len &&
        !strncasecmp(sec_type_s.s, s_tls.s , s_tls.len))
        return SEC_TLS;
    else if (sec_type_s.len==s_ipsec.len &&
            !strncasecmp(sec_type_s.s, s_ipsec.s , s_ipsec.len))
            return SEC_IPSEC;
    return SEC_NONE;
}

str cscf_get_pref_security_header	(	struct sip_msg *	req,
		str	header_name,
		r_security_type *	type,
		float *	q
	)

Looks for the prefered Security header .

Parameters:

	req	- the SIP message
	header_name	- SIP header name
	type	- output value of the security type
	q	- output preferate value

Returns:

the security body for the provided SIP message

Definition at line 267 of file security.c.

References cscf_get_next_header(), cscf_get_security_type(), get_param, M_NAME, pcscf_use_ipsec, pcscf_use_tls, s_q, SEC_IPSEC, SEC_NONE, and SEC_TLS.

Referenced by P_security_200(), P_security_401(), and P_verify_security().

{
    str q_sec={0,0},t_sec;
    r_security_type q_type=SEC_NONE,t_type;
    float q_q=-1,t_q;
    struct hdr_field *hdr=0;    
    str tmp={0,0};
    char c; 

        
    /* first find the highest q */
    for(hdr = cscf_get_next_header(req,header_name,(void*)0);hdr;hdr = cscf_get_next_header(req,header_name,hdr)){
        t_sec = hdr->body;
        /* if unknown type, skip */
        t_type = cscf_get_security_type(t_sec);
        if (t_type==SEC_NONE ||
            (!pcscf_use_ipsec&&t_type==SEC_IPSEC)||
            (!pcscf_use_tls&&t_type==SEC_TLS)) continue;
        /* check if q is maximum */
        get_param(t_sec,s_q,tmp);
        if (tmp.len) {
            c = tmp.s[tmp.len];
            tmp.s[tmp.len]=0;           
            t_q = atof(tmp.s);
            tmp.s[tmp.len]=c;
        }   
        else t_q = -1;
        if (t_q > q_q || q_sec.len==0)  {           
            q_sec = t_sec;
            q_q = t_q;
            q_type = t_type;
        }       
    }

    if (!q_sec.len) {
        LOG(L_INFO,"DBG:"M_NAME":cscf_get_pref_security_header: No known Security header found.\n");
        return q_sec;
    }   
    
    if (type) *type = q_type;
    if (q) *q = q_q;
    return q_sec;
}

r_contact* save_contact_security	(	struct sip_msg *	req,
		str	auth,
		str	sec_hdr,
		r_security_type	type,
		float	q
	)

Saves the Contact Security information into the P-CSCF registrar for this contact.

Parameters:

	req	- REGISTER request
	auth	- WWW-Authenticate header
	sec_hdr	- Security header
	type	- Security Type
	q	- Preference Value

Definition at line 320 of file security.c.

References ck, cscf_parse_contacts(), free_r_security(), get_next_spi(), get_param, get_qparam, ik, M_NAME, new_r_ipsec(), new_r_security(), _r_ipsec::port_us, r_act_time(), REG_PENDING, s_aes_in, s_aes_out, s_alg, s_ck, s_des_in, s_des_out, s_ealg, s_ik, s_md5_in, s_md5_out, s_null_out, s_port_c, s_port_s, s_sha_in, s_sha_out, s_spi_c, s_spi_s, SEC_IPSEC, SEC_NONE, SEC_TLS, strtoint, time_now, and update_r_contact_sec().

Referenced by P_security_401().

{
    contact_t* c=0;
    contact_body_t* b=0;    
    r_contact *rc;
    enum Reg_States reg_state=REG_PENDING;
    int expires,pending_expires=60;
    struct sip_uri puri;
    r_security *s=0;
    
    b = cscf_parse_contacts(req);
    
    if (!b||!b->contacts) {
        LOG(L_ERR,"ERR:"M_NAME":save_contact_security: No contacts found\n");
        goto error; 
    }
    
    if (b) c = b->contacts;
            
    r_act_time();
    /* the Security works for just 1 contact/registration! */
    if(c){
        LOG(L_DBG,"DBG:"M_NAME":save_contact_security: <%.*s>\n",c->uri.len,c->uri.s);
        
        expires = time_now+pending_expires;
        
        if (parse_uri(c->uri.s,c->uri.len,&puri)<0){
            LOG(L_DBG,"DBG:"M_NAME":save_contact_security: Error parsing Contact URI <%.*s>\n",c->uri.len,c->uri.s);
            goto error;         
        }
        if (puri.port_no==0) puri.port_no=5060;
        LOG(L_DBG,"DBG:"M_NAME":save_contact_security: %d %.*s : %d\n",
            puri.proto, puri.host.len,puri.host.s,puri.port_no);

        if (type == SEC_TLS) 
            puri.proto = PROTO_TLS;

        /* create the r_security structure */
        s = new_r_security(sec_hdr,type,q);
        if (!s) goto error; 

        switch(type) {
            case SEC_NONE:
                break;
            case SEC_TLS:
                // r_tls creation happens on 200
                break;
            case SEC_IPSEC:
            {
                /* then parse the parameters */
                r_ipsec *ipsec; 
                str ck,ik,ealg,alg,tmp;
                str alg_setkey,ealg_setkey;
                unsigned int spi_uc,spi_us;
                unsigned int spi_pc,spi_ps;
                int port_uc,port_us;
                char ck_c[64],ik_c[64];
                str ck_esp={ck_c,0},ik_esp={ik_c,0};
                                    
                get_qparam(auth,s_ck,ck);
                LOG(L_DBG,"DBG:"M_NAME":save_contact_security: CK: <%.*s>\n",
                    ck.len,ck.s);
                get_qparam(auth,s_ik,ik);
                LOG(L_DBG,"DBG:"M_NAME":save_contact_security: IK: <%.*s>\n",
                    ik.len,ik.s);       
                get_param(sec_hdr,s_ealg,ealg);
                LOG(L_DBG,"DBG:"M_NAME":save_contact_security: Enc Algorithm: <%.*s>\n",
                    ealg.len,ealg.s);
                get_param(sec_hdr,s_alg,alg);
                LOG(L_DBG,"DBG:"M_NAME":save_contact_security: Int Algorithm: <%.*s>\n",
                    alg.len,alg.s);
                /* and for spis */
                get_param(sec_hdr,s_spi_c,tmp);
                strtoint(tmp,spi_uc);
                LOG(L_DBG,"DBG:"M_NAME":save_contact_security: SPI-C: %d\n",
                    spi_uc);
                get_param(sec_hdr,s_spi_s,tmp);
                strtoint(tmp,spi_us);
                LOG(L_DBG,"DBG:"M_NAME":save_contact_security: SPI-S: %d\n",
                    spi_us);
                /* and for ports */
                get_param(sec_hdr,s_port_c,tmp);
                strtoint(tmp,port_uc);
                LOG(L_DBG,"DBG:"M_NAME":save_contact_security: Port-C: %d\n",
                    port_uc);
                get_param(sec_hdr,s_port_s,tmp);
                strtoint(tmp,port_us);
                LOG(L_DBG,"DBG:"M_NAME":save_contact_security: Port-S: %d\n",
                    port_us);
        
                ck_esp.s[ck_esp.len++]='0';
                ck_esp.s[ck_esp.len++]='x'; 
                if (ealg.len == s_des_in.len && strncasecmp(ealg.s,s_des_in.s,ealg.len)==0) {
                    memcpy(ck_esp.s+ck_esp.len,ck.s,32);ck_esp.len+=32;
                    memcpy(ck_esp.s+ck_esp.len,ck.s,16);ck_esp.len+=16;
                    ealg_setkey = s_des_out;
                }
                else
                if (ealg.len == s_aes_in.len && strncasecmp(ealg.s,s_aes_in.s,ealg.len)==0) {
                    memcpy(ck_esp.s+ck_esp.len,ck.s,ck.len);ck_esp.len+=ck.len;
                    ealg_setkey = s_aes_out;
                }else {
                    memcpy(ck_esp.s+ck_esp.len,ck.s,ck.len);ck_esp.len+=ck.len;
                    ealg_setkey = s_null_out;
                    ealg = s_null_out;
                }
            
                ik_esp.s[ik_esp.len++]='0';
                ik_esp.s[ik_esp.len++]='x';     
                if (alg.len == s_md5_in.len && strncasecmp(alg.s,s_md5_in.s,alg.len)==0) {
                    memcpy(ik_esp.s+ik_esp.len,ik.s,ik.len);ik_esp.len+=ik.len;
                    alg_setkey = s_md5_out;
                }
                else
                if (alg.len == s_sha_in.len && strncasecmp(alg.s,s_sha_in.s,alg.len)==0) {      
                    memcpy(ik_esp.s+ik_esp.len,ik.s,ik.len);ik_esp.len+=ik.len;
                    memcpy(ik_esp.s+ik_esp.len,"00000000",8);ik_esp.len+=8;
                    alg_setkey = s_sha_out;
                }else{
                    LOG(L_ERR,"ERR:"M_NAME":save_contact_security: Unknown Integrity algorithm <%.*s>\n",alg.len,alg.s);
                    goto error;
                }
                
                spi_pc=get_next_spi();  
                spi_ps=get_next_spi();  

                ipsec = new_r_ipsec(spi_uc,spi_us,spi_pc,spi_ps,port_uc,port_us,
                    ealg_setkey,ealg, ck_esp,alg_setkey,alg, ik_esp);
                if (!ipsec) goto error;
                s->data.ipsec = ipsec;
                
                puri.port_no = ipsec->port_us;
                /*
                 * this should actually be port_uc... then the cscf_get_ue_via should be 
                 * changed to give rport and not the port in the via. but this would
                 * break NATed clients...
                 */
            }
                break;
        }
    }
    
    rc = update_r_contact_sec(puri.host,puri.port_no,puri.proto,
            &(c->uri),&reg_state,&expires,s);                       

    return rc;  
error:
    if (s) free_r_security(s);
    return 0;   
}

int execute_cmd

(

char *

cmd

)

[inline]

Executes an external command.

Used to call the IPSec scripts/commands.

Note:

Temporarily disabled the signal for SIGCHLD. Logs the output of the command

Parameters:

cmd

- full command to execute, with parameters

Returns:

1 if ok, 0 on error

Definition at line 479 of file security.c.

References M_NAME, and out.

Referenced by P_security_200(), P_security_401(), and P_security_drop().

{
    FILE *p;
    void *prev;
    char out[256];
    LOG(L_INFO,"INF:"M_NAME":execute_cmd: [%s]\n",cmd);     
    /* because SER forked dies when a chield dies, SIGCHLD is masked temporary */
    prev = signal(SIGCHLD,SIG_DFL);
    p = popen(cmd,"r");
    if (!p) {       
        LOG(L_ERR,"ERR:"M_NAME":execute_cmd: Error executing cmd> %s\n",cmd);
        signal(SIGCHLD,prev);   
        return 0;
    }
    while(fgets(out,256,p))
        LOG(L_DBG,"DBG:"M_NAME":execute_cmd: > %s",out);
    pclose(p);
    signal(SIGCHLD,prev);   
    return 1;
}

int P_verify_security	(	struct sip_msg *	req,
		char *	str1,
		char *	str2
	)

Process the REGISTER and verify Client-Security.

Parameters:

	req	- Register request
	str1	- not used
	str2	- not used

Returns:

1 if ok, 0 if not

Definition at line 507 of file security.c.

References cscf_get_first_via(), cscf_get_pref_security_header(), CSCF_RETURN_FALSE, CSCF_RETURN_TRUE, _r_security::data, get_param, get_r_contact(), _r_contact::hash, _r_security::ipsec, M_NAME, pcscf_ipsec_port_c, pcscf_ipsec_port_s, pcscf_tls_port, r_act_time(), _r_ipsec::r_alg, _r_ipsec::r_ealg, r_unlock(), r_valid_contact(), s_alg, s_ealg, s_port_c, s_port_s, s_security_verify, s_spi_c, s_spi_s, SEC_IPSEC, SEC_NONE, SEC_TLS, _r_contact::security_temp, _r_ipsec::spi_pc, _r_ipsec::spi_ps, strtoint, and _r_security::type.

{
    str sec_hdr;
    struct hdr_field *h;
    struct via_body *vb;
    r_contact *c;
    r_security *s;
    r_security_type sec_type;
    float sec_q;
    
    str ealg,alg,tmp;
    unsigned int spi_pc,spi_ps;;
    int port_pc,port_ps;

    vb = cscf_get_first_via(req,&h);

    LOG(L_INFO,"DBG:"M_NAME":P_verify_security: Looking for <%d://%.*s:%d> \n", vb->proto,vb->host.len,vb->host.s,vb->port);

    c = get_r_contact(vb->host,vb->port,vb->proto);

    r_act_time();
    if (!c){
        //first register
        LOG(L_DBG,"DBG:"M_NAME":P_verify_security: No Contact found ! \n");
        return CSCF_RETURN_TRUE;
    }

    if (!r_valid_contact(c) || !c->security_temp){
        LOG(L_DBG,"DBG:"M_NAME":P_verify_security: No security temp !.\n");
        r_unlock(c->hash);
        return CSCF_RETURN_TRUE;
    }

    sec_hdr = cscf_get_pref_security_header(req,s_security_verify, &sec_type,&sec_q);
    if (!sec_hdr.len)
    {   
        LOG(L_DBG,"DBG:"M_NAME":P_verify_security: No Security-Verify header found.\n");
        r_unlock(c->hash);
        return CSCF_RETURN_TRUE;
    }
    
    s = c->security_temp;
    
    switch (s->type)
    {
    case SEC_NONE:
        break;
    case SEC_TLS:
        if (sec_type != SEC_TLS || req->rcv.dst_port != pcscf_tls_port)
                    goto error;
        break;
    case SEC_IPSEC:
        if (sec_type != SEC_IPSEC || req->rcv.dst_port != pcscf_ipsec_port_s)
        {
            LOG(L_INFO,"DBG:"M_NAME":P_verify_security: Not IPSEC tunnel!.\n");
            r_unlock(c->hash);
            goto error;
        }
        get_param(sec_hdr,s_ealg,ealg);
        get_param(sec_hdr,s_alg,alg);
        /* and for spis */
        get_param(sec_hdr,s_spi_c,tmp);
        strtoint(tmp,spi_pc);
        get_param(sec_hdr,s_spi_s,tmp);
        strtoint(tmp,spi_ps);
        /* and for ports */
        get_param(sec_hdr,s_port_c,tmp);
        strtoint(tmp,port_pc);
        get_param(sec_hdr,s_port_s,tmp);
        strtoint(tmp,port_ps);
        if ((s->data.ipsec->r_ealg.len != ealg.len || strncasecmp(s->data.ipsec->r_ealg.s, ealg.s, ealg.len)) ||
                (s->data.ipsec->r_alg.len != alg.len || strncasecmp(s->data.ipsec->r_alg.s, alg.s, alg.len)) || 
                (s->data.ipsec->spi_pc != spi_pc) ||
                (s->data.ipsec->spi_ps != spi_ps) ||
                (pcscf_ipsec_port_c != port_pc) ||
                (pcscf_ipsec_port_s != port_ps))
        {       
            LOG(L_INFO,"DBG:"M_NAME":P_verify_security: No valid Security-Verify header!.\n");
            r_unlock(c->hash);
            goto error;
        }
        break;
    }
    r_unlock(c->hash);
    
    return CSCF_RETURN_TRUE;
error:  
    return CSCF_RETURN_FALSE;
}

int P_security_401	(	struct sip_msg *	rpl,
		char *	str1,
		char *	str2
	)

Process the 401 response for REGISTER and creates the first Security-Associations.

IPSEc: Only the SA for P_Inc_Req - Incoming Requests is set now as the next REGISTER could come over that one.

Parameters:

	rpl	- the 401 response
	str1	- not used
	str2	- not used

Returns:

1 if ok, 0 if not

Definition at line 606 of file security.c.

References _r_ipsec::alg, _r_ipsec::ck, cscf_add_header(), cscf_get_authenticate(), cscf_get_pref_security_header(), cscf_get_request_from_reply(), CSCF_RETURN_ERROR, CSCF_RETURN_FALSE, CSCF_RETURN_TRUE, _r_security::data, _r_ipsec::ealg, execute_cmd(), _r_contact::hash, _r_contact::host, _r_ipsec::ik, _r_security::ipsec, M_NAME, pcscf_ipsec_host, pcscf_ipsec_P_Inc_Req, pcscf_ipsec_port_c, pcscf_ipsec_port_s, pcscf_use_ipsec, pcscf_use_tls, _r_ipsec::port_uc, _r_ipsec::r_alg, _r_ipsec::r_ealg, r_unlock(), s_security_client, s_security_server_e, s_security_server_s, save_contact_security(), SEC_IPSEC, SEC_NONE, SEC_TLS, _r_contact::security_temp, _r_ipsec::spi_pc, _r_ipsec::spi_ps, and STR_APPEND.

{
    struct sip_msg *req;
    struct hdr_field *hdr;  
    str sec_hdr,sec_srv={0,0};
    r_security_type sec_type;
    char cmd[256];
    r_contact *c;
    r_ipsec *ipsec;
    float sec_q=-1;
    str auth;

    if (!pcscf_use_ipsec &&!pcscf_use_tls) goto ret_false;
    
    req = cscf_get_request_from_reply(rpl);
    if (!req){
        LOG(L_ERR,"ERR:"M_NAME":P_security_401: No transactional request found.\n");
        goto error;
    }
    auth = cscf_get_authenticate(rpl,&hdr);
    if (!auth.len){
        LOG(L_ERR,"ERR:"M_NAME":P_security_401: No WWW-Authenticate header found.\n");
        goto ret_false; 
    }
    
    sec_hdr = cscf_get_pref_security_header(req,s_security_client, &sec_type,&sec_q);
    if (!sec_hdr.len) { 
        LOG(L_DBG,"DBG:"M_NAME":P_security_401: No Security-Client header found.\n");
        goto ret_false;
    }
    LOG(L_INFO,"DBG:"M_NAME":P_security_401: Security-Client header found : <%.*s>.\n", sec_hdr.len, sec_hdr.s);    


    /* save data into registrar */
    c = save_contact_security(req, auth, sec_hdr, sec_type, sec_q); 
    if (!c) goto error;
    switch(sec_type){
        case SEC_NONE:
            break;
        case SEC_TLS:           
            /* try to add the Security-Server header */     
            sec_srv.len = s_security_server_s.len+sec_hdr.len+s_security_server_e.len;
            sec_srv.s = pkg_malloc(sec_srv.len);
            if (!sec_srv.s){
                LOG(L_ERR,"ERR:"M_NAME":P_security_401: Error allocating %d pkg bytes \n",sec_srv.len);
                goto error;
            }
            sec_srv.len=0;
            STR_APPEND(sec_srv,s_security_server_s);
            STR_APPEND(sec_srv,sec_hdr);
            STR_APPEND(sec_srv,s_security_server_e);

            if (!cscf_add_header(rpl,&sec_srv,HDR_OTHER_T)) {
                LOG(L_ERR,"ERR:"M_NAME":P_security_401: Error adding header <%.*s> \n",sec_srv.len,sec_srv.s);
                pkg_free(sec_srv.s);
                goto error;
            }
            break;
        case SEC_IPSEC:
            ipsec = c->security_temp->data.ipsec;
            /* try to add the Security-Server header */
            sprintf(cmd,"Security-Server: ipsec-3gpp; ealg=%.*s; alg=%.*s; spi-c=%d; spi-s=%d; port-c=%d; port-s=%d; q=0.1\r\n",
                ipsec->r_ealg.len,ipsec->r_ealg.s,
                ipsec->r_alg.len,ipsec->r_alg.s,
                ipsec->spi_pc,ipsec->spi_ps,
                pcscf_ipsec_port_c,pcscf_ipsec_port_s);
            
            sec_srv.len = strlen(cmd);
            sec_srv.s = pkg_malloc(sec_srv.len);
            if (!sec_srv.s){
                LOG(L_ERR,"ERR:"M_NAME":P_security_401: Error allocating %d pkg bytes \n",sec_srv.len);
                goto error;
            }
            memcpy(sec_srv.s,cmd,sec_srv.len);
            if (!cscf_add_header(rpl,&sec_srv,HDR_OTHER_T)) {
                LOG(L_ERR,"ERR:"M_NAME":P_security_401: Error adding header <%.*s> \n",sec_srv.len,sec_srv.s);
                pkg_free(sec_srv.s);
                goto error;
            }
    
            /* run the IPSec script */  
            /* P_Inc_Req */
            sprintf(cmd,"%s %.*s %d %s %d %d %.*s %.*s %.*s %.*s",
                pcscf_ipsec_P_Inc_Req,
                c->host.len,c->host.s,
                ipsec->port_uc,
                pcscf_ipsec_host,
                pcscf_ipsec_port_s,
                ipsec->spi_ps,
                ipsec->ealg.len,ipsec->ealg.s,
                ipsec->ck.len,ipsec->ck.s,
                ipsec->alg.len,ipsec->alg.s,
                ipsec->ik.len,ipsec->ik.s);

            r_unlock(c->hash);
                
            execute_cmd(cmd);
            break;                      
    }
    
    return CSCF_RETURN_TRUE;
ret_false:
    return CSCF_RETURN_FALSE;
error:
    return CSCF_RETURN_ERROR;
}

int P_security_200	(	struct sip_msg *	rpl,
		char *	str1,
		char *	str2
	)

Process the 200 response for REGISTER and creates the first Security-Associations.

The rest of the SA are not set. could come over that one.

Parameters:

	rpl	- the 200 response
	str1	- not used
	str2	- not used

Returns:

1 if ok, 0 if not

Definition at line 723 of file security.c.

References _r_ipsec::alg, _r_ipsec::ck, cscf_get_first_via(), cscf_get_max_expires(), cscf_get_pref_security_header(), cscf_get_request_from_reply(), CSCF_RETURN_ERROR, CSCF_RETURN_FALSE, CSCF_RETURN_TRUE, _r_security::data, DEREGISTERED, _r_ipsec::ealg, execute_cmd(), _r_contact::expires, free_r_security(), get_r_contact(), get_tls_session_hash, _r_contact::hash, _r_contact::host, _r_ipsec::ik, _r_security::ipsec, M_NAME, new_r_tls(), P_security_drop(), pcscf_ipsec_host, pcscf_ipsec_P_Inc_Rpl, pcscf_ipsec_P_Out_Req, pcscf_ipsec_P_Out_Rpl, pcscf_ipsec_port_c, pcscf_ipsec_port_s, pcscf_use_ipsec, pcscf_use_tls, _r_tls::port_tls, _r_ipsec::port_uc, _r_ipsec::port_us, r_act_time(), r_unlock(), r_valid_contact(), _r_contact::reg_state, s_security_client, SEC_IPSEC, SEC_NONE, SEC_TLS, _r_contact::security, _r_contact::security_temp, _r_tls::session_hash, _r_ipsec::spi_pc, _r_ipsec::spi_uc, _r_ipsec::spi_us, time_now, _r_security::tls, tls_get_session_hash(), and _r_security::type.

{
    struct sip_msg *req;
    str sec_hdr;
    r_security_type sec_type;
    float sec_q;
    struct hdr_field *h;
    struct via_body *vb;
    r_contact *c;
    r_ipsec *i;
    int expires;
    unsigned long s_hash;
    char out_rpl[256],out_req[256],inc_rpl[256];

    if (!pcscf_use_ipsec &&!pcscf_use_tls) goto ret_false;

    req = cscf_get_request_from_reply(rpl);
    if (!req){
        LOG(L_ERR,"ERR:"M_NAME":P_security_200: No transactional request found.\n");
        goto error;
    }   

    sec_hdr = cscf_get_pref_security_header(req,s_security_client, &sec_type,&sec_q);   
    if (!sec_hdr.len) { 
        LOG(L_DBG,"DBG:"M_NAME":P_security_200: No Security-Verify header found.\n");
        goto error;
    }
    
    /* find the expires (reg or dereg?) */
    expires = cscf_get_max_expires(req);
    
    /* get the IPSec info from the registrar */
    
    vb = cscf_get_first_via(req,&h);    
    LOG(L_DBG,"DBG:"M_NAME":P_security_200: Looking for <%d://%.*s:%d> \n",
        vb->proto,vb->host.len,vb->host.s,vb->port);

    c = get_r_contact(vb->host,vb->port,vb->proto);
        
    r_act_time();
    if (!c){
        LOG(L_ERR,"ERR:"M_NAME":P_security_200: Contact not found\n");      
        goto error;
    }
    
    if (c->security_temp){
        if (c->security && c->security->type == SEC_TLS && 
                (c->security->data.tls && c->security->