oversip 1.1.0.beta5 → 1.1.0

data/etc/oversip.conf

@@ -46,7 +46,7 @@ sip:
   #
   sip_tls: yes
 
-  # Enable or dissable IPv4. By default _yes_.
+  # Enable or disable IPv4. By default _yes_.
   #
   enable_ipv4: yes
 
@@ -58,7 +58,7 @@ sip:
   #
   listen_ipv4: null
 
-  # Enable or dissable IPv6. By default _yes_.
+  # Enable or disable IPv6. By default _yes_.
   #
   enable_ipv6: yes
 
@@ -93,6 +93,12 @@ sip:
   #
   listen_port_tls_tunnel: 5062
 
+  # Call the OverSIP::SipEvents.on_client_tls_handshake() callback when a SIP
+  # client attemps a TLS handshake with OverSIP.
+  # By default _yes_.
+  #
+  callback_on_client_tls_handshake: yes
+
   # Local domains OverSIP is responsible for.  Value can be:
   # - A domain.
   # - An array of domains.
@@ -138,7 +144,7 @@ websocket:
   #
   sip_wss: yes
 
-  # Enable or dissable IPv4. By default _yes_.
+  # Enable or disable IPv4. By default _yes_.
   #
   enable_ipv4: yes
 
@@ -150,7 +156,7 @@ websocket:
   #
   listen_ipv4: null
 
-  # Enable or dissable IPv6. By default _yes_.
+  # Enable or disable IPv6. By default _yes_.
   #
   enable_ipv6: yes
 
@@ -185,6 +191,12 @@ websocket:
   #
   listen_port_tls_tunnel: 10444
 
+  # Call the OverSIP::WebSocketEvents.on_client_tls_handshake() callback when a WebSocket
+  # client attemps a TLS handshake with OverSIP.
+  # By default _yes_.
+  #
+  callback_on_client_tls_handshake: yes
+
   # WebSocket message max size (bytes). By default 65536.
   #
   max_ws_message_size: 65536

data/etc/proxies.conf

@@ -65,8 +65,9 @@ default_proxy:
   ip_type_preference: ["ipv4", "ipv6"]
 
   # DNS failover on received 503.
-  # RFC 3261 section 16.7 "Response Processing" states that a proxy receiving a 503 MUST
-  # convert it into a 500 (unless certain cases). We make it optional.
+  # If a DNS query retrieves more than a single destinations and the first attempt
+  # receives a 503 response, then OverSIP tries the next destination (when this parameter
+  # is set) or replies a 500 error upstream (when not set).
   # Default value is _yes_.
   #
   dns_failover_on_503: yes
@@ -92,13 +93,11 @@ default_proxy:
   #
   timer_F: 32
 
-  # Validate TLS certificate from the contacted server (just when using TLS transport).
-  # If set to _yes_, the contacted server MUST present a valid certificate. The connection
-  # will be inmediately closed otherwise and a 500 error locally generated.
-  # NOTE: This does not match the SIP request destination host against the hosts asserted by
-  # the certificate. This just performs TLS certificate pure validation.
-  # Default value is _no_.
-  tls_validation: no
+  # Call the OverSIP::SIP.on_server_tls_handshake() callback when
+  # establishing an outbound SIP TLS connection with a remote SIP peer.
+  # By default _yes_.
+  #
+  callback_on_server_tls_handshake: yes
 
 
 # Proxy configuration for routing in-dialog requests.

data/etc/server.rb

@@ -171,6 +171,10 @@ def (OverSIP::SipEvents).on_request request
       log_notice "on_error: #{status} '#{reason}'"
     end
 
+    proxy.on_invite_timeout do
+      log_notice "INVITE timeout, no final response before Timer C expires."
+    end
+
     proxy.route request
     return
 
@@ -215,6 +219,43 @@ def (OverSIP::SipEvents).on_request request
     return
 
   end
+
+end
+
+
+# This callback is called when a client initiates a SIP TLS handshake.
+def (OverSIP::SipEvents).on_client_tls_handshake connection, pems
+
+  log_info "validating TLS connection from IP #{connection.remote_ip} and port #{connection.remote_port}"
+
+  cert, validated, tls_error, tls_error_string = ::OverSIP::TLS.validate pems
+  identities = ::OverSIP::TLS.get_sip_identities cert
+
+  if validated
+    log_info "client provides a valid TLS certificate with SIP identities #{identities}"
+  else
+    log_notice "client provides an invalid TLS certificate with SIP identities #{identities} (TLS error: #{tls_error.inspect}, description: #{tls_error_string.inspect})"
+    #connection.close
+  end
+
+end
+
+
+# This callback is called when conntacting a SIP TLS server and the TLS handshake takes place.
+def (OverSIP::SipEvents).on_server_tls_handshake connection, pems
+
+  log_info "validating TLS connection to IP #{connection.remote_ip} and port #{connection.remote_port}"
+
+  cert, validated, tls_error, tls_error_string = ::OverSIP::TLS.validate pems
+  identities = ::OverSIP::TLS.get_sip_identities cert
+
+  if validated
+    log_info "server provides a valid TLS certificate with SIP identities #{identities}"
+  else
+    log_notice "server provides an invalid TLS certificate with SIP identities #{identities} (TLS error: #{tls_error.inspect}, description: #{tls_error_string.inspect})"
+    #connection.close
+  end
+
 end
 
 
@@ -245,3 +286,21 @@ end
 # def (OverSIP::WebSocketEvents).on_disconnection connection, client_closed
 #   [...]
 # end
+
+
+# This callback is called when a client initiates a WebSocket TLS handshake.
+def (OverSIP::WebSocketEvents).on_client_tls_handshake connection, pems
+
+  log_info "validating TLS connection from IP #{connection.remote_ip} and port #{connection.remote_port}"
+
+  cert, validated, tls_error, tls_error_string = ::OverSIP::TLS.validate pems
+  identities = ::OverSIP::TLS.get_sip_identities cert
+
+  if validated
+    log_info "client provides a valid TLS certificate with SIP identities #{identities}"
+  else
+    log_notice "client provides an invalid TLS certificate with SIP identities #{identities} (TLS error: #{tls_error.inspect}, description: #{tls_error_string.inspect})"
+    #connection.close
+  end
+
+end