oversip_p 1.0.0

data/lib/oversip/sip/listeners/ipv6_tls_server.rb

@@ -0,0 +1,22 @@
+module OverSIP::SIP
+
+  class IPv6TlsServer < TlsServer
+
+    @ip_type = :ipv6
+    @transport = :tls
+    @connections = {}
+    @invite_server_transactions = {}
+    @non_invite_server_transactions = {}
+    @invite_client_transactions = {}
+    @non_invite_client_transactions = {}
+    @is_reliable_transport_listener = true
+    @is_outbound_listener = true
+
+    LOG_ID = "SIP TLS IPv6 server"
+    def log_id
+      LOG_ID
+    end
+
+  end
+
+end

data/lib/oversip/sip/listeners/ipv6_tls_tunnel_server.rb

@@ -0,0 +1,22 @@
+module OverSIP::SIP
+
+  class IPv6TlsTunnelServer < TlsTunnelServer
+
+    @ip_type = :ipv6
+    @transport = :tls
+    @connections = {}
+    @invite_server_transactions = {}
+    @non_invite_server_transactions = {}
+    @invite_client_transactions = {}
+    @non_invite_client_transactions = {}
+    @is_reliable_transport_listener = true
+    @is_outbound_listener = true
+
+    LOG_ID = "SIP TLS-Tunnel IPv6 server"
+    def log_id
+      LOG_ID
+    end
+
+  end
+
+end

data/lib/oversip/sip/listeners/ipv6_udp_server.rb

@@ -0,0 +1,21 @@
+module OverSIP::SIP
+
+  class IPv6UdpServer < UdpConnection
+
+    @ip_type = :ipv6
+    @transport = :udp
+    @connections = nil  # To be set after creating the unique server instance.
+    @invite_server_transactions = {}
+    @non_invite_server_transactions = {}
+    @invite_client_transactions = {}
+    @non_invite_client_transactions = {}
+    @is_outbound_listener = true
+
+    LOG_ID = "SIP UDP IPv6 server"
+    def log_id
+      LOG_ID
+    end
+
+  end
+
+end

data/lib/oversip/sip/listeners/tcp_client.rb

@@ -0,0 +1,97 @@
+module OverSIP::SIP
+
+  class TcpClient < TcpConnection
+
+    class << self
+      attr_reader :server_class
+    end
+
+    attr_reader :connected
+    attr_reader :pending_client_transactions
+
+    def initialize ip, port
+      # NOTE: The parent class implementing "initialize" method is Connection, and allows no arguments.
+      # If we call just "super" from here it will fail since "ip" and "port" will be passed as
+      # arguments. So we must use "super()" and we are done (no arguments are passed to parent).
+      super()
+
+      @remote_ip = ip
+      @remote_port = port
+      @connection_id = ::OverSIP::SIP::TransportManager.add_connection self, self.class, self.class.ip_type, @remote_ip, @remote_port
+      @connected = false
+      @pending_client_transactions = []
+
+      ### TODO: make it configurable.
+      set_pending_connect_timeout 2.0
+    end
+
+
+    def connection_completed
+      log_system_info "TCP connection opened to " << remote_desc
+
+      @connected = true
+      @pending_client_transactions.clear
+    end
+
+
+    def remote_desc
+      @remote_desc ||= case self.class.ip_type
+        when :ipv4  ; "#{@remote_ip}:#{@remote_port.to_s}"
+        when :ipv6  ; "[#{@remote_ip}]:#{@remote_port.to_s}"
+        end
+    end
+
+
+    def unbind cause=nil
+      @state = :ignore
+
+      # Remove the connection.
+      self.class.connections.delete @connection_id
+
+      @local_closed = true  if cause == ::Errno::ETIMEDOUT
+
+      if @connected
+        log_msg = "connection to #{remote_desc} "
+        log_msg << ( @local_closed ? "locally closed" : "remotely closed" )
+        log_msg << " (cause: #{cause.inspect})"  if cause
+        log_system_debug log_msg  if $oversip_debug
+
+      # If the TCP client connection has failed (remote server rejected the connection) then
+      # inform to all the pending client transactions.
+      else
+        log_system_notice "connection to #{remote_desc} failed"  if $oversip_debug
+
+        @pending_client_transactions.each do |client_transaction|
+          client_transaction.connection_failed
+        end
+        @pending_client_transactions.clear
+      end unless $!
+
+      @connected = false
+    end
+
+
+    # For the case in which OverSIP receives a SIP request from a connection open by OverSIP.
+    def record_route
+      @record_route and return @record_route
+
+      server_class = self.class.server_class
+      local_port, local_ip = ::Socket.unpack_sockaddr_in(get_sockname)
+
+      case
+        when server_class == ::OverSIP::SIP::IPv4TcpServer
+          uri_ip = local_ip
+        when server_class == ::OverSIP::SIP::IPv6TcpServer
+          uri_ip = "[#{local_ip}]"
+        when server_class == ::OverSIP::SIP::IPv4TlsServer
+          uri_ip = local_ip
+        when server_class == ::OverSIP::SIP::IPv6TlsServer
+          uri_ip = "[#{local_ip}]"
+        end
+
+      @record_route = "<sip:#{uri_ip}:#{local_port};transport=#{server_class.transport.to_s};lr;ovid=#{OverSIP::SIP::Tags.value_for_route_ovid}>"
+    end
+
+  end
+
+end

data/lib/oversip/sip/listeners/tcp_connection.rb

@@ -0,0 +1,202 @@
+module OverSIP::SIP
+
+  class TcpConnection < Connection
+
+    # Max size (bytes) of the buffered data when receiving message headers
+    # (avoid DoS attacks).
+    HEADERS_MAX_SIZE = 16384
+
+    def remote_ip_type
+      @remote_ip_type || self.class.ip_type
+    end
+
+    def remote_ip
+      @remote_ip
+    end
+
+    def remote_port
+      @remote_port
+    end
+
+    def receive_data data
+      @state == :ignore and return
+      @buffer << data
+      @state == :waiting_for_on_client_tls_handshake and return
+
+      process_received_data
+    end
+
+    def process_received_data
+      @state == :ignore and return
+
+      while (case @state
+        when :init
+          @parser.reset
+          @parser_nbytes = 0
+          @state = :headers
+
+        when :headers
+          parse_headers
+          # TODO: Add a timer for the case in which an attacker sends us slow headers that never end:
+          #   http://ha.ckers.org/slowloris/.
+
+        when :body
+          get_body
+
+        when :finished
+          if @msg.request?
+            process_request
+          else
+            process_response
+          end
+
+          # Set state to :init.
+          @state = :init
+          # Return true to continue processing possible remaining data.
+          true
+
+        when :ignore
+          false
+        end)
+      end  # while
+    end
+
+    def parse_headers
+      return false if @buffer.empty?
+
+      # Parse the currently buffered data. If parsing fails @parser_nbytes gets nil value.
+      unless @parser_nbytes = @parser.execute(@buffer.to_str, @parser_nbytes)
+        # The parsed data is invalid, however some data could be parsed so @parsed.parsed
+        # can be:
+        # - SIP::Request
+        # - SIP::Response
+        # - nil (the message is so wrong that cannot be neither a request or response).
+        if wrong_message = @parser.parsed
+          log_system_warn "parsing error for #{MSG_TYPE[wrong_message.class]}: \"#{@parser.error}\""
+        else
+          log_system_warn "parsing error: \"#{@parser.error}\""
+        end
+
+        close_connection_after_writing
+        @state = :ignore
+        return false
+      end
+
+      # Avoid flood attacks in TCP (very long headers).
+      if @parser_nbytes > HEADERS_MAX_SIZE
+        log_system_warn "DoS attack detected: headers size exceedes #{HEADERS_MAX_SIZE} bytes, closing connection with #{remote_desc}"
+        close_connection
+        # After closing client connection some data can still arrrive to "receive_data()"
+        # (explained in EM documentation). By setting @state = :ignore we ensure such
+        # remaining data is not processed.
+        @state = :ignore
+        return false
+      end
+
+      # If the parsing has not finished, it is correct in TCP so return false and wait for more data under :headers state.
+      return false  unless @parser.finished?
+
+      # At this point we've got a SIP::Request, SIP::Response or :outbound_keepalive symbol.
+      @msg = @parser.parsed
+
+      # Clear parsed data from the buffer.
+      @buffer.read(@parser_nbytes)
+
+      # Received data is a Outbound keealive.
+      if @msg == :outbound_keepalive
+        log_system_debug "Outbound keepalive received, replying single CRLF"  if $oversip_debug
+        # Reply a single CRLF over the same connection.
+        send_data CRLF
+        # If TCP then go back to :init state so possible remaining data would be processed.
+        @state = :init
+        return true
+      end
+
+      @parser.post_parsing
+
+      # Here we have received the entire headers of a SIP request or response. Fill some
+      # attributes.
+      @msg.connection = self
+      @msg.transport = self.class.transport
+      @msg.source_ip = @remote_ip
+      @msg.source_port = @remote_port
+      @msg.source_ip_type = @remote_ip_type || self.class.ip_type
+
+      unless valid_message? @parser
+        close_connection_after_writing
+        @state = :ignore
+        return false
+      end
+
+      add_via_received_rport if @msg.request?
+
+      unless check_via_branch
+        close_connection_after_writing
+        @state = :ignore
+        return false
+      end
+
+      # Examine Content-Length header.
+      # In SIP over TCP Content-Length header is mandatory.
+      if (@body_length = @msg.content_length)
+        # There is body (or should be).
+        if @body_length > 0
+          @state = :body
+          # Return true to continue in get_body() method.
+          return true
+        # No body.
+        else
+          # Set :finished state and return true to process the parsed message.
+          @state = :finished
+          return true
+        end
+      # No Content-Length, invalid message!
+      else
+        # Log it and reply a 400 Bad Request (if it's a request).
+        # Close the connection, set :ignore state and return false to leave
+        # receive_data().
+        if @msg.request?
+          unless @msg.sip_method == :ACK
+            log_system_warn "request body size doesn't match Content-Length => 400"
+            @msg.reply 400, "Body size doesn't match Content-Length"
+          else
+            log_system_warn "ACK body size doesn't match Content-Length, ignoring it"
+          end
+        else
+          log_system_warn "response has not Content-Length header, ignoring it"
+        end
+        close_connection_after_writing
+        @state = :ignore
+        return false
+      end
+    end  # parse_headers
+
+    def get_body
+      # Return false until the buffer gets all the body.
+      return false if @buffer.size < @body_length
+
+      ### TODO: Creo que es mejor forzarlo a BINARY y no a UTF-8. Aunque IOBuffer ya lo saca siempre en BINARY.
+      # ¿Por qué lo forcé a UTF-8?
+      # RESPUESTA: Si no lo hago y resulta que el body no es UTF-8 válido, al añadir el body a los headers (que
+      # se generan como un string en UTF-8 (aunque contengan símbolos no UTF-8) fallaría. O todo UTF-8 (aunque
+      # tenga símbolos inválidos) o todo BINARY.
+      @msg.body = @buffer.read(@body_length).force_encoding(::Encoding::UTF_8)
+      @state = :finished
+      return true
+    end
+
+
+    # Parameters ip and port are just included because they are needed in UDP, so the API remains equal.
+    def send_sip_msg msg, ip=nil, port=nil
+      if self.error?
+        log_system_notice "SIP message could not be sent, connection is closed"
+        return false
+      end
+      send_data msg
+      true
+    end
+
+  end
+
+end
+

data/lib/oversip/sip/listeners/tcp_server.rb

@@ -0,0 +1,71 @@
+module OverSIP::SIP
+
+  class TcpServer < TcpConnection
+
+    attr_reader :outbound_flow_token
+
+    def post_connection
+      begin
+        @remote_port, @remote_ip = ::Socket.unpack_sockaddr_in(get_peername)
+      rescue => e
+        log_system_error "error obtaining remote IP/port (#{e.class}: #{e.message}), closing connection"
+        close_connection
+        @state = :ignore
+        return
+      end
+
+      @connection_id = ::OverSIP::SIP::TransportManager.add_connection self, self.class, self.class.ip_type, @remote_ip, @remote_port
+
+      # Create an Outbound (RFC 5626) flow token for this connection.
+      @outbound_flow_token = ::OverSIP::SIP::TransportManager.add_outbound_connection self
+
+      ### Testing TCP keepalive.
+      # https://github.com/bklang/eventmachine/commit/74c65a56c733bc1b6f092e32a9f0d722501ade46
+      # http://tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/
+      if ::OverSIP::SIP.tcp_keepalive_interval
+        set_sock_opt Socket::SOL_SOCKET, Socket::SO_KEEPALIVE, true
+        set_sock_opt Socket::SOL_TCP, Socket::TCP_KEEPIDLE, ::OverSIP::SIP.tcp_keepalive_interval  # First TCP ping.
+        set_sock_opt Socket::SOL_TCP, Socket::TCP_KEEPINTVL, ::OverSIP::SIP.tcp_keepalive_interval  # Interval between TCP pings.
+      end
+
+      log_system_debug("connection opened from " << remote_desc)  if $oversip_debug
+    end
+
+    def remote_desc force=nil
+      if force
+        @remote_desc = case @remote_ip_type
+          when :ipv4  ; "#{@remote_ip}:#{@remote_port.to_s}"
+          when :ipv6  ; "[#{@remote_ip}]:#{@remote_port.to_s}"
+          end
+      else
+        @remote_desc ||= case self.class.ip_type
+          when :ipv4  ; "#{@remote_ip}:#{@remote_port.to_s}"
+          when :ipv6  ; "[#{@remote_ip}]:#{@remote_port.to_s}"
+          end
+      end
+    end
+
+
+    def unbind cause=nil
+      @state = :ignore
+
+      # Remove the connection.
+      self.class.connections.delete @connection_id
+
+      # Remove the Outbound token flow.
+      ::OverSIP::SIP::TransportManager.delete_outbound_connection @outbound_flow_token
+
+      @local_closed = true  if cause == ::Errno::ETIMEDOUT
+
+      if $oversip_debug
+        log_msg = "connection from #{remote_desc} "
+        log_msg << ( @local_closed ? "locally closed" : "remotely closed" )
+        log_msg << " (cause: #{cause.inspect})"  if cause
+        log_system_debug log_msg
+      end unless $!
+    end
+
+  end
+
+end
+

data/lib/oversip/sip/listeners/tls_client.rb

@@ -0,0 +1,125 @@
+module OverSIP::SIP
+
+  class TlsClient < TcpClient
+
+    TLS_HANDSHAKE_MAX_TIME = 4
+
+
+    attr_writer :callback_on_server_tls_handshake
+
+
+    def initialize ip, port
+      super
+      @pending_messages = []
+    end
+
+
+    def connection_completed
+      @server_pems = []
+      @server_last_pem = false
+
+      start_tls({
+        :verify_peer => @callback_on_server_tls_handshake,
+        :cert_chain_file => ::OverSIP.tls_public_cert,
+        :private_key_file => ::OverSIP.tls_private_cert,
+        :ssl_version => %w(tlsv1 tlsv1_1 tlsv1_2)
+      })
+
+      # If the remote server does never send us a TLS certificate
+      # after the TCP connection we would leak by storing more and
+      # more messages in @pending_messages array.
+      @timer_tls_handshake = ::EM::Timer.new(TLS_HANDSHAKE_MAX_TIME) do
+        unless @connected
+          log_system_notice "TLS handshake not performed within #{TLS_HANDSHAKE_MAX_TIME} seconds, closing the connection"
+          close_connection
+        end
+      end
+    end
+
+
+    # Called for every certificate provided by the peer.
+    # This is just called in case @callback_on_server_tls_handshake is true.
+    def ssl_verify_peer pem
+      # TODO: Dirty workaround for bug https://github.com/eventmachine/eventmachine/issues/194.
+      return true  if @server_last_pem == pem
+
+      @server_last_pem = pem
+      @server_pems << pem
+
+      log_system_debug "received certificate num #{@server_pems.size} from server"  if $oversip_debug
+
+      # Validation must be done in ssl_handshake_completed after receiving all the certs, so return true.
+      return true
+    end
+
+
+    # This is called after all the calls to ssl_verify_peer().
+    def ssl_handshake_completed
+      log_system_debug("TLS connection established to " << remote_desc)  if $oversip_debug
+
+      # @connected in TlsClient means "TLS connection" rather than
+      # just "TCP connection".
+      @connected = true
+      @timer_tls_handshake.cancel  if @timer_tls_handshake
+
+      # Run OverSIP::SipEvents.on_server_tls_handshake.
+      ::Fiber.new do
+        if @callback_on_server_tls_handshake
+          log_system_debug "running OverSIP::SipEvents.on_server_tls_handshake()..."  if $oversip_debug
+          begin
+            ::OverSIP::SipEvents.on_server_tls_handshake self, @server_pems
+          rescue ::Exception => e
+            log_system_error "error calling OverSIP::SipEvents.on_server_tls_handshake():"
+            log_system_error e
+            close_connection
+          end
+
+          # If the user or peer has closed the connection in the on_server_tls_handshake() callback
+          # then notify pending transactions.
+          if @local_closed or error?
+            log_system_debug "connection closed, aborting"  if $oversip_debug
+            @pending_client_transactions.each do |client_transaction|
+              client_transaction.tls_validation_failed
+            end
+            @pending_client_transactions.clear
+            @pending_messages.clear
+            @state = :ignore
+          end
+        end
+
+        @pending_client_transactions.clear
+        @pending_messages.each do |msg|
+          send_data msg
+        end
+        @pending_messages.clear
+      end.resume
+    end
+
+    def unbind cause=nil
+      super
+      @timer_tls_handshake.cancel  if @timer_tls_handshake
+      @pending_messages.clear
+    end
+
+    # In TLS client, we must wait until ssl_handshake_completed is
+    # completed before sending data. If not, data will be sent in
+    # plain TCP.
+    #   http://dev.sipdoc.net/issues/457
+    def send_sip_msg msg, ip=nil, port=nil
+      if self.error?
+        log_system_notice "SIP message could not be sent, connection is closed"
+        return false
+      end
+
+      if @connected
+        send_data msg
+      else
+        log_system_debug "TLS handshake not completed yet, waiting before sending the message"  if $oversip_debug
+        @pending_messages << msg
+      end
+      true
+    end
+
+  end
+
+end

data/lib/oversip/sip/listeners/tls_server.rb

@@ -0,0 +1,88 @@
+module OverSIP::SIP
+
+  class TlsServer < TcpServer
+
+    TLS_HANDSHAKE_MAX_TIME = 4
+
+
+    def post_init
+      @client_pems = []
+      @client_last_pem = false
+
+      start_tls({
+        :verify_peer => true,
+        :cert_chain_file => ::OverSIP.tls_public_cert,
+        :private_key_file => ::OverSIP.tls_private_cert,
+        :ssl_version => %w(tlsv1 tlsv1_1 tlsv1_2)
+      })
+
+      # If the remote client does never send us a TLS certificate
+      # after the TCP connection we would leak by storing more and
+      # more messages in @pending_messages array.
+      @timer_tls_handshake = ::EM::Timer.new(TLS_HANDSHAKE_MAX_TIME) do
+        unless @connected
+          log_system_notice "TLS handshake not performed within #{TLS_HANDSHAKE_MAX_TIME} seconds, closing the connection"
+          close_connection
+        end
+      end
+    end
+
+
+    def ssl_verify_peer pem
+      # TODO: Dirty workaround for bug https://github.com/eventmachine/eventmachine/issues/194.
+      return true  if @client_last_pem == pem
+
+      @client_last_pem = pem
+      @client_pems << pem
+
+      log_system_debug "received certificate num #{@client_pems.size} from client"  if $oversip_debug
+
+      # Validation must be done in ssl_handshake_completed after receiving all the certs, so return true.
+      return true
+    end
+
+
+    def ssl_handshake_completed
+      log_system_info "TLS connection established from " << remote_desc
+
+      # @connected in TlsServer means "TLS connection" rather than
+      # just "TCP connection".
+      @connected = true
+      @timer_tls_handshake.cancel  if @timer_tls_handshake
+
+      if ::OverSIP::SIP.callback_on_client_tls_handshake
+        # Set the state to :waiting_for_on_client_tls_handshake so data received after TLS handshake  but before
+        # user callback validation is just stored.
+        @state = :waiting_for_on_client_tls_handshake
+
+        # Run OverSIP::SipEvents.on_client_tls_handshake.
+        ::Fiber.new do
+          begin
+            log_system_debug "running OverSIP::SipEvents.on_client_tls_handshake()..."  if $oversip_debug
+            ::OverSIP::SipEvents.on_client_tls_handshake self, @client_pems
+            # If the user of the peer has not closed the connection then continue.
+            unless @local_closed or error?
+              @state = :init
+              # Call process_received_data() to process possible data received in the meanwhile.
+              process_received_data
+            else
+              log_system_debug "connection closed, aborting"  if $oversip_debug
+            end
+
+          rescue ::Exception => e
+            log_system_error "error calling OverSIP::SipEvents.on_client_tls_handshake():"
+            log_system_error e
+            close_connection
+          end
+        end.resume
+      end
+    end
+
+
+    def unbind cause=nil
+      @timer_tls_handshake.cancel  if @timer_tls_handshake
+      super
+    end
+
+  end
+end