mirror of https://github.com/asterisk/asterisk
This commit introduces the security events API. This API is to be used by Asterisk components to report events that have security implications. A simple example is when a connection is made but fails authentication. These events can be used by external tools manipulate firewall rules or something similar after detecting unusual activity based on security events. Inside of Asterisk, the events go through the ast_event API. This means that they have a binary encoding, and it is easy to write code to subscribe to these events and do something with them. One module is provided that is a subscriber to these events - res_security_log. This module turns security events into a parseable text format and sends them to the "security" logger level. Using logger.conf, these log entries may be sent to a file, or to syslog. One service, AMI, has been fully updated for reporting security events. AMI was chosen as it was a fairly straight forward service to convert. The next target will be chan_sip. That will be more complicated and will be done as its own project as the next phase of security events work. For more information on the security events framework, see the documentation generated from doc/tex/. "make asterisk.pdf" Review: https://reviewboard.asterisk.org/r/273/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@206021 65c4cc65-6c06-0410-ace0-fbb531ad65f3certified/1.8.6
Russell Bryant
16 years ago
parent
c01286976a
commit
4cf8a968fd
@ -0,0 +1,250 @@
|
||||
\section{Introduction}
|
||||
|
||||
Attacks on Voice over IP networks are becoming increasingly more common. It
|
||||
has become clear that we must do something within Asterisk to help mitigate
|
||||
these attacks.
|
||||
|
||||
Through a number of discussions with groups of developers in the Asterisk
|
||||
community, the general consensus is that the best thing that we can do within
|
||||
Asterisk is to build a framework which recognizes and reports events that could
|
||||
potentially have security implications. Each channel driver has a different
|
||||
concept of what is an "event", and then each administrator has different
|
||||
thresholds of what is a "bad" event and what is a restorative event. The
|
||||
process of acting upon this information is left to an external program to
|
||||
correlate and then take action - block traffic, modify dialing rules, etc. It
|
||||
was decided that embedding actions inside of Asterisk was inappropriate, as the
|
||||
complexity of construction of such rule sets is difficult and there was no
|
||||
agreement on where rules should be enabled or how they should be processed. The
|
||||
addition of a major section of code to handle rule expiration and severity
|
||||
interpretation was significant. As a final determining factor, there are
|
||||
external programs and services which already parse log files and act in concert
|
||||
with packet filters or external devices to protect or alter network security
|
||||
models for IP connected hosts.
|
||||
|
||||
\section{Framework Overview}
|
||||
|
||||
This section discusses the architecture of the Asterisk modifications being
|
||||
proposed.
|
||||
|
||||
There are two main components that we propose for the initial
|
||||
implementation of the security framework:
|
||||
|
||||
\begin{itemize}
|
||||
\item Security Event Generation
|
||||
\item Security Event Logger
|
||||
\end{itemize}
|
||||
|
||||
\subsection{Security Event Generation}
|
||||
|
||||
The ast\_event API is used for the generation of security events. That
|
||||
way, the events are in an easily interpretable format within Asterisk to
|
||||
make it easy to write modules that do things with them. There are also some
|
||||
helper data structures and functions to aid Asterisk modules in reporting these
|
||||
security events with the proper contents.
|
||||
|
||||
The next section of this document contains the current list of security events
|
||||
being proposed. Each security event type has some required pieces of
|
||||
information and some other optional pieces of information.
|
||||
|
||||
Subscribing to security events from within Asterisk can be done by
|
||||
subscribing to events of type AST\_EVENT\_SECURITY. These events have an
|
||||
information element, AST\_EVENT\_IE\_SECURITY\_EVENT, which identifies the security
|
||||
event sub-type (from the list described in the next section). The result of the
|
||||
information elements in the events contain the required and optional meta data
|
||||
associated with the event sub-type.
|
||||
|
||||
\subsection{Security Event Logger}
|
||||
|
||||
In addition to the infrastructure for generating the events, one module that
|
||||
is a consumer of these events has been implemented.
|
||||
|
||||
Asterisk trunk was recently updated to include support for dynamic logger
|
||||
levels. This module takes advantage of this functionality to create a
|
||||
custom "security" logger level. Then, when this module is in use, logger.conf
|
||||
can be configured to put security events into a file:
|
||||
|
||||
\begin{verbatim}
|
||||
security_log => security
|
||||
\end{verbatim}
|
||||
|
||||
The content of this file is a well defined and easily interpretable
|
||||
format for external scripts to read and act upon. The definition for the format
|
||||
of the log file is described later in this chapter.
|
||||
|
||||
\section{Events to Log}
|
||||
|
||||
\begin{verbatim}
|
||||
(-) required
|
||||
(+) optional
|
||||
|
||||
Invalid Account ID
|
||||
(-) Local address family/IP address/port/transport
|
||||
(-) Remote address family/IP address/port/transport
|
||||
(-) Service (SIP, AMI, IAX2, ...)
|
||||
(-) System Name
|
||||
(+) Module
|
||||
(+) Account ID (username, etc)
|
||||
(+) Session ID (CallID, etc)
|
||||
(+) Session timestamp (required if Session ID present)
|
||||
(-) Event timestamp (sub-second precision)
|
||||
|
||||
Failed ACL match
|
||||
-> everything from invalid account ID
|
||||
(+) Name of ACL (when we have named ACLs)
|
||||
|
||||
Invalid Challenge/Response
|
||||
-> everything from invalid account ID
|
||||
(-) Challenge
|
||||
(-) Response
|
||||
(-) Expected Response
|
||||
|
||||
Invalid Password
|
||||
-> everything from invalid account ID
|
||||
|
||||
Successful Authentication
|
||||
-> informational event
|
||||
-> everything from invalid account ID
|
||||
|
||||
Invalid formatting of Request
|
||||
-> everything from invalid account ID
|
||||
-> account ID optional
|
||||
(-) Request Type
|
||||
(+) Request parameters
|
||||
|
||||
Session Limit Reached (such as a call limit)
|
||||
-> everything from invalid account ID
|
||||
|
||||
Memory Limit Reached
|
||||
-> everything from invalid account ID
|
||||
|
||||
Maximum Load Average Reached
|
||||
-> everything from invalid account ID
|
||||
|
||||
Request Not Allowed
|
||||
-> everything from invalid account ID
|
||||
(-) Request Type
|
||||
(+) Request parameters
|
||||
|
||||
Request Not Supported
|
||||
-> everything from invalid account ID
|
||||
(-) Request Type
|
||||
|
||||
Authentication Method Not Allowed
|
||||
-> everything from invalid account ID
|
||||
(-) Authentication Method attempted
|
||||
|
||||
In dialog message from unexpected host
|
||||
-> everything from invalid account ID
|
||||
(-) expected host
|
||||
\end{verbatim}
|
||||
|
||||
\section{Security Log File Format}
|
||||
|
||||
The beginning of each line in the log file is the same as it is for other
|
||||
logger levels within Asterisk.
|
||||
|
||||
\begin{verbatim}
|
||||
[Feb 11 07:57:03] SECURITY[23736] res_security_log.c: <...>
|
||||
\end{verbatim}
|
||||
|
||||
The part of the log entry identified by <...> is where the security event
|
||||
content resides. The security event content is a comma separated list
|
||||
of key value pairs. The key is the information element type, and the value is a
|
||||
quoted string that contains the associated meta data for that information
|
||||
element. Any embedded quotes within the content are escaped with a
|
||||
backslash.
|
||||
|
||||
\begin{verbatim}
|
||||
INFORMATION_ELEMENT_1="IE1 content",INFORMATION_ELEMENT_2="IE2 content"
|
||||
\end{verbatim}
|
||||
|
||||
The following table includes potential information elements and what the
|
||||
associated content looks like:
|
||||
|
||||
\begin{verbatim}
|
||||
IE: SecurityEvent
|
||||
Content: This is the security event sub-type.
|
||||
Values: FailedACL, InvalidAccountID, SessionLimit, MemoryLimit, LoadAverageLimit,
|
||||
RequestNotSupported, RequestNotAllowed, AuthMethodNotAllowed,
|
||||
ReqBadFormat, UnexpectedAddress, ChallengeResponseFailed,
|
||||
InvalidPassword
|
||||
|
||||
IE: EventVersion
|
||||
Content: This is a numeric value that indicates when updates are made to the
|
||||
content of the event.
|
||||
Values: Monotonically increasing integer, starting at 1
|
||||
|
||||
IE: Service
|
||||
Content: This is the Asterisk service that generated the event.
|
||||
Values: TEST, SIP, AMI
|
||||
|
||||
IE: Module
|
||||
Content: This is the Asterisk module that generated the event.
|
||||
Values: chan_sip
|
||||
|
||||
IE: AccountID
|
||||
Content: This is a string used to identify the account associated with the
|
||||
event. In most cases, this would be a username.
|
||||
|
||||
IE: SessionID
|
||||
Content: This is a string used to identify the session associated with the
|
||||
event. The format of the session identifier is specific to the
|
||||
service. In the case of SIP, this would be the Call-ID.
|
||||
|
||||
IE: SessionTV
|
||||
Content: The time that the session associated with the SessionID started.
|
||||
Values: <seconds>-<microseconds> since epoch
|
||||
|
||||
IE: ACLName
|
||||
Content: This is a string that identifies which named ACL is associated with
|
||||
this event.
|
||||
|
||||
IE: LocalAddress
|
||||
Content: This is the local address that was contacted for the related event.
|
||||
Values: <Address Family>/<Transport>/<Address>/<Port>
|
||||
Examples:
|
||||
-> IPV4/UDP/192.168.1.1/5060
|
||||
-> IPV4/TCP/192.168.1.1/5038
|
||||
|
||||
IE: RemoteAddress
|
||||
Content: This is the remote address associated with the event.
|
||||
Examples:
|
||||
-> IPV4/UDP/192.168.1.2/5060
|
||||
-> IPV4/TCP/192.168.1.2/5038
|
||||
|
||||
IE: ExpectedAddress
|
||||
Content: This is the address that was expected to be the remote address.
|
||||
Examples:
|
||||
-> IPV4/UDP/192.168.1.2/5060
|
||||
-> IPV4/TCP/192.168.1.2/5038
|
||||
|
||||
IE: EventTV
|
||||
Content: This is the timestamp of when the event occurred.
|
||||
Values: <seconds>-<microseconds> since epoch
|
||||
|
||||
IE: RequestType
|
||||
Content: This is a service specific string that represents the invalid request
|
||||
|
||||
IE: RequestParams
|
||||
Content: This is a service specific string that represents relevant parameters
|
||||
given with a request that was considered invalid.
|
||||
|
||||
IE: AuthMethod
|
||||
Content: This is a service specific string that represents an authentication
|
||||
method that was used or requested.
|
||||
|
||||
IE: Challenge
|
||||
Content: This is a service specific string that represents the challenge
|
||||
provided to a user attempting challenge/response authentication.
|
||||
|
||||
IE: Response
|
||||
Content: This is a service specific string that represents the response
|
||||
received from a user attempting challenge/response authentication.
|
||||
|
||||
IE: ExpectedResponse
|
||||
Content: This is a service specific string that represents the response
|
||||
that was expected to be received from a user attempting
|
||||
challenge/response authentication.
|
||||
|
||||
\end{verbatim}
|
||||
|
||||
@ -0,0 +1,114 @@
|
||||
/*
|
||||
* Asterisk -- An open source telephony toolkit.
|
||||
*
|
||||
* Copyright (C) 2009, Digium, Inc.
|
||||
*
|
||||
* Russell Bryant <russell@digium.com>
|
||||
*
|
||||
* See http://www.asterisk.org for more information about
|
||||
* the Asterisk project. Please do not directly contact
|
||||
* any of the maintainers of this project for assistance;
|
||||
* the project provides a web site, mailing lists and IRC
|
||||
* channels for your use.
|
||||
*
|
||||
* This program is free software, distributed under the terms of
|
||||
* the GNU General Public License Version 2. See the LICENSE file
|
||||
* at the top of the source tree.
|
||||
*/
|
||||
|
||||
/*!
|
||||
* \file
|
||||
*
|
||||
* \brief Security Event Reporting API
|
||||
*
|
||||
* \author Russell Bryant <russell@digium.com>
|
||||
*/
|
||||
|
||||
#ifndef __AST_SECURITY_EVENTS_H__
|
||||
#define __AST_SECURITY_EVENTS_H__
|
||||
|
||||
#include "asterisk/event.h"
|
||||
|
||||
/* Data structure definitions */
|
||||
#include "asterisk/security_events_defs.h"
|
||||
|
||||
#if defined(__cplusplus) || defined(c_plusplus)
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*!
|
||||
* \brief Report a security event
|
||||
*
|
||||
* \param[in] sec security event data. Callers of this function should never
|
||||
* declare an instance of ast_security_event_common directly. The
|
||||
* argument should be an instance of a specific security event
|
||||
* descriptor which has ast_security_event_common at the very
|
||||
* beginning.
|
||||
*
|
||||
* \retval 0 success
|
||||
* \retval non-zero failure
|
||||
*/
|
||||
int ast_security_event_report(const struct ast_security_event_common *sec);
|
||||
|
||||
struct ast_security_event_ie_type {
|
||||
enum ast_event_ie_type ie_type;
|
||||
/*! \brief For internal usage */
|
||||
size_t offset;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Get the list of required IEs for a given security event sub-type
|
||||
*
|
||||
* \param[in] event_type security event sub-type
|
||||
*
|
||||
* \retval NULL invalid event_type
|
||||
* \retval non-NULL An array terminated with the value AST_EVENT_IE_END
|
||||
*
|
||||
* \since 1.6.3
|
||||
*/
|
||||
const struct ast_security_event_ie_type *ast_security_event_get_required_ies(
|
||||
const enum ast_security_event_type event_type);
|
||||
|
||||
/*!
|
||||
* \brief Get the list of optional IEs for a given security event sub-type
|
||||
*
|
||||
* \param[in] event_type security event sub-type
|
||||
*
|
||||
* \retval NULL invalid event_type
|
||||
* \retval non-NULL An array terminated with the value AST_EVENT_IE_END
|
||||
*
|
||||
* \since 1.6.3
|
||||
*/
|
||||
const struct ast_security_event_ie_type *ast_security_event_get_optional_ies(
|
||||
const enum ast_security_event_type event_type);
|
||||
|
||||
/*!
|
||||
* \brief Get the name of a security event sub-type
|
||||
*
|
||||
* \param[in] event_type security event sub-type
|
||||
*
|
||||
* \retval NULL if event_type is invalid
|
||||
* \retval non-NULL the name of the security event type
|
||||
*
|
||||
* \since 1.6.3
|
||||
*/
|
||||
const char *ast_security_event_get_name(const enum ast_security_event_type event_type);
|
||||
|
||||
/*!
|
||||
* \brief Get the name of a security event severity
|
||||
*
|
||||
* \param[in] severity security event severity
|
||||
*
|
||||
* \retval NULL if severity is invalid
|
||||
* \retval non-NULL the name of the security event severity
|
||||
*
|
||||
* \since 1.6.3
|
||||
*/
|
||||
const char *ast_security_event_severity_get_name(
|
||||
const enum ast_security_event_severity severity);
|
||||
|
||||
#if defined(__cplusplus) || defined(c_plusplus)
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* __AST_SECURITY_EVENTS_H__ */
|
||||
@ -0,0 +1,470 @@
|
||||
/*
|
||||
* Asterisk -- An open source telephony toolkit.
|
||||
*
|
||||
* Copyright (C) 2009, Digium, Inc.
|
||||
*
|
||||
* Russell Bryant <russell@digium.com>
|
||||
*
|
||||
* See http://www.asterisk.org for more information about
|
||||
* the Asterisk project. Please do not directly contact
|
||||
* any of the maintainers of this project for assistance;
|
||||
* the project provides a web site, mailing lists and IRC
|
||||
* channels for your use.
|
||||
*
|
||||
* This program is free software, distributed under the terms of
|
||||
* the GNU General Public License Version 2. See the LICENSE file
|
||||
* at the top of the source tree.
|
||||
*/
|
||||
|
||||
/*!
|
||||
* \file
|
||||
*
|
||||
* \brief Security Event Reporting Data Structures
|
||||
*
|
||||
* \author Russell Bryant <russell@digium.com>
|
||||
*/
|
||||
|
||||
#ifndef __AST_SECURITY_EVENTS_DEFS_H__
|
||||
#define __AST_SECURITY_EVENTS_DEFS_H__
|
||||
|
||||
#include "asterisk/network.h"
|
||||
|
||||
#if defined(__cplusplus) || defined(c_plusplus)
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/*!
|
||||
* \brief Security event types
|
||||
*
|
||||
* AST_EVENT_SECURITY is the event type of an ast_event generated as a security
|
||||
* event. The event will have an information element of type
|
||||
* AST_EVENT_IE_SECURITY_EVENT which identifies the security event sub-type.
|
||||
* This enum defines the possible values for this sub-type.
|
||||
*/
|
||||
enum ast_security_event_type {
|
||||
/*!
|
||||
* \brief Failed ACL
|
||||
*
|
||||
* This security event should be generated when an incoming request
|
||||
* was made, but was denied due to configured IP address access control
|
||||
* lists.
|
||||
*/
|
||||
AST_SECURITY_EVENT_FAILED_ACL,
|
||||
/*!
|
||||
* \brief Invalid Account ID
|
||||
*
|
||||
* This event is used when an invalid account identifier is supplied
|
||||
* during authentication. For example, if an invalid username is given,
|
||||
* this event should be used.
|
||||
*/
|
||||
AST_SECURITY_EVENT_INVAL_ACCT_ID,
|
||||
/*!
|
||||
* \brief Session limit reached
|
||||
*
|
||||
* A request has been denied because a configured session limit has been
|
||||
* reached, such as a call limit.
|
||||
*/
|
||||
AST_SECURITY_EVENT_SESSION_LIMIT,
|
||||
/*!
|
||||
* \brief Memory limit reached
|
||||
*
|
||||
* A request has been denied because a configured memory limit has been
|
||||
* reached.
|
||||
*/
|
||||
AST_SECURITY_EVENT_MEM_LIMIT,
|
||||
/*!
|
||||
* \brief Load Average limit reached
|
||||
*
|
||||
* A request has been denied because a configured load average limit has been
|
||||
* reached.
|
||||
*/
|
||||
AST_SECURITY_EVENT_LOAD_AVG,
|
||||
/*!
|
||||
* \brief A request was made that we understand, but do not support
|
||||
*/
|
||||
AST_SECURITY_EVENT_REQ_NO_SUPPORT,
|
||||
/*!
|
||||
* \brief A request was made that is not allowed
|
||||
*/
|
||||
AST_SECURITY_EVENT_REQ_NOT_ALLOWED,
|
||||
/*!
|
||||
* \brief The attempted authentication method is not allowed
|
||||
*/
|
||||
AST_SECURITY_EVENT_AUTH_METHOD_NOT_ALLOWED,
|
||||
/*!
|
||||
* \brief Request received with bad formatting
|
||||
*/
|
||||
AST_SECURITY_EVENT_REQ_BAD_FORMAT,
|
||||
/*!
|
||||
* \brief FYI FWIW, Successful authentication has occurred
|
||||
*/
|
||||
AST_SECURITY_EVENT_SUCCESSFUL_AUTH,
|
||||
/*!
|
||||
* \brief An unexpected source address was seen for a session in progress
|
||||
*/
|
||||
AST_SECURITY_EVENT_UNEXPECTED_ADDR,
|
||||
/*!
|
||||
* \brief An attempt at challenge/response authentication failed
|
||||
*/
|
||||
AST_SECURITY_EVENT_CHAL_RESP_FAILED,
|
||||
/*!
|
||||
* \brief An attempt at basic password authentication failed
|
||||
*/
|
||||
AST_SECURITY_EVENT_INVAL_PASSWORD,
|
||||
/* \brief This _must_ stay at the end. */
|
||||
AST_SECURITY_EVENT_NUM_TYPES
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief the severity of a security event
|
||||
*
|
||||
* This is defined as a bit field to make it easy for consumers of the API to
|
||||
* subscribe to any combination of the defined severity levels.
|
||||
*
|
||||
* XXX \todo Do we need any more levels here?
|
||||
*/
|
||||
enum ast_security_event_severity {
|
||||
/*! \brief Informational event, not something that has gone wrong */
|
||||
AST_SECURITY_EVENT_SEVERITY_INFO = (1 << 0),
|
||||
/*! \brief Something has gone wrong */
|
||||
AST_SECURITY_EVENT_SEVERITY_ERROR = (1 << 1),
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Transport types
|
||||
*/
|
||||
enum ast_security_event_transport_type {
|
||||
AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
AST_SECURITY_EVENT_TRANSPORT_TLS,
|
||||
};
|
||||
|
||||
#define AST_SEC_EVT(e) ((struct ast_security_event_common *) e)
|
||||
|
||||
struct ast_security_event_ipv4_addr {
|
||||
const struct sockaddr_in *sin;
|
||||
enum ast_security_event_transport_type transport;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Common structure elements
|
||||
*
|
||||
* This is the structure header for all event descriptor structures defined
|
||||
* below. The contents of this structure are very important and must not
|
||||
* change. Even though these structures are exposed via a public API, we have
|
||||
* a version field that can be used to ensure ABI safety. If the event
|
||||
* descriptors need to be changed or updated in the future, we can safely do
|
||||
* so and can detect ABI changes at runtime.
|
||||
*/
|
||||
struct ast_security_event_common {
|
||||
/*! \brief The security event sub-type */
|
||||
enum ast_security_event_type event_type;
|
||||
/*! \brief security event version */
|
||||
uint32_t version;
|
||||
/*!
|
||||
* \brief Service that generated the event
|
||||
* \note Always required
|
||||
*
|
||||
* Examples: "SIP", "AMI"
|
||||
*/
|
||||
const char *service;
|
||||
/*!
|
||||
* \brief Module, Normally the AST_MODULE define
|
||||
* \note Always optional
|
||||
*/
|
||||
const char *module;
|
||||
/*!
|
||||
* \brief Account ID, specific to the service type
|
||||
* \note optional/required, depending on event type
|
||||
*/
|
||||
const char *account_id;
|
||||
/*!
|
||||
* \brief Session ID, specific to the service type
|
||||
* \note Always required
|
||||
*/
|
||||
const char *session_id;
|
||||
/*!
|
||||
* \brief Session timeval, when the session started
|
||||
* \note Always optional
|
||||
*/
|
||||
const struct timeval *session_tv;
|
||||
/*!
|
||||
* \brief Local address the request came in on
|
||||
* \note Always required
|
||||
*/
|
||||
struct ast_security_event_ipv4_addr local_addr;
|
||||
/*!
|
||||
* \brief Remote address the request came from
|
||||
* \note Always required
|
||||
*/
|
||||
struct ast_security_event_ipv4_addr remote_addr;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Checking against an IP access control list failed
|
||||
*/
|
||||
struct ast_security_event_failed_acl {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_FAILED_ACL_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
/*!
|
||||
* \brief ACL name, identifies which ACL was hit
|
||||
* \note optional
|
||||
*/
|
||||
const char *acl_name;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Invalid account ID specified (invalid username, for example)
|
||||
*/
|
||||
struct ast_security_event_inval_acct_id {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_INVAL_ACCT_ID_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Request denied because of a session limit
|
||||
*/
|
||||
struct ast_security_event_session_limit {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_SESSION_LIMIT_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Request denied because of a memory limit
|
||||
*/
|
||||
struct ast_security_event_mem_limit {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_MEM_LIMIT_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Request denied because of a load average limit
|
||||
*/
|
||||
struct ast_security_event_load_avg {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_LOAD_AVG_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Request denied because we don't support it
|
||||
*/
|
||||
struct ast_security_event_req_no_support {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_REQ_NO_SUPPORT_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
/*!
|
||||
* \brief Request type that was made
|
||||
* \note required
|
||||
*/
|
||||
const char *request_type;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Request denied because it's not allowed
|
||||
*/
|
||||
struct ast_security_event_req_not_allowed {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_REQ_NOT_ALLOWED_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
/*!
|
||||
* \brief Request type that was made
|
||||
* \note required
|
||||
*/
|
||||
const char *request_type;
|
||||
/*!
|
||||
* \brief Request type that was made
|
||||
* \note optional
|
||||
*/
|
||||
const char *request_params;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Auth method used not allowed
|
||||
*/
|
||||
struct ast_security_event_auth_method_not_allowed {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_AUTH_METHOD_NOT_ALLOWED_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
/*!
|
||||
* \brief Auth method attempted
|
||||
* \note required
|
||||
*/
|
||||
const char *auth_method;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Invalid formatting of request
|
||||
*/
|
||||
struct ast_security_event_req_bad_format {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_REQ_BAD_FORMAT_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID optional
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
/*!
|
||||
* \brief Request type that was made
|
||||
* \note required
|
||||
*/
|
||||
const char *request_type;
|
||||
/*!
|
||||
* \brief Request type that was made
|
||||
* \note optional
|
||||
*/
|
||||
const char *request_params;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Successful authentication
|
||||
*/
|
||||
struct ast_security_event_successful_auth {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_SUCCESSFUL_AUTH_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief Unexpected source address for a session in progress
|
||||
*/
|
||||
struct ast_security_event_unexpected_addr {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_UNEXPECTED_ADDR_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
/*!
|
||||
* \brief Expected remote address
|
||||
* \note required
|
||||
*/
|
||||
struct ast_security_event_ipv4_addr expected_addr;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief An attempt at challenge/response auth failed
|
||||
*/
|
||||
struct ast_security_event_chal_resp_failed {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_CHAL_RESP_FAILED_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
/*!
|
||||
* \brief Challenge provided
|
||||
* \note required
|
||||
*/
|
||||
const char *challenge;
|
||||
/*!
|
||||
* \brief Response received
|
||||
* \note required
|
||||
*/
|
||||
const char *response;
|
||||
/*!
|
||||
* \brief Response expected to be received
|
||||
* \note required
|
||||
*/
|
||||
const char *expected_response;
|
||||
};
|
||||
|
||||
/*!
|
||||
* \brief An attempt at basic password auth failed
|
||||
*/
|
||||
struct ast_security_event_inval_password {
|
||||
/*!
|
||||
* \brief Event descriptor version
|
||||
* \note This _must_ be changed if this event descriptor is changed.
|
||||
*/
|
||||
#define AST_SECURITY_EVENT_INVAL_PASSWORD_VERSION 1
|
||||
/*!
|
||||
* \brief Common security event descriptor elements
|
||||
* \note Account ID required
|
||||
*/
|
||||
struct ast_security_event_common common;
|
||||
};
|
||||
|
||||
#if defined(__cplusplus) || defined(c_plusplus)
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* __AST_SECURITY_EVENTS_DEFS_H__ */
|
||||
@ -0,0 +1,647 @@
|
||||
/*
|
||||
* Asterisk -- An open source telephony toolkit.
|
||||
*
|
||||
* Copyright (C) 2009, Digium, Inc.
|
||||
*
|
||||
* Russell Bryant <russell@digium.com>
|
||||
*
|
||||
* See http://www.asterisk.org for more information about
|
||||
* the Asterisk project. Please do not directly contact
|
||||
* any of the maintainers of this project for assistance;
|
||||
* the project provides a web site, mailing lists and IRC
|
||||
* channels for your use.
|
||||
*
|
||||
* This program is free software, distributed under the terms of
|
||||
* the GNU General Public License Version 2. See the LICENSE file
|
||||
* at the top of the source tree.
|
||||
*/
|
||||
|
||||
/*!
|
||||
* \file
|
||||
*
|
||||
* \brief Security Event Reporting Helpers
|
||||
*
|
||||
* \author Russell Bryant <russell@digium.com>
|
||||
*/
|
||||
|
||||
#include "asterisk.h"
|
||||
|
||||
ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
|
||||
|
||||
#include "asterisk/utils.h"
|
||||
#include "asterisk/strings.h"
|
||||
#include "asterisk/network.h"
|
||||
#include "asterisk/security_events.h"
|
||||
|
||||
static const size_t TIMESTAMP_STR_LEN = 32;
|
||||
|
||||
static const struct {
|
||||
const char *name;
|
||||
uint32_t version;
|
||||
enum ast_security_event_severity severity;
|
||||
#define MAX_SECURITY_IES 12
|
||||
struct ast_security_event_ie_type required_ies[MAX_SECURITY_IES];
|
||||
struct ast_security_event_ie_type optional_ies[MAX_SECURITY_IES];
|
||||
#undef MAX_SECURITY_IES
|
||||
} sec_events[AST_SECURITY_EVENT_NUM_TYPES] = {
|
||||
|
||||
#define SEC_EVT_FIELD(e, field) (offsetof(struct ast_security_event_##e, field))
|
||||
|
||||
[AST_SECURITY_EVENT_FAILED_ACL] = {
|
||||
.name = "FailedACL",
|
||||
.version = AST_SECURITY_EVENT_FAILED_ACL_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_ACL_NAME, SEC_EVT_FIELD(failed_acl, acl_name) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_INVAL_ACCT_ID] = {
|
||||
.name = "InvalidAccountID",
|
||||
.version = AST_SECURITY_EVENT_INVAL_ACCT_ID_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_SESSION_LIMIT] = {
|
||||
.name = "SessionLimit",
|
||||
.version = AST_SECURITY_EVENT_SESSION_LIMIT_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_MEM_LIMIT] = {
|
||||
.name = "MemoryLimit",
|
||||
.version = AST_SECURITY_EVENT_MEM_LIMIT_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_LOAD_AVG] = {
|
||||
.name = "LoadAverageLimit",
|
||||
.version = AST_SECURITY_EVENT_LOAD_AVG_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_REQ_NO_SUPPORT] = {
|
||||
.name = "RequestNotSupported",
|
||||
.version = AST_SECURITY_EVENT_REQ_NO_SUPPORT_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_REQUEST_TYPE, SEC_EVT_FIELD(req_no_support, request_type) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_REQ_NOT_ALLOWED] = {
|
||||
.name = "RequestNotAllowed",
|
||||
.version = AST_SECURITY_EVENT_REQ_NOT_ALLOWED_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_REQUEST_TYPE, SEC_EVT_FIELD(req_not_allowed, request_type) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_REQUEST_PARAMS, SEC_EVT_FIELD(req_not_allowed, request_params) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_AUTH_METHOD_NOT_ALLOWED] = {
|
||||
.name = "AuthMethodNotAllowed",
|
||||
.version = AST_SECURITY_EVENT_AUTH_METHOD_NOT_ALLOWED_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_AUTH_METHOD, SEC_EVT_FIELD(auth_method_not_allowed, auth_method) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_REQ_BAD_FORMAT] = {
|
||||
.name = "RequestBadFormat",
|
||||
.version = AST_SECURITY_EVENT_REQ_BAD_FORMAT_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_REQUEST_TYPE, SEC_EVT_FIELD(req_bad_format, request_type) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_REQUEST_PARAMS, SEC_EVT_FIELD(req_bad_format, request_params) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_SUCCESSFUL_AUTH] = {
|
||||
.name = "SuccessfulAuth",
|
||||
.version = AST_SECURITY_EVENT_SUCCESSFUL_AUTH_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_INFO,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_UNEXPECTED_ADDR] = {
|
||||
.name = "UnexpectedAddress",
|
||||
.version = AST_SECURITY_EVENT_UNEXPECTED_ADDR_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_EXPECTED_ADDR, SEC_EVT_FIELD(unexpected_addr, expected_addr) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_CHAL_RESP_FAILED] = {
|
||||
.name = "ChallengeResponseFailed",
|
||||
.version = AST_SECURITY_EVENT_CHAL_RESP_FAILED_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_CHALLENGE, SEC_EVT_FIELD(chal_resp_failed, challenge) },
|
||||
{ AST_EVENT_IE_RESPONSE, SEC_EVT_FIELD(chal_resp_failed, response) },
|
||||
{ AST_EVENT_IE_EXPECTED_RESPONSE, SEC_EVT_FIELD(chal_resp_failed, expected_response) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
[AST_SECURITY_EVENT_INVAL_PASSWORD] = {
|
||||
.name = "InvalidPassword",
|
||||
.version = AST_SECURITY_EVENT_INVAL_PASSWORD_VERSION,
|
||||
.severity = AST_SECURITY_EVENT_SEVERITY_ERROR,
|
||||
.required_ies = {
|
||||
{ AST_EVENT_IE_EVENT_TV, 0 },
|
||||
{ AST_EVENT_IE_SEVERITY, 0 },
|
||||
{ AST_EVENT_IE_SERVICE, SEC_EVT_FIELD(common, service) },
|
||||
{ AST_EVENT_IE_EVENT_VERSION, SEC_EVT_FIELD(common, version) },
|
||||
{ AST_EVENT_IE_ACCOUNT_ID, SEC_EVT_FIELD(common, account_id) },
|
||||
{ AST_EVENT_IE_SESSION_ID, SEC_EVT_FIELD(common, session_id) },
|
||||
{ AST_EVENT_IE_LOCAL_ADDR, SEC_EVT_FIELD(common, local_addr) },
|
||||
{ AST_EVENT_IE_REMOTE_ADDR, SEC_EVT_FIELD(common, remote_addr) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
.optional_ies = {
|
||||
{ AST_EVENT_IE_MODULE, SEC_EVT_FIELD(common, module) },
|
||||
{ AST_EVENT_IE_SESSION_TV, SEC_EVT_FIELD(common, session_tv) },
|
||||
{ AST_EVENT_IE_END, 0 }
|
||||
},
|
||||
},
|
||||
|
||||
#undef SEC_EVT_FIELD
|
||||
|
||||
};
|
||||
|
||||
static const struct {
|
||||
enum ast_security_event_severity severity;
|
||||
const char *str;
|
||||
} severities[] = {
|
||||
{ AST_SECURITY_EVENT_SEVERITY_INFO, "Informational" },
|
||||
{ AST_SECURITY_EVENT_SEVERITY_ERROR, "Error" },
|
||||
};
|
||||
|
||||
const char *ast_security_event_severity_get_name(
|
||||
const enum ast_security_event_severity severity)
|
||||
{
|
||||
unsigned int i;
|
||||
|
||||
for (i = 0; i < ARRAY_LEN(severities); i++) {
|
||||
if (severities[i].severity == severity) {
|
||||
return severities[i].str;
|
||||
}
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static int check_event_type(const enum ast_security_event_type event_type)
|
||||
{
|
||||
if (event_type < 0 || event_type >= AST_SECURITY_EVENT_NUM_TYPES) {
|
||||
ast_log(LOG_ERROR, "Invalid security event type %u\n", event_type);
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
const char *ast_security_event_get_name(const enum ast_security_event_type event_type)
|
||||
{
|
||||
if (check_event_type(event_type)) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return sec_events[event_type].name;
|
||||
}
|
||||
|
||||
const struct ast_security_event_ie_type *ast_security_event_get_required_ies(
|
||||
const enum ast_security_event_type event_type)
|
||||
{
|
||||
if (check_event_type(event_type)) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return sec_events[event_type].required_ies;
|
||||
}
|
||||
|
||||
const struct ast_security_event_ie_type *ast_security_event_get_optional_ies(
|
||||
const enum ast_security_event_type event_type)
|
||||
{
|
||||
if (check_event_type(event_type)) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return sec_events[event_type].optional_ies;
|
||||
}
|
||||
|
||||
static void encode_timestamp(struct ast_str **str, const struct timeval *tv)
|
||||
{
|
||||
ast_str_set(str, 0, "%u-%u",
|
||||
(unsigned int) tv->tv_sec,
|
||||
(unsigned int) tv->tv_usec);
|
||||
}
|
||||
|
||||
static struct ast_event *alloc_event(const struct ast_security_event_common *sec)
|
||||
{
|
||||
struct ast_str *str = ast_str_alloca(TIMESTAMP_STR_LEN);
|
||||
struct timeval tv = ast_tvnow();
|
||||
const char *severity_str;
|
||||
|
||||
if (check_event_type(sec->event_type)) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
encode_timestamp(&str, &tv);
|
||||
|
||||
severity_str = S_OR(
|
||||
ast_security_event_severity_get_name(sec_events[sec->event_type].severity),
|
||||
"Unknown"
|
||||
);
|
||||
|
||||
return ast_event_new(AST_EVENT_SECURITY,
|
||||
AST_EVENT_IE_SECURITY_EVENT, AST_EVENT_IE_PLTYPE_UINT, sec->event_type,
|
||||
AST_EVENT_IE_EVENT_VERSION, AST_EVENT_IE_PLTYPE_UINT, sec->version,
|
||||
AST_EVENT_IE_EVENT_TV, AST_EVENT_IE_PLTYPE_STR, str->str,
|
||||
AST_EVENT_IE_SERVICE, AST_EVENT_IE_PLTYPE_STR, sec->service,
|
||||
AST_EVENT_IE_SEVERITY, AST_EVENT_IE_PLTYPE_STR, severity_str,
|
||||
AST_EVENT_IE_END);
|
||||
}
|
||||
|
||||
static int add_timeval_ie(struct ast_event **event, enum ast_event_ie_type ie_type,
|
||||
const struct timeval *tv)
|
||||
{
|
||||
struct ast_str *str = ast_str_alloca(TIMESTAMP_STR_LEN);
|
||||
|
||||
encode_timestamp(&str, tv);
|
||||
|
||||
return ast_event_append_ie_str(event, ie_type, ast_str_buffer(str));
|
||||
}
|
||||
|
||||
static int add_ipv4_ie(struct ast_event **event, enum ast_event_ie_type ie_type,
|
||||
const struct ast_security_event_ipv4_addr *addr)
|
||||
{
|
||||
struct ast_str *str = ast_str_alloca(64);
|
||||
|
||||
ast_str_set(&str, 0, "IPV4/");
|
||||
|
||||
switch (addr->transport) {
|
||||
case AST_SECURITY_EVENT_TRANSPORT_UDP:
|
||||
ast_str_append(&str, 0, "UDP/");
|
||||
break;
|
||||
case AST_SECURITY_EVENT_TRANSPORT_TCP:
|
||||
ast_str_append(&str, 0, "TCP/");
|
||||
break;
|
||||
case AST_SECURITY_EVENT_TRANSPORT_TLS:
|
||||
ast_str_append(&str, 0, "TLS/");
|
||||
break;
|
||||
}
|
||||
|
||||
ast_str_append(&str, 0, "%s/%hu",
|
||||
ast_inet_ntoa(addr->sin->sin_addr),
|
||||
ntohs(addr->sin->sin_port));
|
||||
|
||||
return ast_event_append_ie_str(event, ie_type, ast_str_buffer(str));
|
||||
}
|
||||
|
||||
enum ie_required {
|
||||
NOT_REQUIRED,
|
||||
REQUIRED
|
||||
};
|
||||
|
||||
static int add_ie(struct ast_event **event, const struct ast_security_event_common *sec,
|
||||
const struct ast_security_event_ie_type *ie_type, enum ie_required req)
|
||||
{
|
||||
int res = 0;
|
||||
|
||||
switch (ie_type->ie_type) {
|
||||
case AST_EVENT_IE_SERVICE:
|
||||
case AST_EVENT_IE_ACCOUNT_ID:
|
||||
case AST_EVENT_IE_SESSION_ID:
|
||||
case AST_EVENT_IE_MODULE:
|
||||
case AST_EVENT_IE_ACL_NAME:
|
||||
case AST_EVENT_IE_REQUEST_TYPE:
|
||||
case AST_EVENT_IE_REQUEST_PARAMS:
|
||||
case AST_EVENT_IE_AUTH_METHOD:
|
||||
case AST_EVENT_IE_CHALLENGE:
|
||||
case AST_EVENT_IE_RESPONSE:
|
||||
case AST_EVENT_IE_EXPECTED_RESPONSE:
|
||||
{
|
||||
const char *str;
|
||||
|
||||
str = *((const char **)(((const char *) sec) + ie_type->offset));
|
||||
|
||||
if (req && !str) {
|
||||
ast_log(LOG_WARNING, "Required IE '%d' for security event "
|
||||
"type '%d' not present\n", ie_type->ie_type,
|
||||
sec->event_type);
|
||||
res = -1;
|
||||
}
|
||||
|
||||
if (str) {
|
||||
res = ast_event_append_ie_str(event, ie_type->ie_type, str);
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
case AST_EVENT_IE_EVENT_VERSION:
|
||||
{
|
||||
uint32_t val;
|
||||
val = *((const uint32_t *)(((const char *) sec) + ie_type->offset));
|
||||
res = ast_event_append_ie_uint(event, ie_type->ie_type, val);
|
||||
break;
|
||||
}
|
||||
case AST_EVENT_IE_LOCAL_ADDR:
|
||||
case AST_EVENT_IE_REMOTE_ADDR:
|
||||
case AST_EVENT_IE_EXPECTED_ADDR:
|
||||
{
|
||||
const struct ast_security_event_ipv4_addr *addr;
|
||||
|
||||
addr = (const struct ast_security_event_ipv4_addr *)(((const char *) sec) + ie_type->offset);
|
||||
|
||||
if (req && !addr->sin) {
|
||||
ast_log(LOG_WARNING, "Required IE '%d' for security event "
|
||||
"type '%d' not present\n", ie_type->ie_type,
|
||||
sec->event_type);
|
||||
res = -1;
|
||||
}
|
||||
|
||||
if (addr->sin) {
|
||||
res = add_ipv4_ie(event, ie_type->ie_type, addr);
|
||||
}
|
||||
break;
|
||||
}
|
||||
case AST_EVENT_IE_SESSION_TV:
|
||||
{
|
||||
const struct timeval *tval;
|
||||
|
||||
tval = *((const struct timeval **)(((const char *) sec) + ie_type->offset));
|
||||
|
||||
if (req && !tval) {
|
||||
ast_log(LOG_WARNING, "Required IE '%d' for security event "
|
||||
"type '%d' not present\n", ie_type->ie_type,
|
||||
sec->event_type);
|
||||
res = -1;
|
||||
}
|
||||
|
||||
if (tval) {
|
||||
add_timeval_ie(event, ie_type->ie_type, tval);
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
case AST_EVENT_IE_EVENT_TV:
|
||||
case AST_EVENT_IE_SEVERITY:
|
||||
/* Added automatically, nothing to do here. */
|
||||
break;
|
||||
default:
|
||||
ast_log(LOG_WARNING, "Unhandled IE type '%d', this security event "
|
||||
"will be missing data.\n", ie_type->ie_type);
|
||||
break;
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
static int handle_security_event(const struct ast_security_event_common *sec)
|
||||
{
|
||||
struct ast_event *event;
|
||||
const struct ast_security_event_ie_type *ies;
|
||||
unsigned int i;
|
||||
|
||||
if (!(event = alloc_event(sec))) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
for (ies = ast_security_event_get_required_ies(sec->event_type), i = 0;
|
||||
ies[i].ie_type != AST_EVENT_IE_END;
|
||||
i++) {
|
||||
if (add_ie(&event, sec, ies + i, REQUIRED)) {
|
||||
goto return_error;
|
||||
}
|
||||
}
|
||||
|
||||
for (ies = ast_security_event_get_optional_ies(sec->event_type), i = 0;
|
||||
ies[i].ie_type != AST_EVENT_IE_END;
|
||||
i++) {
|
||||
if (add_ie(&event, sec, ies + i, NOT_REQUIRED)) {
|
||||
goto return_error;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if (ast_event_queue(event)) {
|
||||
goto return_error;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
return_error:
|
||||
if (event) {
|
||||
ast_event_destroy(event);
|
||||
}
|
||||
|
||||
return -1;
|
||||
}
|
||||
|
||||
int ast_security_event_report(const struct ast_security_event_common *sec)
|
||||
{
|
||||
int res;
|
||||
|
||||
if (sec->event_type < 0 || sec->event_type >= AST_SECURITY_EVENT_NUM_TYPES) {
|
||||
ast_log(LOG_ERROR, "Invalid security event type\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!sec_events[sec->event_type].name) {
|
||||
ast_log(LOG_WARNING, "Security event type %u not handled\n",
|
||||
sec->event_type);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (sec->version != sec_events[sec->event_type].version) {
|
||||
ast_log(LOG_WARNING, "Security event %u version mismatch\n",
|
||||
sec->event_type);
|
||||
return -1;
|
||||
}
|
||||
|
||||
res = handle_security_event(sec);
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
|
||||
@ -0,0 +1,163 @@
|
||||
/*
|
||||
* Asterisk -- An open source telephony toolkit.
|
||||
*
|
||||
* Copyright (C) 2009, Digium, Inc.
|
||||
*
|
||||
* Russell Bryant <russell@digium.com>
|
||||
*
|
||||
* See http://www.asterisk.org for more information about
|
||||
* the Asterisk project. Please do not directly contact
|
||||
* any of the maintainers of this project for assistance;
|
||||
* the project provides a web site, mailing lists and IRC
|
||||
* channels for your use.
|
||||
*
|
||||
* This program is free software, distributed under the terms of
|
||||
* the GNU General Public License Version 2. See the LICENSE file
|
||||
* at the top of the source tree.
|
||||
*/
|
||||
|
||||
/*!
|
||||
* \file
|
||||
*
|
||||
* \author Russell Bryant <russell@digium.com>
|
||||
*
|
||||
* \brief Security Event Logging
|
||||
*
|
||||
* \todo Make informational security events optional
|
||||
* \todo Escape quotes in string payload IE contents
|
||||
*/
|
||||
|
||||
#include "asterisk.h"
|
||||
|
||||
ASTERISK_FILE_VERSION(__FILE__, "$Revision$");
|
||||
|
||||
#include "asterisk/module.h"
|
||||
#include "asterisk/logger.h"
|
||||
#include "asterisk/event.h"
|
||||
#include "asterisk/threadstorage.h"
|
||||
#include "asterisk/strings.h"
|
||||
#include "asterisk/security_events.h"
|
||||
|
||||
static const char LOG_SECURITY_NAME[] = "SECURITY";
|
||||
|
||||
static int LOG_SECURITY;
|
||||
|
||||
static struct ast_event_sub *security_event_sub;
|
||||
|
||||
AST_THREADSTORAGE(security_event_buf);
|
||||
static const size_t SECURITY_EVENT_BUF_INIT_LEN = 256;
|
||||
|
||||
enum ie_required {
|
||||
NOT_REQUIRED,
|
||||
REQUIRED
|
||||
};
|
||||
|
||||
static int ie_is_present(const struct ast_event *event,
|
||||
const enum ast_event_ie_type ie_type)
|
||||
{
|
||||
return (ast_event_get_ie_raw(event, ie_type) != NULL);
|
||||
}
|
||||
|
||||
static void append_ie(struct ast_str **str, const struct ast_event *event,
|
||||
const enum ast_event_ie_type ie_type, enum ie_required required)
|
||||
{
|
||||
if (!required && !ie_is_present(event, ie_type)) {
|
||||
/* Optional IE isn't present. Ignore. */
|
||||
return;
|
||||
}
|
||||
|
||||
/* At this point, it _better_ be there! */
|
||||
ast_assert(ie_is_present(event, ie_type));
|
||||
|
||||
switch (ast_event_get_ie_pltype(ie_type)) {
|
||||
case AST_EVENT_IE_PLTYPE_UINT:
|
||||
ast_str_append(str, 0, ",%s=\"%u\"",
|
||||
ast_event_get_ie_type_name(ie_type),
|
||||
ast_event_get_ie_uint(event, ie_type));
|
||||
break;
|
||||
case AST_EVENT_IE_PLTYPE_STR:
|
||||
ast_str_append(str, 0, ",%s=\"%s\"",
|
||||
ast_event_get_ie_type_name(ie_type),
|
||||
ast_event_get_ie_str(event, ie_type));
|
||||
break;
|
||||
case AST_EVENT_IE_PLTYPE_BITFLAGS:
|
||||
ast_str_append(str, 0, ",%s=\"%u\"",
|
||||
ast_event_get_ie_type_name(ie_type),
|
||||
ast_event_get_ie_bitflags(event, ie_type));
|
||||
break;
|
||||
case AST_EVENT_IE_PLTYPE_UNKNOWN:
|
||||
case AST_EVENT_IE_PLTYPE_EXISTS:
|
||||
case AST_EVENT_IE_PLTYPE_RAW:
|
||||
ast_log(LOG_WARNING, "Unexpected payload type for IE '%s'\n",
|
||||
ast_event_get_ie_type_name(ie_type));
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
static void append_ies(struct ast_str **str, const struct ast_event *event,
|
||||
const struct ast_security_event_ie_type *ies, enum ie_required required)
|
||||
{
|
||||
unsigned int i;
|
||||
|
||||
for (i = 0; ies[i].ie_type != AST_EVENT_IE_END; i++) {
|
||||
append_ie(str, event, ies[i].ie_type, required);
|
||||
}
|
||||
}
|
||||
|
||||
static void security_event_cb(const struct ast_event *event, void *data)
|
||||
{
|
||||
struct ast_str *str;
|
||||
enum ast_security_event_type event_type;
|
||||
|
||||
if (!(str = ast_str_thread_get(&security_event_buf,
|
||||
SECURITY_EVENT_BUF_INIT_LEN))) {
|
||||
return;
|
||||
}
|
||||
|
||||
/* Note that the event type is guaranteed to be valid here. */
|
||||
event_type = ast_event_get_ie_uint(event, AST_EVENT_IE_SECURITY_EVENT);
|
||||
ast_assert(event_type >= 0 && event_type < AST_SECURITY_EVENT_NUM_TYPES);
|
||||
|
||||
ast_str_set(&str, 0, "%s=\"%s\"",
|
||||
ast_event_get_ie_type_name(AST_EVENT_IE_SECURITY_EVENT),
|
||||
ast_security_event_get_name(event_type));
|
||||
|
||||
append_ies(&str, event,
|
||||
ast_security_event_get_required_ies(event_type), REQUIRED);
|
||||
append_ies(&str, event,
|
||||
ast_security_event_get_optional_ies(event_type), NOT_REQUIRED);
|
||||
|
||||
ast_log_dynamic_level(LOG_SECURITY, "%s\n", ast_str_buffer(str));
|
||||
}
|
||||
|
||||
static int load_module(void)
|
||||
{
|
||||
if ((LOG_SECURITY = ast_logger_register_level(LOG_SECURITY_NAME)) == -1) {
|
||||
return AST_MODULE_LOAD_DECLINE;
|
||||
}
|
||||
|
||||
if (!(security_event_sub = ast_event_subscribe(AST_EVENT_SECURITY,
|
||||
security_event_cb, "Security Event Logger",
|
||||
NULL, AST_EVENT_IE_END))) {
|
||||
ast_logger_unregister_level(LOG_SECURITY_NAME);
|
||||
LOG_SECURITY = -1;
|
||||
return AST_MODULE_LOAD_DECLINE;
|
||||
}
|
||||
|
||||
ast_verb(3, "Security Logging Enabled\n");
|
||||
|
||||
return AST_MODULE_LOAD_SUCCESS;
|
||||
}
|
||||
|
||||
static int unload_module(void)
|
||||
{
|
||||
if (security_event_sub) {
|
||||
security_event_sub = ast_event_unsubscribe(security_event_sub);
|
||||
}
|
||||
|
||||
ast_verb(3, "Security Logging Disabled\n");
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
AST_MODULE_INFO_STANDARD(ASTERISK_GPL_KEY, "Security Event Logging");
|
||||
@ -0,0 +1,47 @@
|
||||
#!/bin/bash
|
||||
|
||||
# manager.conf:
|
||||
#
|
||||
# [general]
|
||||
# ...
|
||||
# allowmultipleconnects=no
|
||||
# ...
|
||||
#
|
||||
# [russell]
|
||||
# secret=blah123
|
||||
# read = system,call,log,verbose,command,agent,user,config
|
||||
# write = system,call,log,verbose,command,agent,user,config
|
||||
# deny=0.0.0.0/0.0.0.0
|
||||
# permit=127.0.0.1/255.255.255.255
|
||||
#
|
||||
# [russell2]
|
||||
# secret=blah123
|
||||
# read = system,call,log,verbose,command,agent,user,config
|
||||
# write = system,call,log,verbose,command,agent,user,config
|
||||
# deny=127.0.0.1/255.255.255.255
|
||||
|
||||
# Invalid User
|
||||
printf "Action: Login\r\nUsername: foo\r\nSecret: moo\r\n\r\n" | nc localhost 5038
|
||||
|
||||
# Invalid Secret
|
||||
printf "Action: Login\r\nUsername: russell\r\nSecret: moo\r\n\r\n" | nc localhost 5038
|
||||
|
||||
# Auth Success
|
||||
printf "Action: Login\r\nUsername: russell\r\nSecret: blah123\r\n\r\n" | nc -w 1 localhost 5038
|
||||
|
||||
# Failed ACL
|
||||
printf "Action: Login\r\nUsername: russell2\r\nSecret: blah123\r\n\r\n" | nc -w 1 localhost 5038
|
||||
|
||||
# Request Not Allowed
|
||||
printf "Action: Login\r\nUsername: russell\r\nSecret: blah123\r\n\r\nAction: Originate\r\n\r\n" | nc -w 1 localhost 5038
|
||||
|
||||
# Request Bad Format
|
||||
printf "Action: Login\r\nUsername: russell\r\nSecret: blah123\r\n\r\nAction: FakeActionBLAH\r\n\r\n" | nc -w 1 localhost 5038
|
||||
|
||||
# Failed Challenge Response
|
||||
printf "Action: Challenge\r\nUsername: russell\r\nAuthType: MD5\r\n\r\nAction: Login\r\nUsername: russell\r\nAuthType: MD5\r\nKey: 00000000\r\n\r\n" | nc localhost 5038
|
||||
|
||||
# Session Limit
|
||||
printf "Action: Login\r\nUsername: russell\r\nSecret: blah123\r\n\r\n" | nc -w 5 localhost 5038 &
|
||||
printf "Action: Login\r\nUsername: russell\r\nSecret: blah123\r\n\r\n" | nc -w 1 localhost 5038
|
||||
|
||||
@ -0,0 +1,625 @@
|
||||
/*
|
||||
* Asterisk -- An open source telephony toolkit.
|
||||
*
|
||||
* Copyright (C) 2009, Digium, Inc.
|
||||
*
|
||||
* Russell Bryant <russell@digium.com>
|
||||
*
|
||||
* See http://www.asterisk.org for more information about
|
||||
* the Asterisk project. Please do not directly contact
|
||||
* any of the maintainers of this project for assistance;
|
||||
* the project provides a web site, mailing lists and IRC
|
||||
* channels for your use.
|
||||
*
|
||||
* This program is free software, distributed under the terms of
|
||||
* the GNU General Public License Version 2. See the LICENSE file
|
||||
* at the top of the source tree.
|
||||
*/
|
||||
|
||||
/*! \file
|
||||
*
|
||||
* \brief Test security event generation
|
||||
*
|
||||
* \author Russell Bryant <russell@digium.com>
|
||||
*/
|
||||
|
||||
/*** MODULEINFO
|
||||
<defaultenabled>no</defaultenabled>
|
||||
***/
|
||||
|
||||
#include "asterisk.h"
|
||||
|
||||
ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
|
||||
|
||||
#include "asterisk/module.h"
|
||||
#include "asterisk/cli.h"
|
||||
#include "asterisk/utils.h"
|
||||
#include "asterisk/security_events.h"
|
||||
|
||||
static void evt_gen_failed_acl(void);
|
||||
static void evt_gen_inval_acct_id(void);
|
||||
static void evt_gen_session_limit(void);
|
||||
static void evt_gen_mem_limit(void);
|
||||
static void evt_gen_load_avg(void);
|
||||
static void evt_gen_req_no_support(void);
|
||||
static void evt_gen_req_not_allowed(void);
|
||||
static void evt_gen_auth_method_not_allowed(void);
|
||||
static void evt_gen_req_bad_format(void);
|
||||
static void evt_gen_successful_auth(void);
|
||||
static void evt_gen_unexpected_addr(void);
|
||||
static void evt_gen_chal_resp_failed(void);
|
||||
static void evt_gen_inval_password(void);
|
||||
|
||||
typedef void (*evt_generator)(void);
|
||||
static const evt_generator evt_generators[AST_SECURITY_EVENT_NUM_TYPES] = {
|
||||
[AST_SECURITY_EVENT_FAILED_ACL] = evt_gen_failed_acl,
|
||||
[AST_SECURITY_EVENT_INVAL_ACCT_ID] = evt_gen_inval_acct_id,
|
||||
[AST_SECURITY_EVENT_SESSION_LIMIT] = evt_gen_session_limit,
|
||||
[AST_SECURITY_EVENT_MEM_LIMIT] = evt_gen_mem_limit,
|
||||
[AST_SECURITY_EVENT_LOAD_AVG] = evt_gen_load_avg,
|
||||
[AST_SECURITY_EVENT_REQ_NO_SUPPORT] = evt_gen_req_no_support,
|
||||
[AST_SECURITY_EVENT_REQ_NOT_ALLOWED] = evt_gen_req_not_allowed,
|
||||
[AST_SECURITY_EVENT_AUTH_METHOD_NOT_ALLOWED] = evt_gen_auth_method_not_allowed,
|
||||
[AST_SECURITY_EVENT_REQ_BAD_FORMAT] = evt_gen_req_bad_format,
|
||||
[AST_SECURITY_EVENT_SUCCESSFUL_AUTH] = evt_gen_successful_auth,
|
||||
[AST_SECURITY_EVENT_UNEXPECTED_ADDR] = evt_gen_unexpected_addr,
|
||||
[AST_SECURITY_EVENT_CHAL_RESP_FAILED] = evt_gen_chal_resp_failed,
|
||||
[AST_SECURITY_EVENT_INVAL_PASSWORD] = evt_gen_inval_password,
|
||||
};
|
||||
|
||||
static void evt_gen_failed_acl(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_failed_acl failed_acl_event = {
|
||||
.common.event_type = AST_SECURITY_EVENT_FAILED_ACL,
|
||||
.common.version = AST_SECURITY_EVENT_FAILED_ACL_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "Username",
|
||||
.common.session_id = "Session123",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
|
||||
.acl_name = "TEST_ACL",
|
||||
};
|
||||
|
||||
inet_aton("192.168.1.1", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(12121);
|
||||
|
||||
inet_aton("192.168.1.2", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(12345);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&failed_acl_event));
|
||||
}
|
||||
|
||||
static void evt_gen_inval_acct_id(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_inval_acct_id inval_acct_id = {
|
||||
.common.event_type = AST_SECURITY_EVENT_INVAL_ACCT_ID,
|
||||
.common.version = AST_SECURITY_EVENT_INVAL_ACCT_ID_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "FakeUser",
|
||||
.common.session_id = "Session456",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
};
|
||||
|
||||
inet_aton("10.1.2.3", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(4321);
|
||||
|
||||
inet_aton("10.1.2.4", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(1234);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&inval_acct_id));
|
||||
}
|
||||
|
||||
static void evt_gen_session_limit(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_session_limit session_limit = {
|
||||
.common.event_type = AST_SECURITY_EVENT_SESSION_LIMIT,
|
||||
.common.version = AST_SECURITY_EVENT_SESSION_LIMIT_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "Jenny",
|
||||
.common.session_id = "8675309",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TLS,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TLS,
|
||||
},
|
||||
};
|
||||
|
||||
inet_aton("10.5.4.3", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(4444);
|
||||
|
||||
inet_aton("10.5.4.2", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(3333);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&session_limit));
|
||||
}
|
||||
|
||||
static void evt_gen_mem_limit(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_mem_limit mem_limit = {
|
||||
.common.event_type = AST_SECURITY_EVENT_MEM_LIMIT,
|
||||
.common.version = AST_SECURITY_EVENT_MEM_LIMIT_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "Felix",
|
||||
.common.session_id = "Session2604",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
};
|
||||
|
||||
inet_aton("10.10.10.10", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(555);
|
||||
|
||||
inet_aton("10.10.10.12", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(5656);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&mem_limit));
|
||||
}
|
||||
|
||||
static void evt_gen_load_avg(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_load_avg load_avg = {
|
||||
.common.event_type = AST_SECURITY_EVENT_LOAD_AVG,
|
||||
.common.version = AST_SECURITY_EVENT_LOAD_AVG_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "GuestAccount",
|
||||
.common.session_id = "XYZ123",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
};
|
||||
|
||||
inet_aton("10.11.12.13", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(9876);
|
||||
|
||||
inet_aton("10.12.11.10", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(9825);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&load_avg));
|
||||
}
|
||||
|
||||
static void evt_gen_req_no_support(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_req_no_support req_no_support = {
|
||||
.common.event_type = AST_SECURITY_EVENT_REQ_NO_SUPPORT,
|
||||
.common.version = AST_SECURITY_EVENT_REQ_NO_SUPPORT_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "George",
|
||||
.common.session_id = "asdkl23478289lasdkf",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
|
||||
.request_type = "MakeMeDinner",
|
||||
};
|
||||
|
||||
inet_aton("10.110.120.130", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(9888);
|
||||
|
||||
inet_aton("10.120.110.100", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(9777);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&req_no_support));
|
||||
}
|
||||
|
||||
static void evt_gen_req_not_allowed(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_req_not_allowed req_not_allowed = {
|
||||
.common.event_type = AST_SECURITY_EVENT_REQ_NOT_ALLOWED,
|
||||
.common.version = AST_SECURITY_EVENT_REQ_NOT_ALLOWED_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "George",
|
||||
.common.session_id = "alksdjf023423h4lka0df",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
|
||||
.request_type = "MakeMeBreakfast",
|
||||
.request_params = "BACONNNN!",
|
||||
};
|
||||
|
||||
inet_aton("10.110.120.130", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(9888);
|
||||
|
||||
inet_aton("10.120.110.100", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(9777);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&req_not_allowed));
|
||||
}
|
||||
|
||||
static void evt_gen_auth_method_not_allowed(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_auth_method_not_allowed auth_method_not_allowed = {
|
||||
.common.event_type = AST_SECURITY_EVENT_AUTH_METHOD_NOT_ALLOWED,
|
||||
.common.version = AST_SECURITY_EVENT_AUTH_METHOD_NOT_ALLOWED_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "Bob",
|
||||
.common.session_id = "010101010101",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
|
||||
.auth_method = "PlainText"
|
||||
};
|
||||
|
||||
inet_aton("10.110.120.135", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(8754);
|
||||
|
||||
inet_aton("10.120.110.105", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(8745);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&auth_method_not_allowed));
|
||||
}
|
||||
|
||||
static void evt_gen_req_bad_format(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_req_bad_format req_bad_format = {
|
||||
.common.event_type = AST_SECURITY_EVENT_REQ_BAD_FORMAT,
|
||||
.common.version = AST_SECURITY_EVENT_REQ_BAD_FORMAT_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "Larry",
|
||||
.common.session_id = "838383fhfhf83hf8h3f8h",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
|
||||
.request_type = "CheeseBurger",
|
||||
.request_params = "Onions,Swiss,MotorOil",
|
||||
};
|
||||
|
||||
inet_aton("10.110.220.230", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(1212);
|
||||
|
||||
inet_aton("10.120.210.200", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(2121);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&req_bad_format));
|
||||
}
|
||||
|
||||
static void evt_gen_successful_auth(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_successful_auth successful_auth = {
|
||||
.common.event_type = AST_SECURITY_EVENT_SUCCESSFUL_AUTH,
|
||||
.common.version = AST_SECURITY_EVENT_SUCCESSFUL_AUTH_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "ValidUser",
|
||||
.common.session_id = "Session456",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
};
|
||||
|
||||
inet_aton("10.1.2.3", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(4321);
|
||||
|
||||
inet_aton("10.1.2.4", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(1234);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&successful_auth));
|
||||
}
|
||||
|
||||
static void evt_gen_unexpected_addr(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_expected = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_unexpected_addr unexpected_addr = {
|
||||
.common.event_type = AST_SECURITY_EVENT_UNEXPECTED_ADDR,
|
||||
.common.version = AST_SECURITY_EVENT_UNEXPECTED_ADDR_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "CoolUser",
|
||||
.common.session_id = "Session789",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
|
||||
.expected_addr = {
|
||||
.sin = &sin_expected,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_UDP,
|
||||
},
|
||||
};
|
||||
|
||||
inet_aton("10.1.2.3", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(4321);
|
||||
|
||||
inet_aton("10.1.2.4", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(1234);
|
||||
|
||||
inet_aton("10.1.2.5", &sin_expected.sin_addr);
|
||||
sin_expected.sin_port = htons(2343);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&unexpected_addr));
|
||||
}
|
||||
|
||||
static void evt_gen_chal_resp_failed(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_chal_resp_failed chal_resp_failed = {
|
||||
.common.event_type = AST_SECURITY_EVENT_CHAL_RESP_FAILED,
|
||||
.common.version = AST_SECURITY_EVENT_CHAL_RESP_FAILED_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "SuperDuperUser",
|
||||
.common.session_id = "Session1231231231",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
|
||||
.challenge = "8adf8a9sd8fas9df23ljk4",
|
||||
.response = "9u3jlaksdjflakjsdfoi23",
|
||||
.expected_response = "oiafaljhadf9834luahk3k",
|
||||
};
|
||||
|
||||
inet_aton("10.1.2.3", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(4321);
|
||||
|
||||
inet_aton("10.1.2.4", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(1234);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&chal_resp_failed));
|
||||
}
|
||||
|
||||
static void evt_gen_inval_password(void)
|
||||
{
|
||||
struct sockaddr_in sin_local = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct sockaddr_in sin_remote = {
|
||||
.sin_family = AF_INET
|
||||
};
|
||||
struct timeval session_tv = ast_tvnow();
|
||||
struct ast_security_event_inval_password inval_password = {
|
||||
.common.event_type = AST_SECURITY_EVENT_INVAL_PASSWORD,
|
||||
.common.version = AST_SECURITY_EVENT_INVAL_PASSWORD_VERSION,
|
||||
.common.service = "TEST",
|
||||
.common.module = AST_MODULE,
|
||||
.common.account_id = "AccountIDGoesHere",
|
||||
.common.session_id = "SessionIDGoesHere",
|
||||
.common.session_tv = &session_tv,
|
||||
.common.local_addr = {
|
||||
.sin = &sin_local,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
.common.remote_addr = {
|
||||
.sin = &sin_remote,
|
||||
.transport = AST_SECURITY_EVENT_TRANSPORT_TCP,
|
||||
},
|
||||
};
|
||||
|
||||
inet_aton("10.200.100.30", &sin_local.sin_addr);
|
||||
sin_local.sin_port = htons(4321);
|
||||
|
||||
inet_aton("10.200.100.40", &sin_remote.sin_addr);
|
||||
sin_remote.sin_port = htons(1234);
|
||||
|
||||
ast_security_event_report(AST_SEC_EVT(&inval_password));
|
||||
}
|
||||
|
||||
static void gen_events(struct ast_cli_args *a)
|
||||
{
|
||||
unsigned int i;
|
||||
|
||||
ast_cli(a->fd, "Generating some security events ...\n");
|
||||
|
||||
for (i = 0; i < ARRAY_LEN(evt_generators); i++) {
|
||||
const char *event_type = ast_security_event_get_name(i);
|
||||
|
||||
if (!evt_generators[i]) {
|
||||
ast_cli(a->fd, "*** No event generator for event type '%s' ***\n",
|
||||
event_type);
|
||||
continue;
|
||||
}
|
||||
|
||||
ast_cli(a->fd, "Generating a '%s' security event ...\n", event_type);
|
||||
|
||||
evt_generators[i]();
|
||||
}
|
||||
|
||||
ast_cli(a->fd, "Security event generation complete.\n");
|
||||
}
|
||||
|
||||
static char *handle_cli_sec_evt_test(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
|
||||
{
|
||||
switch (cmd) {
|
||||
case CLI_INIT:
|
||||
e->command = "securityevents test generation";
|
||||
e->usage = ""
|
||||
"Usage: securityevents test generation"
|
||||
"";
|
||||
return NULL;
|
||||
case CLI_GENERATE:
|
||||
return NULL;
|
||||
case CLI_HANDLER:
|
||||
gen_events(a);
|
||||
return CLI_SUCCESS;
|
||||
}
|
||||
|
||||
return CLI_FAILURE;
|
||||
}
|
||||
|
||||
static struct ast_cli_entry cli_sec_evt[] = {
|
||||
AST_CLI_DEFINE(handle_cli_sec_evt_test, "Test security event generation"),
|
||||
};
|
||||
|
||||
static int unload_module(void)
|
||||
{
|
||||
return ast_cli_unregister_multiple(cli_sec_evt, ARRAY_LEN(cli_sec_evt));
|
||||
}
|
||||
|
||||
static int load_module(void)
|
||||
{
|
||||
int res;
|
||||
|
||||
res = ast_cli_register_multiple(cli_sec_evt, ARRAY_LEN(cli_sec_evt));
|
||||
|
||||
return res ? AST_MODULE_LOAD_DECLINE : AST_MODULE_LOAD_SUCCESS;
|
||||
}
|
||||
|
||||
AST_MODULE_INFO_STANDARD(ASTERISK_GPL_KEY, "Test Security Event Generation");
|
||||
Loading…
Reference in new issue