5 Commits (14ea4d3b3988490c4c69acb4ceb476dc875013dd)

Author	SHA1	Message	Date
Alexei Gradinari	14ea4d3b39	sorcery: Prevent duplicate objects and ensure missing objects are created on update ... This patch resolves two issues in Sorcery objectset handling with multiple backends: 1. Prevent duplicate objects: When an object exists in more than one backend (e.g., a contact in both 'astdb' and 'realtime'), the objectset previously returned multiple instances of the same logical object. This caused logic failures in components like the PJSIP registrar, where duplicate contact entries led to overcounting and incorrect deletions, when max_contacts=1 and remove_existing=yes. This patch ensures only one instance of an object with a given key is added to the objectset, avoiding these duplicate-related side effects. 2. Ensure missing objects are created: When using multiple writable backends, a temporary backend failure can lead to objects missing permanently from that backend. Currently, .update() silently fails if the object is not present, and no .create() is attempted. This results in inconsistent state across backends (e.g. astdb vs. realtime). This patch introduces a new global option in sorcery.conf: [general] update_or_create_on_update_miss = yes|no Default: no (preserves existing behavior). When enabled: if .update() fails with no data found, .create() is attempted in that backend. This ensures that objects missing due to temporary backend outages are re-synchronized once the backend is available again. Added a new CLI command: sorcery show settings Displays global Sorcery settings, including the current value of update_or_create_on_update_miss. Updated tests to validate both flag enabled/disabled behavior. Fixes: #1289 UserNote: Users relying on Sorcery multiple writable backends configurations (e.g., astdb + realtime) may now enable update_or_create_on_update_miss = yes in sorcery.conf to ensure missing objects are recreated after temporary backend failures. Default behavior remains unchanged unless explicitly enabled.	2 months ago
George Joseph	628f8d7a43	Stir/Shaken Refactor ... Why do we need a refactor? The original stir/shaken implementation was started over 3 years ago when little was understood about practical implementation. The result was an implementation that wouldn't actually interoperate with any other stir-shaken implementations. There were also a number of stir-shaken features and RFC requirements that were never implemented such as TNAuthList certificate validation, sending Reason headers in SIP responses when verification failed but we wished to continue the call, and the ability to send Media Key(mky) grants in the Identity header when the call involved DTLS. Finally, there were some performance concerns around outgoing calls and selection of the correct certificate and private key. The configuration was keyed by an arbitrary name which meant that for every outgoing call, we had to scan the entire list of configured TNs to find the correct cert to use. With only a few TNs configured, this wasn't an issue but if you have a thousand, it could be. What's changed? * Configuration objects have been refactored to be clearer about their uses and to fix issues. * The "general" object was renamed to "verification" since it contains parameters specific to the incoming verification process. It also never handled ca_path and crl_path correctly. * A new "attestation" object was added that controls the outgoing attestation process. It sets default certificates, keys, etc. * The "certificate" object was renamed to "tn" and had it's key change to telephone number since outgoing call attestation needs to look up certificates by telephone number. * The "profile" object had more parameters added to it that can override default parameters specified in the "attestation" and "verification" objects. * The "store" object was removed altogther as it was never implemented. * We now use libjwt to create outgoing Identity headers and to parse and validate signatures on incoming Identiy headers. Our previous custom implementation was much of the source of the interoperability issues. * General code cleanup and refactor. * Moved things to better places. * Separated some of the complex functions to smaller ones. * Using context objects rather than passing tons of parameters in function calls. * Removed some complexity and unneeded encapsuation from the config objects. Resolves: #351 Resolves: #46 UserNote: Asterisk's stir-shaken feature has been refactored to correct interoperability, RFC compliance, and performance issues. See https://docs.asterisk.org/Deployment/STIR-SHAKEN for more information. UpgradeNote: The stir-shaken refactor is a breaking change but since it's not working now we don't think it matters. The stir_shaken.conf file has changed significantly which means that existing ones WILL need to be changed. The stir_shaken.conf.sample file in configs/samples/ has quite a bit more information. This is also an ABI breaking change since some of the existing objects needed to be changed or removed, and new ones added. Additionally, if res_stir_shaken is enabled in menuselect, you'll need to either have the development package for libjwt v1.15.3 installed or use the --with-libjwt-bundled option with ./configure.	2 years ago
Joshua Colp	270b485f04	pjsip: Add Alembic for PUBLISH support. ... This change adds database tables for the PUBLISH support so it can be configured using realtime. A minor fix to the res_pjsip_publish_asterisk module was done so that it read the sorcery configuration from the correct section. Finally the sample configuration files have been updated. ASTERISK-26928 Change-Id: I81991ae5c75af98d247f7eacd1c0b0a763675952	9 years ago
George Joseph	648d181d2f	configs/samples: Fix placement of 'identify' entry in sorcery.conf ... The entry for 'identify' was incorrectly placed in the res_pjsip section when it should be in res_pjsip_endpoint_identifier_ip. ASTERISK-26785 #close Change-Id: Ia1372b12a952bfe2df6b1b1e0e725ca306a5d41a	9 years ago
Matthew Jordan	fc0fecb476	configs: Move sample config files into a subdirectory of configs ... This moves all samples configs from configs/ to configs/samples. This allows for additional sets of sample configuration files to be added in the future. Review: https://reviewboard.asterisk.org/r/3804/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@418870 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago