Stir/Shaken Refactor
George Joseph <[email protected]> Tue, 9 Jan 2024 13:16:28 -0700
| Newsgroups | gmane.comp.telephony.pbx.asterisk.devel |
|---|---|
| Message-ID | <CAP=uFEt4bXem7dqJXsQwH2y==Yf9R9O4pNB7QLfcFf72R7uxiw@mail.gmail.com> |
--===============2907646648207026476== Content-Type: multipart/alternative; boundary="00000000000047063d060e88fe9e" --00000000000047063d060e88fe9e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I have no idea how this email will render in the old asterisk-dev list but here goes. If you can't read it, and you're not already subscribed to the new list, this is your reminder to do so... https://groups.io/g/asterisk-dev ---------- Forwarded message --------- From: George Joseph via groups.io <[email protected]> Date: Tue, Jan 9, 2024 at 1:11=E2=80=AFPM Subject: [asterisk-dev] Stir/Shaken Refactor To: <[email protected]> Please review the pull request at Stir/Shaken Refactor <https://github.com/asterisk/asterisk/pull/524> You can review this PR locally by running gh pr checkout 524 if you have the GitHub CLI client installed or by running git fetch upstream pull/524/head:master-stir-shaken-refactor (assuming "upstream" points to https://github.com/asterisk/asterisk.git). It's important that you understand that there are breaking changes to the Stir/Shaken implementation and that you TEST!! I'll be updating the documentation at https://docs.asterisk.org/Deployment/STIR-SHAKEN over the next few days. Why do we need a refactor? The original stir/shaken implementation was started over 3 years ago when little was understood about practical implementation. The result was an implementation that wouldn't actually interoperate with any other stir-shaken implementations. There were also a number of stir-shaken features and RFC requirements that were never implemented such as TNAuthList certificate validation, sending Reason headers in SIP responses when verification failed but we wished to continue the call, and the ability to send Media Key(mky) grants in the Identity header when the call involved DTLS. Finally, there were some performance concerns around outgoing calls and selection of the correct certificate and private key. The configuration was keyed by an arbitrary name which meant that for every outgoing call, we had to scan the entire list of configured TNs to find the correct cert to use. With only a few TNs configured, this wasn't an issue but if you have a thousand, it could be. What's changed? - Configuration objects have been refactored to be clearer about their uses and to fix issues. - The "general" object was renamed to "verification" since it contains parameters specific to the incoming verification process. It also nev= er handled ca_path and crl_path correctly. - A new "attestation" object was added that controls the outgoing attestation process. It sets default certificates, keys, etc. - The "certificate" object was renamed to "tn" and had it's key change to telephone number since outgoing call attestation needs to look up certificates by telephone number. - The "profile" object had more parameters added to it that can override default parameters specified in the "attestation" and "verification" objects. - The "store" object was removed altogether as it was never implemented. - We now use libjwt to create outgoing Identity headers and to parse and validate signatures on incoming Identity headers. Our previous custom implementation was much of the source of the interoperability issues. - General code cleanup and refactor. - Moved things to better places. - Separated some of the complex functions to smaller ones. - Using context objects rather than passing tons of parameters in function calls. - Removed some complexity and unneeded encapsulation from the config objects. Resolves: #351 Resolves: #46 UserNote: Asterisk's stir-shaken feature has been refactored to correct interoperability, RFC compliance, and performance issues. See https://docs.asterisk.org/Deployment/STIR-SHAKEN for more information. UpgradeNote: The stir-shaken refactor is a breaking change but since it's not working now we don't think it matters. The stir_shaken.conf file has changed significantly which means that existing ones WILL need to be changed. The stir_shaken.conf.sample file in configs/samples/ has quite a bit more information. This is also an ABI breaking change since some of the existing objects needed to be changed or removed, and new ones added. _._,_._,_ ------------------------------ Groups.io Links: You receive all messages sent to this group. View/Reply Online (#12) <https://groups.io/g/asterisk-dev/message/12> | Rep= ly To Group <[email protected]?subject=3DRe:%20%5Basterisk-dev%5D%20Stir%2FShaken%= 20Refactor> | Reply To Sender <[email protected]?subject=3DPrivate:%20Re:%20%5Basterisk-dev%5D%20Stir%2= FShaken%20Refactor> | Mute This Topic <https://groups.io/mt/103627606/8107472> | New Topic <https://groups.io/g/asterisk-dev/post> Your Subscription <https://groups.io/g/asterisk-dev/editsub/8107472> | Cont= act Group Owner <[email protected]> | Unsubscribe <https://groups.io/g/asterisk-dev/leave/12915652/8107472/342978022/xyzzy> [ [email protected]] _._,_._,_ --00000000000047063d060e88fe9e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">I have no idea how this email will render in the old aster= isk-dev<div>list but here goes.<div>If you can't read it, and you'r= e not already subscribed to the</div><div>new list, this is your reminder t= o do so...=C2=A0=C2=A0<a href=3D"https://groups.io/g/asterisk-dev">https://= groups.io/g/asterisk-dev</a><br><br><div class=3D"gmail_quote"><div dir=3D"= ltr" class=3D"gmail_attr">---------- Forwarded message ---------<br>From: <= strong class=3D"gmail_sendername" dir=3D"auto">George Joseph via <a href=3D= "http://groups.io">groups.io</a></strong> <span dir=3D"auto"><gjoseph=3D= <a href=3D"mailto:[email protected]">[email protected]</a>></spa= n><br>Date: Tue, Jan 9, 2024 at 1:11=E2=80=AFPM<br>Subject: [asterisk-dev] = Stir/Shaken Refactor<br>To: <<a href=3D"mailto:[email protected]">= [email protected]</a>><br></div><br><br><h2>Please review the pull = request at <a href=3D"https://github.com/asterisk/asterisk/pull/524" target= =3D"_blank">Stir/Shaken Refactor</a></h2> <p>You can review this PR locally by running <code>gh pr checkout 524</code= > if you have the GitHub CLI client installed or by running <code>git fetch upstream pull/524/head:master-stir-shaken-ref= actor</code> (assuming "upstream" points to <a href=3D"https://github.com/asterisk/asterisk.git)" target=3D"_= blank">https://github.com/asterisk/asterisk.git)</a>.</p> <h2>It's important that you understand that there are breaking changes = to the Stir/Shaken implementation and that you TEST!!</h2> <p>I'll be updating the documentation at <a href=3D"https://docs.asteri= sk.org/Deployment/STIR-SHAKEN" target=3D"_blank">https://docs.asterisk.org/= Deployment/STIR-SHAKEN</a> over the next few days.</p> <h2>Why do we need a refactor?</h2> <p>The original stir/shaken implementation was started over 3 years ago when little was understood about practical implementation. The result was an implementation that wouldn't actually interoperate with any other stir-shaken implementations.</p> <p>There were also a number of stir-shaken features and RFC requirements that were never implemented such as TNAuthList certificate validation, sending Reason headers in SIP responses when verification failed but we wished to continue the call, and the ability to send Media Key(mky) grants in the Identity header when the call involved DTLS.</p> <p>Finally, there were some performance concerns around outgoing calls and selection of the correct certificate and private key. The configuration was keyed by an arbitrary name which meant that for every outgoing call, we had to scan the entire list of configured TNs to find the correct cert to use. With only a few TNs configured, this wasn't an issue but if you have a thousand, it could be.</p> <p>What's changed?</p> <ul> <li><p>Configuration objects have been refactored to be clearer about their uses and to fix issues.</p> <ul> <li>The "general" object was renamed to "verification" = since it contains parameters specific to the incoming verification process. It also never handled ca_path and crl_path correctly.</li> <li>A new "attestation" object was added that controls the outgoing attestation process. It sets default certificates, keys, etc.</li> <li>The "certificate" object was renamed to "tn" and ha= d it's key change to telephone number since outgoing call attestation needs to look up certificates by telephone number.</li> <li>The "profile" object had more parameters added to it that can override default parameters specified in the "attestation" and "verification" objects.</li> <li>The "store" object was removed altogether as it was never implemented.</li> </ul></li> <li><p>We now use libjwt to create outgoing Identity headers and to parse and validate signatures on incoming Identity headers. Our previous custom implementation was much of the source of the interoperability issues.</p></li> <li><p>General code cleanup and refactor.</p> <ul> <li>Moved things to better places.</li> <li>Separated some of the complex functions to smaller ones.</li> <li>Using context objects rather than passing tons of parameters in function calls.</li> <li>Removed some complexity and unneeded encapsulation from the config objects.</li> </ul></li> </ul> <p>Resolves: #351<br> Resolves: #46</p> <p>UserNote: Asterisk's stir-shaken feature has been refactored to correct interoperability, RFC compliance, and performance issues. See <a href=3D"https://docs.asterisk.org/Deployment/STIR-SHAKEN" target=3D"= _blank">https://docs.asterisk.org/Deployment/STIR-SHAKEN</a> for more information.</p> <p>UpgradeNote: The stir-shaken refactor is a breaking change but since it's not working now we don't think it matters. The stir_shaken.conf file has changed significantly which means that existing ones WILL need to be changed. The stir_shaken.conf.sample file in configs/samples/ has quite a bit more information. This is also an ABI breaking change since some of the existing objects needed to be changed or removed, and new ones added.</p> <div width=3D"1" style=3D"color:white;clear:both">_._,_._,_</div> <hr> Groups.io Links:<p> =20 You receive all messages sent to this group. =20 =20 </p><p> <a href=3D"https://groups.io/g/asterisk-dev/message/12" target=3D"_blank">V= iew/Reply Online (#12)</a> | <a href=3D"mailto:[email protected]?subject=3DRe:%20%5Basterisk-dev%= 5D%20Stir%2FShaken%20Refactor" target=3D"_blank">Reply To Group</a> =20 | <a href=3D"mailto:[email protected]?subject=3DPrivate:%20Re:%20%5Ba= sterisk-dev%5D%20Stir%2FShaken%20Refactor" target=3D"_blank">Reply To Sende= r</a> =20 | <a href=3D"https://groups.io/mt/103627606/8107472" target=3D"_blank">Mute= This Topic</a> | <a href=3D"https://groups.io/g/asterisk-dev/post" target=3D"_blank">New T= opic</a> <br> <a href=3D"https://groups.io/g/asterisk-dev/editsub/8107472" target=3D"_bla= nk">Your Subscription</a> | <a href=3D"mailto:[email protected]" target=3D"_blank">Contact G= roup Owner</a> | <a href=3D"https://groups.io/g/asterisk-dev/leave/12915652/8107472/34297802= 2/xyzzy" target=3D"_blank">Unsubscribe</a> [<a href=3D"mailto:[email protected]" target=3D"_blank">gjoseph@sangoma.= com</a>]<br> </p><div width=3D"1" style=3D"color:white;clear:both">_._,_._,_</div> <p></p><p></p></div></div></div></div> --00000000000047063d060e88fe9e-- --===============2907646648207026476== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwotLSBCYW5kd2lkdGggYW5kIENvbG9jYXRpb24gUHJvdmlkZWQgYnkg aHR0cDovL3d3dy5hcGktZGlnaXRhbC5jb20gLS0KCmFzdGVyaXNrLWRldiBtYWlsaW5nIGxpc3QK VG8gVU5TVUJTQ1JJQkUgb3IgdXBkYXRlIG9wdGlvbnMgdmlzaXQ6CiAgIGh0dHA6Ly9saXN0cy5k aWdpdW0uY29tL21haWxtYW4vbGlzdGluZm8vYXN0ZXJpc2stZGV2 --===============2907646648207026476==--