ben.carrasco/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-10-03 17:53:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

[mod_sofia] Add enable-chat-api-proto to gate the api chat proto (#3135)

Browse Source 
The chat layer lets an inbound SIP MESSAGE select which chat proto handles it,
and the `api` proto runs the address as a FreeSWITCH API command. The new
per-profile `enable-chat-api-proto` param controls that route and is off unless
set. A MESSAGE selecting the proto on a profile without it is answered 403 and
logged with the source and the requested command.

The proto compare is case-insensitive, matching the chat interface registry,
which is created with `switch_core_hash_init_nocase()`.

The param ships commented out in the four vanilla profiles and the mod_sofia
sofia.conf.xml sample.
This commit is contained in:
Dmitry Verenitsin
2026-08-26 16:46:56 +03:00
committed by GitHub
parent 098018df3d
commit 7015f6a73a
8 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/vanilla/sip_profiles/external-ipv6.xml
+2
View File
@@ -56,6 +56,8 @@
<param name="inbound-codec-negotiation" value="generous"/>
<param name="nonce-ttl" value="60"/>
<param name="auth-calls" value="false"/>
<!-- lets an inbound MESSAGE to api+<command> run FreeSWITCH API commands, so enable only for trusted peers -->
<!-- <param name="enable-chat-api-proto" value="true"/> -->
<param name="inbound-late-negotiation" value="true"/>
<!--
DO NOT USE HOSTNAMES, ONLY IP ADDRESSES IN THESE SETTINGS!
conf/vanilla/sip_profiles/external.xml
+2
View File
@@ -56,6 +56,8 @@
<param name="inbound-codec-negotiation" value="generous"/>
<param name="nonce-ttl" value="60"/>
<param name="auth-calls" value="false"/>
<!-- lets an inbound MESSAGE to api+<command> run FreeSWITCH API commands, so enable only for trusted peers -->
<!-- <param name="enable-chat-api-proto" value="true"/> -->
<param name="inbound-late-negotiation" value="true"/>
<!--
DO NOT USE HOSTNAMES, ONLY IP ADDRESSES IN THESE SETTINGS!
conf/vanilla/sip_profiles/internal-ipv6.xml
+2
View File
@@ -93,6 +93,8 @@
<!-- add a ;received="<ip>:<port>" to the contact when replying to register for nat handling -->
<!--<param name="NDLB-received-in-nat-reg-contact" value="true"/>-->
<param name="auth-calls" value="$${internal_auth_calls}"/>
<!-- lets an inbound MESSAGE to api+<command> run FreeSWITCH API commands, so enable only for trusted peers -->
<!-- <param name="enable-chat-api-proto" value="true"/> -->
<!-- on authed calls, authenticate *all* the packets not just invite -->
<param name="auth-all-packets" value="false"/>
<!-- Shouldn't set these on IPv6 -->
conf/vanilla/sip_profiles/internal.xml
+3
View File
@@ -107,6 +107,9 @@
<!-- extended info parsing -->
<!-- <param name="extended-info-parsing" value="true"/> -->
<!-- lets an inbound MESSAGE to api+<command> run FreeSWITCH API commands, so enable only for trusted peers -->
<!-- <param name="enable-chat-api-proto" value="true"/> -->
<!--<param name="aggressive-nat-detection" value="true"/>-->
<!--
There are known issues (asserts and segfaults) when 100rel is enabled.
src/mod/endpoints/mod_sofia/conf/sofia.conf.xml
+4
View File
@@ -148,6 +148,10 @@
<!-- extended info parsing -->
<!-- <param name="extended-info-parsing" value="true"/> -->
<!-- lets an inbound MESSAGE to api+<command> run FreeSWITCH API commands,
so enable only for trusted peers -->
<!-- <param name="enable-chat-api-proto" value="true"/> -->
<!-- <param name="aggressive-nat-detection" value="true"/> -->
<!-- There are known issues (asserts and segfaults) when 100rel is
enabled. It is not recommended to enable 100rel at this time. -->
src/mod/endpoints/mod_sofia/mod_sofia.h
+1
View File
@@ -311,6 +311,7 @@ typedef enum {
PFLAG_AUTH_REQUIRE_USER,
PFLAG_AUTH_CALLS_ACL_ONLY,
PFLAG_USE_PORT_FOR_ACL_CHECK,
PFLAG_ENABLE_CHAT_API_PROTO,
/* No new flags below this line */
PFLAG_MAX
src/mod/endpoints/mod_sofia/sofia.c
+6
View File
@@ -4917,6 +4917,12 @@ switch_status_t config_sofia(sofia_config_t reload, char *profile_name)
} else {
sofia_clear_pflag(profile, PFLAG_ENABLE_CHAT);
}
} else if (!strcasecmp(var, "enable-chat-api-proto")) {
if (switch_true(val)) {
sofia_set_pflag(profile, PFLAG_ENABLE_CHAT_API_PROTO);
} else {
sofia_clear_pflag(profile, PFLAG_ENABLE_CHAT_API_PROTO);
}
} else if (!strcasecmp(var, "fire-bye-response-events")) {
if (switch_true(val)) {
sofia_set_pflag(profile, PFLAG_FIRE_BYE_RESPONSE_EVENTS);
src/mod/endpoints/mod_sofia/sofia_presence.c
+18
View File
@@ -4879,6 +4879,24 @@ void sofia_presence_handle_sip_i_message(int status,
p = strchr(proto, '+');
*p++ = '\0';
if (!strcasecmp(proto, "api") && !sofia_test_pflag(profile, PFLAG_ENABLE_CHAT_API_PROTO)) {
/* p is the rest of the To user, still percent-encoded and bounded by the proto buffer. */
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_WARNING,
"Profile [%s] rejected a MESSAGE from %s@%s (%s:%d) addressed to the 'api' chat proto [%s]. "
"Set enable-chat-api-proto=true on the profile to permit it.\n",
profile->name, switch_str_nil(from_user), switch_str_nil(from_host), network_ip, network_port, p);
nua_respond(nh, SIP_403_FORBIDDEN, NUTAG_WITH_THIS_MSG(de->data->e_msg), TAG_END());
if (full_from) {
su_free(nua_handle_get_home(nh), full_from);
}
/* Return rather than goto end: the end label answers 200/202, which would be a
second response on this transaction. */
return;
}
if ((to_addr = strdup(p))) {
if ((p = strchr(to_addr, '+'))) {
*p = '@';