<!-- Kamailio Pull Request Template -->
<!-- IMPORTANT: - for detailed contributing guidelines, read: https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md - pull requests must be done to master branch, unless they are backports of fixes from master branch to a stable branch - backports to stable branches must be done with 'git cherry-pick -x ...' - code is contributed under BSD for core and main components (tm, sl, auth, tls) - code is contributed GPLv2 or a compatible license for the other components - GPL code is contributed with OpenSSL licensing exception -->
#### Pre-Submission Checklist <!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply --> <!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above--> <!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list --> - [x] Commit message has the format required by CONTRIBUTING guide - [x] Commits are split per component (core, individual modules, libs, utils, ...) - [x] Each component has a single commit (if not, squash them into one commit) - [x] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change - [ ] Small bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist: <!-- Go over all points below, and after creating the PR, tick the checkboxes that apply --> - [ ] PR should be backported to stable branches - [x] Tested changes locally - [x] Related to PR https://github.com/kamailio/kamailio/pull/3891
#### Description <!-- Describe your changes in detail --> Normally, the IMS P-CSCF should identify the clients (UEs) by the received IP address and ports on Rx. The current code is using a mix of that, plus using Contact and Via headers, with arguable potential security issues.
This patch adds a new parameter to `ims_registrar_pcscf` and `ims_qos` modules, allowing for an optional outsource of the IPsec functionality to another element, which is also in charge of checking/enforcing correct UE Via header. The existing code is allowed to work as before, with the default value of the flag being towards that.
List of functional changes: - `ims_qos` - added `trust_bottom_via` parameter - used it on `w_rx_aar_register()` - `ims_registrar_pcscf` - added `trust_bottom_via` parameter - used it on `update_contacts()`, `save_pending()`, `check_contact()`, `getContactP()`, `check_service_routes()`, `enforce_service_routes()` - made `ims_ipsec_pcscf` dependency optional, with checks when used - skipped checks of `port-uc` in `checkcontact()` if the `ims_ipsec_pcscf` module was not loaded - added `ignore_contact_rxproto_check` parameter - IMS devices open IPsec Security Associations just between IPs and ports, with both UDP and TCP protocols allowed. The default then was set here to always ignore protocol checks. Before, the `ignore_contact_rxport_check` was used to skip this and still make it work, but that seemed like a typo/mistake with hidden effects.
List of indirect changes: - `core/ut.h`: added a `str2ushort()` macro, since code was using some dangerous casting and macros with a larger type - `ims_registrar_pcscf`: added `Route` headers in `SUBSCRIBE` to `reginfo`, with values from `Service-Route`s, as per 3GPP specs. - `ims_usrloc_pcscf`: small log fixes
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3901
-- Commit Summary --
* core: added str2ushort() to avoid some questionable casting in ims_qos * lib/ims: fixed a typo in a log message * ims_usrloc_pcscf: small log fixes * ims_qos: added trust_bottom_via parameter * ims_registrar_pcscf: added trust_bottom_via parameter, added ignore_contact_rxproto_check, fixes for logging, fixes for SUBSCRIBE to reginfo for including Service-Route, allow use without ims_ipsec_pcscf
-- File Changes --
M src/core/ut.h (8) M src/lib/ims/ims_getters.c (2) M src/modules/ims_qos/doc/ims_qos.xml (6) M src/modules/ims_qos/doc/ims_qos_admin.xml (41) M src/modules/ims_qos/ims_qos_mod.c (27) M src/modules/ims_qos/rx_aar.h (4) M src/modules/ims_qos/rx_authdata.h (2) M src/modules/ims_qos/rx_avp.c (2) M src/modules/ims_registrar_pcscf/doc/ims_registrar_pcscf.xml (6) M src/modules/ims_registrar_pcscf/doc/ims_registrar_pcscf_admin.xml (73) M src/modules/ims_registrar_pcscf/ims_registrar_pcscf_mod.c (26) M src/modules/ims_registrar_pcscf/notify.c (2) M src/modules/ims_registrar_pcscf/save.c (80) M src/modules/ims_registrar_pcscf/service_routes.c (136) M src/modules/ims_registrar_pcscf/subscribe.c (74) M src/modules/ims_registrar_pcscf/subscribe.h (4) M src/modules/ims_usrloc_pcscf/udomain.c (4)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3901.patch https://github.com/kamailio/kamailio/pull/3901.diff
@herlesupreeth approved this pull request.
Looks good to me
Many thanks for the review and help with this!
Is it only for SUBSCRIBE or is it required for INVITE as well or UE remembers it from the response to SUBSCRIBE?
This was just for the SUBSCRIBE which the P-CSCF itself originates, in UAC mode (so not the proxied SUBSCRIBE from a UE). I think this could also be routed through the I-CSCF, but I found that 3GPP said to skip that extra "work" (at HSS also) and target directly the same S-CSCF which indicated itself in the "Service-Route" header during registration.
--- Otherwise, for UE originated requests: - The UE also might SUBSCRIBE to the same `reginfo` event at the S-CSCF, but that would be another dialog. And all the initial dialog requests (a.i. first SUBSCRIBE, first INVITE), or standalone ones (a.i. MESSAGE) should also use the Service-Route, including, based on the UE's behavior, also the P-CSCF in the route (some UEs might just force the outbound proxy without a Route, some add a Route and do loose route). - All the subsequent dialog methods from the UE should use the saved Record-Routes for that dialog.
And in case the UE misbehaves, the P-CSCF must enforce all of these routes. (e.g. the `pcscf_force_service_routes()` from `ims_registrar_pcscf` should do it, respectively something similar from `dialog`/`ims_dialog`)
@vingarzan pushed 5 commits.
7eda2bea65ca2b0f10a249aac566a51641123ec7 core: added str2ushort() to avoid some questionable casting in ims_qos 3259d0f8f474e2902a639620d41952d72960b182 lib/ims: fixed a typo in a log message b3672bd379ed3f8ea68a5230b8ea203f6ae3115c ims_usrloc_pcscf: small log fixes a079071130241bf030d252aea3b5f8bf62394c59 ims_qos: added trust_bottom_via parameter b6b7e8d114f79a7edffe22427149083838b140bf ims_registrar_pcscf: added trust_bottom_via parameter, added ignore_contact_rxproto_check, fixes for logging, fixes for SUBSCRIBE to reginfo for including Service-Route, allow use without ims_ipsec_pcscf
Merged #3901 into master.