Skip to content

Transaction only topology_hiding enhancements #3908

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
davidtrihy-genesys wants to merge 16 commits into
base: master
Choose a base branch
from
Open

Transaction only topology_hiding enhancements #3908

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
75ff8a6
Refactoring logic into dialog, no dialog and common files
davidtrihy-genesys Apr 27, 2026
44b8621
thinfo compact binary codec
davidtrihy-genesys Apr 27, 2026
ac6d588
Added TH_decoded_* pseudovars
davidtrihy-genesys Apr 27, 2026
11783c1
Major logic rework of one way hiding and compact thinfo
davidtrihy-genesys Jun 5, 2026
bbba1f6
Adding modparam to configure encoding in transaction only mode
kordian-pawelec May 19, 2026
9fb595b
Adding logic to encode only one auto route header
davidtrihy-genesys May 27, 2026
5b974f0
Fixing some memory issues
davidtrihy-genesys Jun 5, 2026
0d8947c
Initialize *suffix_enc to NULL
davidtrihy-genesys Jun 5, 2026
3c405d3
license updates
davidtrihy-genesys Jun 12, 2026
27caa97
Added decode/encode bounds checking to ensure crafted requests cannot…
davidtrihy-genesys Jun 12, 2026
aea7e16
Fix null terminated modparam
davidtrihy-genesys Jun 12, 2026
d75c9fa
XML documentation
davidtrihy-genesys Jun 12, 2026
69d2225
Add check dual URI decoding
davidtrihy-genesys Jun 15, 2026
3dc85d4
Removing sprintf in favour of int2str
davidtrihy-genesys Jun 17, 2026
8a6a1b6
Remove block for topology_hiding on sequential requests in TM mode
davidtrihy-genesys Jun 24, 2026
b4dd4f9
th_use_param.len recomputing
davidtrihy-genesys Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 0 additions & 82 deletions modules/rr/loose.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,88 +138,6 @@ static inline int find_first_route(struct sip_msg* _m)
}


/*
* Find out if a URI contains r2 parameter which indicates
* that we put 2 record routes
*/
static inline int is_2rr(str* _params)
{
str s;
int i, state = 0;

if (_params->len == 0) return 0;
s = *_params;

for(i = 0; i < s.len; i++) {
switch(state) {
case 0:
switch(s.s[i]) {
case ' ':
case '\r':
case '\n':
case '\t': break;
case 'r':
case 'R': state = 1; break;
default: state = 4; break;
}
break;

case 1:
switch(s.s[i]) {
case '2': state = 2; break;
default: state = 4; break;
}
break;

case 2:
switch(s.s[i]) {
case ';': return 1;
case '=': return 1;
case ' ':
case '\r':
case '\n':
case '\t': state = 3; break;
default: state = 4; break;
}
break;

case 3:
switch(s.s[i]) {
case ';': return 1;
case '=': return 1;
case ' ':
case '\r':
case '\n':
case '\t': break;
default: state = 4; break;
}
break;

case 4:
switch(s.s[i]) {
case '\"': state = 5; break;
case ';': state = 0; break;
default: break;
}
break;

case 5:
switch(s.s[i]) {
case '\\': state = 6; break;
case '\"': state = 4; break;
default: break;
}
break;

case 6: state = 5; break;
}
}

if ((state == 2) || (state == 3)) return 1;
else return 0;
}


/*
* Check if URI is myself
*/
Expand Down
80 changes: 80 additions & 0 deletions modules/rr/loose.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,5 +159,85 @@ static inline int is_strict(str* _params)
else return 1;
}

/*
* Find out if a URI contains r2 parameter which indicates
* that we put 2 record routes
*/
static inline int is_2rr(str* _params)
{
str s;
int i, state = 0;

if (_params->len == 0) return 0;
s = *_params;

for(i = 0; i < s.len; i++) {
switch(state) {
case 0:
switch(s.s[i]) {
case ' ':
case '\r':
case '\n':
case '\t': break;
case 'r':
case 'R': state = 1; break;
default: state = 4; break;
}
break;

case 1:
switch(s.s[i]) {
case '2': state = 2; break;
default: state = 4; break;
}
break;

case 2:
switch(s.s[i]) {
case ';': return 1;
case '=': return 1;
case ' ':
case '\r':
case '\n':
case '\t': state = 3; break;
default: state = 4; break;
}
break;

case 3:
switch(s.s[i]) {
case ';': return 1;
case '=': return 1;
case ' ':
case '\r':
case '\n':
case '\t': break;
default: state = 4; break;
}
break;

case 4:
switch(s.s[i]) {
case '\"': state = 5; break;
case ';': state = 0; break;
default: break;
}
break;

case 5:
switch(s.s[i]) {
case '\\': state = 6; break;
case '\"': state = 4; break;
default: break;
}
break;

case 6: state = 5; break;
}
}

if ((state == 2) || (state == 3)) return 1;
else return 0;
}

#endif /* LOOSE_H */
132 changes: 121 additions & 11 deletions modules/topology_hiding/doc/topology_hiding_admin.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,41 +152,70 @@ modparam("topology_hiding", "force_dialog", 1)
</example>
</section>

<section id="param_th_contact_encode_passwd" xreflabel="th_contact_encode_passwd">
<title><varname>th_contact_encode_passwd</varname> (string)</title>
<section id="param_th_contact_encode_param_password" xreflabel="th_contact_encode_param_password">
<title><varname>th_contact_encode_param_password</varname> (string)</title>
<para>
When not relying on the dialog module ( due to script writer preference or simply when doing topo hiding for non INVITE dialogs ), the module will store the needed information in a Contact URI param. The parameter configures the string password that will be used for encoding/decoding that specific param .
When not relying on the dialog module ( due to script writer preference or simply when doing topo hiding for non INVITE dialogs ), the module will store the needed information in a Contact URI param. This parameter defines a Contact URI param together with the password used for encoding/decoding the data stored in it, and (optionally) the encoding layout.
</para>
<para>
The value has the format <emphasis>param_name[:password[:encoding_type]]</emphasis>:
<itemizedlist>
<listitem><para><emphasis>param_name</emphasis> - the name of the Contact URI parameter holding the encoded topology hiding information.</para></listitem>
<listitem><para><emphasis>password</emphasis> - the string password used to encode/decode the data. If omitted, the default password <quote>ToPoCtPaSS</quote> is used.</para></listitem>
<listitem><para><emphasis>encoding_type</emphasis> - the encoding layout, one of <emphasis>C</emphasis>/<emphasis>c</emphasis> (compact, the default) or <emphasis>L</emphasis>/<emphasis>l</emphasis> (long).</para></listitem>
</itemizedlist>
</para>
<para>
This parameter may be set more than once in order to define multiple
(param name, password) entries, which allows password rotation - data
encoded with an older password can still be decoded while new data is
encoded with the current one. At most 2 entries are supported. Use
<varname>th_use_param</varname> to select which entry is used when encoding.
</para>
<para>
<emphasis>
Default value is <quote>"ToPoCtPaSS"</quote>
Default value is <quote>"thinfo:ToPoCtPaSS:C"</quote> ( param name <quote>thinfo</quote>, password <quote>ToPoCtPaSS</quote>, compact encoding ).
</emphasis>
</para>
<example>
<title>Set <varname>th_contact_encode_passwd</varname> parameter</title>
<title>Set <varname>th_contact_encode_param_password</varname> parameter</title>
<programlisting format="linespecific">
...
modparam("topology_hiding", "th_contact_encode_passwd", "my_topoh_passwd")
# only define the param name, use the default password and compact encoding
modparam("topology_hiding", "th_contact_encode_param_password", "customparam")
...
# define param name and password
modparam("topology_hiding", "th_contact_encode_param_password", "customparam:my_topoh_passwd")
...
# define param name, password and long encoding, plus a second entry for rotation
modparam("topology_hiding", "th_contact_encode_param_password", "customparam:new_passwd:L")
modparam("topology_hiding", "th_contact_encode_param_password", "customparam_old:old_passwd:L")
...
</programlisting>
</example>
</section>

<section id="param_th_contact_encode_param" xreflabel="th_contact_encode_param">
<title><varname>th_contact_encode_param</varname> (string)</title>
<section id="param_th_use_param" xreflabel="th_use_param">
<title><varname>th_use_param</varname> (string)</title>
<para>
When not relying on the dialog module ( due to script writer preference or simply when doing topo hiding for non INVITE dialogs ), the module will store the needed information in a Contact URI param. The parameter configures the respective parameter name.
Selects, by name, which of the Contact URI params defined via
<varname>th_contact_encode_param_password</varname> is used when
<emphasis>encoding</emphasis> the topology hiding information. All defined
params are always considered when <emphasis>decoding</emphasis>, but only the
one referenced here is used for encoding. The value must match one of the
configured param names.
</para>
<para>
<emphasis>
Default value is <quote>"thinfo"</quote>
</emphasis>
</para>
<example>
<title>Set <varname>th_contact_encode_param</varname> parameter</title>
<title>Set <varname>th_use_param</varname> parameter</title>
<programlisting format="linespecific">
...
modparam("topology_hiding", "th_contact_encode_param", "customparam")
modparam("topology_hiding", "th_contact_encode_param_password", "customparam:new_passwd:L")
modparam("topology_hiding", "th_use_param", "customparam")
...
</programlisting>
</example>
Expand Down Expand Up @@ -281,6 +310,87 @@ modparam("topology_hiding", "th_callid_loop_protection", 1)
</example>
</section>

<section id="param_th_internal_trusted_tag" xreflabel="th_internal_trusted_tag">
<title><varname>th_internal_trusted_tag</varname> (string)</title>
<para>
Socket tag identifying the internal (trusted) sockets, as defined via the
<emphasis>tag</emphasis> attribute of a listening socket. When set, requests forced through this socket
will allow the network topology information(Contact, Record-Routes and Vias) to percolate through to the next hop.
This applies to requests and replies and allows for the internal side to have a complete network topology while
removing internal topology information from the SIP message sent outbound.
</para>
<para>
<emphasis>
Default value is <quote>empty</quote> ( no internal trusted tag )
</emphasis>
</para>
<example>
<title>Set <varname>th_internal_trusted_tag</varname> parameter</title>
<programlisting format="linespecific">
...
socket=udp:203.0.113.1:5060
socket=udp:10.0.0.1:5060 tag internal
...
$socket_out = "10.0.0.1:5060";
topology_hiding();
t_relay();
...
modparam("topology_hiding", "th_internal_trusted_tag", "internal")
...
</programlisting>
</example>
</section>

<section id="param_th_external_socket_tag" xreflabel="th_external_socket_tag">
<title><varname>th_external_socket_tag</varname> (string)</title>
<para>
Socket tag identifying the external sockets, as defined via the
<emphasis>tag</emphasis> attribute of a listening socket. When a sequential from an auto Route
request cannot be matched because the socket address was encoded on a different instance
this tag is used to select an appropriate socket for sending outbound.
</para>
<para>
<emphasis>
Default value is <quote>empty</quote> ( no external socket tag )
</emphasis>
</para>
<example>
<title>Set <varname>th_external_socket_tag</varname> parameter</title>
<programlisting format="linespecific">
...
socket=udp:203.0.113.1:5060 tag external
...
modparam("topology_hiding", "th_external_socket_tag", "external")
...
</programlisting>
</example>
</section>

<section id="param_th_auto_route_on_trusted_socket" xreflabel="th_auto_route_on_trusted_socket">
<title><varname>th_auto_route_on_trusted_socket</varname> (int)</title>
<para>
When enabled, and when doing topology hiding without dialog support, the
module automatically adds a Record-Route header encoding the receiving
socket information, so that sequential requests can be matched and routed
back through the correct socket without relying on the dialog module. The
encoded Route is decoded using the passwords defined via
<varname>th_contact_encode_param_password</varname>.
</para>
<para>
<emphasis>
Default value is <quote>1</quote> / enabled.
</emphasis>
</para>
<example>
<title>Set <varname>th_auto_route_on_trusted_socket</varname> parameter</title>
<programlisting format="linespecific">
...
modparam("topology_hiding", "th_auto_route_on_trusted_socket", 0)
...
</programlisting>
</example>
</section>


</section>
<section id="exported_functions" xreflabel="exported_functions">
Expand Down
Loading