Added 'Verify Server Certificates' setting

app/src/main/assets/config

@@ -2,6 +2,7 @@ auto_start yes
 log_level 2
 poll_method epoll
 sip_trans_bsize 128
+sip_verify_server no
 call_local_timeout 120
 call_max_calls 4
 audio_player opensles,nil

app/src/main/kotlin/com/tutpro/baresip/Config.kt

@@ -14,8 +14,8 @@ object Config {
 
         Log.d("Baresip", "Config is '$config'")
 
-        if (!config.contains("zrtp_hash")) {
-            config = "${config}zrtp_hash yes\n"
+        if (!config.contains("sip_verify_server")) {
+            config = "${config}sip_verify_server no\n"
         }
 
         if (!config.contains(Regex("ausrc_format s16"))) {

app/src/main/kotlin/com/tutpro/baresip/ConfigActivity.kt

@@ -20,6 +20,7 @@ class ConfigActivity : AppCompatActivity() {
     private lateinit var listenAddr: EditText
     private lateinit var dnsServers: EditText
     private lateinit var certificateFile: CheckBox
+    private lateinit var verifyServer: CheckBox
     private lateinit var caFile: CheckBox
     private lateinit var darkTheme: CheckBox
     private lateinit var debug: CheckBox
@@ -30,6 +31,7 @@ class ConfigActivity : AppCompatActivity() {
     private var oldListenAddr = ""
     private var oldDnsServers = ""
     private var oldCertificateFile = false
+    private var oldVerifyServer = ""
     private var oldCAFile = false
     private var oldLogLevel = ""
     private var callVolume = BaresipService.callVolume
@@ -76,6 +78,11 @@ class ConfigActivity : AppCompatActivity() {
         oldCertificateFile = Config.variable("sip_certificate").isNotEmpty()
         certificateFile.isChecked = oldCertificateFile
 
+        verifyServer = binding.VerifyServer
+        val vsCv = Config.variable("sip_verify_server")
+        oldVerifyServer = if (vsCv.size == 0) "no" else vsCv[0]
+        verifyServer.isChecked = oldVerifyServer == "yes"
+
         caFile = binding.CAFile
         oldCAFile = Config.variable("sip_cafile").isNotEmpty()
         caFile.isChecked = oldCAFile
@@ -216,8 +223,10 @@ class ConfigActivity : AppCompatActivity() {
                     if (caFile.isChecked) {
                         if (!Utils.requestPermission(this,
                                         android.Manifest.permission.READ_EXTERNAL_STORAGE,
-                                        READ_CA_PERMISSION_CODE))
+                                        READ_CA_PERMISSION_CODE)) {
+                            caFile.isChecked = false
                             return false
+                        }
                         val content = Utils.getFileContents(BaresipService.downloadsPath +
                                 "/ca_certs.crt")
                         if (content == null) {
@@ -237,6 +246,19 @@ class ConfigActivity : AppCompatActivity() {
                     restart = true
                 }
 
+                if (verifyServer.isChecked && !caFile.isChecked) {
+                    Utils.alertView(this, getString(R.string.error),
+                            getString(R.string.verify_server_error))
+                    verifyServer.isChecked = false
+                    return false
+                }
+
+                val verifyServerString = if (verifyServer.isChecked) "yes" else "no"
+                if (oldVerifyServer != verifyServerString) {
+                    Config.replaceVariable("sip_verify_server", verifyServerString)
+                    save = true
+                    restart = true
+                }
 
                 if (BaresipService.callVolume != callVolume) {
                     BaresipService.callVolume = callVolume
@@ -343,6 +365,10 @@ class ConfigActivity : AppCompatActivity() {
                 Utils.alertView(this, getString(R.string.tls_certificate_file),
                         getString(R.string.tls_certificate_file_help))
             }
+            binding.VerifyServerTitle  -> {
+                Utils.alertView(this, getString(R.string.verify_server),
+                        getString(R.string.verify_server_help))
+            }
             binding.CAFileTitle -> {
                 Utils.alertView(this, getString(R.string.tls_ca_file),
                         getString(R.string.tls_ca_file_help))

app/src/main/res/layout/activity_config.xml

@@ -108,6 +108,33 @@
             </CheckBox>
         </RelativeLayout>
 
+        <RelativeLayout
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_marginBottom="12dp"
+            android:orientation="horizontal" >
+            <TextView
+                android:id="@+id/VerifyServerTitle"
+                android:layout_width="wrap_content"
+                android:layout_height="wrap_content"
+                android:layout_alignParentStart="true"
+                android:layout_centerVertical="true"
+                android:layout_toStartOf="@id/VerifyServer"
+                android:textSize="18sp"
+                android:onClick="onClick"
+                android:text="@string/verify_server" >
+            </TextView>
+            <CheckBox
+                android:id="@+id/VerifyServer"
+                android:layout_width="wrap_content"
+                android:layout_height="wrap_content"
+                android:layout_alignParentEnd="true"
+                android:layout_centerVertical="true"
+                android:layout_gravity="end"
+                android:checked="false" >
+            </CheckBox>
+        </RelativeLayout>
+
         <RelativeLayout
             android:layout_width="wrap_content"
             android:layout_height="wrap_content"

app/src/main/res/values-fi/strings.xml

@@ -285,6 +285,14 @@
         tämän baresip-sovelluksen julkisen ja yksityisen TLS-varmentimen, on joko jo ladattu tai tullaan
         lataamaan Download-hakemistosta.  Turvallisuusyistä tuhoa tiedosto heti lataamisen jälkeen.
     </string>
+    <string name="verify_server">Tarkista palvelinten varmentimet</string>
+    <string name="verify_server_error">Palvelinten varmentimia ei voi tarkistaa ilman TLS
+        CA-tiedostoa.
+    </string>
+    <string name="verify_server_help">Jos merkitty, baresip tarkistaa SIP-palvelinten
+        varmenteet, kun TLS-tiedonsiirto on käytössä.  Tällöin myös TLS CA-tiedoston on oltava
+        ladattuna.
+    </string>
     <string name="tls_ca_file">TLS CA-tiedosto</string>
     <string name="tls_ca_file_help">Jos merkitty, tiedosto \'ca_certs.crt\', joka sisältää
         TLS-varmenninauktoriteettien julkiset varmentimen, on joko jo ladattu tai tullaan lataamaan

app/src/main/res/values/strings.xml

@@ -265,6 +265,12 @@
     <string name="tls_certificate_file_help">If checked, file \'cert.pem\' containing
         TLS certificate and private key of this baresip instance has been or will be loaded from
         Download directory. For security reasons, delete the file after loading.</string>
+    <string name="verify_server">Verify Server Certificates</string>
+    <string name="verify_server_error">Server Certificates cannot be verified without
+        TLS CA file.</string>
+    <string name="verify_server_help">If checked, baresip verifies TLS certificates of SIP User
+        Agent and SIP Proxy Servers when TLS transport is used.  If checked, also TLS CA File has
+        to be loaded.</string>
     <string name="tls_ca_file">TLS CA File</string>
     <string name="tls_ca_file_help">If checked, file \'ca_certs.crt\' containing TLS certificates
         of Certificate Authorities has been or will be loaded from Download directory.</string>