From 7bf24472870a24155ae74d3a37a545164bbd2e52 Mon Sep 17 00:00:00 2001 From: Juha Heinanen Date: Sun, 28 Feb 2021 15:48:01 +0200 Subject: [PATCH] Added 'Verify Server Certificates' setting --- app/src/main/assets/config | 1 + .../main/kotlin/com/tutpro/baresip/Config.kt | 4 +-- .../com/tutpro/baresip/ConfigActivity.kt | 28 ++++++++++++++++++- app/src/main/res/layout/activity_config.xml | 27 ++++++++++++++++++ app/src/main/res/values-fi/strings.xml | 8 ++++++ app/src/main/res/values/strings.xml | 6 ++++ 6 files changed, 71 insertions(+), 3 deletions(-) diff --git a/app/src/main/assets/config b/app/src/main/assets/config index 71151b2f..243ed3d9 100644 --- a/app/src/main/assets/config +++ b/app/src/main/assets/config @@ -2,6 +2,7 @@ auto_start yes log_level 2 poll_method epoll sip_trans_bsize 128 +sip_verify_server no call_local_timeout 120 call_max_calls 4 audio_player opensles,nil diff --git a/app/src/main/kotlin/com/tutpro/baresip/Config.kt b/app/src/main/kotlin/com/tutpro/baresip/Config.kt index 857f4c51..ec94d80d 100644 --- a/app/src/main/kotlin/com/tutpro/baresip/Config.kt +++ b/app/src/main/kotlin/com/tutpro/baresip/Config.kt @@ -14,8 +14,8 @@ object Config { Log.d("Baresip", "Config is '$config'") - if (!config.contains("zrtp_hash")) { - config = "${config}zrtp_hash yes\n" + if (!config.contains("sip_verify_server")) { + config = "${config}sip_verify_server no\n" } if (!config.contains(Regex("ausrc_format s16"))) { diff --git a/app/src/main/kotlin/com/tutpro/baresip/ConfigActivity.kt b/app/src/main/kotlin/com/tutpro/baresip/ConfigActivity.kt index c8ca6517..ef64fee9 100644 --- a/app/src/main/kotlin/com/tutpro/baresip/ConfigActivity.kt +++ b/app/src/main/kotlin/com/tutpro/baresip/ConfigActivity.kt @@ -20,6 +20,7 @@ class ConfigActivity : AppCompatActivity() { private lateinit var listenAddr: EditText private lateinit var dnsServers: EditText private lateinit var certificateFile: CheckBox + private lateinit var verifyServer: CheckBox private lateinit var caFile: CheckBox private lateinit var darkTheme: CheckBox private lateinit var debug: CheckBox @@ -30,6 +31,7 @@ class ConfigActivity : AppCompatActivity() { private var oldListenAddr = "" private var oldDnsServers = "" private var oldCertificateFile = false + private var oldVerifyServer = "" private var oldCAFile = false private var oldLogLevel = "" private var callVolume = BaresipService.callVolume @@ -76,6 +78,11 @@ class ConfigActivity : AppCompatActivity() { oldCertificateFile = Config.variable("sip_certificate").isNotEmpty() certificateFile.isChecked = oldCertificateFile + verifyServer = binding.VerifyServer + val vsCv = Config.variable("sip_verify_server") + oldVerifyServer = if (vsCv.size == 0) "no" else vsCv[0] + verifyServer.isChecked = oldVerifyServer == "yes" + caFile = binding.CAFile oldCAFile = Config.variable("sip_cafile").isNotEmpty() caFile.isChecked = oldCAFile @@ -216,8 +223,10 @@ class ConfigActivity : AppCompatActivity() { if (caFile.isChecked) { if (!Utils.requestPermission(this, android.Manifest.permission.READ_EXTERNAL_STORAGE, - READ_CA_PERMISSION_CODE)) + READ_CA_PERMISSION_CODE)) { + caFile.isChecked = false return false + } val content = Utils.getFileContents(BaresipService.downloadsPath + "/ca_certs.crt") if (content == null) { @@ -237,6 +246,19 @@ class ConfigActivity : AppCompatActivity() { restart = true } + if (verifyServer.isChecked && !caFile.isChecked) { + Utils.alertView(this, getString(R.string.error), + getString(R.string.verify_server_error)) + verifyServer.isChecked = false + return false + } + + val verifyServerString = if (verifyServer.isChecked) "yes" else "no" + if (oldVerifyServer != verifyServerString) { + Config.replaceVariable("sip_verify_server", verifyServerString) + save = true + restart = true + } if (BaresipService.callVolume != callVolume) { BaresipService.callVolume = callVolume @@ -343,6 +365,10 @@ class ConfigActivity : AppCompatActivity() { Utils.alertView(this, getString(R.string.tls_certificate_file), getString(R.string.tls_certificate_file_help)) } + binding.VerifyServerTitle -> { + Utils.alertView(this, getString(R.string.verify_server), + getString(R.string.verify_server_help)) + } binding.CAFileTitle -> { Utils.alertView(this, getString(R.string.tls_ca_file), getString(R.string.tls_ca_file_help)) diff --git a/app/src/main/res/layout/activity_config.xml b/app/src/main/res/layout/activity_config.xml index 1defceb4..ddbb1f1e 100644 --- a/app/src/main/res/layout/activity_config.xml +++ b/app/src/main/res/layout/activity_config.xml @@ -108,6 +108,33 @@ + + + + + + + + Tarkista palvelinten varmentimet + Palvelinten varmentimia ei voi tarkistaa ilman TLS + CA-tiedostoa. + + Jos merkitty, baresip tarkistaa SIP-palvelinten + varmenteet, kun TLS-tiedonsiirto on käytössä. Tällöin myös TLS CA-tiedoston on oltava + ladattuna. + TLS CA-tiedosto Jos merkitty, tiedosto \'ca_certs.crt\', joka sisältää TLS-varmenninauktoriteettien julkiset varmentimen, on joko jo ladattu tai tullaan lataamaan diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml index ca9277aa..c509134e 100644 --- a/app/src/main/res/values/strings.xml +++ b/app/src/main/res/values/strings.xml @@ -265,6 +265,12 @@ If checked, file \'cert.pem\' containing TLS certificate and private key of this baresip instance has been or will be loaded from Download directory. For security reasons, delete the file after loading. + Verify Server Certificates + Server Certificates cannot be verified without + TLS CA file. + If checked, baresip verifies TLS certificates of SIP User + Agent and SIP Proxy Servers when TLS transport is used. If checked, also TLS CA File has + to be loaded. TLS CA File If checked, file \'ca_certs.crt\' containing TLS certificates of Certificate Authorities has been or will be loaded from Download directory.