We have an Asterisk instance with some PJSIP peers (Regular SIP), and some are using WebRTC. The normal SIP clients are using userpass as the auth_type.
For WebRTC, we have a backend application and a reverse proxy which checks if a user is authorized before even forwarding the SIP messages to Asterisk, but for the user accounts themselves, we’re looking to implement either token-based authentication or simply receive HMAC-SHA1 signed messages. We have control over the WebRTC client and hence can send custom SIP messages if required.
I think I have an idea about how to implement this. My thinking is that I set the WebRTC peers as anonymous in Asterisk, and then have a C module that will hook into the REGISTER request with a higher priority than what is already there, and then do the authorization validation before allowing the rest of the SIP messages through. If the signature fails at any other SIP message, it returns an error, essentially sitting above the default message flow as a gatekeeper, and conditionally decide whether to respond directly or allow Asterisk to continue processing.
Is this the best way to go about this? Or is this something I can implement in the Dialplan itself via AGI? Although the users are trusted in a private environment, my concern with writing it in C is that some bug I introduce into the system can potentially take the whole system down with it.
I wrote a sample module that hooks into the REGISTER request and it works on my development system running Asterisk 18.20, however, when we tested it with Asterisk 18.12, we got a compile errors, probably due to some ABI change in PJSIP itself, and we haven’t yet got around to checking when a change happened with the ABIs we’re calling.
So, now before we rewrite some of the parts for Asterisk 18.12, I just wanted to get a rough idea about if my approach is even the right way or if there is some fundamental flaw that I’m overlooking.