metasploit-framework/lib/rex/proto/iax2/client.rb

# -*- coding: binary -*-
require 'rex/proto/iax2/constants'
require 'rex/proto/iax2/codecs'
require 'rex/proto/iax2/call'

require 'rex/socket'
require 'thread'
require 'digest/md5'
require 'timeout'

module Rex
module Proto
module IAX2
class Client

  attr_accessor :caller_number, :caller_name, :server_host, :server_port
  attr_accessor :username, :password
  attr_accessor :sock, :monitor
  attr_accessor :src_call_idx
  attr_accessor :debugging
  attr_accessor :calls

  def initialize(uopts={})
    opts = {
      :caller_number => '15555555555',
      :caller_name   => '',
      :server_port   => IAX2_DEFAULT_PORT,
      :context       => { }
    }.merge(uopts)

    self.caller_name   = opts[:caller_name]
    self.caller_number = opts[:caller_number]
    self.server_host   = opts[:server_host]
    self.server_port   = opts[:server_port]
    self.username      = opts[:username]
    self.password      = opts[:password]

    self.sock = Rex::Socket::Udp.create(
      'PeerHost' => self.server_host,
      'PeerPort' => self.server_port,
      'Context'  => opts[:context]
    )

    self.monitor   = ::Thread.new { monitor_socket }

    self.src_call_idx = 0
    self.calls = {}

  end

  def shutdown
    self.monitor.kill rescue nil
  end

  def create_call
    cid  = allocate_call_id()
    self.calls[ cid ] = IAX2::Call.new(self, cid)
  end

  #
  # Transport
  #

  def monitor_socket
    while true
      begin
        pkt, src = self.sock.recvfrom(65535)
        next if not pkt

        # Find the matching call object
        mcall = matching_call(pkt)
        next if not mcall

        if (pkt[0,1].unpack("C")[0] & 0x80) != 0
          mcall.handle_control(pkt)
        else
          # Dispatch the buffer via the call handler
          mcall.handle_audio(pkt)
        end
      rescue ::Exception => e
        dprint("monitor_socket: #{e.class} #{e} #{e.backtrace}")
        break
      end
    end
    self.sock.close rescue nil
  end

  def matching_call(pkt)
    src_call = pkt[0,2].unpack('n')[0]
    dst_call = nil

    if (src_call & 0x8000 != 0)
      dst_call = pkt[2,2].unpack('n')[0]
      dst_call ^= 0x8000 if (dst_call & 0x8000 != 0)
    end

    src_call ^= 0x8000 if (src_call & 0x8000 != 0)

    # Find a matching call in our list
    mcall = self.calls.values.select {|x| x.dcall == src_call or (dst_call and x.scall == dst_call) }.first
    if not mcall
      dprint("Packet received for non-existent call #{[src_call, dst_call].inspect}  vs #{self.calls.values.map{|x| [x.dcall, x.scall]}.inspect}")
      return
    end
    mcall
  end

  def allocate_call_id
    res = ( self.src_call_idx += 1 )
    if ( res > 0x8000 )
      self.src_call_idx = 1
      res = 1
    end
    res
  end

  def dprint(msg)
    return if not self.debugging
    $stderr.puts "[#{Time.now.to_s}] #{msg}"
  end

  def send_data(call, data, inc_seq = true )
    r = self.sock.sendto(data, self.server_host, self.server_port, 0)
    if inc_seq
      call.oseq = (call.oseq + 1) & 0xff
    end
    r
  end

  def send_ack(call)
    data =	[ IAX_SUBTYPE_ACK ].pack('C')
    send_data( call, create_pkt( call.scall, call.dcall, call.timestamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ), false )
  end

  def send_pong(call, stamp)
    data =	[ IAX_SUBTYPE_PONG ].pack('C')
    send_data( call, create_pkt( call.scall, call.dcall, stamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ) )
  end

  def send_lagrp(call, stamp)
    data =	[ IAX_SUBTYPE_LAGRP ].pack('C')
    send_data( call, create_pkt( call.scall, call.dcall, stamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ) )
  end


  def send_invalid(call)
    data =	[ IAX_SUBTYPE_INVAL ].pack('C')
    send_data( call, create_pkt( call.scall, call.dcall, call.timestamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ) )
  end

  def send_hangup(call)
    data =	[ IAX_SUBTYPE_HANGUP ].pack('C')
    send_data( call, create_pkt( call.scall, call.dcall, call.timestamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ) )
  end

  def send_new(call, number)
    data = [ IAX_SUBTYPE_NEW ].pack('C')

    cid = call.caller_number || self.caller_number
    cid = number if cid == 'SELF'

    data << create_ie(IAX_IE_CALLING_NUMBER, cid )
    data << create_ie(IAX_IE_CALLING_NAME, call.caller_name || self.caller_name)
    data << create_ie(IAX_IE_DESIRED_CODEC, [IAX_SUPPORTED_CODECS].pack("N") )
    data << create_ie(IAX_IE_ACTUAL_CODECS, [IAX_SUPPORTED_CODECS].pack("N") )
    data << create_ie(IAX_IE_USERNAME, self.username) if self.username
    data << create_ie(IAX_IE_CALLED_NUMBER, number)
    data << create_ie(IAX_IE_ORIGINAL_DID, number)

    send_data( call, create_pkt( call.scall, call.dcall, call.timestamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ) )
  end

  def send_authrep_chall_response(call, chall)
    data =
      [ IAX_SUBTYPE_AUTHREP ].pack('C') +
      create_ie(IAX_IE_CHALLENGE_RESP, ::Digest::MD5.hexdigest( chall + self.password ))

    send_data( call, create_pkt( call.scall, call.dcall, call.timestamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ) )
  end

  def send_regreq(call)
    data = [ IAX_SUBTYPE_REGREQ ].pack('C')
    data << create_ie(IAX_IE_USERNAME, self.username) if self.username
    data << create_ie(IAX_IE_REG_REFRESH, [IAX_DEFAULT_REG_REFRESH].pack('n'))

    send_data( call, create_pkt( call.scall, call.dcall, call.timestamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ) )
  end

  def send_regreq_chall_response(call, chall)
    data =
      [ IAX_SUBTYPE_REGREQ ].pack('C') +
      create_ie(IAX_IE_USERNAME, self.username) +
      create_ie(IAX_IE_CHALLENGE_RESP, ::Digest::MD5.hexdigest( chall + self.password )) +
      create_ie(IAX_IE_REG_REFRESH, [IAX_DEFAULT_REG_REFRESH].pack('n'))

    send_data( call, create_pkt( call.scall, call.dcall, call.timestamp, call.oseq, call.iseq, IAX_TYPE_IAX, data ) )
  end

  def create_ie(ie_type, ie_data)
    [ie_type, ie_data.length].pack('CC') + ie_data
  end

  def create_pkt(src_call, dst_call, tstamp, out_seq, inp_seq, itype, data)
    [
      src_call | 0x8000,  # High bit indicates a full packet
      dst_call,
      tstamp,
      out_seq & 0xff,     # Sequence numbers wrap at 8-bits
      inp_seq & 0xff,     # Sequence numbers wrap at 8-bits
      itype
    ].pack('nnNCCC') + data
  end

end
end
end
end