[asterisk-commits] jrose: trunk r402538 - in /trunk: ./ res/res_pjsip_authenticator_digest.c

[SVN commits to the Asterisk project]

Author: jrose
Date: Thu Nov  7 17:42:31 2013
New Revision: 402538

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=402538
Log:
PJSIP: Improve error handling in digest authenticator

Previously, regardless of whether failure to authenticate was due to
lacking any authentication or actually failing authentication, the
Digest Authenticator would simply return that a challenge was still
needed. It will continue to do that when no authentication information
is in the received SIP digest, but when authentication information
is present and does not pass authentication, that will be treated as
an authentication error. This is to ensure that PJSIP will issue
security events indicated failed auths.
........

Merged revisions 402537 from http://svn.asterisk.org/svn/asterisk/branches/12

Modified:
    trunk/   (props changed)
    trunk/res/res_pjsip_authenticator_digest.c

Propchange: trunk/
------------------------------------------------------------------------------
--- branch-12-merged (original)
+++ branch-12-merged Thu Nov  7 17:42:31 2013
@@ -1,1 +1,1 @@
-/branches/12:1-398558,398560-398577,398579-399305,399307-401390,401392-402528
+/branches/12:1-398558,398560-398577,398579-399305,399307-401390,401392-402528,402537

Modified: trunk/res/res_pjsip_authenticator_digest.c
URL: http://svnview.digium.com/svn/asterisk/trunk/res/res_pjsip_authenticator_digest.c?view=diff&rev=402538&r1=402537&r2=402538
==============================================================================
--- trunk/res/res_pjsip_authenticator_digest.c (original)
+++ trunk/res/res_pjsip_authenticator_digest.c Thu Nov  7 17:42:31 2013
@@ -290,6 +290,8 @@
 	AUTH_SUCCESS,
 	/*! Authentication credentials correct but nonce mismatch */
 	AUTH_STALE,
+	/*! Authentication credentials were not provided */
+	AUTH_NOAUTH,
 };
 
 /*!
@@ -330,6 +332,11 @@
 			return AUTH_SUCCESS;
 		}
 	}
+
+	if (authed == PJSIP_EAUTHNOAUTH) {
+		return AUTH_NOAUTH;
+	}
+
 	return AUTH_FAIL;
 }
 
@@ -376,6 +383,7 @@
 	enum digest_verify_result *verify_res;
 	enum ast_sip_check_auth_result res;
 	int i;
+	int failures = 0;
 
 	RAII_VAR(struct ast_sip_endpoint *, artificial_endpoint,
 		 ast_sip_get_artificial_endpoint(), ao2_cleanup);
@@ -403,13 +411,20 @@
 			res = AST_SIP_AUTHENTICATION_SUCCESS;
 			goto cleanup;
 		}
+		if (verify_res[i] == AUTH_FAIL) {
+			failures++;
+		}
 	}
 
 	for (i = 0; i < endpoint->inbound_auths.num; ++i) {
 		challenge(auths[i]->realm, tdata, rdata, verify_res[i] == AUTH_STALE);
 	}
 
-	res = AST_SIP_AUTHENTICATION_CHALLENGE;
+	if (failures == endpoint->inbound_auths.num) {
+		res = AST_SIP_AUTHENTICATION_FAILED;
+	} else {
+		res = AST_SIP_AUTHENTICATION_CHALLENGE;
+	}
 
 cleanup:
 	ast_sip_cleanup_auths(auths, endpoint->inbound_auths.num);