From fb0d7d14ada55df7d60cd1bd0a1c1ba50e9557aa Mon Sep 17 00:00:00 2001 From: Thomas Ries Date: Sat, 1 Oct 2005 21:14:48 +0000 Subject: [PATCH] - [1278537] Read proxy_auth_pwfile after config file is read - [1278591] Proxy-Authenticate header not included in response - process empty Contact header (means "query registrations") (only supported for registrations at a remote server) --- ChangeLog | 4 ++++ src/auth.c | 8 ++++---- src/register.c | 51 ++++++++++++++++++++++++++----------------------- src/sip_utils.c | 14 +++++++++----- src/siproxd.c | 20 +++++++++---------- src/siproxd.h | 4 ++-- 6 files changed, 56 insertions(+), 45 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8bb5701..3f20039 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,10 @@ 0.5.12 ====== 14-Jul-2005: - allocate only even port numbers for RTP traffic + 1-Oct-2005: - [1278537] Read proxy_auth_pwfile after config file is read + - [1278591] Proxy-Authenticate header not included in response + - process empty Contact header (means "query registrations") + (only supported for registrations at a remote server) 0.5.11 ====== diff --git a/src/auth.c b/src/auth.c index f60ddd7..ab61e54 100644 --- a/src/auth.c +++ b/src/auth.c @@ -58,7 +58,7 @@ static char *auth_getpwd(char *username); * STS_FAILURE : authentication failed * STS_NEEDAUTH: authentication needed */ -int authenticate_proxy(sip_ticket_t *ticket) { +int authenticate_proxy(osip_message_t *sipmsg) { osip_proxy_authorization_t *proxy_auth=NULL; /* required by config? */ @@ -67,7 +67,7 @@ int authenticate_proxy(sip_ticket_t *ticket) { } /* supplied by UA? */ - osip_message_get_proxy_authorization(ticket->sipmsg, 0, &proxy_auth); + osip_message_get_proxy_authorization(sipmsg, 0, &proxy_auth); if (proxy_auth == NULL) { DEBUGC(DBCLASS_AUTH,"proxy-auth required, not supplied by UA"); return STS_NEED_AUTH; @@ -91,7 +91,7 @@ int authenticate_proxy(sip_ticket_t *ticket) { * STS_SUCCESS * STS_FAILURE */ -int auth_include_authrq(sip_ticket_t *ticket) { +int auth_include_authrq(osip_message_t *sipmsg) { osip_proxy_authenticate_t *p_auth; char *realm=NULL; @@ -112,7 +112,7 @@ int auth_include_authrq(sip_ticket_t *ticket) { return STS_FAILURE; } - osip_list_add (ticket->sipmsg->proxy_authenticates, p_auth, -1); + osip_list_add (sipmsg->proxy_authenticates, p_auth, -1); DEBUGC(DBCLASS_AUTH,"added authentication header"); diff --git a/src/register.c b/src/register.c index 624a593..3c1b7d4 100644 --- a/src/register.c +++ b/src/register.c @@ -189,7 +189,7 @@ int register_client(sip_ticket_t *ticket, int force_lcl_masq) { * RFC 3261, Section 16.3 step 6 * Proxy Behavior - Request Validation - Proxy-Authorization */ - sts = authenticate_proxy(ticket); + sts = authenticate_proxy(ticket->sipmsg); if (sts == STS_FAILURE) { /* failed */ WARN("proxy authentication failed for %s@%s", @@ -224,6 +224,31 @@ int register_client(sip_ticket_t *ticket, int force_lcl_masq) { DEBUGC(DBCLASS_BABBLE,"sip_register:"); + /* + * First make sure, we have a proper Contact header: + * - url + * - url -> hostname + * + * Libosip parses an: + * "Contact: *" + * the following way (Note: Display name!! and URL is NULL) + * (gdb) p *((osip_contact_t*)(sip->contacts->node->element)) + * $5 = {displayname = 0x8af8848 "*", url = 0x0, gen_params = 0x8af8838} + */ + if (ticket->sipmsg->contacts && ticket->sipmsg->contacts->node && + ticket->sipmsg->contacts->node->element) { + url1_contact=((osip_contact_t*) + (ticket->sipmsg->contacts->node->element))->url; + } + + if ((url1_contact == NULL) || (url1_contact->host == NULL)) { + /* Don't have required Contact fields. + This may be a Registration query. We should simply forward + this request to its destination. */ + ERROR("empty Contact header - seems to be a registration query"); + return STS_SUCCESS; + } + /* evaluate Expires Header field */ osip_message_get_expires(ticket->sipmsg, 0, &expires_hdr); @@ -262,28 +287,6 @@ int register_client(sip_ticket_t *ticket, int force_lcl_masq) { * REGISTER */ if (expires > 0) { - /* - * First make sure, we have a proper Contact header: - * - url - * - url -> hostname - * - * Libosip parses an: - * "Contact: *" - * the following way (Note: Display name!! and URL is NULL) - * (gdb) p *((osip_contact_t*)(sip->contacts->node->element)) - * $5 = {displayname = 0x8af8848 "*", url = 0x0, gen_params = 0x8af8838} - */ - if (ticket->sipmsg->contacts && ticket->sipmsg->contacts->node && - ticket->sipmsg->contacts->node->element) { - url1_contact=((osip_contact_t*) - (ticket->sipmsg->contacts->node->element))->url; - } - if ((url1_contact == NULL) || (url1_contact->host == NULL)) { - /* Don't have required Contact fields */ - ERROR("tried registration with empty Contact header"); - return STS_FAILURE; - } - DEBUGC(DBCLASS_REG,"register: %s@%s expires=%i seconds", (url1_contact->username) ? url1_contact->username : "*NULL*", (url1_contact->host) ? url1_contact->host : "*NULL*", @@ -546,7 +549,7 @@ int register_response(sip_ticket_t *ticket, int flag) { /* if we send back an proxy authentication needed, include the Proxy-Authenticate field */ if (code == 407) { - auth_include_authrq(ticket); + auth_include_authrq(response); } /* get the IP address from existing VIA header */ diff --git a/src/sip_utils.c b/src/sip_utils.c index 4d814cf..fdf4332 100644 --- a/src/sip_utils.c +++ b/src/sip_utils.c @@ -673,11 +673,6 @@ int sip_rewrite_contact (sip_ticket_t *ticket, int direction) { /* found a mapping entry */ if (i %s@%s", - (contact->url->username)? contact->url->username : "*NULL*", - (contact->url->host)? contact->url->host : "*NULL*", - urlmap[i].masq_url->username, urlmap[i].masq_url->host); - /* remove old entry */ osip_list_remove(sip_msg->contacts,0); osip_contact_to_str(contact, &tmp); @@ -691,9 +686,18 @@ int sip_rewrite_contact (sip_ticket_t *ticket, int direction) { if (direction == DIR_OUTGOING) { /* outgoing, use masqueraded url */ osip_uri_clone(urlmap[i].masq_url, &contact->url); + DEBUGC(DBCLASS_PROXY, "rewrote Contact header %s@%s -> %s@%s", + (contact->url->username)? contact->url->username : "*NULL*", + (contact->url->host)? contact->url->host : "*NULL*", + urlmap[i].masq_url->username, urlmap[i].masq_url->host); } else { /* incoming, use true url */ osip_uri_clone(urlmap[i].true_url, &contact->url); + DEBUGC(DBCLASS_PROXY, "rewrote Contact header %s@%s -> %s@%s", + (contact->url->username)? contact->url->username : "*NULL*", + (contact->url->host)? contact->url->host : "*NULL*", + urlmap[i].true_url->username, urlmap[i].true_url->host); + } osip_list_add(sip_msg->contacts,contact,-1); diff --git a/src/siproxd.c b/src/siproxd.c index 0ef3b77..adca6c9 100644 --- a/src/siproxd.c +++ b/src/siproxd.c @@ -122,16 +122,6 @@ int main (int argc, char *argv[]) log_set_pattern(configuration.debuglevel); -/* - * open a the pwfile instance, so we still have access after - * we possibly have chroot()ed to somewhere. - */ - if (configuration.proxy_auth_pwfile) { - siproxd_passwordfile = fopen(configuration.proxy_auth_pwfile, "r"); - } else { - siproxd_passwordfile = NULL; - } - /* * parse command line */ @@ -197,6 +187,16 @@ int main (int argc, char *argv[]) configuration.debuglevel=cmdline_debuglevel; } +/* + * open a the pwfile instance, so we still have access after + * we possibly have chroot()ed to somewhere. + */ + if (configuration.proxy_auth_pwfile) { + siproxd_passwordfile = fopen(configuration.proxy_auth_pwfile, "r"); + } else { + siproxd_passwordfile = NULL; + } + /* set debug level as desired */ log_set_pattern(configuration.debuglevel); log_set_listen_port(configuration.debugport); diff --git a/src/siproxd.h b/src/siproxd.h index ec398ac..382b99d 100644 --- a/src/siproxd.h +++ b/src/siproxd.h @@ -191,8 +191,8 @@ int security_check_raw(char *sip_buffer, int size); /*X*/ int security_check_sip(sip_ticket_t *ticket); /*X*/ /* auth.c */ -int authenticate_proxy(sip_ticket_t *ticket); /*X*/ -int auth_include_authrq(sip_ticket_t *ticket); /*X*/ +int authenticate_proxy(osip_message_t *sipmsg); /*X*/ +int auth_include_authrq(osip_message_t *sipmsg); /*X*/ void CvtHex(char *hash, char *hashstring); /* fwapi.c */