Skip to content

Set default pjsip_cred_info.auth_algorithm to PJSIP_AUTH_ALGORITHM_MD5 #4195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sauwming merged 1 commit into from
Dec 6, 2024
Merged

Set default pjsip_cred_info.auth_algorithm to PJSIP_AUTH_ALGORITHM_MD5 #4195

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 31 additions & 3 deletions pjsip/include/pjsip/sip_auth.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -373,6 +373,10 @@ PJ_DECL(int) pjsip_cred_info_cmp(const pjsip_cred_info *cred1,
/**
* Type of function to lookup credential for the specified name.
*
* \note If pjsip_cred_info::data_type is set to PJSIP_CRED_DATA_DIGEST and
* pjsip_cred_info::algorithm_type is left unset (0), algorithm_type will
* default to #PJSIP_AUTH_ALGORITHM_MD5.
*
* @param pool Pool to initialize the credential info.
* @param realm Realm to find the account.
* @param acc_name Account name to look for.
Expand Down Expand Up @@ -406,6 +410,10 @@ typedef struct pjsip_auth_lookup_cred_param
/**
* Type of function to lookup credential for the specified name.
*
* \note If pjsip_cred_info::data_type is set to PJSIP_CRED_DATA_DIGEST and
* pjsip_cred_info::algorithm_type is left unset (0), algorithm_type will
* default to #PJSIP_AUTH_ALGORITHM_MD5.
*
* @param pool Pool to initialize the credential info.
* @param param The input param for credential lookup.
* @param cred_info The structure to put the credential when it's found.
Expand Down Expand Up @@ -482,6 +490,10 @@ PJ_DECL(pj_status_t) pjsip_auth_clt_clone( pj_pool_t *pool,
* Set the credentials to be used during the session. This will duplicate
* the specified credentials using client authentication's pool.
*
* \note If pjsip_cred_info::data_type is set to PJSIP_CRED_DATA_DIGEST and
* pjsip_cred_info::algorithm_type is left unset (0), algorithm_type will
* default to #PJSIP_AUTH_ALGORITHM_MD5.
*
* @param sess The client authentication session.
* @param cred_cnt Number of credentials.
* @param c Array of credentials.
Expand Down Expand Up @@ -711,6 +723,9 @@ PJ_DECL(pj_status_t) pjsip_auth_srv_challenge2(pjsip_auth_srv *auth_srv,
* Helper function to create a digest out of the specified
* parameters.
*
* \deprecated Use #pjsip_auth_create_digest2 with
* algorithm_type = #PJSIP_AUTH_ALGORITHM_MD5.
*
* \warning Because of ambiguities in the API, this function
* should only be used for backward compatibility with the
* MD5 digest algorithm. New code should use
Expand All @@ -719,6 +734,10 @@ PJ_DECL(pj_status_t) pjsip_auth_srv_challenge2(pjsip_auth_srv *auth_srv,
* pjsip_cred_info::data_type must be #PJSIP_CRED_DATA_PLAIN_PASSWD
* or #PJSIP_CRED_DATA_DIGEST.
*
* \note If pjsip_cred_info::data_type is set to PJSIP_CRED_DATA_DIGEST and
* pjsip_cred_info::algorithm_type is left unset (0), algorithm_type will
* default to #PJSIP_AUTH_ALGORITHM_MD5.
*
* @param result String to store the response digest. This string
* must have been preallocated by caller with the
* buffer at least PJSIP_MD5STRLEN (32 bytes) in size.
Expand Down Expand Up @@ -746,9 +765,21 @@ PJ_DECL(pj_status_t) pjsip_auth_create_digest(pj_str_t *result,
/**
* Helper function to create SHA-256 digest out of the specified
* parameters.
*
* \deprecated Use #pjsip_auth_create_digest2 with
* algorithm_type = #PJSIP_AUTH_ALGORITHM_SHA256.
*
* \warning Because of ambiguities in the API, this function
* should only be used for backward compatibility with the
* SHA256 digest algorithm. New code should use
* #pjsip_auth_create_digest2
*
* pjsip_cred_info::data_type must be #PJSIP_CRED_DATA_PLAIN_PASSWD
* or #PJSIP_CRED_DATA_DIGEST.
*
* \note If pjsip_cred_info::data_type is set to PJSIP_CRED_DATA_DIGEST and
* pjsip_cred_info::algorithm_type is left unset (0), algorithm_type will
* default to #PJSIP_AUTH_ALGORITHM_SHA256.
*
* @param result String to store the response digest. This string
* must have been preallocated by caller with the
Expand Down Expand Up @@ -794,9 +825,6 @@ PJ_DECL(pj_status_t) pjsip_auth_create_digestSHA256(pj_str_t* result,
* pjsip_cred_info::algorithm_type MUST match the algorithm_type
* passed as the last parameter to this function.
*
* \note If left unset (0), pjsip_cred_info::algorithm_type will
* default to #PJSIP_AUTH_ALGORITHM_MD5.
*
* @param result String to store the response digest. This string
* must have been preallocated by the caller with the
* buffer at least as large as the digest_str_length
Expand Down
26 changes: 18 additions & 8 deletions pjsip/src/pjsip/sip_auth_client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,10 +221,7 @@ PJ_DEF(pj_status_t) pjsip_auth_create_digest2( pj_str_t *result,
PJ_ASSERT_RETURN(result && nonce && uri && realm && cred_info && method, PJ_EINVAL);
pj_bzero(result->ptr, result->slen);

algorithm = pjsip_auth_get_algorithm_by_type(algorithm_type == PJSIP_AUTH_ALGORITHM_NOT_SET
? PJSIP_AUTH_ALGORITHM_MD5
: algorithm_type);

algorithm = pjsip_auth_get_algorithm_by_type(algorithm_type);
if (!algorithm) {
PJ_LOG(4, (THIS_FILE, "The algorithm_type is invalid"));
return PJ_ENOTSUP;
Expand Down Expand Up @@ -263,12 +260,16 @@ PJ_DEF(pj_status_t) pjsip_auth_create_digest2( pj_str_t *result,
}

if (PJSIP_CRED_DATA_IS_DIGEST(cred_info)) {
if (cred_info->algorithm_type != algorithm_type) {
pjsip_auth_algorithm_type cred_algorithm_type = cred_info->algorithm_type;

if (cred_algorithm_type == PJSIP_AUTH_ALGORITHM_NOT_SET) {
cred_algorithm_type = algorithm_type;
} else if (cred_algorithm_type != algorithm_type) {
PJ_LOG(4,(THIS_FILE,
"The algorithm specified in the cred_info (%.*s) "
"doesn't match the algorithm requested for hashing (%.*s)",
(int)pjsip_auth_algorithms[cred_info->algorithm_type].iana_name.slen,
pjsip_auth_algorithms[cred_info->algorithm_type].iana_name.ptr,
(int)pjsip_auth_algorithms[cred_algorithm_type].iana_name.slen,
pjsip_auth_algorithms[cred_algorithm_type].iana_name.ptr,
(int)pjsip_auth_algorithms[algorithm_type].iana_name.slen,
pjsip_auth_algorithms[algorithm_type].iana_name.ptr));
return PJ_EINVAL;
Expand Down Expand Up @@ -917,7 +918,16 @@ PJ_DEF(pj_status_t) pjsip_auth_clt_set_credentials( pjsip_auth_clt_sess *sess,
pj_strdup(sess->pool, &sess->cred_info[i].realm, &c[i].realm);
pj_strdup(sess->pool, &sess->cred_info[i].username, &c[i].username);
pj_strdup(sess->pool, &sess->cred_info[i].data, &c[i].data);
sess->cred_info[i].algorithm_type = c[i].algorithm_type;
/*
* If the data type is DIGEST and an auth algorithm isn't set,
* default it to MD5.
*/
if (PJSIP_CRED_DATA_IS_DIGEST(&c[i]) &&
c[i].algorithm_type == PJSIP_AUTH_ALGORITHM_NOT_SET) {
sess->cred_info[i].algorithm_type = PJSIP_AUTH_ALGORITHM_MD5;
} else {
sess->cred_info[i].algorithm_type = c[i].algorithm_type;
}
}
sess->cred_cnt = cred_cnt;
}
Expand Down
9 changes: 9 additions & 0 deletions pjsip/src/pjsip/sip_auth_server.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,15 @@ PJ_DEF(pj_status_t) pjsip_auth_srv_verify( pjsip_auth_srv *auth_srv,
}
}

/*
* If the data type is DIGEST and an auth algorithm isn't set,
* default it to MD5.
*/
if (PJSIP_CRED_DATA_IS_DIGEST(&cred_info) &&
cred_info.algorithm_type == PJSIP_AUTH_ALGORITHM_NOT_SET) {
cred_info.algorithm_type = PJSIP_AUTH_ALGORITHM_MD5;
}

/* Authenticate with the specified credential. */
status = pjsip_auth_verify(h_auth, &msg->line.req.method.name,
&cred_info);
Expand Down