aboutsummaryrefslogtreecommitdiffstats
path: root/channels
diff options
context:
space:
mode:
authortwilson <twilson@f38db490-d61c-443f-a65b-d21fe96a405b>2011-01-04 17:37:26 +0000
committertwilson <twilson@f38db490-d61c-443f-a65b-d21fe96a405b>2011-01-04 17:37:26 +0000
commitdb77b780cd1d81fd83a5a111f5522fec4114a5cd (patch)
tree62aa7a23fb40c9d7e21fb0893640bd3861581c86 /channels
parentef87b06b4d3315fb8fd3a7f35a88aabca2d61ef1 (diff)
Merged revisions 300216 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4 ........ r300216 | twilson | 2011-01-04 11:11:48 -0600 (Tue, 04 Jan 2011) | 15 lines Don't authenticate SUBSCRIBE re-transmissions This only skips authentication on retransmissions that are already authenticated. A similar method is already used for INVITES. This is the kind of thing we end up having to do when we don't have a transaction layer... (closes issue #18075) Reported by: mdu113 Patches: diff.txt uploaded by twilson (license 396) Tested by: twilson, mdu113 Review: https://reviewboard.asterisk.org/r/1005/ ........ git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.6.2@300298 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'channels')
-rw-r--r--channels/chan_sip.c34
1 files changed, 20 insertions, 14 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 880443c0d..5636db78a 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -21445,7 +21445,7 @@ static int handle_request_subscribe(struct sip_pvt *p, struct sip_request *req,
int firststate = AST_EXTENSION_REMOVED;
struct sip_peer *authpeer = NULL;
const char *eventheader = get_header(req, "Event"); /* Get Event package name */
- int resubscribe = (p->subscribed != NONE);
+ int resubscribe = (p->subscribed != NONE) && !req->ignore;
char *temp, *event;
if (p->initreq.headers) {
@@ -21461,7 +21461,7 @@ static int handle_request_subscribe(struct sip_pvt *p, struct sip_request *req,
if (resubscribe)
ast_debug(1, "Got a re-subscribe on existing subscription %s\n", p->callid);
else
- ast_debug(1, "Got a new subscription %s (possibly with auth)\n", p->callid);
+ ast_debug(1, "Got a new subscription %s (possibly with auth) or retransmission\n", p->callid);
}
}
@@ -21515,19 +21515,25 @@ static int handle_request_subscribe(struct sip_pvt *p, struct sip_request *req,
} else
event = (char *) eventheader; /* XXX is this legal ? */
- /* Handle authentication */
- res = check_user_full(p, req, SIP_SUBSCRIBE, e, 0, sin, &authpeer);
- /* if an authentication response was sent, we are done here */
- if (res == AUTH_CHALLENGE_SENT) /* authpeer = NULL here */
- return 0;
- if (res < 0) {
- if (res == AUTH_FAKE_AUTH) {
- ast_log(LOG_NOTICE, "Sending fake auth rejection for device %s\n", get_header(req, "From"));
- transmit_fake_auth_response(p, SIP_SUBSCRIBE, req, XMIT_UNRELIABLE);
- } else {
- ast_log(LOG_NOTICE, "Failed to authenticate device %s for SUBSCRIBE\n", get_header(req, "From"));
- transmit_response_reliable(p, "403 Forbidden", req);
+ /* Handle authentication if we're new and not a retransmission. We can't just
+ * use if !req->ignore, because then we'll end up sending
+ * a 200 OK if someone retransmits without sending auth */
+ if (p->subscribed == NONE || resubscribe) {
+ res = check_user_full(p, req, SIP_SUBSCRIBE, e, 0, sin, &authpeer);
+
+ /* if an authentication response was sent, we are done here */
+ if (res == AUTH_CHALLENGE_SENT) /* authpeer = NULL here */
+ return 0;
+ if (res < 0) {
+ if (res == AUTH_FAKE_AUTH) {
+ ast_log(LOG_NOTICE, "Sending fake auth rejection for device %s\n", get_header(req, "From"));
+ transmit_fake_auth_response(p, SIP_SUBSCRIBE, req, XMIT_UNRELIABLE);
+ } else {
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s for SUBSCRIBE\n", get_header(req, "From"));
+ transmit_response_reliable(p, "403 Forbidden", req);
+ }
}
+
pvt_set_needdestroy(p, "authentication failed");
return 0;
}