From 2f3e5b494a213c20d93257a17b98a5a08525ccc1 Mon Sep 17 00:00:00 2001 From: Mark Michelson Date: Thu, 18 Dec 2014 15:40:13 +0000 Subject: [PATCH] Prevent potential infinite outbound authentication loops in registration. Prior to this patch, Asterisk would always respond to 401 responses to registration attempts by trying to provide a registration with authentication credentials. Even if subsequent attempts were rejected with 401 responses, Asterisk would continue this behavior. If authentication credentials were incorrect, this could continue forever. With this patch, we keep track of whether we have attempted authentication on an outbound registration attempt. If we already have, we don not try again until the next attempt. This prevents the infinite loop scenario. Review: https://reviewboard.asterisk.org/r/4273 ........ Merged revisions 429761 from http://svn.asterisk.org/svn/asterisk/branches/13 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@429762 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- res/res_pjsip_outbound_registration.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/res/res_pjsip_outbound_registration.c b/res/res_pjsip_outbound_registration.c index c5f5ba1280..bb9904a399 100644 --- a/res/res_pjsip_outbound_registration.c +++ b/res/res_pjsip_outbound_registration.c @@ -272,6 +272,8 @@ struct sip_outbound_registration_client_state { struct ast_sip_auth_vector outbound_auths; /*! \brief Registration should be destroyed after completion of transaction */ unsigned int destroy:1; + /*! \brief Non-zero if we have attempted sending a REGISTER with authentication */ + unsigned int auth_attempted:1; }; /*! \brief Outbound registration state information (persists for lifetime that registration should exist) */ @@ -627,12 +629,15 @@ static int handle_registration_response(void *data) ast_copy_pj_str(server_uri, &info.server_uri, sizeof(server_uri)); ast_copy_pj_str(client_uri, &info.client_uri, sizeof(client_uri)); - if (response->code == 401 || response->code == 407) { + if (!response->client_state->auth_attempted && + (response->code == 401 || response->code == 407)) { pjsip_tx_data *tdata; if (!ast_sip_create_request_with_auth(&response->client_state->outbound_auths, response->rdata, response->tsx, &tdata)) { ao2_ref(response->client_state, +1); + response->client_state->auth_attempted = 1; if (pjsip_regc_send(response->client_state->client, tdata) != PJ_SUCCESS) { + response->client_state->auth_attempted = 0; ao2_cleanup(response->client_state); } return 0; @@ -640,6 +645,8 @@ static int handle_registration_response(void *data) /* Otherwise, fall through so the failure is processed appropriately */ } + response->client_state->auth_attempted = 0; + if (PJSIP_IS_STATUS_IN_CLASS(response->code, 200)) { /* Check if this is in regards to registering or unregistering */ if (response->expiration) {