From 5ef025a2bf958ba5a78c9091f6f9f7c7fc3c67ce Mon Sep 17 00:00:00 2001 From: donat zenichev Date: Fri, 16 Jul 2021 12:35:52 +0300 Subject: [PATCH] TT#128701 Authentication from SEMS with no credentials There are cases when calls coming to a subscriber of C5 CE, is being challenged by this subscriber, the use case for that could be if for e.g. we have a PBX/SBC connected to NGCP via subscriber's object. Current implementation of SEMS works so, that in case parameters; 'enable_auth' and 'enable_aleg_auth' are set to value 'yes', SEMS tries to pass the digest for the calling party. This leads to the empty 'username' and wrong 'response' parameters of the Proxy-Authorization header, eventually the Authorization process is failed. This is to be changed, so in case 'u=', 'p=' and 'd=' have not been previously sent by the Proxy (in 'P-App-Param:'), or rather they are empty, authentication should be transparent, hence be processed by the calling side, with no interfer from SEMS into that. Change-Id: I9bced848d27f8c23bd557609277d5127e7e8696a --- debian/patches/series | 1 + .../skip_outbound_auth_if_credentials_empty.patch | 13 +++++++++++++ 2 files changed, 14 insertions(+) create mode 100644 debian/patches/sipwise/skip_outbound_auth_if_credentials_empty.patch diff --git a/debian/patches/series b/debian/patches/series index f3cf80ab..7bb6093a 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -38,3 +38,4 @@ sipwise/handle_bye_after_180.patch sipwise/upgrade_to_bullseye.patch sipwise/port_to_py3k.patch sipwise/db_reg_agent_auth_header.patch +sipwise/skip_outbound_auth_if_credentials_empty.patch diff --git a/debian/patches/sipwise/skip_outbound_auth_if_credentials_empty.patch b/debian/patches/sipwise/skip_outbound_auth_if_credentials_empty.patch new file mode 100644 index 00000000..73d9d40a --- /dev/null +++ b/debian/patches/sipwise/skip_outbound_auth_if_credentials_empty.patch @@ -0,0 +1,13 @@ +--- a/core/plug-in/uac_auth/UACAuth.cpp ++++ b/core/plug-in/uac_auth/UACAuth.cpp +@@ -173,7 +173,9 @@ bool UACAuth::onSipReply(const AmSipRequ + // credential->realm.c_str(), + // credential->user.c_str(), + // credential->pwd.c_str()); +- if (!nonce_reuse && ++ if ((credential->user.empty() || credential->pwd.empty()) && reply.code==407) { ++ DBG("No credentials to pass the challenge from behalf of B2B, sending 407 transparently\n"); ++ } else if (!nonce_reuse && + (((reply.code == 401) && + getHeader(ri->second.hdrs, SIP_HDR_AUTHORIZATION, true).length()) || + ((reply.code == 407) &&