Module: sip-router
Branch: master
Commit: c53bc97968e4ac2ddf5b8a23af44942e8d50e7b3
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=c53bc97…
Author: Juha Heinanen <jh(a)tutpro.com>
Committer: Juha Heinanen <jh(a)tutpro.com>
Date: Thu Oct 7 17:59:27 2010 +0300
modules/auth: fixed sending of [www|proxy]_challenge reply
- By default, [www|proxy]_challenge functions now send reply statefully
if transaction exists and statelessly otherwise.
- Added force_stateless_reply module param that can be used to change
the default behavior.
- Credits to Andrei Pelinescu-Onciul.
---
modules/auth/README | 29 ++++++++++++++++++++++-------
modules/auth/auth_mod.c | 12 ++++++++++--
modules/auth/doc/functions.xml | 6 ++++--
modules/auth/doc/params.xml | 19 +++++++++++++++++++
4 files changed, 55 insertions(+), 11 deletions(-)
diff --git a/modules/auth/README b/modules/auth/README
index 92e4641..0f0214b 100644
--- a/modules/auth/README
+++ b/modules/auth/README
@@ -36,6 +36,7 @@ Daniel-Constantin Mierla
1.3.10. secret (string)
1.3.11. nonce_expire (integer)
1.3.12. nonce_auth_max_drift (integer)
+ 1.3.13. force_stateless_reply (boolean)
1.4. Functions
@@ -450,6 +451,18 @@ modparam("auth", "nonce_expire", 600) # Set nonce_expire to 600s
modparam("auth", "nonce_auth_max_drift", 1) # set max drift to 1 s
...
+1.3.13. force_stateless_reply (boolean)
+
+ If set to 1, www_challenge() and proxy_challenge() functions send reply
+ statelessly no matter if transaction exists or not. If set to 0
+ (default), reply is sent statefully if transaction exists and
+ stelelessly otherwise.
+
+ Example 13. force_stateless_reply example
+...
+modparam("auth", "force_stateless_reply", 1)
+...
+
1.4. Functions
1.4.1. consume_credentials()
@@ -462,7 +475,7 @@ modparam("auth", "nonce_auth_max_drift", 1) # set max drift to 1 s
little bit shorter. The function must be called after www_authorize,
proxy_authorize, www_authenticate or proxy_authenticate.
- Example 13. consume_credentials example
+ Example 14. consume_credentials example
...
if (www_authenticate("realm", "subscriber)) {
consume_credentials();
@@ -476,7 +489,8 @@ if (www_authenticate("realm", "subscriber)) {
field into a response generated from the request the server is
processing and send the reply. Upon reception of such a reply the user
agent should compute credentials and retry the request. For more
- information regarding digest authentication see RFC2617.
+ information regarding digest authentication see RFC2617. See module
+ parameter force_stateless_reply regarding sending of the reply.
Meaning of the parameters is as follows:
* realm - Realm is a opaque string that the user agent should present
@@ -496,7 +510,7 @@ if (www_authenticate("realm", "subscriber)) {
This function can be used from REQUEST_ROUTE.
- Example 14. www_challenge usage
+ Example 15. www_challenge usage
...
if (!www_authenticate("$td", "subscriber")) {
www_challenge("$td", "1");
@@ -510,14 +524,15 @@ if (!www_authenticate("$td", "subscriber")) {
the header field into a response generated from the request the server
is processing and send the reply. Upon reception of such a reply the
user agent should compute credentials and retry the request. For more
- information regarding digest authentication see RFC2617.
+ information regarding digest authentication see RFC2617. See module
+ parameter force_stateless_reply regarding sending of the reply.
Meaning of the parameters the same as for function www_challenge(realm,
flags)
This function can be used from REQUEST_ROUTE.
- Example 15. proxy_challenge usage
+ Example 16. proxy_challenge usage
...
if (!proxy_authenticate("$fd", "subscriber)) {
proxy_challenge("$fd", "1");
@@ -562,7 +577,7 @@ if (!proxy_authenticate("$fd", "subscriber)) {
This function can be used from REQUEST_ROUTE.
- Example 16. pv_www_authenticate usage
+ Example 17. pv_www_authenticate usage
...
if (!pv_www_authenticate("$td", "123abc", "0")) {
www_challenge("$td", "1");
@@ -584,7 +599,7 @@ if (!pv_www_authenticate("$td", "123abc", "0")) {
This function can be used from REQUEST_ROUTE.
- Example 17. pv_proxy_authenticate usage
+ Example 18. pv_proxy_authenticate usage
...
$avp(password)="xyz";
if (!pv_proxy_authenticate("$fd", "$avp(password)", "0")) {
diff --git a/modules/auth/auth_mod.c b/modules/auth/auth_mod.c
index f75530b..b30f6b8 100644
--- a/modules/auth/auth_mod.c
+++ b/modules/auth/auth_mod.c
@@ -97,6 +97,7 @@ char* sec_param = 0; /* If the parameter was not used, the secret phrase
int nonce_expire = 300; /* Nonce lifetime */
/*int auth_extra_checks = 0; -- in nonce.c */
int protect_contacts = 0; /* Do not include contacts in nonce by default */
+int force_stateless_reply = 0; /* Always send reply statelessly */
str secret1;
str secret2;
@@ -171,7 +172,7 @@ static param_export_t params[] = {
{"one_time_nonce" , PARAM_INT, &otn_enabled },
{"otn_in_flight_no", PARAM_INT, &otn_in_flight_no },
{"otn_in_flight_order", PARAM_INT, &otn_in_flight_k },
- {"nid_pool_no", PARAM_INT, &nid_pool_no },
+ {"force_stateless_reply", PARAM_INT, &force_stateless_reply },
{0, 0, 0}
};
@@ -558,6 +559,8 @@ static int fixup_pv_auth(void **param, int param_no)
static int auth_send_reply(struct sip_msg *msg, int code, char *reason,
char *hdr, int hdr_len)
{
+ str reason_str;
+
/* Add new headers if there are any */
if ((hdr!=NULL) && (hdr_len>0)) {
if (add_lump_rpl(msg, hdr, hdr_len, LUMP_RPL_HDR)==0) {
@@ -566,7 +569,12 @@ static int auth_send_reply(struct sip_msg *msg, int code, char *reason,
}
}
- return slb.zreply(msg, code, reason);
+ reason_str.s = reason;
+ reason_str.len = strlen(reason);
+
+ return force_stateless_reply ?
+ slb.sreply(msg, code, &reason_str) :
+ slb.freply(msg, code, &reason_str);
}
/**
diff --git a/modules/auth/doc/functions.xml b/modules/auth/doc/functions.xml
index 90f4c93..b9816bc 100644
--- a/modules/auth/doc/functions.xml
+++ b/modules/auth/doc/functions.xml
@@ -42,7 +42,8 @@ if (www_authenticate("realm", "subscriber)) {
server is processing and send the reply. Upon reception of such a
reply the user agent should compute credentials and retry the
request. For more information regarding digest authentication
- see RFC2617.
+ see RFC2617. See module parameter force_stateless_reply
+ regarding sending of the reply.
</para>
<para>Meaning of the parameters is as follows:</para>
<itemizedlist>
@@ -109,7 +110,8 @@ if (!www_authenticate("$td", "subscriber")) {
put the header field into a response generated from the request the
server is processing and send the reply. Upon reception of such a
reply the user agent should compute credentials and retry the request.
- For more information regarding digest authentication see RFC2617.
+ For more information regarding digest authentication see RFC2617. See module parameter force_stateless_reply
+ regarding sending of the reply.
</para>
<para>Meaning of the parameters the same as for function
www_challenge(realm, flags)</para>
diff --git a/modules/auth/doc/params.xml b/modules/auth/doc/params.xml
index ad84251..67c83bb 100644
--- a/modules/auth/doc/params.xml
+++ b/modules/auth/doc/params.xml
@@ -572,4 +572,23 @@ modparam("auth", "nonce_auth_max_drift", 1) # set max drift to 1 s
</programlisting>
</example>
</section>
+
+ <section id="force_stateless_reply">
+ <title><varname>force_stateless_reply</varname> (boolean)</title>
+ <para>
+ If set to 1, <function>www_challenge()</function> and
+ <function>proxy_challenge()</function>
+ functions send reply statelessly no matter if transaction
+ exists or not. If set to 0 (default), reply is sent statefully
+ if transaction exists and stelelessly otherwise.
+ </para>
+ <example>
+ <title>force_stateless_reply example</title>
+ <programlisting>
+...
+modparam("auth", "force_stateless_reply", 1)
+...
+ </programlisting>
+ </example>
+ </section>
</section>
Hi, in a module I'm writting I export a script function which gives
value to a new pseudo-variable. This pv is stored in a global variable
into each worker process.
I don't know how to solve this issue:
- A request is handled by worker-1.
- The script calls to the module function so the pv is filled (it's
value is stored in a global str within the process).
- Later in the script I can access to $new_pv (it reads the global str
in the pv_get_new_pv() function).
- The request processing ends (i.e: t_relay).
- After some time the same worker-1 receives a new request.
- If the script reads $new_pv (without calling the module function
before) it will get the value generated during the previous SIP
request.
Of course the script configuration shouldn't try to read $new_pv
without calling first to the exported function, but anyhow this could
happen (due to a bad script file). Is there an ellegant way to avoid
this? This is, I would like that when a process receives a request (or
a response) $new_pv gets automatically reseted (to NULL), prior to
executing the script logic. In this way accessing to $new_pv without
calling the module function would return an empty value.
Is it possible? how do other modules handle this case?
Thanks a lot.
--
Iñaki Baz Castillo
<ibc(a)aliax.net>
Module: sip-router
Branch: 3.1
Commit: 405fb620d1bba43c159012772175f533a40a3a77
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=405fb62…
Author: Juha Heinanen <jh(a)tutpro.com>
Committer: Juha Heinanen <jh(a)tutpro.com>
Date: Thu Oct 7 15:57:27 2010 +0300
modules/auth: fixed comment in nonce_count example
---
modules/auth/README | 6 ++++--
modules/auth/doc/params.xml | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/modules/auth/README b/modules/auth/README
index e70cf07..92e4641 100644
--- a/modules/auth/README
+++ b/modules/auth/README
@@ -194,8 +194,10 @@ modparam("auth", "qop", "auth") # enable qop=auth
route{
...
# go stateful and catch retransmissions
- if (!t_newtran())
- drop; # retransmission
+ if (!t_newtran()) {
+ xlog("L_NOTICE", "Failed to create new transaction\n");
+ drop;
+ };
if (method=="REGISTER"){
if (!www_authenticate("test", "credentials")){
# reply must be sent with t_reply because the
diff --git a/modules/auth/doc/params.xml b/modules/auth/doc/params.xml
index af44e2a..ad84251 100644
--- a/modules/auth/doc/params.xml
+++ b/modules/auth/doc/params.xml
@@ -194,8 +194,10 @@ modparam("auth", "qop", "auth") # enable qop=auth
route{
...
# go stateful and catch retransmissions
- if (!t_newtran())
- drop; # retransmission
+ if (!t_newtran()) {
+ xlog("L_NOTICE", "Failed to create new transaction\n");
+ drop;
+ };
if (method=="REGISTER"){
if (!www_authenticate("test", "credentials")){
# reply must be sent with t_reply because the
Module: sip-router
Branch: master
Commit: d5634f0e2e9f25395e312a98aa6814d78e39b16f
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=d5634f0…
Author: Juha Heinanen <jh(a)tutpro.com>
Committer: Juha Heinanen <jh(a)tutpro.com>
Date: Thu Oct 7 15:57:27 2010 +0300
modules/auth: fixed comment in nonce_count example
---
modules/auth/README | 6 ++++--
modules/auth/doc/params.xml | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/modules/auth/README b/modules/auth/README
index e70cf07..92e4641 100644
--- a/modules/auth/README
+++ b/modules/auth/README
@@ -194,8 +194,10 @@ modparam("auth", "qop", "auth") # enable qop=auth
route{
...
# go stateful and catch retransmissions
- if (!t_newtran())
- drop; # retransmission
+ if (!t_newtran()) {
+ xlog("L_NOTICE", "Failed to create new transaction\n");
+ drop;
+ };
if (method=="REGISTER"){
if (!www_authenticate("test", "credentials")){
# reply must be sent with t_reply because the
diff --git a/modules/auth/doc/params.xml b/modules/auth/doc/params.xml
index af44e2a..ad84251 100644
--- a/modules/auth/doc/params.xml
+++ b/modules/auth/doc/params.xml
@@ -194,8 +194,10 @@ modparam("auth", "qop", "auth") # enable qop=auth
route{
...
# go stateful and catch retransmissions
- if (!t_newtran())
- drop; # retransmission
+ if (!t_newtran()) {
+ xlog("L_NOTICE", "Failed to create new transaction\n");
+ drop;
+ };
if (method=="REGISTER"){
if (!www_authenticate("test", "credentials")){
# reply must be sent with t_reply because the
Feature Requests item #3082812, was opened at 2010-10-07 08:30
Message generated for change (Tracker Item Submitted) made by nobody
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=743023&aid=3082812&group_…
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: core
Group: ver devel
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: comment2, zolpidem, winston cigarette adatives, allopurinol
Initial Comment:
comment2, zolpidem, winston cigarette adatives, allopurinol without prescription, ultram, alprazolam, pall mall cigarettes, propranolol used, adult dating sites, breastfeed and metformin, reductil, boards cat prednisone, dunhill international cigarettes, baclofen side effects, christian dating website singles, dunhill menthol cigarettes, lipitor, book buy de fluoxetine guest site, female spray viagra,
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=743023&aid=3082812&group_…
when i start sr, i get this warning:
Oct 2 12:13:12 sip /usr/sbin/sip-proxy[10603]: WARNING: tls [tls_init.c:592]: init_tls_h(): tls: ser compiled without MALLOC_STATS support: the workaround for low mem. openssl bugs will _not_ work
if TLS is enabled when sr is build, would it be possible to
automatically compile it also with MALLOC_STATS support so that the
workaround would work?
-- juha
tls module README says:
Creating a server/client certificate
------------------------------------
1. create a certificate request (and its private key in privkey.pem)
openssl req -out ser1_cert_req.pem -new -nodes
WARNING: the organization name should be the same as in the ca
certificate.
why the warning? i followed the tuto and there they are not the same
and still tls works.
-- juha
Kamailio (OpenSER) v3.1.0 is out – major release with impressing
number of new features and improvements.
This release is a result of more than 8 months of development and
testing from the teams of Kamailio (OpenSER) and SIP Express Router
(SER) projects. Backed up by a solid development group, we are proud to
announce that this release brings a large set of features, many for
first time on the SIP server market, such as asynchronous TLS, UDP raw
sockets, embedded HTTP and XCAP servers, embedded Lua, configuration
file debugger. All together, there are over 15 new modules and countless
improvements to old components.
Since last major release (version 3.0.0, which was out in January 10,
2010), the two SIP servers, Kamailio and SER, are practically the same
application, the name making the difference regarding the database
structure and the extensions used for certain features, such as user
database based authentication or location service.
Therefore another development direction was towards smooth integration
of Kamailio and SER extensions, previously duplicated modules such as
auth, sl, ratelimit or sms were merged during this development cycle.
Continue reading the release notes at:
http://www.kamailio.org/w/kamailio-openser-v3.1.0-release-notes/
Many thanks to all developers and community members that made possible
this release.
--
Daniel-Constantin Mierla
http://www.asipto.com