Am Donnerstag, 17. Mai 2018, 15:02:13 CEST schrieb Daniel Tryba:

> [..]

> > I wonder why these particular module parameters would break the

> > functionality though, I thought the idea was that each proxy would be able

> > to generate the nonce with a shared secret if it recieved a challenge

> > response from a ua who's nonce was generated on a different proxy. Is this

> > a bug, or, is it working as intended when these two module paramters are

> > enabled?

>

> I was looking at the wording for nonce_count

> https://www.kamailio.org/docs/modules/5.1.x/modules/auth.html#auth.p.nonce_c

> ount "3.5. nonce_count (boolean)

>

> If enabled the received nc value is remembered and checked against the

> older value (for a successful authentication the received nc must be

> greater then the previously received one, see rfc2617 for more details).

> This will provide protection against replay attacks while still allowing

> credentials caching at the UA side."

>

> It sounds like this is kept in memory. Since this isn't shared between

> kamailio instances, the discrepancies in nonce count should trigger the

> replay attack prevention mechanism (i.e. offer a new challenge).

>

> So I guess this is indended behavior.

The conditions for the nonce check are bit more complicated, but this is basically the way it works out in the end.

Henning