From: George Joseph <gjoseph@sangoma.com>
Date: Fri, 17 Jan 2025 16:20:16 +0000 (-0700)
Subject: res_pjsip_authenticator_digest: Fix issue with missing auth and DONT_OPTIMIZE
X-Git-Tag: 21.7.0-rc1~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e7801702c66d234ba48e62f954fb3f5c7f2e193d;p=thirdparty%2Fasterisk.git

res_pjsip_authenticator_digest: Fix issue with missing auth and DONT_OPTIMIZE

The return code fom digest_check_auth wasn't explicitly being initialized.
The return code also wasn't explicitly set to CHALLENGE when challenges
were sent.  When optimization was turned off (DONT_OPTIMIZE), the compiler
was setting it to "0"(CHALLENGE) which worked fine.  However, with
optimization turned on, it was setting it to "1" (SUCCESS) so if there was
no incoming Authorization header, the function was returning SUCCESS to the
distributor allowing the request to incorrectly succeed.

The return code is now initialized correctly and is now explicitly set
to CHALLENGE when we send challenges.

(cherry picked from commit 317b830c1ea646ab0f875ee11117be0c31ca8441)
---

diff --git a/res/res_pjsip_authenticator_digest.c b/res/res_pjsip_authenticator_digest.c
index 6d7fdab2b8..1dbc14d4c6 100644
--- a/res/res_pjsip_authenticator_digest.c
+++ b/res/res_pjsip_authenticator_digest.c
@@ -566,7 +566,7 @@ static enum ast_sip_check_auth_result digest_check_auth(struct ast_sip_endpoint
 	struct ast_sip_auth **auths;
 	enum digest_verify_result *verify_res;
 	struct ast_sip_endpoint *artificial_endpoint;
-	enum ast_sip_check_auth_result res;
+	enum ast_sip_check_auth_result res = AST_SIP_AUTHENTICATION_ERROR;
 	int idx;
 	int is_artificial;
 	int failures = 0;
@@ -674,6 +674,7 @@ static enum ast_sip_check_auth_result digest_check_auth(struct ast_sip_endpoint
 
 			SCOPE_CALL(5, challenge, endpoint_id, auth, tdata, rdata,
 				verify_res[idx] == AUTH_STALE, algorithm);
+			res = AST_SIP_AUTHENTICATION_CHALLENGE;
 
 			SCOPE_EXIT("%s:%s:%s: Challenged with " PJSTR_PRINTF_SPEC "\n",
 				endpoint_id, auth_id, src_name, PJSTR_PRINTF_VAR(algorithm->iana_name));
@@ -689,10 +690,17 @@ static enum ast_sip_check_auth_result digest_check_auth(struct ast_sip_endpoint
 	 * auth object as a UAS.
 	 */
 
+	/*
+	 * If the authentication failed for any reason, we want to send
+	 * a 401 with a challenge.  If it was because there was no
+	 * Authorization header or there was a stale nonce, fine.  That's not
+	 * unusual so we return AST_SIP_AUTHENTICATION_CHALLENGE.  If it
+	 * failed because of a user/password mismatch then we return
+	 * AST_SIP_AUTHENTICATION_FAILED which causes the distributor to
+	 * print a "Failed to authenticate" message.
+	 */
 	if (failures == auth_size) {
 		res = AST_SIP_AUTHENTICATION_FAILED;
-	} else if (res != AST_SIP_AUTHENTICATION_SUCCESS){
-		res = AST_SIP_AUTHENTICATION_CHALLENGE;
 	}
 
 	ast_sip_cleanup_auths(auths, auth_size);