Changeset 1488 for pjproject/trunk/pjsip/src/pjsip/sip_auth_client.c

Timestamp:

Oct 10, 2007 11:37:56 AM (17 years ago)

Author:

bennylp

Message:

Ticket #396: initial implementation of digest AKA (akav1-md5) authentication for IMS/3GPP

File:

• pjproject/trunk/pjsip/src/pjsip/sip_auth_client.c (modified) (8 diffs)

pjproject/trunk/pjsip/src/pjsip/sip_auth_client.c

@@ -20 +20 @@
 #include <pjsip/sip_auth.h>
 #include <pjsip/sip_auth_parser.h>      /* just to get pjsip_DIGEST_STR */
+#include <pjsip/sip_auth_aka.h>
 #include <pjsip/sip_transport.h>
 #include <pjsip/sip_endpoint.h>
@@ -44 +45 @@
 #endif
 
+#define PASSWD_MASK         0x000F
+#define EXT_MASK            0x00F0
+
+
+PJ_DEF(void) pjsip_cred_info_dup(pj_pool_t *pool,
+                                 pjsip_cred_info *dst,
+                                 const pjsip_cred_info *src)
+{
+    pj_memcpy(dst, src, sizeof(pjsip_cred_info));
+
+    pj_strdup_with_null(pool, &dst->realm, &src->realm);
+    pj_strdup_with_null(pool, &dst->scheme, &src->scheme);
+    pj_strdup_with_null(pool, &dst->username, &src->username);
+    pj_strdup_with_null(pool, &dst->data, &src->data);
+
+    if ((dst->data_type & EXT_MASK) == PJSIP_CRED_DATA_EXT_AKA) {
+        pj_strdup(pool, &dst->ext.aka.k, &src->ext.aka.k);
+        pj_strdup(pool, &dst->ext.aka.op, &src->ext.aka.op);
+        pj_strdup(pool, &dst->ext.aka.amf, &src->ext.aka.amf);
+    }
+}
+
 
 /* Transform digest to string.
@@ -64 +87 @@
  * digest ASCII in 'result'. 
  */
-void pjsip_auth_create_digest( pj_str_t *result,
-                               const pj_str_t *nonce,
-                               const pj_str_t *nc,
-                               const pj_str_t *cnonce,
-                               const pj_str_t *qop,
-                               const pj_str_t *uri,
-                               const pj_str_t *realm,
-                               const pjsip_cred_info *cred_info,
-                               const pj_str_t *method)
+PJ_DEF(void) pjsip_auth_create_digest( pj_str_t *result,
+                                       const pj_str_t *nonce,
+                                       const pj_str_t *nc,
+                                       const pj_str_t *cnonce,
+                                       const pj_str_t *qop,
+                                       const pj_str_t *uri,
+                                       const pj_str_t *realm,
+                                       const pjsip_cred_info *cred_info,
+                                       const pj_str_t *method)
 {
     char ha1[PJSIP_MD5STRLEN];
@@ -83 +106 @@
     AUTH_TRACE_((THIS_FILE, "Begin creating digest"));
 
-    if (cred_info->data_type == PJSIP_CRED_DATA_PLAIN_PASSWD) {
+    if ((cred_info->data_type & PASSWD_MASK) == PJSIP_CRED_DATA_PLAIN_PASSWD) {
         /*** 
          *** ha1 = MD5(username ":" realm ":" password) 
@@ -97 +120 @@
         digest2str(digest, ha1);
 
-    } else if (cred_info->data_type == PJSIP_CRED_DATA_DIGEST) {
+    } else if ((cred_info->data_type & PASSWD_MASK) == PJSIP_CRED_DATA_DIGEST) {
         pj_assert(cred_info->data.slen == 32);
         pj_memcpy( ha1, cred_info->data.ptr, cred_info->data.slen );
+    } else {
+        pj_assert(!"Invalid data_type");
     }
 
@@ -221 +246 @@
         /* Server doesn't require quality of protection. */
 
-        /* Convert digest to string and store in chal->response. */
-        pjsip_auth_create_digest( &cred->response, &cred->nonce, NULL, NULL, 
-                                  NULL, uri, &chal->realm, cred_info, method);
+        if ((cred_info->data_type & EXT_MASK) == PJSIP_CRED_DATA_EXT_AKA) {
+            /* Call application callback to create the response digest */
+            return (*cred_info->ext.aka.cb)(pool, chal, cred_info, 
+                                            method, cred);
+        } 
+        else {
+            /* Convert digest to string and store in chal->response. */
+            pjsip_auth_create_digest( &cred->response, &cred->nonce, NULL, 
+                                      NULL,  NULL, uri, &chal->realm, 
+                                      cred_info, method);
+        }
 
     } else if (has_auth_qop(pool, &chal->qop)) {
@@ -240 +273 @@
         }
 
-        pjsip_auth_create_digest( &cred->response, &cred->nonce, &cred->nc, 
-                                  cnonce, &pjsip_AUTH_STR, uri, &chal->realm, 
-                                  cred_info, method );
+        if ((cred_info->data_type & EXT_MASK) == PJSIP_CRED_DATA_EXT_AKA) {
+            /* Call application callback to create the response digest */
+            return (*cred_info->ext.aka.cb)(pool, chal, cred_info, 
+                                            method, cred);
+        }
+        else {
+            pjsip_auth_create_digest( &cred->response, &cred->nonce, 
+                                      &cred->nc, cnonce, &pjsip_AUTH_STR, 
+                                      uri, &chal->realm, cred_info, method );
+        }
 
     } else {
@@ -425 +465 @@
         for (i=0; i<cred_cnt; ++i) {
             sess->cred_info[i].data_type = c[i].data_type;
+
+            /* When data_type is PJSIP_CRED_DATA_EXT_AKA, 
+             * callback must be specified.
+             */
+            if ((c[i].data_type & EXT_MASK) == PJSIP_CRED_DATA_EXT_AKA) {
+                /* Callback must be specified */
+                PJ_ASSERT_RETURN(c[i].ext.aka.cb != NULL, PJ_EINVAL);
+
+                /* Verify K len */
+                PJ_ASSERT_RETURN(c[i].ext.aka.k.slen == PJSIP_AKA_KLEN, 
+                                 PJSIP_EAUTHINAKACRED);
+
+                /* Verify OP len */
+                PJ_ASSERT_RETURN(c[i].ext.aka.op.slen == PJSIP_AKA_OPLEN, 
+                                 PJSIP_EAUTHINAKACRED);
+
+                /* Verify AMF len */
+                PJ_ASSERT_RETURN(c[i].ext.aka.amf.slen == PJSIP_AKA_AMFLEN,
+                                 PJSIP_EAUTHINAKACRED);
+
+                sess->cred_info[i].ext.aka.cb = c[i].ext.aka.cb;
+                pj_strdup(sess->pool, &sess->cred_info[i].ext.aka.k,
+                          &c[i].ext.aka.k);
+                pj_strdup(sess->pool, &sess->cred_info[i].ext.aka.op,
+                          &c[i].ext.aka.op);
+                pj_strdup(sess->pool, &sess->cred_info[i].ext.aka.amf,
+                          &c[i].ext.aka.amf);
+            }
+
             pj_strdup(sess->pool, &sess->cred_info[i].scheme, &c[i].scheme);
             pj_strdup(sess->pool, &sess->cred_info[i].realm, &c[i].realm);