Skip to content

Commit 85ca354

Browse files
jmillanjmillan
committed
Implement credential reuse
2 parents 351ca06 + 45a3b35 commit 85ca354

File tree

3 files changed

+132
-63
lines changed

3 files changed

+132
-63
lines changed

‎src/DigestAuthentication.js

+71-46
Original file line numberDiff line numberDiff line change
@@ -10,69 +10,94 @@
1010
* @param {JsSIP.UA} ua
1111
* @param {JsSIP.OutgoingRequest} request
1212
* @param {JsSIP.IncomingResponse} response
13-
* @returns {String}
1413
*/
1514
JsSIP.DigestAuthentication = function (ua, request, response) {
16-
var authenticate, ha1, ha2, param,
17-
authorization = {},
18-
digest = '',
19-
nc = "00000001",
20-
cnonce = Math.random().toString(36).substr(2, 12),
21-
credentials = {
22-
username: ua.configuration.authorization_user,
23-
password: ua.configuration.password
24-
};
15+
var authenticate, credentials, realm, qop, nonce, opaque,
16+
username = ua.configuration.authorization_user,
17+
password = ua.configuration.password;
2518

2619
if(response.status_code === 401) {
2720
authenticate = response.parseHeader('www-authenticate');
2821
} else {
2922
authenticate = response.parseHeader('proxy-authenticate');
3023
}
3124

32-
response = {
33-
realm: authenticate.realm.replace(/"/g,''),
34-
qop: authenticate.qop || null,
35-
nonce: authenticate.nonce.replace(/"/g,'')
36-
};
25+
realm = authenticate.realm.replace(/"/g,'');
26+
qop = authenticate.qop || null;
27+
nonce = authenticate.nonce.replace(/"/g,'');
28+
opaque = authenticate.opaque;
29+
30+
this.password = password;
31+
this.method = request.method;
32+
33+
this.username = username;
34+
this.realm = realm;
35+
this.nonce = nonce;
36+
this.uri = request.ruri;
37+
this.qop = qop;
38+
this.response = null;
39+
this.algorithm = "MD5";
40+
this.opaque = opaque;
41+
this.cnonce = null;
42+
this.nc = 0;
43+
};
44+
45+
JsSIP.DigestAuthentication.prototype.authenticate = function(password) {
46+
var ha1, ha2, nc;
47+
48+
password = password || this.password;
49+
50+
this.cnonce = Math.random().toString(36).substr(2, 12);
51+
this.nc += 1;
52+
53+
// nc-value = 8LHEX. Max value = 'FFFFFFFF'
54+
if (this.nc === 4294967296) {
55+
console.log('Maximum "nc" value has been reached. Reseting "nc"');
56+
this.nc = 1;
57+
}
3758

3859
// HA1 = MD5(A1) = MD5(username:realm:password)
39-
ha1 = JsSIP.utils.MD5(credentials.username + ":" + response.realm + ":" + credentials.password);
40-
41-
switch(response.qop) {
42-
case 'auth-int':
43-
// HA2 = MD5(A2) = MD5(method:digestURI:MD5(entityBody))
44-
ha2 = JsSIP.utils.MD5(request.method + ":" + request.ruri + ":" + JsSIP.utils.MD5(request.body ? request.body : ""));
45-
break;
46-
default:
47-
// HA2 = MD5(A2) = MD5(method:digestURI)
48-
ha2 = JsSIP.utils.MD5(request.method + ":" + request.ruri);
60+
ha1 = JsSIP.utils.MD5(this.username + ":" + this.realm + ":" + password);
61+
62+
if (this.qop === 'auth' || this.qop === null) {
63+
// HA2 = MD5(A2) = MD5(method:digestURI)
64+
ha2 = JsSIP.utils.MD5(this.method + ":" + this.uri);
65+
66+
} else if (this.qop === 'auth-int') {
67+
// HA2 = MD5(A2) = MD5(method:digestURI:MD5(entityBody))
68+
ha2 = JsSIP.utils.MD5(this.method + ":" + this.uri + ":" + JsSIP.utils.MD5(this.body ? this.body : ""));
4969
}
5070

51-
if(response.qop) {
71+
if(this.qop === 'auth' || this.qop === 'auth-int') {
5272
// response = MD5(HA1:nonce:nonceCount:credentialsNonce:qop:HA2)
53-
response = JsSIP.utils.MD5(ha1 + ":" + response.nonce + ":" + nc + ":" + cnonce + ":" + response.qop + ":" + ha2);
73+
this.response = JsSIP.utils.MD5(ha1 + ":" + this.nonce + ":" + this.decimalToHex(this.nc) + ":" + this.cnonce + ":" + this.qop + ":" + ha2);
5474
} else {
5575
// response = MD5(HA1:nonce:HA2)
56-
response = JsSIP.utils.MD5(ha1 + ":" + response.nonce + ":" + ha2);
76+
this.response = JsSIP.utils.MD5(ha1 + ":" + this.nonce + ":" + ha2);
5777
}
5878

59-
// Fill the Authorization object
60-
authorization.username = '"' + credentials.username + '"';
61-
authorization.realm = authenticate.realm;
62-
authorization.nonce = authenticate.nonce;
63-
authorization.uri = '"' + request.ruri + '"';
64-
authorization.qop = authenticate.qop || null;
65-
authorization.response = '"' + response + '"';
66-
authorization.algorithm = "MD5";
67-
authorization.opaque = authenticate.opaque || null;
68-
authorization.cnonce = authenticate.qop ? '"' + cnonce + '"' : null;
69-
authorization.nc = authenticate.qop ? nc : null;
70-
71-
for(param in authorization) {
72-
if(authorization[param] !== null) {
73-
digest += ',' + param + '=' + authorization[param];
74-
}
75-
}
79+
return this.toString();
80+
};
81+
82+
JsSIP.DigestAuthentication.prototype.toString = function() {
83+
var authorization = 'Digest ';
84+
85+
authorization += 'username="' + this.username + '", ';
86+
authorization += 'realm="' + this.realm + '", ';
87+
authorization += 'nonce="' + this.nonce + '", ';
88+
authorization += 'uri="' + this.uri + '", ';
89+
authorization += this.qop ? 'qop=' + this.qop + ', ' : '';
90+
authorization += 'response="' + this.response + '", ';
91+
authorization += 'algorithm=MD5, ';
92+
authorization += this.opaque ? 'opaque="' + this.opaque + '", ': '';
93+
authorization += this.qop ? 'cnonce="' + this.cnonce + '", ' : '';
94+
authorization += this.qop ? 'nc=' + this.decimalToHex(this.nc) : '';
95+
96+
return authorization;
97+
};
98+
7699

77-
return 'Digest ' + digest.substr(1);
100+
JsSIP.DigestAuthentication.prototype.decimalToHex = function(decimal) {
101+
var hex = Number(decimal).toString(16);
102+
return '00000000'.substr(0, 8-hex.length) + hex;
78103
};

‎src/RequestSender.js

+37-17
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,31 @@ JsSIP.RequestSender = function(applicant, ua) {
1515
this.applicant = applicant;
1616
this.method = applicant.request.method;
1717
this.request = applicant.request;
18+
this.credentials = null;
1819
this.challenged = false;
20+
this.staled = false;
1921

2022
// If ua is in closing process or even closed just allow sending Bye and ACK
2123
if (ua.status === JsSIP.c.UA_STATUS_USER_CLOSED && (this.method !== JsSIP.c.BYE || this.method !== JsSIP.c.ACK)) {
2224
this.onTransportError();
2325
}
26+
27+
this.credentials = ua.getCredentials(this.request);
2428
};
2529

2630
/**
2731
* Create the client transaction and send the message.
2832
*/
2933
JsSIP.RequestSender.prototype = {
3034
send: function() {
35+
if (this.credentials) {
36+
if (this.request.method === JsSIP.c.REGISTER) {
37+
this.request.setHeader('authorization', this.credentials.authenticate());
38+
} else {
39+
this.request.setHeader('proxy-authorization', this.credentials.authenticate());
40+
}
41+
}
42+
3143
switch(this.method) {
3244
case "INVITE":
3345
this.clientTransaction = new JsSIP.Transactions.InviteClientTransaction(this, this.request, this.ua.transport);
@@ -65,36 +77,44 @@ JsSIP.RequestSender.prototype = {
6577
* @param {JsSIP.IncomingResponse} response
6678
*/
6779
receiveResponse: function(response) {
68-
var authorization, cseq,
80+
var cseq, challenge,
6981
status_code = response.status_code;
7082

7183
/*
7284
* Authentication
7385
* Authenticate once. _challenged_ flag used to avoid infinite authentications.
7486
*/
75-
if ((status_code === 401 || status_code === 407) && !this.challenged && this.ua.configuration.password !== null) {
76-
authorization = JsSIP.DigestAuthentication(this.ua, this.request, response);
87+
if ((status_code === 401 || status_code === 407) && this.ua.configuration.password !== null) {
7788

7889
if (status_code === 401) {
79-
this.request.setHeader('authorization', authorization);
90+
challenge = response.s('WWW-Authenticate');
8091
} else {
81-
this.request.setHeader('proxy-authorization', authorization);
92+
challenge = response.s('Authenticate');
8293
}
8394

84-
if (response.method === JsSIP.c.REGISTER) {
85-
cseq = this.applicant.cseq += 1;
86-
} else if (this.request.dialog){
87-
cseq = this.request.dialog.local_seqnum += 1;
88-
} else {
89-
cseq = this.request.headers.CSeq.toString().split(' ')[0];
90-
cseq = parseInt(cseq,10) +1;
91-
}
95+
if ( !this.challenged || (this.challenged && !this.staled && challenge.stale) ) {
96+
if (!this.credentials) {
97+
this.credentials = new JsSIP.DigestAuthentication(this.ua, this.request, response);
98+
}
9299

93-
this.request.setHeader('cseq', cseq +' '+ this.method);
94-
this.challenged = true;
95-
this.send();
100+
if (response.method === JsSIP.c.REGISTER) {
101+
cseq = this.applicant.cseq += 1;
102+
} else if (this.request.dialog){
103+
cseq = this.request.dialog.local_seqnum += 1;
104+
} else {
105+
cseq = this.request.headers.CSeq.toString().split(' ')[0];
106+
cseq = parseInt(cseq,10) +1;
107+
}
108+
109+
this.request.setHeader('cseq', cseq +' '+ this.method);
110+
this.challenged = true;
111+
this.send();
112+
}
96113
} else {
97-
this.applicant.receiveResponse(response);
114+
if (this.challenged && response.status_code >= 200) {
115+
this.ua.saveCredentials(this.credentials);
116+
}
117+
this.applicant.receiveResponse(response);
98118
}
99119
}
100120
};

‎src/UA.js

+24
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ JsSIP.UA = function(configuration) {
1919
'newMessage'
2020
];
2121

22+
this.cache = {
23+
credentials: {}
24+
};
25+
2226
this.configuration = {};
2327
this.dialogs = {};
2428
this.registrator = null;
@@ -234,6 +238,26 @@ JsSIP.UA.prototype.start = function() {
234238
}
235239
};
236240

241+
242+
JsSIP.UA.prototype.saveCredentials = function(credentials) {
243+
this.cache.credentials[credentials.realm] = this.cache.credentials[credentials.realm] || {};
244+
this.cache.credentials[credentials.realm][credentials.uri] = credentials;
245+
};
246+
247+
JsSIP.UA.prototype.getCredentials = function(request) {
248+
var realm, credentials;
249+
250+
realm = JsSIP.grammar.parse(request.headers['To'].toString(), 'To').host;
251+
252+
if (this.cache.credentials[realm] && this.cache.credentials[realm][request.ruri]) {
253+
credentials = this.cache.credentials[realm][request.ruri];
254+
credentials.method = request.method;
255+
}
256+
257+
return credentials;
258+
};
259+
260+
237261
//==========================
238262
// Event Handlers
239263
//==========================

0 commit comments

Comments
 (0)