Agreed. Initially I thought it was a stale nonce. I captured the messages at the moment it went from working to not working and compared the nonces. The developers of Linphone have not responded to a bug report.
Rob On Thursday, January 11, 2018 2:20:48 AM PST Bogdan-Andrei Iancu wrote: > oh, so it is even worst, like the UA is generating its own nonce - you > now this a violation of the Digest authentication RFC and a huge > security risk for a SIP server - this is why OpenSIPS rejects expired or > unknown nonces. Otherwise someone can attach your service by simply > re-using credentials collected from network level. > > Regards, > > Bogdan-Andrei Iancu > > OpenSIPS Founder and Developer > http://www.opensips-solutions.com > OpenSIPS Summit 2018 > http://www.opensips.org/events/Summit-2018Amsterdam > > On 01/11/2018 01:59 AM, Robert Dyck wrote: > > I have to accept that I cannot work around the UA's bug. A strange bug > > that > > only manifests itself after an hour or so. The servers say the nonce is > > stale when in fact the UA presents a nonce of its own invention even > > changing the number of characters in the nonce. > > > > Thank you for your time > > Rob > > > > On Wednesday, January 10, 2018 1:14:22 AM PST Bogdan-Andrei Iancu wrote: > >> Hi Robert, > >> > >> Yes, it is exactly what I understood :). Again, if the nonce is expired > >> (too old - see nonce_expire - > >> http://www.opensips.org/html/docs/modules/2.3.x/auth.html#idp185504), > >> there is no way to force its acceptance. OpenSIPS will reject it as > >> stale (even if there is correct auth answer). > >> > >> The disable_nonce_check parameter > >> (http://www.opensips.org/html/docs/modules/2.3.x/auth.html#idp5552944) > >> is exclusively for nonce re-usage. > >> > >> Regards, > >> > >> Bogdan-Andrei Iancu > >> > >> OpenSIPS Founder and Developer > >> > >> http://www.opensips-solutions.com > >> > >> OpenSIPS Summit 2018 > >> > >> http://www.opensips.org/events/Summit-2018Amsterdam > >> > >> On 01/09/2018 05:53 PM, Robert Dyck wrote: > >>> Let me rephrase. The UA receives a 401 message from opensip. The nonce > >>> is > >>> reported as stale. The UA attempts again to register using the same > >>> nonce > >>> as previously. On and on. I calculated the digest myself and it is > >>> correct for the stale nonce. My thinking is that if opensips ignored the > >>> fact that the nonce has expired then register should succeed. > >>> > >>> On Tuesday, January 9, 2018 6:39:04 AM PST Bogdan-Andrei Iancu wrote: > >>>> Hi Rob, > >>>> > >>>> A "reused" and a "stale" nonce are different things. A reused one means > >>>> that same nonce is to be used for multiple auth attempts. A stale nonce > >>>> means the nonce (used or not) is rejected as it is too old (relative to > >>>> the time when the nonce was generated by the server). > >>>> > >>>> Of course, the stale check is first perform (and mandatory). After that > >>>> (according to disable_nonce_check option) the nonce re-usage is > >>>> checked. > >>>> > >>>> Regards, > >>>> > >>>> Bogdan-Andrei Iancu > >>>> > >>>> OpenSIPS Founder and Developer > >>>> > >>>> http://www.opensips-solutions.com > >>>> > >>>> OpenSIPS Summit 2018 > >>>> > >>>> http://www.opensips.org/events/Summit-2018Amsterdam > >>>> > >>>> On 01/08/2018 08:36 PM, Robert Dyck wrote: > >>>>> Using opensips 2.3.2 compiled from source > >>>>> > >>>>> I have a buggy UA that insists on reusing a stale nonce. I tried to > >>>>> work around it by setting disable_nonce_check. It didn't work for me. > >>>>> Am I misunderstanding the purpose of the parameter or is this an > >>>>> opensips bug? > >>>>> > >>>>> Jan 8 09:46:19 [11380] DBG:core:set_mod_param_regex: found > >>>>> <disable_nonce_check> in module auth [/usr/lib64/opensips/modules/] > >>>>> > >>>>> Rob > >>>>> > >>>>> > >>>>> > >>>>> _______________________________________________ > >>>>> Users mailing list > >>>>> [email protected] > >>>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users _______________________________________________ Users mailing list [email protected] http://lists.opensips.org/cgi-bin/mailman/listinfo/users
