<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hello,</p>
<p>I did some research, from RFC 2617:<br>
</p>
<pre> stale
A flag, indicating that the previous request from the client was
rejected because the nonce value was stale. If stale is TRUE
(case-insensitive), the client may wish to simply retry the request
with a new encrypted response, without reprompting the user for a
new username and password. The server should only set stale to TRUE
if it receives a request for which the nonce is invalid but with a
valid digest for that nonce (indicating that the client knows the
correct username/password). If stale is FALSE, or anything other
than TRUE, or the stale directive is not present, the username
and/or password are invalid, and new values must be obtained.</pre>
<p>It is a "SHOULD", not a "MUST". So it would be also ok to go with the current implementation.<br>
</p>
<p>That said, of course changing the auth module to make it more compliant to the spec would be a good idea. That could be also done with a parameter to switch between both modes (related to the discussed performance concerns).<br>
</p>
<p>About the other question in another part of this thread related to nonce re-use, I only found this old discussion:</p>
<p><a class="moz-txt-link-freetext" href="https://lists.cs.columbia.edu/pipermail/sip-implementors/2003-October/005486.html">https://lists.cs.columbia.edu/pipermail/sip-implementors/2003-October/005486.html</a></p>
<p>This supports the point given above again:</p>
<pre>"the server has the option of computing whether or not the credentials
used to construct the response value with that nonce were good, and if
so return 'stale=true' to indicate that a retry using the same
credentials and the new nonce should succeed, but it is not required
to do that check."</pre>
<p>Cheers,</p>
<p>Henning<br>
</p>
<div class="moz-cite-prefix">Am 03.07.19 um 07:30 schrieb Juha Heinanen:<br>
</div>
<blockquote type="cite" cite="mid:23836.15752.889532.699297@tutpro.com">
<pre class="moz-quote-pre" wrap="">Daniel-Constantin Mierla writes:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">With the above considerations, to make it specs compliant, the code has to
be extended that even in the case of expired nonce, the auth_db (and the
other auth* variants) has to go further to compute the response and if
there was a match, then add stale=true. As it is right now, if someone
sends an expired nonce with an incorrect password, the stale=true is added,
even it shouldn't as per specs.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I would consider that a serious bug that needs to be fixed. stale=true
should be set only in case authentication would otherwise succeed, but
nonce has expired.
After the fix, I don't see any reason why stale=true could not be set.
-- Juha
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Henning Westerholt - <a class="moz-txt-link-freetext" href="https://skalatan.de/blog/">https://skalatan.de/blog/</a>
Kamailio services - <a class="moz-txt-link-freetext" href="https://skalatan.de/services">https://skalatan.de/services</a></pre>
</body>
</html>