modules/ims_auth: ims_www_challenge allows specification of auth algorithm from cfg

	- e.g. ims_www_challenge("REG_MAR_REPLY", "$td", "MD5");
	- useful for non-ims clients that do not do AKA

modules/ims_auth/authims_mod.c

@@ -113,6 +113,7 @@ int ignore_failed_auth = 0;
 static cmd_export_t cmds[] = {
     {"ims_www_authenticate", (cmd_function) www_authenticate, 1, auth_fixup, 0, REQUEST_ROUTE},
     {"ims_www_challenge", (cmd_function) www_challenge, 2, challenge_fixup_async, 0, REQUEST_ROUTE},
+    {"ims_www_challenge", (cmd_function) www_challenge, 3, challenge_fixup_async, 0, REQUEST_ROUTE},
     {"ims_www_resync_auth", (cmd_function) www_resync_auth, 2, challenge_fixup_async, 0, REQUEST_ROUTE},
     {"ims_proxy_authenticate", (cmd_function) proxy_authenticate, 1, auth_fixup, 0, REQUEST_ROUTE},
     {"ims_proxy_challenge", (cmd_function) proxy_challenge, 2, auth_fixup_async, 0, REQUEST_ROUTE},
@@ -262,7 +263,12 @@ static int challenge_fixup_async(void** param, int param_no) {
         return 0;
     } else if (param_no == 2) {
         if (fixup_var_str_12(param, 1) == -1) {
-            LM_ERR("Erroring doing fixup on challenge");
+            LM_ERR("Error doing fixup on challenge");
+            return -1;
+        }
+    } else if (param_no == 3) /* algorithm */ {
+	if (fixup_var_str_12(param, 1) == -1) {
+            LM_ERR("Error doing fixup on challenge");
             return -1;
         }
     }

modules/ims_auth/authorize.c

@@ -269,13 +269,13 @@ int proxy_authenticate(struct sip_msg* _m, char* _realm, char* _table) {
     return digest_authenticate(_m, &srealm, &stable, HDR_PROXYAUTH_T);
 }
  */
-int challenge(struct sip_msg* msg, char* str1, char* str2, int is_proxy_auth, char *route) {
+int challenge(struct sip_msg* msg, char* str1, char* alg, int is_proxy_auth, char *route) {
 
-    str realm = {0, 0};
+    str realm = {0, 0}, algo = {0,0};
     unsigned int aud_hash;
     str private_identity, public_identity, auts = {0, 0}, nonce = {0, 0};
     auth_vector *av = 0;
-    int algo_type;
+    int algo_type = 0;
     str route_name;
 
     saved_transaction_t* saved_t;
@@ -287,6 +287,15 @@ int challenge(struct sip_msg* msg, char* str1, char* str2, int is_proxy_auth, ch
         return -1;
     }
     
+    if (!alg) {
+	LM_DBG("no algorithm specified in cfg... using default\n");
+    } else {
+	if (get_str_fparam(&algo, msg, (fparam_t*) alg) < 0) {
+	    LM_ERR("failed to get auth algorithm\n");
+	    return -1;
+	}
+    }
+    
     LM_DBG("Looking for route block [%.*s]\n", route_name.len, route_name.s);
     int ri = route_get(&main_rt, route_name.s);
     if (ri < 0) {
@@ -343,8 +352,12 @@ int challenge(struct sip_msg* msg, char* str1, char* str2, int is_proxy_auth, ch
         return CSCF_RETURN_BREAK;
     }
 
-    algo_type = registration_default_algorithm_type;
-
+    if (algo.len > 0) {
+	algo_type = get_algorithm_type(algo);
+    } else {
+	algo_type = registration_default_algorithm_type;
+    }
+    
 //    /* check if it is a synchronization request */
 //    //TODO this is MAR syncing - have removed it currently - TOD maybe put back in
 //    auts = ims_get_auts(msg, realm, is_proxy_auth);

modules/ims_auth/doc/ims_auth_admin.xml

@@ -422,17 +422,17 @@ if (!www_authorize("kamailio.org", "subscriber")) {
     </section>
 
     <section>
-      <title><function moreinfo="none">ims_www_authenticate(realm,
-      table)</function></title>
+      <title><function
+      moreinfo="none">ims_www_authenticate(realm)</function></title>
 
-      <para>It is same function as www_authenticate(realm, table). This name
-      is kept for backward compatibility, since it was named this way first
-      time by it actually does user authentication.</para>
+      <para>It is the same function as www_authenticate(realm, table). This
+      name is kept for backward compatibility, since it was named this way
+      first time by it actually does user authentication.</para>
     </section>
 
     <section>
-      <title><function moreinfo="none">ims_www_challenge(route_block, realm,
-      table)</function></title>
+      <title><function moreinfo="none">ims_www_challenge(route_block,
+      realm)</function></title>
 
       <para>Name alias: proxy_authorize(realm, table)</para>
 
@@ -471,17 +471,12 @@ if (!www_authorize("kamailio.org", "subscriber")) {
 
           <para>The string may contain pseudo variables.</para>
         </listitem>
-
-        <listitem>
-          <para><emphasis>table</emphasis> - Table to be used to lookup
-          usernames and passwords (usually subscribers table).</para>
-        </listitem>
       </itemizedlist>
 
       <para>This function can be used from REQUEST_ROUTE.</para>
 
       <example>
-        <title>proxy_authorize usage</title>
+        <title>ims_www_challenge usage</title>
 
         <programlisting format="linespecific">
 ...
@@ -513,6 +508,53 @@ route[REG_MAR_REPLY]
      }
      exit;           
 }               
+</programlisting>
+      </example>
+    </section>
+
+    <section>
+      <title><function moreinfo="none">ims_www_challenge(route_block, realm,
+      algorithm)</function></title>
+
+      <para>Same as 4.3 except here there is the addiional option to specify
+      the authorisation algorithm</para>
+
+      <itemizedlist>
+        <listitem>
+          <para><emphasis>algorithm</emphasis> - The algorithm to be used when
+          challenging the client. Can be AKAv1-MD5, AKAv2-MD5, MD5, or
+          HSS-Selected. If left as an empty string, the default algorithm will
+          be chosen according to the parameter registration_default_algorithm
+          (see section 3.7)</para>
+        </listitem>
+      </itemizedlist>
+
+      <para>This function can be used from REQUEST_ROUTE.</para>
+
+      <example>
+        <title>ims_www_challenge usage</title>
+
+        <programlisting format="linespecific">
+...
+ if (!ims_www_authenticate(NETWORKNAME)) {
+                #user has not been authenticated. Lets send a challenge via 401 Unauthorized
+                if ($? == -2) {
+                        t_reply("403", "Authentication Failed");
+                        exit;
+                } else if ($? == -3) {
+                        t_reply("400", "Bad Request");
+                        exit;
+                } else if ($? == -9) {
+                        xlog("L_DBG", "Authentication re-sync requested\n");
+                        ims_www_resync_auth("REG_RESYNC_REPLY", "$td");
+                        exit;
+                } else {
+                        xlog("L_DBG","About to challenge! auth_ims\n"); 
+                        ims_www_challenge("REG_MAR_REPLY", "$td", "MD5");
+                        exit;
+                }
+        }
+
 </programlisting>
       </example>
     </section>