{"action":"created","issue":{"url":"https://api.github.com/repos/Metaswitch/sprout/issues/1599","repository_url":"https://api.github.com/repos/Metaswitch/sprout","labels_url":"https://api.github.com/repos/Metaswitch/sprout/issues/1599/labels{/name}","comments_url":"https://api.github.com/repos/Metaswitch/sprout/issues/1599/comments","events_url":"https://api.github.com/repos/Metaswitch/sprout/issues/1599/events","html_url":"https://github.com/Metaswitch/sprout/issues/1599","id":190497293,"number":1599,"title":"Sprout will incorrectly fail AKA authentication if the RES/XRES contains an 0x00 byte","user":{"login":"rkd-msw","id":4363492,"avatar_url":"https://avatars.githubusercontent.com/u/4363492?v=3","gravatar_id":"","url":"https://api.github.com/users/rkd-msw","html_url":"https://github.com/rkd-msw","followers_url":"https://api.github.com/users/rkd-msw/followers","following_url":"https://api.github.com/users/rkd-msw/following{/other_user}","gists_url":"https://api.github.com/users/rkd-msw/gists{/gist_id}","starred_url":"https://api.github.com/users/rkd-msw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rkd-msw/subscriptions","organizations_url":"https://api.github.com/users/rkd-msw/orgs","repos_url":"https://api.github.com/users/rkd-msw/repos","events_url":"https://api.github.com/users/rkd-msw/events{/privacy}","received_events_url":"https://api.github.com/users/rkd-msw/received_events","type":"User","site_admin":false},"labels":[{"id":38617503,"url":"https://api.github.com/repos/Metaswitch/sprout/labels/bug","name":"bug","color":"fc2929","default":true},{"id":486015646,"url":"https://api.github.com/repos/Metaswitch/sprout/labels/cat:system-test","name":"cat:system-test","color":"996633","default":false},{"id":90665651,"url":"https://api.github.com/repos/Metaswitch/sprout/labels/high-priority","name":"high-priority","color":"ff0000","default":false}],"state":"open","locked":false,"assignee":{"login":"rkd-msw","id":4363492,"avatar_url":"https://avatars.githubusercontent.com/u/4363492?v=3","gravatar_id":"","url":"https://api.github.com/users/rkd-msw","html_url":"https://github.com/rkd-msw","followers_url":"https://api.github.com/users/rkd-msw/followers","following_url":"https://api.github.com/users/rkd-msw/following{/other_user}","gists_url":"https://api.github.com/users/rkd-msw/gists{/gist_id}","starred_url":"https://api.github.com/users/rkd-msw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rkd-msw/subscriptions","organizations_url":"https://api.github.com/users/rkd-msw/orgs","repos_url":"https://api.github.com/users/rkd-msw/repos","events_url":"https://api.github.com/users/rkd-msw/events{/privacy}","received_events_url":"https://api.github.com/users/rkd-msw/received_events","type":"User","site_admin":false},"assignees":[{"login":"rkd-msw","id":4363492,"avatar_url":"https://avatars.githubusercontent.com/u/4363492?v=3","gravatar_id":"","url":"https://api.github.com/users/rkd-msw","html_url":"https://github.com/rkd-msw","followers_url":"https://api.github.com/users/rkd-msw/followers","following_url":"https://api.github.com/users/rkd-msw/following{/other_user}","gists_url":"https://api.github.com/users/rkd-msw/gists{/gist_id}","starred_url":"https://api.github.com/users/rkd-msw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rkd-msw/subscriptions","organizations_url":"https://api.github.com/users/rkd-msw/orgs","repos_url":"https://api.github.com/users/rkd-msw/repos","events_url":"https://api.github.com/users/rkd-msw/events{/privacy}","received_events_url":"https://api.github.com/users/rkd-msw/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2016-11-19T13:47:28Z","updated_at":"2016-11-23T14:34:27Z","closed_at":null,"body":"<!--\r\nThis page is for reporting issues with Project Clearwater. If you have a question, rather than a bug report, the mailing list at clearwater@lists.projectclearwater.org is a better place for it.\r\n\r\nTo give us the best chance of fixing the problem, we've suggested some information to give - please follow these guidelines if possible.\r\n\r\nDon't forget that you can attach logs and screenshots to Github issues - this may help us debug a problem.\r\n-->\r\n\r\n#### Symptoms\r\n<!-- What exactly went wrong? (If possible, copy and paste the exact output you saw) -->\r\n\r\nI added an AKAv1 live test, and noticed it intermittently failing (with my authenticated REGISTER being rejected with a 403 Forbidden). A SAS trace is at \\\\ad\\csd\\bigfiles\\clearwater\\issue-attachments\\.\r\n\r\nLooking at this SAS trace, the SIP-Authorization in the MAA is 0x346667c3e9200037 - i.e. one of the bytes is 0x00. I added some logging to my test script, which confirms that the failures happen when (and only when) the RES contains a zero byte.\r\n\r\n#### Impact\r\n<!-- What is this preventing you from doing? Does this stop Clearwater working, or stop some calls being processed? -->\r\n\r\nThis causes a REGISTER to be rejected with a 403 when it happens, and https://tools.ietf.org/html/rfc3261#section-21.4.4 says that 403 means a request SHOULD NOT be repeated, so a subscriber might lose service when this happens.\r\n\r\nThere are 8 bytes in the RES, and any one of them being 0x00 causes this, so this will happen on (1/256 + 1/255 ... + 1/249) of REGISTERs - i.e. this will make about 3.17% of AKAv1 REGISTERs fail. (That matches up with the frequency of test failures I'm seeing).\r\n\r\n\r\n#### Release and environment \r\n<!-- For example: the \"Doom\" release, whether you're on VMware or OpenStack, etc. -->\r\n\r\nQuilava release, on VMware (but unlikely to be specific to either). I'm using the vmware.obu-enfield.test deployment for this testing.\r\n\r\n#### Steps to reproduce\r\n\r\nAttempt AKAv1 registration with a RES that includes 0x00. (This could probably be reproduced in UT, but RES isn't easy to control live, so you'd just need to REGISTER repeatedly.)"},"comment":{"url":"https://api.github.com/repos/Metaswitch/sprout/issues/comments/262528382","html_url":"https://github.com/Metaswitch/sprout/issues/1599#issuecomment-262528382","issue_url":"https://api.github.com/repos/Metaswitch/sprout/issues/1599","id":262528382,"user":{"login":"richardwhiuk","id":346165,"avatar_url":"https://avatars.githubusercontent.com/u/346165?v=3","gravatar_id":"","url":"https://api.github.com/users/richardwhiuk","html_url":"https://github.com/richardwhiuk","followers_url":"https://api.github.com/users/richardwhiuk/followers","following_url":"https://api.github.com/users/richardwhiuk/following{/other_user}","gists_url":"https://api.github.com/users/richardwhiuk/gists{/gist_id}","starred_url":"https://api.github.com/users/richardwhiuk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richardwhiuk/subscriptions","organizations_url":"https://api.github.com/users/richardwhiuk/orgs","repos_url":"https://api.github.com/users/richardwhiuk/repos","events_url":"https://api.github.com/users/richardwhiuk/events{/privacy}","received_events_url":"https://api.github.com/users/richardwhiuk/received_events","type":"User","site_admin":false},"created_at":"2016-11-23T14:34:27Z","updated_at":"2016-11-23T14:34:27Z","body":"Rob, I've fixed both of these in the attached pull request, so this is back with you to retest."}}
{"actor":{"display_login":"richardwhiuk"}}