Skip to content

Commit

Permalink
Fix documentation on loose_route().
Browse files Browse the repository at this point in the history
loose_route() returns FALSE only if there is no Route header or if preloaded local Route only.
Reported by @gergelypeli on github
Closes #550

(cherry picked from commit 2421034)
  • Loading branch information
bogdan-iancu committed Jun 11, 2015
1 parent c0df4e9 commit 8b1bd12
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 29 deletions.
26 changes: 13 additions & 13 deletions modules/rr/README
Expand Up @@ -222,19 +222,19 @@ modparam("rr", "enable_socket_mismatch_warning", 0)
loose_route. It also takes care of translating between
strict-routers and loose-router.

The loose_route function analyzes the Route: headers in the
requests. If there is no Route: header, the function returns
FALSE and routing should be done with normal lookup functions.
If a Route: header is found, the function returns 1 and behaves
as described in section 16.12 of RFC 3261. The only exceptions
are : 1. If the request is out-of-dialog (no to-tag) and there
is only one Route: header indicating the local proxy, then the
Route: header is removed and the function returns FALSE. 2. If
the request in inside a dialog ( has a to-tag ), loose-routing
was used ($ru is end-point) and Route contains only the local
proxy, the function returns FALSE. 3. If there is a Route
Header but other parsing errors occur ( like parsing the TO
header to get the TAG ), the function also returns FALSE.
The loose_route() function analyzes the Route headers in the
requests. If there is no Route header, the function returns
FALSE and routing should be done exclusivly via RURI. If a
Route header is found, the function returns TRUE and behaves as
described in section 16.12 of RFC 3261. The only exception is
for requests with preload Route headers (intial requests,
carrying a Route header): if there is only one Route header
indicating the local proxy, then the Route header is removed
and the function returns FALSE.

If there is a Route header but other parsing errors occur (
like parsing the TO header to get the TAG ), the function also
returns FALSE.

Make sure your loose_routing function can't be used by
attackers to bypass proxy authorization.
Expand Down
27 changes: 11 additions & 16 deletions modules/rr/doc/rr_admin.xml
Expand Up @@ -226,24 +226,19 @@ modparam("rr", "enable_socket_mismatch_warning", 0)
loose-router.
</para>
<para>
The loose_route function analyzes the Route: headers in the requests.
If there is no Route: header, the function returns FALSE and routing
should be done with normal lookup functions. If a Route: header is
found, the function returns 1 and behaves as described in section
16.12 of RFC 3261.

The only exceptions are :
1. If the request is
out-of-dialog (no to-tag) and there is only one Route: header
indicating the local proxy, then the Route: header is removed and
the function returns FALSE.
2. If the request in inside a dialog ( has a to-tag ), loose-routing was used
($ru is end-point) and Route contains only the local proxy, the function
returns FALSE.
3. If there is a Route Header but other parsing errors occur ( like
The loose_route() function analyzes the Route headers in the requests.
If there is no Route header, the function returns FALSE and routing
should be done exclusivly via RURI. If a Route header is
found, the function returns TRUE and behaves as described in section
16.12 of RFC 3261. The only exception is for requests with preload
Route headers (intial requests, carrying a Route header): if there is
only one Route header indicating the local proxy, then the Route
header is removed and the function returns FALSE.
</para>
<para>
If there is a Route header but other parsing errors occur ( like
parsing the TO header to get the TAG ), the function also returns
FALSE.

</para>
<para>
Make sure your loose_routing function can't be used by attackers to
Expand Down

0 comments on commit 8b1bd12

Please sign in to comment.