RFC Violation - 401 Unauthorized not sending WWW-Authenticate to SUBSCRIBE messages

[junction1153]

Describe the bug
Previously reported in ticket # 1779 but not addressed. When FS sends a 401 Unauthorized to a SUBSCRIBE request, the WWW-Authenticate string is missing. This is required per RFC RFC 3261 section 22.2

To Reproduce
Simply have an endpoint send a SUBSCRIBE for BLF. When the endpoint re-sends a subscribe after the sofia nonce expired, freeswitch will respond with 401 unauthorized

Expected behavior
WWW-Authenticate string should be received in the SIP message

Package version or git hash

• Tested with 1.10.8 to 1.10.12, all easily reproduceable

[greenbea]

I fixed this bug #2648

[junction1153]

I can confirm that #2648 patches the mentioned issue

[themsley-voiceflex]

Also worth noting that some Fanvil phones will immediately retry the same SUBSCRIBE and get the same response, thus launching their own DoS attack in response to the 401. We had over 50 million SUBSCRIBEs a day due to this bug - I think from around 10 phones. Fanvil issued firmware updates to stop it from happening.

[greenbea]

@themsley-voiceflex did you test the patch?

[volga629-1]

@greenbea I tested patch and fix works as intended. SUBSCRIBE in dialog get authenticated properly