[kamailio] auth_check: to 2 accounts on the same Phone, same username different realm fails with -2 (#548)
Hi there, we are using kamailio as Registrar and Dispatcher. Running ```modparam("auth_db", "use_domain", MULTIDOMAIN) //with MULTIDOMAIN = 1``` In our ```route[AUTH]``` I call ```if (!auth_check("$fd", "subscriber", "1")) {``` to filter unwanted Guests and and brute-force attacks to the blacklist.
strangely auth_check fails under the following conditions: 1 UserAgent(Phone) with 2 SipAccounts with the same user-name but different realm The first account can REGISTER without a problem. for the second Account REGISTER fails with -2. If I disable the first one the second one Registered.
Could it be that auth_check is not multidomain-safe in one user-agent thread?
Hope to here from you...
PS: I like kamailio =).
--- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/548
Here some logs of the auth_check. If I switch the load-order on the Phone account 1 fails. [kamailio_auth_check_log.txt](https://github.com/kamailio/kamailio/files/184449/kamailio_auth_check_log.tx...)
--- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/548#issuecomment-199876347
Closed #548.
--- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/548#event-600156181
Realm is used for domain matching in subscriber table. Also be sure that if you use ha1 for digest authentication, the realm is used to build that string. You need to have two records in this case inside the subscriber table.
This is something to continue on sr-users@lists.sip-router.org mailing list if you want to discuss more. It is not related to a bug in the code and the tracker here is not used as a discussions forum, so I am closing the item here.
--- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/548#issuecomment-200313772
Hello again,
Sorry to bother again. I am using it exactly as you describe. please let me elaborate: I have one Hardware-Phone with 2 SipAccounts: 34@domain1, 34@domain2. Both have a row in the subscribers table (ha1 calculated with: MD5(34:domain:password)). If I try to register the second account to register fails. If I move the Account to a different Hardware-Phone It registers.
Therefore there must be an issue in the code with threading authentication of SipAccount with the same username but different domains from one ip-address and port.
--- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/548#issuecomment-200348409
After further testing this seems to be a problem of the phones firmware. I tried it with a som320 and it works fine. Thank you...
--- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/548#issuecomment-200377867
-
chiluap -
Daniel-Constantin Mierla