6 Jun
2007
6 Jun
'07
10:03 a.m.
I've got a new openser config I'm testing with a secondary server (1.1.1
on Centos5), but I'm having a few problems getting some clients, X-lite
3.0 and an ATA from draytek, who are unable to register with the server.
Watching with ngrep on the server and wireshark locally I see the server
and the client communicating, the client sends a register to the server,
the server says 401 Unauthorized and generates a realm and nonce, but
instead of going on with the next step in the register process (adding
one to the Cseq and generating a nonce of its own) the client just
doesn't seem to notice that the 401 was sent (could they possibly be
expecting a 407?) they just keep trying with the first step in the process.
Is this an error in my config (sending a 401 instead of something else)
or a deficiency in the client ( I have a few grandstream phones which
work perfectly)...
Here's a few lines from the ngrep output...
U X.X.X.30:5061 -> X.X.X.17:5061
REGISTER sip:logycs.it SIP/2.0.
Via: SIP/2.0/UDP X.X.X.30:5061;branch=z9hG4bK-Rgr-15494;rport.
From: Test User <sip:testuser@logycs.it>;tag=dio-18539.
To: <sip:testuser@logycs.it>.
Call-ID: lpB-27408(a)X.X.X.30.
CSeq: 100 REGISTER.
Contact: <sip:testuser@X.X.X.30:5061>.
Max-Forwards: 70.
Expires: 600.
User-Agent: DrayTek UA-1.2.1 Vigor2100V series.
Content-Length: 0.
.
#
U X.X.X.17:5061 -> X.X.X.30:5061
SIP/2.0 100 Trying.
Via: SIP/2.0/UDP X.X.X.30:5061;branch=z9hG4bK-Rgr-15494;rport=5061.
From: Test User <sip:testuser@logycs.it>;tag=dio-18539.
To: <sip:testuser@logycs.it>.
Call-ID: lpB-27408(a)X.X.X.30.
CSeq: 100 REGISTER.
Mobilia SIP Server.
Content-Length: 0.
Warning: 392 X.X.X.17:5061 "Noisy feedback tells: pid=11509
req_src_ip=X.X.X.30 req_src_port=5061 in_uri=sip:logycs.it
out_uri=sip:logycs.it via_cnt==1".
.
#
U X.X.X.17:5061 -> X.X.X.30:5061
SIP/2.0 401 Unauthorized.
Via: SIP/2.0/UDP X.X.X.30:5061;branch=z9hG4bK-Rgr-15494;rport=5061.
From: Test User <sip:testuser@logycs.it>;tag=dio-18539.
To: <sip:testuser@logycs.it>;tag=e39f848b5629fc672733e67aefa3e192.f4af.
Call-ID: lpB-27408(a)X.X.X.30.
CSeq: 100 REGISTER.
WWW-Authenticate: Digest realm="logycs.it",
nonce="4666de896a20a47ce567604e015d96a9f7b93027".
Mobilia SIP Server.
Content-Length: 0.
Warning: 392 X.X.X.17:5061 "Noisy feedback tells: pid=11509
req_src_ip=X.X.X.30 req_src_port=5061 in_uri=sip:logycs.it
out_uri=sip:logycs.it via_cnt==1".
The ATA is .30 and has a public IP, as does the Server (.17)
I personally can't see any errors in terms of where the replies are
being sent, but I may be overlooking something quite obvious.
The useful parts of my openser.cfg (I have use domain as 1 in auth,
auth_db, etc, but the registration isn't even getting that far yet).
listen = udp:X.X.X.17:5061
mpath = "/usr/lib/openser/modules"
alias = siptest.logycs.it
children = 8
debug = 6
fork = yes
disable_tcp = no
log_facility = LOG_LOCAL6
log_stderror = no
tcp_children = 4
mhomed = no
server_header = "Mobilia SIP Server"
server_signature = yes
sock_mode = 0600
user_agent_header = "Mobilia SIP Server"
reply_to_via = no
sip_warning = yes
check_via = yes
dns = no
rev_dns = no
syn_branch = yes
disable_core_dump = yes
dns_try_ipv6 = no
dns_use_search_list = yes
route[0]
{
xlog("L_INFO", "New request - M=$rm RURI=$ru F=$fu T=$tu IP=$si
ID=$ci\n");
force_rport();
if(msg:len > max_len)
{
xlog("L_INFO", "Message too big - M=$rm RURI=$ru F=$fu T=$tu IP=$si
ID=$ci\n");
sl_send_reply("513", "Message Too Big");
exit;
}
if (!mf_process_maxfwd_header("10"))
{
xlog("L_INFO", "Too many hops - M=$rm RURI=$ru F=$fu T=$tu IP=$si
ID=$ci\n");
sl_send_reply("483", "Too Many Hops");
exit;
}
if(!is_method("REGISTER"))
{
if(nat_uac_test("3"))
{
record_route(";nat=yes");
}
else
{
record_route();
}
}
if(loose_route())
{
if(!has_totag())
{
xlog("L_INFO", "Initial loose-routing rejected - M=$rm
RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n");
sl_send_reply("403", "Initial Loose-Routing Rejected");
exit;
}
if(nat_uac_test("19") || search("^Route:.*;nat=yes"))
{
fix_nated_contact();
if(!search("^Content-Length:[ ]*0"))
{
fix_nated_sdp("3");
setflag(6);
}
}
if(is_method("BYE"))
{
setflag(24); # account failed transactions
setflag(25); # account successful transactions
}
# mark as loose-routed for acc
setflag(26);
route(1);
}
if(is_method("REGISTER"))
{
route(2);
}
setflag(24); # account failed transactions
setflag(25); # account successful transactions
if(is_method("INVITE"))
{
route(3);
}
if(is_method("CANCEL") || is_method("ACK"))
{
route(4);
}
route(5);
}
route[2]
{
sl_send_reply("100", "Trying");
if(!www_authorize("", "subscriber"))
{
xlog("L_INFO", "Register authentication failed - M=$rm RURI=$ru F=$fu
T=$tu IP=$si ID=$ci\n");
www_challenge("", "0");
exit;
}
if(!check_to())
{
xlog("L_INFO", "Spoofed To-URI detected - M=$rm RURI=$ru F=$fu T=$tu
IP=$si ID=$ci\n");
sl_send_reply("403", "Spoofed To-URI Detected");
exit;
}
consume_credentials();
if(!search("^Contact:[ ]*\*") && nat_uac_test("19"))
{
fix_nated_register();
setflag(6);
}
if(!save("location"))
{
xlog("L_ERR", "Saving contact failed - M=$rm RURI=$ru F=$fu T=$tu
IP=$si ID=$ci\n");
sl_reply_error();
}
xlog("L_INFO", "Registration successful - M=$rm RURI=$ru F=$fu T=$tu
IP=$si ID=$ci\n");
exit;
}
6 Jun
6 Jun
10:14 a.m.
Nick,
Any special reason why your're using port 5061? It's the port for sips
(sip over TLS), so maybe the client doesn't like that? Try 5060, maybe
that helps.
Beside that, can you ensure the client got that response? Any NAT in
between?
Andreas
nick wrote:
I've got a new openser config I'm testing with
a secondary server (1.1.1
on Centos5), but I'm having a few problems getting some clients, X-lite
3.0 and an ATA from draytek, who are unable to register with the server.
Watching with ngrep on the server and wireshark locally I see the server
and the client communicating, the client sends a register to the server,
the server says 401 Unauthorized and generates a realm and nonce, but
instead of going on with the next step in the register process (adding
one to the Cseq and generating a nonce of its own) the client just
doesn't seem to notice that the 401 was sent (could they possibly be
expecting a 407?) they just keep trying with the first step in the process.
Is this an error in my config (sending a 401 instead of something else)
or a deficiency in the client ( I have a few grandstream phones which
work perfectly)...
Here's a few lines from the ngrep output...
U X.X.X.30:5061 -> X.X.X.17:5061
REGISTER sip:logycs.it SIP/2.0.
Via: SIP/2.0/UDP X.X.X.30:5061;branch=z9hG4bK-Rgr-15494;rport.
From: Test User <sip:testuser@logycs.it>;tag=dio-18539.
To: <sip:testuser@logycs.it>.
Call-ID: lpB-27408(a)X.X.X.30.
CSeq: 100 REGISTER.
Contact: <sip:testuser@X.X.X.30:5061>.
Max-Forwards: 70.
Expires: 600.
User-Agent: DrayTek UA-1.2.1 Vigor2100V series.
Content-Length: 0.
.
#
U X.X.X.17:5061 -> X.X.X.30:5061
SIP/2.0 100 Trying.
Via: SIP/2.0/UDP X.X.X.30:5061;branch=z9hG4bK-Rgr-15494;rport=5061.
From: Test User <sip:testuser@logycs.it>;tag=dio-18539.
To: <sip:testuser@logycs.it>.
Call-ID: lpB-27408(a)X.X.X.30.
CSeq: 100 REGISTER.
Mobilia SIP Server.
Content-Length: 0.
Warning: 392 X.X.X.17:5061 "Noisy feedback tells: pid=11509
req_src_ip=X.X.X.30 req_src_port=5061 in_uri=sip:logycs.it
out_uri=sip:logycs.it via_cnt==1".
.
#
U X.X.X.17:5061 -> X.X.X.30:5061
SIP/2.0 401 Unauthorized.
Via: SIP/2.0/UDP X.X.X.30:5061;branch=z9hG4bK-Rgr-15494;rport=5061.
From: Test User <sip:testuser@logycs.it>;tag=dio-18539.
To: <sip:testuser@logycs.it>;tag=e39f848b5629fc672733e67aefa3e192.f4af.
Call-ID: lpB-27408(a)X.X.X.30.
CSeq: 100 REGISTER.
WWW-Authenticate: Digest realm="logycs.it",
nonce="4666de896a20a47ce567604e015d96a9f7b93027".
Mobilia SIP Server.
Content-Length: 0.
Warning: 392 X.X.X.17:5061 "Noisy feedback tells: pid=11509
req_src_ip=X.X.X.30 req_src_port=5061 in_uri=sip:logycs.it
out_uri=sip:logycs.it via_cnt==1".
The ATA is .30 and has a public IP, as does the Server (.17)
I personally can't see any errors in terms of where the replies are
being sent, but I may be overlooking something quite obvious.
The useful parts of my openser.cfg (I have use domain as 1 in auth,
auth_db, etc, but the registration isn't even getting that far yet).
listen = udp:X.X.X.17:5061
mpath = "/usr/lib/openser/modules"
alias = siptest.logycs.it
children = 8
debug = 6
fork = yes
disable_tcp = no
log_facility = LOG_LOCAL6
log_stderror = no
tcp_children = 4
mhomed = no
server_header = "Mobilia SIP Server"
server_signature = yes
sock_mode = 0600
user_agent_header = "Mobilia SIP Server"
reply_to_via = no
sip_warning = yes
check_via = yes
dns = no
rev_dns = no
syn_branch = yes
disable_core_dump = yes
dns_try_ipv6 = no
dns_use_search_list = yes
route[0]
{
xlog("L_INFO", "New request - M=$rm RURI=$ru F=$fu T=$tu IP=$si
ID=$ci\n");
force_rport();
if(msg:len > max_len)
{
xlog("L_INFO", "Message too big - M=$rm RURI=$ru F=$fu T=$tu IP=$si
ID=$ci\n");
sl_send_reply("513", "Message Too Big");
exit;
}
if (!mf_process_maxfwd_header("10"))
{
xlog("L_INFO", "Too many hops - M=$rm RURI=$ru F=$fu T=$tu IP=$si
ID=$ci\n");
sl_send_reply("483", "Too Many Hops");
exit;
}
if(!is_method("REGISTER"))
{
if(nat_uac_test("3"))
{
record_route(";nat=yes");
}
else
{
record_route();
}
}
if(loose_route())
{
if(!has_totag())
{
xlog("L_INFO", "Initial loose-routing rejected - M=$rm RURI=$ru
F=$fu T=$tu IP=$si ID=$ci\n");
sl_send_reply("403", "Initial Loose-Routing Rejected");
exit;
}
if(nat_uac_test("19") || search("^Route:.*;nat=yes"))
{
fix_nated_contact();
if(!search("^Content-Length:[ ]*0"))
{
fix_nated_sdp("3");
setflag(6);
}
}
if(is_method("BYE"))
{
setflag(24); # account failed transactions
setflag(25); # account successful transactions
}
# mark as loose-routed for acc
setflag(26);
route(1);
}
if(is_method("REGISTER"))
{
route(2);
}
setflag(24); # account failed transactions
setflag(25); # account successful transactions
if(is_method("INVITE"))
{
route(3);
}
if(is_method("CANCEL") || is_method("ACK"))
{
route(4);
}
route(5);
}
route[2]
{
sl_send_reply("100", "Trying");
if(!www_authorize("", "subscriber"))
{
xlog("L_INFO", "Register authentication failed - M=$rm RURI=$ru
F=$fu T=$tu IP=$si ID=$ci\n");
www_challenge("", "0");
exit;
}
if(!check_to())
{
xlog("L_INFO", "Spoofed To-URI detected - M=$rm RURI=$ru F=$fu T=$tu
IP=$si ID=$ci\n");
sl_send_reply("403", "Spoofed To-URI Detected");
exit;
}
consume_credentials();
if(!search("^Contact:[ ]*\*") && nat_uac_test("19"))
{
fix_nated_register();
setflag(6);
}
if(!save("location"))
{
xlog("L_ERR", "Saving contact failed - M=$rm RURI=$ru F=$fu T=$tu
IP=$si ID=$ci\n");
sl_reply_error();
}
xlog("L_INFO", "Registration successful - M=$rm RURI=$ru F=$fu T=$tu
IP=$si ID=$ci\n");
exit;
}
_______________________________________________
Users mailing list
Users(a)openser.org
http://openser.org/cgi-bin/mailman/listinfo/users
11:25 a.m.
Andreas Granig wrote:
Nick,
Any special reason why your're using port 5061? It's the port for sips
(sip over TLS), so maybe the client doesn't like that? Try 5060, maybe
that helps.
Beside that, can you ensure the client got that response? Any NAT in
between?
Andreas
I was using 5061 because it's a VM running on the same server, and this
way I was able to filter the traffic when looking at the ngrep output...
I just got a mail from Xlite support they said the problem was probably
this: Mobilia SIP Server.
My server header/signature was confusing the clients, as soon as I
removed it, everything works perfectly... probably I need to learn a bit
more about what can go in headers.
11:30 a.m.
Nick,
Ah, didn't see that from your dump. You have to set a Header-Name, like
"Server: Mobilia SIP Server", not just the value.
Andreas
nick wrote:
Andreas Granig wrote:
Nick,
Any special reason why your're using port 5061? It's the port for sips
(sip over TLS), so maybe the client doesn't like that? Try 5060, maybe
that helps.
Beside that, can you ensure the client got that response? Any NAT in
between?
Andreas
I was using 5061 because it's a VM running on the same server, and this
way I was able to filter the traffic when looking at the ngrep output...
I just got a mail from Xlite support they said the problem was probably
this: Mobilia SIP Server.
My server header/signature was confusing the clients, as soon as I
removed it, everything works perfectly... probably I need to learn a bit
more about what can go in headers.
7 Jun
7 Jun
12:18 a.m.
server_header = "Server: XXX SIP Server"
pls check this URL:
http://www.openser.org/dokuwiki/doku.php/core-cookbook:1.2.x#server_header
Please note that OpenSER will only write
My Company SIP Proxy.
into the header.
To add a valid Server: Header, use server_header="Server: My Company SIP Proxy",
this will add
Server: My Company SIP Proxy
I just trapped into this Problem with OpenSER 1.1.0 and Sipura Clients, Softphones work
correctly.
Best regards,
Gang Liu
__________________________________________
----- Original Message -----
From: "nick" <nick(a)mobilia.it>
To: "Andreas Granig" <agranig(a)sipwise.com>
Cc: <users(a)openser.org>
Sent: Wednesday, June 06, 2007 11:25 PM
Subject: Re: [Users] strange behaviour from clients
> Andreas Granig wrote:
> > Nick,
> >
> > Any special reason why your're using port 5061? It's the port for sips
> > (sip over TLS), so maybe the client doesn't like that? Try 5060, maybe
> > that helps.
> >
> > Beside that, can you ensure the client got that response? Any NAT in
> > between?
> >
> > Andreas
> >
>
> I was using 5061 because it's a VM running on the same server, and this
> way I was able to filter the traffic when looking at the ngrep output...
>
> I just got a mail from Xlite support they said the problem was probably
> this: Mobilia SIP Server.
>
> My server header/signature was confusing the clients, as soon as I
> removed it, everything works perfectly... probably I need to learn a bit
> more about what can go in headers.
>
>
>
>
>
>
> _______________________________________________
> Users mailing list
> Users(a)openser.org
> http://openser.org/cgi-bin/mailman/listinfo/users
>
>
6229
days inactive
6230
days old
4 comments
3 participants
participants (3)
-
Andreas Granig -
Gang Liu -
nick