[SR-Users] Websocket INVITE 407 error

Klaus Darilion klaus.mailinglists at pernau.at
Tue Aug 21 19:42:45 CEST 2012 

When you send the INVITE, then the RURI is not sip:10.1.20.40 but 
sip:102 at 10.1.20.40 - it includes the user part.

I see that you have it correct in the Proxy-Authorization header of the 
INVITE, but maybe you calculated the response with the wrong URI.

Anyway, taking a look at your INVITE from your previous email:

INVITE sip:102 at 10.1.20.40 SIP/2.0
Via: SIP/2.0/WS
KMkjMf37lVeM.invalid;branch=z9hG4bK8cie6bGSG0eOGh7Ne08Ro4CS1hI0oJ
From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
To: sip:102 at 10.1.20.40
Call-ID: 9KoKnFdh285k2jg4
CSeq: 3 INVITE
Max-Forwards: 70
Supported: path, outbound, gruu
Contact: <sip:101 at KMkjMf37lVeM.invalid;transport=ws
	;gr=urn:uuid:beb-68a9-6396e5f4;ob>
Proxy-Authorization: Digest username="101", realm="10.1.20.40",
nonce="UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4Re", opaque="",
uri="sip:102 at 10.1.20.40", response= "f4bbe128abf3acb3a4e11882749d8798"
Content-Type: application/sdp

This gives as input to my script:
username: 101
password: 101 (hope this is correct)
realm: 10.1.20.40
nonce: UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4Re
uri: sip:102 at 10.1.20.40
method: INVITE

--> my script calculates 4a6dab565fa5f1e39e13960c2f323eab but the INVITE 
contains f4bbe128abf3acb3a4e11882749d8798. So, your stack seems to be buggy.

regards
klaus




On 21.08.2012 16:05, David Patiño wrote:
> Hi,
>
> Awesome tool!
>
> I've been checking my info with the output of your script and the
> output is the same. Maybe the auth problem is not here or maybe I've
> made mistakes. Could you please tell my if the data I'm using is
> correct?
>
> For example, I'm user 101 and I want to call to user 102. So I've used
> the following values to create the INVITE response to 407 message:
>
> User: 101
> Pass: 101
> realm: 10.1.20.40
> nonce:"UDOU+1Azk89QyTccXdYGLoCTgF7+rIGv"
> uri: sip:10.1.20.40
>
> HA1 params: 101:10.1.20.40:101
> HA1: 1d578520f175df632f0850415e603029
> HA2 params: INVITE:sip:10.1.20.40
> HA2: 793dd6fa2e181e25a226cc09efc6dc2c
> Sol params: 1d578520f175df632f0850415e603029:UDOU+1Azk89QyTccXdYGLoCTgF7+rIGv:793dd6fa2e181e25a226cc09efc6dc2c
> Sol: 362206a07a3782c6e2557699abe5bf7b
>
> Are those values correct?
>
> Thank you very much.
> Kind Regards,
>
> --
>       --DAVID--
>
>
>
> 2012/8/21 Klaus Darilion <klaus.mailinglists at pernau.at>:
>> I just hacked a small PHP script to calculate and verify the nonce manually:
>> http://pernau.at/kd/sipdigest.php
>>
>> regards
>> Klaus
>>
>> PS: do not use "secret" passwords for testing :-)
>>
>>
>>
>>
>> On 21.08.2012 13:24, David Patiño wrote:
>>>
>>> Hello,
>>>
>>> I've just test a sip call from an X-Lite client to Ekiga client an
>>> everything has gone ok.
>>> It seems an issue with authentication over WebSockets but I have no
>>> experience in this area so I can not say where the problem is (and
>>> REGISTER auth works fine).
>>>
>>> Any other idea or anything else to check?
>>>
>>> I'm blocked since last week.
>>>
>>> Thanks a lot.
>>> Kind Regards,
>>>
>>> --
>>>        --DAVID--
>>>
>>>
>>>
>>>
>>> 2012/8/21 Peter Dunkley <peter.dunkley at crocodile-rcs.com>
>>>>
>>>>
>>>> Hello,
>>>>
>>>> This does look like an issue with authentication rather than WebSockets.
>>>> Have you tried using an ordinary SIP client (for example, Jitsi) with
>>>> your
>>>> Kamailio configuration to verify that the authentication part of
>>>> kamailio.cfg is correct?
>>>>
>>>> Regards,
>>>>
>>>> Peter
>>>>
>>>>
>>>> On Tue, 2012-08-21 at 10:59 +0200, David Patiño wrote:
>>>>
>>>> Hi there,
>>>>
>>>> I'm new on kamailio users list.
>>>> Now I'm developing a client in javascript (using websockets) to SIP
>>>> calls.
>>>>
>>>> I'm using last devel version of kamailio with websocket support. I've
>>>> already get a correct REGISTER transaction but now I'm not able to get
>>>> a correct INVITE transaction. Actually I'm not sure if this a kamailio
>>>> error or a problem with my source code however I'm using the same
>>>> function to get digest info from received nonce both REGISTER and
>>>> INVITE transactions. The INVITE transaction always enters in an
>>>> endless loop with 407 requests.
>>>>
>>>> Please, is there anybody who could help me?
>>>>
>>>> Those are the frames of my code (obtained from chrome browser console):
>>>>
>>>> wsUri: ws://10.1.20.40:80/
>>>> SOCKET CREATED
>>>> SOCKET OPENED
>>>>
>>>> SENT:
>>>> REGISTER sip:10.1.20.40 SIP/2.0
>>>> Via: SIP/2.0/WS
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bK1C36k8S3b0OobHUAOLLOae0SbsbEQg
>>>> From: sip:101 at 10.1.20.40;tag=Me0arqDG6K8o7l32oJgR
>>>> To: sip:101 at 10.1.20.40
>>>> Call-ID: 0EQSBkoG9RGgfg3E
>>>> CSeq: 1 REGISTER
>>>> Max-Forwards: 70
>>>> Supported: path, outbound, gruu
>>>> Contact: <sip:101 at KMkjMf37lVeM.invalid;transport=ws>
>>>>          ;reg-id=98
>>>>          ;+sip.instance="<urn:uuid:beb-68a9-6396e5f4>"
>>>>
>>>>
>>>> RESPONSE:
>>>> SIP/2.0 401 Unauthorized
>>>> Via: SIP/2.0/WS
>>>>
>>>>
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bK1C36k8S3b0OobHUAOLLOae0SbsbEQg;rport=50906;received=10.1.2.229
>>>> From: sip:101 at 10.1.20.40;tag=Me0arqDG6K8o7l32oJgR
>>>> To: sip:101 at 10.1.20.40;tag=9de7b31b15b69da019f867d4866ff286.000c
>>>> Call-ID: 0EQSBkoG9RGgfg3E
>>>> CSeq: 1 REGISTER
>>>> WWW-Authenticate: Digest realm="10.1.20.40",
>>>> nonce="UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4Re"
>>>> Server: kamailio (3.4.0-dev3 (i386/linux))
>>>> Content-Length: 0
>>>>
>>>>
>>>> SENT:
>>>> REGISTER sip:10.1.20.40 SIP/2.0
>>>> Via: SIP/2.0/WS
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bKl521S8acS8nVEcejv2GOJ8r46Jb037
>>>> From: sip:101 at 10.1.20.40;tag=Pb8d1gV8K5qJo1gOv612
>>>> To: sip:101 at 10.1.20.40
>>>> Call-ID: 0EQSBkoG9RGgfg3E
>>>> CSeq: 2 REGISTER
>>>> Max-Forwards: 70
>>>> Supported: path, outbound, gruu
>>>> Contact: <sip:101 at KMkjMf37lVeM.invalid;transport=ws>
>>>>          ;reg-id=98
>>>>          ;+sip.instance="<urn:uuid:beb-68a9-6396e5f4>"
>>>> Authorization: Digest username="101", realm="10.1.20.40",
>>>> nonce="UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4Re", opaque="",
>>>> uri="sip:10.1.20.40", response= "9b209eb35ee88192e2e0c468f8cf91da"
>>>>
>>>>
>>>> RESPONSE:
>>>> SIP/2.0 200 OK
>>>> Via: SIP/2.0/WS
>>>>
>>>>
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bKl521S8acS8nVEcejv2GOJ8r46Jb037;rport=50906;received=10.1.2.229
>>>> From: sip:101 at 10.1.20.40;tag=Pb8d1gV8K5qJo1gOv612
>>>> To: sip:101 at 10.1.20.40;tag=9de7b31b15b69da019f867d4866ff286.b2e4
>>>> Call-ID: 0EQSBkoG9RGgfg3E
>>>> CSeq: 2 REGISTER
>>>> Contact:
>>>>
>>>> <sip:101 at KMkjMf37lVeM.invalid;transport=ws>;expires=120;received="sip:10.1.2.229:50906;transport=WS";pub-gruu="sip:101 at 10.1.20.40;gr=urn:uuid:beb-68a9-6396e5f4";temp-gruu="sip:uloc-5033344d-5211-1-1de173 at 10.1.20.40;gr";+sip.instance="<urn:uuid:beb-68a9-6396e5f4>";reg-id=98
>>>> Server: kamailio (3.4.0-dev3 (i386/linux))
>>>> Content-Length: 0
>>>>
>>>>
>>>> SENT:
>>>> INVITE sip:102 at 10.1.20.40 SIP/2.0
>>>> Via: SIP/2.0/WS
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bKOIosJ8TMPgvfHme6NIm4GSn24Fu7f7
>>>> From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
>>>> To: sip:102 at 10.1.20.40
>>>> Call-ID: 9KoKnFdh285k2jg4
>>>> CSeq: 1 INVITE
>>>> Max-Forwards: 70
>>>> Supported: path, outbound, gruu
>>>> Contact: <sip:101 at KMkjMf37lVeM.invalid;transport=ws
>>>>          ;gr=urn:uuid:beb-68a9-6396e5f4;ob>
>>>> Content-Type: application/sdp
>>>>
>>>>
>>>> RESPONSE:
>>>> SIP/2.0 407 Proxy Authentication Required
>>>> Via: SIP/2.0/WS
>>>>
>>>>
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bKOIosJ8TMPgvfHme6NIm4GSn24Fu7f7;rport=50906;received=10.1.2.229
>>>> From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
>>>> To: sip:102 at 10.1.20.40;tag=9de7b31b15b69da019f867d4866ff286.f545
>>>> Call-ID: 9KoKnFdh285k2jg4
>>>> CSeq: 1 INVITE
>>>> Proxy-Authenticate: Digest realm="10.1.20.40",
>>>> nonce="UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4Re"
>>>> Server: kamailio (3.4.0-dev3 (i386/linux))
>>>> Content-Length: 0
>>>>
>>>>
>>>> SENT:
>>>> ACK sip:102 at 10.1.20.40 SIP/2.0
>>>> Via: SIP/2.0/WS
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bKAmmLhK71tr2QoAiV9f5QmdKF9dGkke
>>>> From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
>>>> To: sip:102 at 10.1.20.40;tag=9de7b31b15b69da019f867d4866ff286.f545
>>>> Call-ID: 9KoKnFdh285k2jg4
>>>> CSeq: 1 ACK
>>>> Max-Forwards: 70
>>>> Supported: path, outbound, gruu
>>>>
>>>>
>>>> SENT:
>>>> INVITE sip:102 at 10.1.20.40 SIP/2.0
>>>> Via: SIP/2.0/WS
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bK1GRkmlTVo7Cb4fg8OMe9g39g096hmn
>>>> From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
>>>> To: sip:102 at 10.1.20.40
>>>> Call-ID: 9KoKnFdh285k2jg4
>>>> CSeq: 2 INVITE
>>>> Max-Forwards: 70
>>>> Supported: path, outbound, gruu
>>>> Contact: <sip:101 at KMkjMf37lVeM.invalid;transport=ws
>>>>          ;gr=urn:uuid:beb-68a9-6396e5f4;ob>
>>>> Proxy-Authorization: Digest username="101", realm="10.1.20.40",
>>>> nonce="UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4Re", opaque="",
>>>> uri="sip:102 at 10.1.20.40", response= "f4bbe128abf3acb3a4e11882749d8798"
>>>> Content-Type: application/sdp
>>>>
>>>>
>>>> RESPONSE:
>>>> SIP/2.0 407 Proxy Authentication Required
>>>> Via: SIP/2.0/WS
>>>>
>>>>
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bK1GRkmlTVo7Cb4fg8OMe9g39g096hmn;rport=50906;received=10.1.2.229
>>>> From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
>>>> To: sip:102 at 10.1.20.40;tag=9de7b31b15b69da019f867d4866ff286.0007
>>>> Call-ID: 9KoKnFdh285k2jg4
>>>> CSeq: 2 INVITE
>>>> Proxy-Authenticate: Digest realm="10.1.20.40",
>>>> nonce="UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4Re"
>>>> Server: kamailio (3.4.0-dev3 (i386/linux))
>>>> Content-Length: 0
>>>>
>>>>
>>>> SENT:
>>>> ACK sip:102 at 10.1.20.40 SIP/2.0
>>>> Via: SIP/2.0/WS
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bKG9v5g7i1LNsoVGo18ULlgqdA1EcFGb
>>>> From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
>>>> To: sip:102 at 10.1.20.40;tag=9de7b31b15b69da019f867d4866ff286.0007
>>>> Call-ID: 9KoKnFdh285k2jg4
>>>> CSeq: 2 ACK
>>>> Max-Forwards: 70
>>>> Supported: path, outbound, gruu
>>>>
>>>>
>>>> SENT:
>>>> INVITE sip:102 at 10.1.20.40 SIP/2.0
>>>> Via: SIP/2.0/WS
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bK8cie6bGSG0eOGh7Ne08Ro4CS1hI0oJ
>>>> From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
>>>> To: sip:102 at 10.1.20.40
>>>> Call-ID: 9KoKnFdh285k2jg4
>>>> CSeq: 3 INVITE
>>>> Max-Forwards: 70
>>>> Supported: path, outbound, gruu
>>>> Contact: <sip:101 at KMkjMf37lVeM.invalid;transport=ws
>>>>          ;gr=urn:uuid:beb-68a9-6396e5f4;ob>
>>>> Proxy-Authorization: Digest username="101", realm="10.1.20.40",
>>>> nonce="UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4Re", opaque="",
>>>> uri="sip:102 at 10.1.20.40", response= "f4bbe128abf3acb3a4e11882749d8798"
>>>> Content-Type: application/sdp
>>>>
>>>>
>>>> RESPONSE:
>>>> SIP/2.0 407 Proxy Authentication Required
>>>> Via: SIP/2.0/WS
>>>>
>>>>
>>>> KMkjMf37lVeM.invalid;branch=z9hG4bK8cie6bGSG0eOGh7Ne08Ro4CS1hI0oJ;rport=50906;received=10.1.2.229
>>>> From: sip:101 at 10.1.20.40;tag=3U0osO4h3h2bgCrvnCqO
>>>> To: sip:102 at 10.1.20.40;tag=9de7b31b15b69da019f867d4866ff286.b1f7
>>>> Call-ID: 9KoKnFdh285k2jg4
>>>> CSeq: 3 INVITE
>>>> Proxy-Authenticate: Digest realm="10.1.20.40",
>>>> nonce="UDND2VAzQq0Tz8wvIFWNh2eYRxdtu4
>>>> Re"
>>>> Server: kamailio (3.4.0-dev3 (i386/linux))
>>>> Content-Length: 0
>>>>
>>>>
>>>> .......and so on in an endless loop with 407 requests
>>>>
>>>> Thanks a lot
>>>>
>>>> Kind Regards
>>>>
>>>> --
>>>>        --DAVID--
>>>>
>>>> _______________________________________________
>>>> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
>>>> sr-users at lists.sip-router.org
>>>> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
>>>>
>>>>
>>>> --
>>>> Peter Dunkley
>>>> Technical Director
>>>> Crocodile RCS Ltd
>>>>
>>>>
>>>> _______________________________________________
>>>> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
>>>> sr-users at lists.sip-router.org
>>>> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
>>>>
>>>
>>> _______________________________________________
>>> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
>>> sr-users at lists.sip-router.org
>>> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
>>>
>>

More information about the sr-users mailing list