<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body ocsi="0" fpstyle="1" bgcolor="#FFFFFF">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div style="direction:ltr; font-family:Tahoma; color:#000000; font-size:10pt">The provider side is sending the BYE.<br>
<br>
Also it's not that it is a second call affecting anything, the call ends unexpectedly after 30 seconds.<br>
<br>
To me it looks like provider keeps sending 200 OK and Asterisk keeps sending ACK until provider timeout and sends BYE.<br>
<br>
This initial issue with the 407 has been dealt with I think so I've posted a new thread with subject "Repeated 200 OK from Enswitch". Want to maximise the correctness of configuration this end before reaching out to the provider for assistance.<br>
<br>
Much appreciated, I was really over-thinking the Kamailio configuration required. There was no easy way that I knew of to see exactly what Asterisk was using for a password via logging etc. It wasn't until I tried to recreate the Digest for myself was I able
to detect Asterisk was sending a blank password. From there, I was able to trace back to Elastix MT how it was treating secret, sippasswd and remotesecret fields when dealing with the sip table in the elxpbx table in mysqld.<br>
<br>
<div style="font-family:Times New Roman; color:#000000; font-size:16px">
<hr tabindex="-1">
<div id="divRpF353726" style="direction:ltr"><font color="#000000" face="Tahoma" size="2"><b>From:</b> Daniel-Constantin Mierla [miconda@gmail.com]<br>
<b>Sent:</b> Tuesday, 12 May 2015 5:27 PM<br>
<b>To:</b> Darren Campbell (Primar); Kamailio (SER) - Users Mailing List<br>
<b>Subject:</b> Re: [SR-Users] Handling 407 Proxy Authentication, Elastix MT<br>
</font><br>
</div>
<div></div>
<div>What do you mean it drops out? What side is sending the BYE?<br>
<br>
Cheers,<br>
Daniel<br>
<br>
<div class="moz-cite-prefix">On 12/05/15 05:14, Darren Campbell (Primar) wrote:<br>
</div>
<blockquote type="cite">
<div style="direction:ltr; font-family:Tahoma; color:#000000; font-size:10pt">Had a closer look at the Digest being sent.<br>
<br>
Attempted to recreate Digest based on the username, realm, password, method & uri I was expecting versus the one created in the invite. Looks like Asterisk was using a blank password.<br>
<br>
<br>
Proxy-Authorization: Digest username="provideruser", realm="providerip", algorithm=MD5, uri=<a class="moz-txt-link-rfc2396E" href="sip:provideruser@providerip" target="_blank">"sip:provideruser@providerip"</a>,
<br>
nonce="nonceexample", response="exampleresponse"<br>
<br>
php -r 'echo md5(md5("provideruser:providerip:password").":nonceexample:".md5("INVITE:<a class="moz-txt-link-freetext" href="sip:provideruser@providerip" target="_blank">sip:provideruser@providerip</a>"));'<br>
someotherresponse<br>
<br>
php -r 'echo md5(md5("provideruser:providerip:").":nonceexample:".md5("INVITE:<a class="moz-txt-link-freetext" href="sip:provideruser@providerip" target="_blank">sip:provideruser@providerip</a>"));'<br>
exampleresponse<br>
<br>
<br>
Here's the two lines in chan_sip.c (<a class="moz-txt-link-freetext" href="http://svn.asterisk.org/svn/asterisk/branches/11/channels/chan_sip.c" target="_blank">http://svn.asterisk.org/svn/asterisk/branches/11/channels/chan_sip.c</a>) that could have set the
secret:<br>
<br>
secret = auth->secret;<br>
<br>
secret = p->relatedpeer <br>
&& !ast_strlen_zero(p->relatedpeer->remotesecret)<br>
? p->relatedpeer->remotesecret : p->peersecret;<br>
<br>
<br>
When I checked Elastix MT code, it wasn't setting the secret for Asterisk Realtime because this is handled by Kamailio for extensions. But I noted that remotesecret could be used for peers.<br>
<br>
<br>
Ended up altering Elastix Mt trunk interface to allow entering remotesecret field via /usr/share/elastix/apps/trunks/index.php<br>
<br>
<br>
Now a single outbound call is able to connect, however, it drops out when a second outbound call is made.<br>
<br>
<br>
<div style="font-family:Times New Roman; color:#000000; font-size:16px">
<hr tabindex="-1">
<div id="divRpF1079" style="direction:ltr"><font color="#000000" face="Tahoma" size="2"><b>From:</b> Daniel-Constantin Mierla [<a class="moz-txt-link-abbreviated" href="mailto:miconda@gmail.com" target="_blank">miconda@gmail.com</a>]<br>
<b>Sent:</b> Monday, 11 May 2015 8:47 PM<br>
<b>To:</b> Darren Campbell (Primar); Kamailio (SER) - Users Mailing List<br>
<b>Subject:</b> Re: [SR-Users] Handling 407 Proxy Authentication, Elastix MT<br>
</font><br>
</div>
<div>What is happening then, is the provider sending back another 407?<br>
<br>
Normally the Proxy-Authorization header should stay unchanged, but if you change the request uri, it may result in mismatch.<br>
<br>
Cheers,<br>
Daniel<br>
<br>
<div class="moz-cite-prefix">On 11/05/15 10:26, Darren Campbell (Primar) wrote:<br>
</div>
<blockquote type="cite">
<div style="direction:ltr; font-family:Tahoma; color:#000000; font-size:10pt">Thanks, much appreciated.<br>
<br>
I'm seeing the Proxy-Authorization from Asterisk in tcpdump. It seems like I've been working against what's already built into Kamailio.<br>
<br>
Probably need to tweak some uri's though.<br>
<br>
When dialing out, the r-uri is:<br>
<a class="moz-txt-link-freetext" href="sip:mobilenumberhere@exampleip" target="_blank">sip:mobilenumberhere@exampleip</a><br>
<br>
But the uri part of the Proxy-Authorization in the new INVITE ends up with uri=<a class="moz-txt-link-rfc2396E" href="sip:mobilenumberhere@exampleip" target="_blank">"sip:mobilenumberhere@exampleip"</a><br>
<br>
However, I think it should be showing uri=<a class="moz-txt-link-rfc2396E" href="sip:providerusernamehere@exampleip" target="_blank">"sip:providerusernamehere@exampleip"</a><br>
<br>
Regards,<br>
<br>
Darren<br>
<div style="font-family:Times New Roman; color:#000000; font-size:16px">
<hr tabindex="-1">
<div id="divRpF31264" style="direction:ltr"><font color="#000000" face="Tahoma" size="2"><b>From:</b> sr-users [<a class="moz-txt-link-abbreviated" href="mailto:sr-users-bounces@lists.sip-router.org" target="_blank">sr-users-bounces@lists.sip-router.org</a>]
on behalf of Daniel-Constantin Mierla [<a class="moz-txt-link-abbreviated" href="mailto:miconda@gmail.com" target="_blank">miconda@gmail.com</a>]<br>
<b>Sent:</b> Monday, 11 May 2015 6:07 PM<br>
<b>To:</b> Kamailio (SER) - Users Mailing List<br>
<b>Subject:</b> Re: [SR-Users] Handling 407 Proxy Authentication, Elastix MT<br>
</font><br>
</div>
<div>Hello,<br>
<br>
<div class="moz-cite-prefix">On 11/05/15 08:41, Darren Campbell (Primar) wrote:<br>
</div>
<blockquote type="cite"><style id="owaParaStyle" type="text/css">
<!--
p
{margin-top:0;
margin-bottom:0}
body
{direction:ltr;
font-family:Tahoma;
color:#000000;
font-size:10pt}
p
{margin-top:0;
margin-bottom:0}
body
{scrollbar-base-color:undefined;
scrollbar-highlight-color:undefined;
scrollbar-darkshadow-color:undefined;
scrollbar-arrow-color:undefined}
body
{direction:ltr;
font-family:Tahoma;
color:#000000;
font-size:10pt}
p
{margin-top:0;
margin-bottom:0}
body
{scrollbar-base-color:undefined;
scrollbar-highlight-color:undefined;
scrollbar-darkshadow-color:undefined;
scrollbar-arrow-color:undefined}
body
{direction:ltr;
font-family:Tahoma;
color:#000000;
font-size:10pt}
p
{margin-top:0;
margin-bottom:0}
-->
BODY {direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;}P {margin-top:0;margin-bottom:0;}BODY {scrollbar-base-color:undefined;scrollbar-highlight-color:undefined;scrollbar-darkshadow-color:undefined;scrollbar-track-color:undefined;scrollbar-arrow-color:undefined}</style>
<div style="direction:ltr; font-family:Tahoma; color:#000000; font-size:10pt">Hi all<br>
<br>
Have Asterisk listening on 127.0.0.1 and aiming to route all inbound/outbound SIP via Kamailio listening on 127.0.0.1 and external interface.<br>
<br>
Inbound calls from the SIP PROVIDER work just fine. Have NAT, rtpproxy configured for successful registration and subsequent INVITEs etc.<br>
<br>
Experiencing some challenges with the outgoing INVITES, primarily authenticating the outbound INVITEs.<br>
<br>
The current situation is this:<br>
Asterisk > INVITE > Kamailio > INVITE > SIP PROVIDER<br>
SIP PROVIDER > 407 Proxy Authenticate > Kamailio > Transaction Cancelled.<br>
Asterisk then plays number unavailable message.<br>
<br>
<br>
The desired situation is more like this:<br>
Asterisk > INVITE > Kamailio > INVITE > SIP PROVIDER<br>
SIP PROVIDER > 407 Proxy Authenticate > Kamailio > Asterisk<br>
Asterisk > INVITE (with auth digest etc) > Kamailio > INVITE > SIP PROVIDER<br>
<br>
<br>
An attempted solution was made by having Kamailio authenticate using the uac module. However, ideally Kamailio should be mostly transparent and Asterisk should be handling and responding to the 407 Proxy Authentication.<br>
<br>
If there is someone in the Kamailio community that has addressed this situation before, guidance would be much appreciated.<br>
</div>
</blockquote>
do you have a failure_route block in kamailio.cfg? Be sure that if 401/407 is received, you just exit the routing block:<br>
<br>
failure_route[abc] {<br>
...<br>
if(t_check_status("401|407")) exit;<br>
...<br>
}<br>
<br>
Then the 401/407 replies will be sent upstream to asterisk.<br>
<br>
Cheers,<br>
Daniel<br>
<br>
<pre class="moz-signature" cols="72">--
Daniel-Constantin Mierla
<a class="moz-txt-link-freetext" href="http://twitter.com/#%21/miconda" target="_blank">http://twitter.com/#!/miconda</a> - <a class="moz-txt-link-freetext" href="http://www.linkedin.com/in/miconda" target="_blank">http://www.linkedin.com/in/miconda</a>
Kamailio World Conference, May 27-29, 2015
Berlin, Germany - <a class="moz-txt-link-freetext" href="http://www.kamailioworld.com" target="_blank">http://www.kamailioworld.com</a></pre>
</div>
</div>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Daniel-Constantin Mierla
<a class="moz-txt-link-freetext" href="http://twitter.com/#%21/miconda" target="_blank">http://twitter.com/#!/miconda</a> - <a class="moz-txt-link-freetext" href="http://www.linkedin.com/in/miconda" target="_blank">http://www.linkedin.com/in/miconda</a>
Kamailio World Conference, May 27-29, 2015
Berlin, Germany - <a class="moz-txt-link-freetext" href="http://www.kamailioworld.com" target="_blank">http://www.kamailioworld.com</a></pre>
</div>
</div>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Daniel-Constantin Mierla
<a class="moz-txt-link-freetext" href="http://twitter.com/#!/miconda" target="_blank">http://twitter.com/#!/miconda</a> - <a class="moz-txt-link-freetext" href="http://www.linkedin.com/in/miconda" target="_blank">http://www.linkedin.com/in/miconda</a>
Kamailio World Conference, May 27-29, 2015
Berlin, Germany - <a class="moz-txt-link-freetext" href="http://www.kamailioworld.com" target="_blank">http://www.kamailioworld.com</a></pre>
</div>
</div>
</div>
</div>
</body>
</html>