-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Folks,
Recently I started to use consume_credentials() function in my SER 0.8.14 and some troubles appeared.
One of some carriers that I send calls through started to reject calls routed from my SER box with:
SIP/2.0 400 Transaction tuple incomplete (9/SL)
The carrier said that my SER box is sending an invalid SIP Header.
I did some dumps of calls from my SER box and I realise that there is an invalid SIP header as the carrier said, follow
the dumps:
x.x.x.x:5060 - my SER box
y.y.y.y:5060 - carrier
z.z.z.z:41593 - UA (GS BT100)
x.x.x.x:5060 -> y.y.y.y:5060
INVITE sip:00000000000000@y.y.y.y:5060 SIP/2.0.
Record-Route: <sip:0000000000000@x.x.x.x;ftag=8c7829c492ab97d9;lr=on>.
Via: SIP/2.0/UDP x.x.x.x;branch=z9hG4bK151b.f401ac77.0.
Via: SIP/2.0/UDP z.z.z.z:41593;branch=z9hG4bK0d356ccd0e9fab1d.
From: "Client 1" <sip:1005@mysipdomain>;tag=8c7829c492ab97d9.
To: <sip:000000000000@mysipdomain>.
Contact: <sip:1005@z.z.z.z:41593>.
Supported: replaces.
sip:000000000000@mysipdomain", nonce="42cc468e4ddef88bad480d1a5dfbd8bf87c03f23", response="0a5825c4e4bf2bb43
e2a0ba850ba32b1".Call-ID: cff0854b39f5c97e(a)z.z.z.z.
CSeq: 59598 INVITE.
User-Agent: Grandstream BT100 1.0.5.22.
Max-Forwards: 69.
Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE.
Content-Type: application/sdp.
Content-Length: 388
As you can see the line after "Supported: replaces." does not start with a "capital letter" as RFC3261 recommend.
After remove "consume_credentials()" function the result is:
x.x.x.x:5060 -> y.y.y.y:5060
INVITE sip:0000000000000@y.y.y.y:5060 SIP/2.0.
Record-Route: <sip:000000000000@x.x.x.x;ftag=21cb576a18f9628d;lr=on>.
Via: SIP/2.0/UDP x.x.x.x;branch=z9hG4bK41cb.cc6503a1.0.
Via: SIP/2.0/UDP z.z.z.z:41593;branch=z9hG4bKa5afc4c7b13b4943.
From: "Client 1" <sip:1005@mysipdomain>;tag=21cb576a18f9628d.
To: <sip:000000000000@mysipdomain>.
Contact: <sip:1005@z.z.z.z:41593>.
Supported: replaces.
Proxy-Authorization: DIGEST username="1005", realm="mysipdomain", algorithm=MD5, uri="sip:00000000000@mysip
domain", nonce="42cc41d72f6d20a05439f0f1ae8c4159b1c4bc3c", response="c111d28d54df340dabd44865f3815966".
Call-ID: a059b6a913ffa488(a)z.z.z.z.
CSeq: 48239 INVITE.
User-Agent: Grandstream BT100 1.0.5.22.
Max-Forwards: 69.
Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE.
Content-Type: application/sdp.
Content-Length: 388
and the carrier accept the call as expected.
So I think the "consume_credentials()" function does not RFC3261 compliance.
Maybe its a BUG and an uri subst function works better.
regards.
- --
============================================
Rodrigo P. Telles <telles(a)devel.it>
TI Manager
Devel-IT - http://www.devel.it
IVOZ # 1029
+55 14 3324-1200
Bestcom Group
============================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFC1AUGiLK8unYgEMQRAjTbAJ4qWeu8V1R7fMpMumR9UcUHiZ/1ugCfTv8Y
mGmkZkn8w0+R1OhQbSTf4do=
=+E+T
-----END PGP SIGNATURE-----
Hi!
Another problem with NAT... I hope I will solve it soon!
My rtpproxy is running and ser can connect to the rtpproxy. I can make calls
to users that are connected to the ser server behind a NAT (Restricted Cone
NAT and symmetrical NAT). That's working fine!!! Thanks for your help!!!
But I have the problem that if I want to call to a Cisco PSTN-Gateway, that
I can establish the call... but I don't hear anything. The callee is hearing
me. What is the difference between an internal user and the Gatway?? The
routing for Gateway and Users is almost equal (the only difference is the
"P-hint: GATEWAY").
And: I'm wondering why the communication is OK with a symmetrical NAT
(Linksys) and WITHOUT rtpproxy. If I turn on the rtpproxy (with symetrical
NAT) the voice stream of the Gateway isn't arriving anymore.
Any ideas?
Thanks!
Sebastian
Hi Ricardo,
Tried it. It still gives me the same error. Please let me know the version of the radius server you are using.?? Also can you please let me know wht did u do to make the accounting work...??
Best Regards,
Naresh
Ricardo Martinez <rmartinez(a)redvoiss.net> wrote:
Hello Naresh.
I guess there is an error in the way you call the authorization for the INVITE. As far as i know for the REGISTER message (authentication) you need the statement :
radius_www_authorize
But for the INVITE you need to call "radius_proxy_authorize". This is what i have in my ser.cfg
if (method=="INVITE") {
if (!radius_proxy_authorize("")) {
proxy_challenge("","1");
break;
};
};
maybe you can try this and tell me how it works.
Good luck
Ricardo Martinez.-
-----Mensaje original-----
De: Naresh Parmar [mailto:naresh_parmar14@yahoo.com]
Enviado el: Miércoles, 20 de Julio de 2005 12:10
Para: Ricardo Martinez; serusers(a)lists.iptel.org
Asunto: RE: [Serusers] Problem authorizing with radius
Hi Ricardo,
We are using freeradius server 0.9.1 and SER 0.9.3. The version of radius client is radiusclient-ng-0.5.1. The users file in the radius server looks like as below:
test(a)sip2.zone Auth-Type := Digest, User-Password == "cisco1234"
Reply-Message = "Authenticated",
Sip-Rpid = "1970"
test(a)sip2.zone Auth-Type := Accept
Reply-Message = "Authorized",
Sip-Group == "ld"
The radius authentication and authorization parts in the ser.cfg file are given below:
if (uri=~"^sip:9[0-9]*@") {
if (method=="INVITE"){
if (!radius_www_authorize("")) {
www_challenge("", "1");
break;
}else{
if (radius_is_user_in("Credentials", "ld")){
forward(192.168.2.101,5060);
break;
}else{
break;
};
};
};
};
And finally the error is as below:
Invalid operator for item Suffix: reverting to '=='
modcall[authorize]: module "preprocess" returns ok
modcall[authorize]: module "chap" returns noop
rlm_eap: No EAP-Message, not doing EAP
modcall[authorize]: module "eap" returns noop
rlm_digest: Converting Digest-Attributes to something sane...
Digest-User-Name = "test"
Digest-Realm = "sip2.zone"
Digest-Nonce = "42de75b2e9e39194a286e8ccd284646ffa14bcc2"
Digest-URI = "sip:94161000@sip2.zone"
Digest-Method = "INVITE"
Digest-QOP = "auth"
Digest-Nonce-Count = "0000000a"
Digest-CNonce = "753F926DB8F5415D8D56EE7816410E33"
rlm_digest: Adding Auth-Type = DIGEST
modcall[authorize]: module "digest" returns ok
rlm_realm: Looking up realm "sip2.zone" for User-Name = "test(a)sip2.zone"
rlm_realm: No such realm "sip2.zone"
modcall[authorize]: module "suffix" returns noop
users: Matched entry test(a)sip2.zone at line 226
modcall[authorize]: module "files" returns ok
modcall[authorize]: module "mschap" returns noop
modcall: group authorize returns ok
rad_check_password: Found Auth-Type Digest
auth: type "digest"
modcall: entering group authenticate
A1 = test:sip2.zone:cisco1234
A2 = INVITE:sip:94161000@sip2.zone
KD = 53d3b82970bada131a062103f553b8b8:42de75b2e9e39194a286e8ccd284646ffa14bcc2:0000000a:753F926DB8F5415D8D56EE7816410E33:auth:18227b358ffe96049a3745eeb449fae2
modcall[authenticate]: module "digest" returns ok
modcall: group authenticate returns ok
radius_xlat: 'Authenticated'
Login OK: [test(a)sip2.zone/<no User-Password attribute>] (from client proxy port 5060)
Sending Access-Accept of id 203 to 192.168.2.1:32831
Reply-Message = "Authenticated"
Sip-Rpid = "1970"
Finished request 6
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 192.168.2.1:32831, id=204, length=53
User-Name = "test"
Sip-Group = "ld"
Service-Type = Group-Check
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
modcall: entering group authorize
Invalid operator for item Suffix: reverting to '=='
Invalid operator for item Suffix: reverting to '=='
Invalid operator for item Suffix: reverting to '=='
modcall[authorize]: module "preprocess" returns ok
modcall[authorize]: module "chap" returns noop
rlm_eap: No EAP-Message, not doing EAP
modcall[authorize]: module "eap" returns noop
modcall[authorize]: module "digest" returns noop
rlm_realm: No '@' in User-Name = "test", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop
modcall[authorize]: module "files" returns notfound
modcall[authorize]: module "mschap" returns noop
modcall: group authorize returns ok
auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
auth: Failed to validate the user.
Login incorrect: [test/<no User-Password attribute>] (from client proxy port 0)
Delaying request 7 for 1 seconds
Finished request 7
Going to the next request
Waking up in 6 seconds...
As you can see from the above configuration, the authentication works perfect, its only in the authorization where it fails. Also can you please let me know about the accounting configuration??
Thanks a lot..
Naresh
Ricardo Martinez <rmartinez(a)redvoiss.net> wrote:
Hello Naresh
I have authentication, authorization and accounting (AAA) through radius working fine. What radius server are you using?, can you send us more information about the configuration?
Cheers,
Ricardo.-
-----Mensaje original-----
De: Naresh Parmar [mailto:naresh_parmar14@yahoo.com]
Enviado el: Miércoles, 20 de Julio de 2005 10:37
Para: serusers(a)lists.iptel.org
Asunto: [Serusers] Problem authorizing with radius
hi friends,
I am having problems while authorizing with the radius server. I am using the same configuration as mentioned in the radius-howto. Authentication works perfect as I am able to authenticate using the radius server. However while authorizing against the radius server to make a call I get the following error:
auth: No authenticate method (Auth-Type) configuration found for the user
request: Rejecting the user
auth: Failed to validate the user.
Delaying request 2 for 1 seconds
Finished request 2
When I authorize against the mysql database, it works fine. Any clue???
Best Regards,
Naresh
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
---------------------------------
Start your day with Yahoo! - make it your home page
Does the AVP get deleted at the end of a transaction? At the end of a
specific dialog?
If the answer is "transaction" (and I think it is), what exactly
constitutes a transaction? e.g. when an INVITE is received,is the
transaction completed when the corresponding "200 OK" is processed (or
CANCEL)?
Also, if I have 'avp_delete("$destination")', and the AVP '$destination'
has never been set, is this "bad"? or a no-op?
The above two are related. I am using AVPs to move information around
in my script, and am wondering how much cleanup is necessary (i.e.,
delete every avp i populate, etc., etc.)
cheers
Hi
Just a quick hello, thought I'd might as well join this list.
Maybe I'll get round to installing it soon, and seeing whats diff, I
believe the config files ser--->openser is the same,
Is there any problem running both ser and openser, on the same machine.
Iqbal
Hello,
the access control list in openser is based on group membership checking
which does a database query each time when user's ACL is verified. We
are considering to optimize this operations since they are very often
used and propose the following solutions:
1. Load all groups to whom an user belongs once per request processing
(one database query) and then store some bitmap flags to be used further
when doing group checking. At start up time, some fixups will be made to
replace the names with positions in bitmap
- advantages: the old group table structure is used and changes in
script should be minimal
- disadvantages: after loading all group names, string comparisons are
required to set the bitmap
2. Introduce a new column in the subscriber table that stores the ACL
bitmap and load it once per request processing
- advantages: very fast load and checking -- old version of group
membership checking is kept
- disadvantages: more complex provisioning system
What do you think? Any other idea?
Daniel
Hi Jayesh,
in OpenSER 0.9.5, you may try the following configuration of the acc module:
....
modparam("acc","db_extra","src_ip=avp/i:10")
....
....
# were setting the acc flag do also
avp_write("src_ip","i:10");
.....
The idea is to set the acc to extra account the i:10 (ID 10) AVP in
which, from script, you store the SRC IP of the message. NOTE you need
to add the src_ip column to your acc/missed_calls table.
the destination IP cannot be logged yet.....
regards,
bogdan
jayesh nambiar wrote:
> hey Bogdan,
>
> Thanx a lot for that information. I am completely new to Openser.
> I've been working on it since last 10 days only. I am still going
> through the developers guide. Our company is very much intersested
> in implementing the openser for our clients.
>
> The version that i m using is Openser-0.9.5.
>
> Any information regarding accounting would be very much valuable
> for me.
>
> Thanx again.
>
> Bye
>
> ------------------------------------------------------------------------
> Yahoo! Mail for Mobile
> Take Yahoo! Mail with you!
> <http://us.rd.yahoo.com/evt=31132/*http://mobile.yahoo.com/learn/mail>
> Check email on your mobile phone.