Re: [SR-Users] [VoLTE] 401 unauthorized error

24 Aug 2021


      Thank you for your help!
I looked into the UE's &nbsp;IMS register request as you told me. (the content of request is shown below)
As my thinking, my UE can support only two algorithms: hmac-sha1-96 and hmac-md5-96.
But fhoss cannot support above auth algorithms (fhoss can support digest-akav1-md5, digest-akav2-md5, digest, http_digest_md5, early-ims-security, nass-bundled and sip digest).
What algorithm should I switch to for authentication in fhoss? Or do I have to change the UE device (smartphone) for auth?
Very thanks,
Taekkyung Oh.
&lt;IMS register request from the UE&gt;
Frame 4153: 840 bytes on wire (6720 bits), 840 bytes captured (6720 bits) on interface 0
Ethernet II, Src: 02:42:ac:16:00:16 (02:42:ac:16:00:16), Dst: 02:42:ac:16:00:06 (02:42:ac:16:00:06)
Internet Protocol Version 4, Src: 172.22.0.22, Dst: 172.22.0.6
User Datagram Protocol, Src Port: 2152, Dst Port: 2152
GPRS Tunneling Protocol
Internet Protocol Version 4, Src: 192.168.101.3, Dst: 172.22.0.21
Transmission Control Protocol, Src Port: 5060, Dst Port: 5060, Seq: 1021, Ack: 1, Len: 750
[2 Reassembled TCP Segments (1770 bytes): #4147(1020), #4153(750)]
Session Initiation Protocol (REGISTER)
&nbsp; &nbsp; Request-Line: REGISTER sip:ims.mnc001.mcc001.3gppnetwork.org SIP/2.0
&nbsp; &nbsp; &nbsp; &nbsp; Method: REGISTER
&nbsp; &nbsp; &nbsp; &nbsp; Request-URI: sip:ims.mnc001.mcc001.3gppnetwork.org
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Request-URI Host Part: ims.mnc001.mcc001.3gppnetwork.org
&nbsp; &nbsp; &nbsp; &nbsp; [Resent Packet: False]
&nbsp; &nbsp; Message Header
&nbsp; &nbsp; &nbsp; &nbsp; To: &lt;sip:001010000031094@ims.mnc001.mcc001.3gppnetwork.org&gt;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SIP to address: sip:001010000031094@ims.mnc001.mcc001.3gppnetwork.org
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SIP to address User Part: 001010000031094
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SIP to address Host Part: ims.mnc001.mcc001.3gppnetwork.org
&nbsp; &nbsp; &nbsp; &nbsp; From: &lt;sip:001010000031094@ims.mnc001.mcc001.3gppnetwork.org&gt;;tag=qyecbkJ
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SIP from address: sip:001010000031094@ims.mnc001.mcc001.3gppnetwork.org
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SIP from address User Part: 001010000031094
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SIP from address Host Part: ims.mnc001.mcc001.3gppnetwork.org
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SIP from tag: qyecbkJ
&nbsp; &nbsp; &nbsp; &nbsp; Contact: &lt;sip:001010000031094@192.168.101.3:5060&gt;;+sip.instance="&lt;urn:gsma:imei:86355804-632692-0&gt;";+g.3gpp.accesstype="cellular2";audio;video;+g.3gpp.smsip;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact URI: sip:001010000031094@192.168.101.3:5060
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact URI User Part: 001010000031094
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact URI Host Part: 192.168.101.3
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact URI Host Port: 5060
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact parameter: +sip.instance="&lt;urn:gsma:imei:86355804-632692-0&gt;"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact parameter: +g.3gpp.accesstype="cellular2"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact parameter: audio
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact parameter: video
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact parameter: +g.3gpp.smsip
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Contact parameter: +g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel"\r
&nbsp; &nbsp; &nbsp; &nbsp; Expires: 600000
&nbsp; &nbsp; &nbsp; &nbsp; P-Access-Network-Info: 3GPP-E-UTRAN-FDD;utran-cell-id-3gpp=0010100010019B01
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; access-type: 3GPP-E-UTRAN-FDD
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; utran-cell-id-3gpp: 0010100010019B01
&nbsp; &nbsp; &nbsp; &nbsp; Supported: path,sec-agree
&nbsp; &nbsp; &nbsp; &nbsp; Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,UPDATE,PRACK,NOTIFY,MESSAGE,REFER
&nbsp; &nbsp; &nbsp; &nbsp; Require: sec-agree
&nbsp; &nbsp; &nbsp; &nbsp; Proxy-Require: sec-agree
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;[truncated]Security-Client: ipsec-3gpp;alg=hmac-sha-1-96;prot=esp;mod=trans;ealg=des-ede3-cbc;spi-c=10559690;spi-s=65664952;port-c=31112;port-s=31803,ipsec-3gpp;alg=hmac-sha-1-96;prot=esp;mod=trans;ealg=aes-cbc;spi-c=10559690;spi-s=65664
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [Security-mechanism]: ipsec-3gpp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; alg: hmac-sha-1-96
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; prot: esp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mod=trans
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ealg: des-ede3-cbc
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-c: 10559690 (0x00a120ca)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-s: 65664952 (0x03e9f7b8)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-c: 31112
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-s: 31803
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [Security-mechanism]: ipsec-3gpp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; alg: hmac-sha-1-96
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; prot: esp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mod=trans
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ealg: aes-cbc
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-c: 10559690 (0x00a120ca)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-s: 65664952 (0x03e9f7b8)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-c: 31112
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-s: 31803
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [Security-mechanism]: ipsec-3gpp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; alg: hmac-sha-1-96
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; prot: esp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mod=trans
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ealg: null
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-c: 10559690 (0x00a120ca)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-s: 65664952 (0x03e9f7b8)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-c: 31112
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-s: 31803
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [Security-mechanism]: ipsec-3gpp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; alg: hmac-md5-96
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; prot: esp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mod=trans
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ealg: des-ede3-cbc
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-c: 10559690 (0x00a120ca)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-s: 65664952 (0x03e9f7b8)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-c: 31112
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-s: 31803
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [Security-mechanism]: ipsec-3gpp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; alg: hmac-md5-96
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; prot: esp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mod=trans
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ealg: aes-cbc
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-c: 10559690 (0x00a120ca)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-s: 65664952 (0x03e9f7b8)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-c: 31112
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-s: 31803
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [Security-mechanism]: ipsec-3gpp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; alg: hmac-md5-96
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; prot: esp
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mod=trans
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ealg: null
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-c: 10559690 (0x00a120ca)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; spi-s: 65664952 (0x03e9f7b8)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-c: 31112
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; port-s: 31803
&nbsp; &nbsp; &nbsp; &nbsp; Authorization: Digest username="001010000031094@ims.mnc001.mcc001.3gppnetwork.org",realm="ims.mnc001.mcc001.3gppnetwork.org",uri="sip:ims.mnc001.mcc001.3gppnetwork.org",nonce="",response=""
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Authentication Scheme: Digest
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Username: "001010000031094@ims.mnc001.mcc001.3gppnetwork.org"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Realm: "ims.mnc001.mcc001.3gppnetwork.org"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Authentication URI: "sip:ims.mnc001.mcc001.3gppnetwork.org"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Nonce Value: ""
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Digest Authentication Response: ""
&nbsp; &nbsp; &nbsp; &nbsp; Call-ID: txecbknlk@192.168.101.3
&nbsp; &nbsp; &nbsp; &nbsp; CSeq: 1 REGISTER
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Sequence Number: 1
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Method: REGISTER
&nbsp; &nbsp; &nbsp; &nbsp; Max-Forwards: 70
&nbsp; &nbsp; &nbsp; &nbsp; Via: SIP/2.0/TCP 192.168.101.3:5060;branch=z9hG4bKrzecbkJzsat7Xk6daqm5;rport
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Transport: TCP
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Sent-by Address: 192.168.101.3
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Sent-by port: 5060
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Branch: z9hG4bKrzecbkJzsat7Xk6daqm5
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RPort: rport
&nbsp; &nbsp; &nbsp; &nbsp; User-Agent: IM-client/OMA1.0 HW-Rto/V1.0
&nbsp; &nbsp; &nbsp; &nbsp; Content-Length: 0
-----Original Message-----
From: "Yuriy Gorlichenko" &lt;ovoshlook@gmail.com&gt;
To: "Kamailio (SER) - Users Mailing List" &lt;sr-users@lists.kamailio.org&gt;;
Cc:
Sent: 2021-08-24 (화) 05:55:26 (UTC+09:00)
Subject: Re: [SR-Users] [VoLTE] 401 unauthorized error
Hi &nbsp;401 is normal response for sip authIt is also normal response for IMS service
Look into sip basic auth mechanism to clarify what is going on here and additionally look into Spec of IMS auth. There should be only auth algo change&nbsp;
I believe you did not check further request processing.On Mon, 23 Aug 2021, 18:19 오택경, &lt;ohtk@kaist.ac.kr mailto:ohtk@kaist.ac.kr&gt; wrote:
Hi.
I am implementing the VoLTE setup with the dockerized project (https://github.com/herlesupreeth/docker_open5gs https://github.com/herlesupreeth/docker_open5gs).
I have almost done to run the VoLTE service, but 401 unauthorized error in sip and auth-pending error in fhoss have occured.
How can I fix this problem?
I will share the discussion note in which I tried to solve some problems including the above one.
: https://github.com/herlesupreeth/docker_open5gs/issues/55 https://github.com/herlesupreeth/docker_open5gs/issues/55
Very thanks,
Taekkyung Oh.
__________________________________________________________Kamailio - Users Mailing List - Non Commercial Discussions&nbsp; * sr-users@lists.kamailio.org mailto:sr-users@lists.kamailio.orgImportant: keep the mailing list in the recipients, do not reply only to the sender!Edit mailing list options or unsubscribe:&nbsp; * https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
__________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions * sr-users@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe: * https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
-----Original Message-----
From: "Yuriy Gorlichenko" &lt;ovoshlook@gmail.com&gt;
To: "Kamailio (SER) - Users Mailing List" &lt;sr-users@lists.kamailio.org&gt;;
Cc:
Sent: 2021-08-24 (화) 05:55:26 (UTC+09:00)
Subject: Re: [SR-Users] [VoLTE] 401 unauthorized error
Hi&nbsp; 401 is normal response for sip authIt is also normal response for IMS service
Look into sip basic auth mechanism to clarify what is going on here and additionally look into Spec of IMS auth. There should be only auth algo change&nbsp;
I believe you did not check further request processing.On Mon, 23 Aug 2021, 18:19 오택경, &lt;ohtk@kaist.ac.kr mailto:ohtk@kaist.ac.kr&gt; wrote:
Hi.
I am implementing the VoLTE setup with the dockerized project (https://github.com/herlesupreeth/docker_open5gs https://github.com/herlesupreeth/docker_open5gs).
I have almost done to run the VoLTE service, but 401 unauthorized error in sip and auth-pending error in fhoss have occured.
How can I fix this problem?
I will share the discussion note in which I tried to solve some problems including the above one.
:&nbsp;https://github.com/herlesupreeth/docker_open5gs/issues/55 https://github.com/herlesupreeth/docker_open5gs/issues/55
Very thanks,
Taekkyung Oh.
__________________________________________________________Kamailio - Users Mailing List - Non Commercial Discussions&nbsp; * sr-users@lists.kamailio.org mailto:sr-users@lists.kamailio.orgImportant: keep the mailing list in the recipients, do not reply only to the sender!Edit mailing list options or unsubscribe:&nbsp; * https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
__________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions * sr-users@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe: * https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

Re: [SR-Users] [VoLTE] 401 unauthorized error