23 Aug
2012
23 Aug
'12
8:57 a.m.
The nonce is globally valid until it expires (for all kind of requests,
IIRC you could also change the user).
Maybe your "internal" SIP clients calculates the response wrong. You
could test the response calculation with this website (do not use 'real'
passwords):
http://pernau.at/kd/sipdigest.php
klaus
On 22.08.2012 10:51, patrice.bodeven(a)orange.com wrote:
Hello,
I am working on Kamailio 3.2.2. There is no traffic, only functional
test done.
Based on the SIP Client used until now (Xlite), the INVITE is
systematically authenticated by 407 as there is no Proxy-Authorization
in the initial INVITE. Expected/normal behavior.
But when using an internal SIP client, the initial INVITE is generated
with a Proxy-Authorization containing the nonce value used by the
successful registration.
_In Authorization of Register (the answer is 200OK)_
Digest username="+33296488922(a)ims.v0.pftest.net".net",
realm="sip:ims.v0.pftest.net",
nonce="UDP43lAzpH7SjicT6+9/KDDloW4OTfTXoGWlZurBVut0JV604jox/QY+tVeA",
uri="sip:ims.v0.pftest.net",
response="4ed51b8e62cf769b19f8c4771e068ad3",
cnonce="06440000000529330fe1", qop=auth, nc=00000011
_In Proxy-Authorization of Invite _
Digest username="+33296488922(a)ims.v0.pftest.net".net",
realm="sip:ims.v0.pftest.net",
nonce="UDP43lAzpH7SjicT6+9/KDDloW4OTfTXoGWlZurBVut0JV604jox/QY+tVeA",
uri="sip:0157361149@ims.v0.pftest.net",
response="b247052d6d5b37e0b6677c816390cb77",
cnonce="06440000000529330fe1", qop=auth, nc=00000012
As the nonce expire is high (see nonce_expire), I don't understand why
Kamailio requests the Authentication of the INVITE by 407.
_407 with Proxy-Authenticate_: Digest realm="ims.v0.pftest.net",
nonce="UDP6pVAzpkWDF+jSlP3zzVYcuNPhY8NQBj62WIA=", qop="auth",
stale=true
*Does it mean that the REGISTER and INVITE are using different Nonce
value ? *
èInformation on my configuration file.
modparam("auth_db", "db_url", DBURLAUTH)
modparam("auth", "auth_checks_register", 6) # callid and From TAG
modparam("auth", "qop", "auth") # enable qop=auth
modparam("auth", "nonce_count", 1) # enable nonce_count support
modparam("auth", "nonce_expire", 21600) # Set nonce_expire to 6
hours
For register, I do
if (!www_authorize("$ru", "subscriber"))
{
if($? == -2 || $? == -3) {
sl_send_reply("403","Forbidden auth ID");
exit;
}
else {
www_challenge("$ru", "17");
exit;
}
}
For invite, I do
if (!proxy_authorize("$fd", "subscriber"))
{
if($? == -2 || $? == -3) {
sl_send_reply("403","Forbidden auth ID");
exit;
}
else {
proxy_challenge("$fd", "17");
xlog("L_INFO","INVITE challenged by 407 to :$di:$dp
\n");
exit;
}
}
Followed by consume_credentials();
Thanks in advance for your support.
*Patrice B*
_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou
privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message
par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages
electroniques etant susceptibles d'alteration,
France Telecom - Orange decline toute responsabilite si ce message a ete altere, deforme
ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that
may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this
message and its attachments.
As emails may be altered, France Telecom - Orange is not liable for messages that have
been modified, changed or falsified.
Thank you.
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users(a)lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users