My provider says the 2nd 401 comes because I used auth_username without domain part. If I change auth_username to "login@ip.provider.com" they send 401 than 201ok.


чт, 14 июл. 2022 г. в 19:03, Алексей Якимкин <ayakimkin@gmail.com>:
Hello,

I try to register on provider`s pbx

version: kamailio 5.7.0-dev0 (x86_64/linux)

modparam("uac", "reg_db_url", "mysql://kamailio:123@localhost/kamailio")
modparam("uac", "reg_contact_addr", "1.1.1.1:5060")
modparam("uac", "reg_retry_interval", 120); # for failed registrations
modparam("uac", "reg_keep_callid", 1)
modparam("uac","restore_mode","auto")

uacreg table:
+----+---------+------------+-----------+----------------+-----------------+-------+----------------+------------------+----------+---------------------+---------+-------+-----------+--------------+------------------+
| id | l_uuid  | l_username | l_domain  | r_username     | r_domain        | realm | auth_username  | auth_password    | auth_ha1 | auth_proxy          | expires | flags | reg_delay | contact_addr | socket           |
+----+---------+------------+-----------+----------------+-----------------+-------+----------------+------------------+----------+---------------------+---------+-------+-----------+--------------+------------------+
|  1 | 1234567 | pbx        | 127.0.0.1 | login | ip.provider.ru   |       | login | password|          | sip:...com   |     120 |     0 |         0 |              | 10.130.0.23:5060 |

I see this two 401 replies
изображение.png

1st REGISTER
Via: SIP/2.0/UDP 1.1.1.1:5060;branch=z9hG4bK589d.8183f2e6000000000000000000000000.0
To: <sip:login@ip.provider.com>
From: <sip:login@ip.provider.com>;tag=f9cf84029bbf24b61836c3d9fef7b7ae-78a2ffe1
CSeq: 10 REGISTER
Call-ID: 6818f1b436befce1-21980@10.130.0.23
Max-Forwards: 70
Content-Length: 0
User-Agent: server
Contact: <sip:1234567@1.1.1.1:5060>
Expires: 120

1st 401
WWW-Authenticate: Digest algorithm=MD5,realm=".......org",nonce="56806a6f32c49a3afea043c2fa42381f",domain="sip:......org",qop="auth",stale=FALSE

2nd REGISTER
Authorization: Digest username="login", realm=".....", nonce="56806a6f32c49a3afea043c2fa42381f", uri="sip:......com", qop=auth, nc=00000001, cnonce="357420659", response="6e300c9f7f4d81095f29b5408f8d5191", algorithm=MD5

2nd 401
WWW-Authenticate: Digest algorithm=MD5,realm=".....org",nonce="3b9586f6d31a76e509eb204d8a030415",domain="sip:.....org",qop="auth",stale=TRUE

I think kamailio need to sent 3nd REGISTER with a new nonce, because stale=true. But it interrupts register with error:

Jul 14 18:41:00 opensips kamailio[21936]: 10(21949) DEBUG: {2 11 REGISTER 6818f1b436befcf7-21980@10.130.0.23} uac [uac_reg.c:852]: uac_reg_tm_callback(): completed with status 401 [uuid: 1234567]
Jul 14 18:41:00 opensips kamailio[21936]: 10(21949) ERROR: {2 11 REGISTER 6818f1b436befcf7-21980@10.130.0.23} uac [uac_reg.c:933]: uac_reg_tm_callback(): authentication failed for <1234567>

Can I get kamailio to send REGISTER after the second 401-reply?
Can I intercept this REGISTER and 401 in kamailio.conf? Is there any examples?
I know about this instruction https://kamailio.org/docs/modules/5.7.x/modules/uac.html :)

Itried in request_route
xlog("L_NOTICE", "uac 114411 1 remote fU $fU user [$rU] on [$rd] via [$du] $Ri \n");
if (uac_reg_request_to("$fU", 0)) {
                xlog("L_NOTICE", "uac 114411 Found remote user [$rU] on [$rd] via [$du]\n");
                t_on_failure("REMOTE_AUTH");

                #t_relay();
        }

And failure_route
failure_route[REMOTE_AUTH] {
        if ($T_reply_code == 401 or $T_reply_code == 407) {
                xlog("L_NOTICE", "uac 114411 Remote asked for authentication\n");
                uac_auth();
        }
}

but I haven't got logs on register request, 401 reply.



--
Best regards,
Alex



--
С уважением,
Якимкин Алексей