Juha,

Seems you're right, I managed to register with sipsak using -p for outbound proxy, and also with Qutecom, if uri is set to the 172.17.10.50 ip. Funny thing is that linphone refuses to register (error code for "wrong password" in Kamailio) although the Authorization header looks the same regarding uri/realm/username tokens.

Well, gonna look deeper, but it makes me wonder a little...

Andreas

Juha Heinanen wrote:

Andreas Granig writes:

...

So how does the IP of Kamailio actually influence authentication? Do I have to set something special on Kamailio to make this work?

i don't think ip addresses have anything to do with authentication. in your example, request uri should have the domain the registration is for, i.e., 172.17.10.50, but that should not affect authentication.

...

Authorization: Digest username="sipwise1", realm="172.17.10.50", nonce="4a06e2820000000a80c173db2d166fedb7d8d1e933c97855", uri="sip:1.2.3.4", response="de645a701a7c507c47a5278923bce54b", algorithm=MD5.

compare this to a working register from sipsak.

-- juha

Hello,

running in debug mode should reveal also more details about where the issue actually resides.

Cheers, Daniel

On 05/10/2009 06:10 PM, Iñaki Baz Castillo wrote:

El Domingo, 10 de Mayo de 2009, Andreas Granig escribió:

...

So the only thing referring to the public Firewall IP is in the R-Uri of the registration and in the Authorization-uri-token. Is this token also used to calculate the auth hashes somehow? Username looks fine in the Authorization header, and so does Realm. Any ideas?

I see nothing wrong in this trace, all seems correct. So I expect some error in client authentication algorithm and so.

You could log the "www_authorize()" return code in Kamailio, which would be a negative value. I do the following:

    if (!www_authorize("","subscriber")) {
            if $rc == -1       
		xlog("L_WARN", "REGISTER _WARN_ www_authorize(): -1 (invalid user)  [$tu from $si:$sp]\n");
            else if $rc == -2
		xlog("L_WARN", "REGISTER _WARN_ www_authorize(): -2 (invalid password)  [$tu from $si:$sp]\n");
            else if $rc == -3
		xlog("L_INFO", "REGISTER www_authorize(): -3 (stale nonce)  [$tu from $si:$sp]\n");
            else if $rc == -5
		xlog("L_WARN", "REGISTER _WARN_ www_authorize(): -5 (generic error)  [$tu from $si:$sp]\n");
            www_challenge("","1");
            exit;
    }

Hello,

On 05/11/2009 12:54 PM, Andreas Granig wrote:

Inaki, Daniel,

In debug mode, it only shows that in auth/api.c:check_response the result doesn't match.

Since I managed to authenticate sipsak and qutecom, but not linphone, I also guess there must be something wrong with the implementation. Strange thing is that it works in a setup without FW, but not with FW (same for kphone).

so you get same behavior with kphone as well (no auth when behind fw)? Never used linphone, but kphone was ok in all test i've been using...

Some of the phones use the domain, some don't, when computing credentials, this could be a reason if the domain is taken from different sources. Checking the source code could reveal the issue.

Cheers, Daniel

Andreas

Daniel-Constantin Mierla wrote:

...

Hello,

running in debug mode should reveal also more details about where the issue actually resides.

Cheers, Daniel

On 05/10/2009 06:10 PM, Iñaki Baz Castillo wrote:

...

El Domingo, 10 de Mayo de 2009, Andreas Granig escribió:

...

So the only thing referring to the public Firewall IP is in the R-Uri of the registration and in the Authorization-uri-token. Is this token also used to calculate the auth hashes somehow? Username looks fine in the Authorization header, and so does Realm. Any ideas?

I see nothing wrong in this trace, all seems correct. So I expect some error in client authentication algorithm and so.

You could log the "www_authorize()" return code in Kamailio, which would be a negative value. I do the following:

    if (!www_authorize("","subscriber")) {
            if $rc == -1       
		xlog("L_WARN", "REGISTER _WARN_ www_authorize(): -1 (invalid user)  [$tu from $si:$sp]\n");
            else if $rc == -2
		xlog("L_WARN", "REGISTER _WARN_ www_authorize(): -2 (invalid password)  [$tu from $si:$sp]\n");
            else if $rc == -3
		xlog("L_INFO", "REGISTER www_authorize(): -3 (stale nonce)  [$tu from $si:$sp]\n");
            else if $rc == -5
		xlog("L_WARN", "REGISTER _WARN_ www_authorize(): -5 (generic error)  [$tu from $si:$sp]\n");
            www_challenge("","1");
            exit;
    }

---

Kamailio (OpenSER) - Users mailing list Users@lists.kamailio.org http://lists.kamailio.org/cgi-bin/mailman/listinfo/users http://lists.openser-project.org/cgi-bin/mailman/listinfo/users