Author |
Message |
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Mon Aug 20, 2018 11:27 am Post subject: Brekeke not responding to INVITE with 401. |
|
|
1. Brekeke Product Name and Version:
PBX 3.6.3 - upgraded to PBX 3.8.5.2/493-3
2. Java version:
1.7 - upgraded to 1.8.0-181
3. OS type and the version:
Linux Debian 8u15
4. UA (phone), gateway or other hardware/software involved:
Cisco & Gigaset.. phones
5. Your problem:
Brekeke registers with VOIP-ISP (no problem there)
When a call arrives it is accepted and works (not in trace below).
When a Call is placed outside (INVITE) a 401 response is received and immediately another INVITE is sent but WITHOUT authentication
After a few refusals there is a final timeout where the UA received 486 Busy.
Code: |
1 0.000000000 192.168.14.100 -> ip.ad.dr.ess SIP 479 Request: REGISTER sip:sipvoice.isp (1 binding) |
2 0.019266000 ip.ad.dr.ess -> 192.168.14.100 SIP 587 Status: 401 Unauthorized |
3 0.021058000 192.168.14.100 -> ip.ad.dr.ess SIP 653 Request: REGISTER sip:sipvoice.isp (1 binding) |
4 0.040303000 ip.ad.dr.ess -> 192.168.14.100 SIP 614 Status: 200 OK (1 binding) |
5 122.276161000 192.168.1.20 -> 192.168.14.100 SIP 522 Request: REGISTER sip:192.168.14.100 (1 binding) |
6 122.276712000 192.168.14.100 -> 192.168.1.20 SIP 344 Status: 100 Trying |
7 122.280506000 192.168.14.100 -> 192.168.1.20 SIP 502 Status: 200 OK (1 binding) |
8 130.293412000 192.168.1.20 -> 192.168.14.100 SIP/SDP 1038 Request: INVITE sip:0555999555@192.168.14.100;user=phone |
9 130.293896000 192.168.14.100 -> 192.168.1.20 SIP 353 Status: 100 Trying |
10 130.306448000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 738 Request: INVITE sip:0555999555@sipvoice.isp |
11 130.326579000 ip.ad.dr.ess -> 192.168.14.100 SIP 608 Status: 401 Unauthorized |
12 130.805749000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 738 Request: INVITE sip:0555999555@sipvoice.isp |
13 130.826038000 ip.ad.dr.ess -> 192.168.14.100 SIP 608 Status: 401 Unauthorized |
14 131.805971000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 738 Request: INVITE sip:0555999555@sipvoice.isp |
15 131.824941000 ip.ad.dr.ess -> 192.168.14.100 SIP 608 Status: 401 Unauthorized |
16 133.806184000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 738 Request: INVITE sip:0555999555@sipvoice.isp |
17 133.824998000 ip.ad.dr.ess -> 192.168.14.100 SIP 608 Status: 401 Unauthorized |
18 134.313312000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 695 Request: INVITE sip:0555999555@sipvoice.isp |
19 134.333001000 ip.ad.dr.ess -> 192.168.14.100 SIP 575 Status: 401 Unauthorized |
20 134.813621000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 695 Request: INVITE sip:0555999555@sipvoice.isp |
21 134.832301000 ip.ad.dr.ess -> 192.168.14.100 SIP 575 Status: 401 Unauthorized |
22 135.813862000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 695 Request: INVITE sip:0555999555@sipvoice.isp |
23 135.832747000 ip.ad.dr.ess -> 192.168.14.100 SIP 575 Status: 401 Unauthorized |
24 137.814102000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 695 Request: INVITE sip:0555999555@sipvoice.isp |
25 137.825559000 ip.ad.dr.ess -> 192.168.14.100 SIP 608 Status: 401 Unauthorized |
26 137.832512000 ip.ad.dr.ess -> 192.168.14.100 SIP 575 Status: 401 Unauthorized |
27 138.319840000 192.168.14.100 -> ip.ad.dr.ess SIP/SDP 739 Request: INVITE sip:0555999555@sipvoice.isp |
|
After upgrading the problem still persists.
Last edited by nico-adenc on Tue Aug 21, 2018 8:53 am; edited 1 time in total |
|
Back to top |
|
llucy Brekeke Talented
![](images/spacer.gif)
Joined: 31 Jan 2014 Posts: 52
|
Posted: Mon Aug 20, 2018 9:29 pm Post subject: |
|
|
nico-adenc,
The PBX sent INVITE requests many times and it would be re-try packets maybe because it did not receive a respnse (or bad response) from the UAS.
Please check if the PBX can receive packets from VOIP-SIP or the response packets are correct.
Lucy |
|
Back to top |
|
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Tue Aug 21, 2018 2:56 am Post subject: |
|
|
@Lucy, Please take note THERE are responces to the requests.
Those are the 401 status responces. The 401 response SHOULD cuase a new INVITE WITH authentication info, problem is it doesn't create those but just retransmists the un-authenticated.
AFAICT the 401 on INVITE has never been picked up by the SIP server.
The VOIP provider wants to authenticate INVITEs as well as REGISTER.
I tried using linphone & zoiper and they DO respond to the 401 adequately and get an immediate conversation.
I can confirm form the logging this is handled like a timeout:
Here is the logging from the New Brekeke sv.log
From a test.
A full .PCAP is available for brekeke developpers if needed.
Code: |
session.8: sipex.7: start: from=<sip:SenderPhone#@sipvoice.isp> to=<sip:Callee#@sipvoice.isp>
session.8: information:
starttime = 08/20/18 21:17:33.463
timestamps = 08/20/18 21:17:33.457 (1) 08/20/18 21:17:33.458 (2) 08/20/18 21:17:33.460
spiral-hop = 1
dispatcher-id = 1
plugin = com.brekeke.net.sip.sv.session.plugins.InviteSession
request = INVITE sip:Callee#@sipvoice.isp SIP/2.0
rulename = outbound & From PBX
org:From: = sip:SenderPhone#@sipvoice.isp
new:From: = sip:SenderPhone#@sipvoice.isp
org:To: = sip:Callee#@sipvoice.isp
new:To: = sip:Callee#@sipvoice.isp
src:addr/port = 127.0.0.1:15062 (UDP local-addr if)
src:interface = 127.0.0.1:5060 (UDP local-addr)
dst:addr/port = Provider.ip.ad.re.ss:5060 (UDP global-addr)
dst:interface = Brekeke.ip.ad.re.ss:5060 (UDP global-addr)
uac:user-agent= Brekeke PBX
mode:B2BUA = on
mode:RTPrelay = off
mode:Auth = off (user-required)
mode:NAT = auto
session.8: phase=0: Initializing
session.8: System Used Memory = 8536
session.8: receive: from=UAC:127.0.0.1:15062(UDP) at 08/20/18 21:17:33.463
==============================================
INVITE sip:Callee#@sipvoice.isp SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:15062;rport=15062;branch=z9hG4bKc47e22a8df3a
From: "SenderPhone#" <sip:SenderPhone#@sipvoice.isp>;tag=bce6b1372p
To: <sip:Callee#@sipvoice.isp>
Max-Forwards: 67
Contact: <sip:SenderPhone#@127.0.0.1:15062>
Call-ID: 46f3ecf5-dc844233-cb05f53c-7f6198b0
User-Agent: Brekeke PBX
CSeq: 1 INVITE
Abandon-Timer: 4000ms
Allow: INVITE,ACK,BYE,CANCEL,INFO,MESSAGE,REFER,NOTIFY,SUBSCRIBE,UPDATE,PRACK
Content-Type: application/sdp
Content-Length: 147
v=0
o=bk 5 1 IN IP4 <$if:127.0.0.1>
s=-
c=IN IP4 <$if:127.0.0.1>
t=0 0
m=audio 30002 RTP/AVP 0
a=sendrecv
a=rtpmap:0 PCMU/8000
a=ptime:20
==============================================
session.8: content-type=application/sdp plugin=com.brekeke.net.content.application.Sdp
session.8: pkt#=1 dp=1 st=0 sip:SenderPhone#@sipvoice.isp(127.0.0.1:15062) --> sip:Callee#@sipvoice.isp(Provider.ip.ad.re.ss)
send="INVITE sip:Callee#@sipvoice.isp SIP/2.0"
session.8: phase=1: Inviting
session.8: processtime=7
session.8: send: to=UAS:Provider.ip.ad.re.ss(UDP) at 08/20/18 21:17:33.464
==============================================
INVITE sip:Callee#@sipvoice.isp SIP/2.0
Via: SIP/2.0/UDP Brekeke.ip.ad.re.ss:5060;branch=z9hG4bKd5e97fff51c4-30-2e4886
From: "SenderPhone#" <sip:SenderPhone#@sipvoice.isp>;tag=bce6b1372p
To: <sip:Callee#@sipvoice.isp>
Max-Forwards: 66
Contact: <sip:SenderPhone#@Brekeke.ip.ad.re.ss:5060>
Call-ID: 46f3ecf5-dc844233-cb05f53c-7f6198b0
User-Agent: Brekeke PBX
CSeq: 1 INVITE
Allow: INVITE,ACK,BYE,CANCEL,INFO,MESSAGE,REFER,NOTIFY,SUBSCRIBE,UPDATE,PRACK
Content-Type: application/sdp
Content-Length: 147
v=0
o=bk 5 1 IN IP4 Brekeke.ip.ad.re.ss
s=-
c=IN IP4 Brekeke.ip.ad.re.ss
t=0 0
m=audio 30002 RTP/AVP 0
a=sendrecv
a=rtpmap:0 PCMU/8000
a=ptime:20
==============================================
session.8: stat: result=undefined(6) close=false
> +--------------+--------------+--------------+--------------+
> | 1 INVITE | | 1 INVITE | |
> +--------------+--------------+--------------+--------------+
> 1/1 0/0 1/1 0/0
> ResendStat: INVITE(1),
session.8: termination: reason=timeout
session.8: phase=6: Closing
session.8: send: to=UAC:127.0.0.1:15062(UDP) at 08/20/18 21:17:37.464
==============================================
SIP/2.0 504 Server Time-out
Via: SIP/2.0/UDP 127.0.0.1:15062;rport=15062;branch=z9hG4bKc47e22a8df3a
From: "SenderPhone#" <sip:SenderPhone#@sipvoice.isp>;tag=bce6b1372p
To: <sip:Callee#@sipvoice.isp>;tag=b49ce798bs
Call-ID: 46f3ecf5-dc844233-cb05f53c-7f6198b0
CSeq: 1 INVITE
Server: Brekeke SIP Server
Content-Length: 0
==============================================
session.8: status: Zombie at Closing
session.8: stat: result=Time Out(4) close=false
> +--------------+--------------+--------------+--------------+
> | | 504 | 1 INVITE | |
> +--------------+--------------+--------------+--------------+
> 0/0 0/0 1/1 0/0
> ResendStat: 504-INVITE(1),
session.8: receive: from=UAC:127.0.0.1:15062(UDP) at 08/20/18 21:17:37.465
==============================================
ACK sip:Callee#@sipvoice.isp SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:15062;rport=15062;branch=z9hG4bKc47e22a8df3a
From: "SenderPhone#" <sip:SenderPhone#@sipvoice.isp>;tag=bce6b1372p
To: <sip:Callee#@sipvoice.isp>;tag=b49ce798bs
Max-Forwards: 67
Contact: <sip:SenderPhone#@127.0.0.1:15062>
Call-ID: 46f3ecf5-dc844233-cb05f53c-7f6198b0
User-Agent: Brekeke PBX
CSeq: 1 ACK
Content-Length: 0
==============================================
session.8: pkt#=2 dp=1 st=0 sip:SenderPhone#@sipvoice.isp(127.0.0.1:15062) --> sip:Callee#@sipvoice.isp(Provider.ip.ad.re.ss)
send="ACK sip:Callee#@sipvoice.isp SIP/2.0"
session.8: Accept ACK and doesn't forward it
session.8: stat: result=Time Out(4) close=false ( wait-retry )
> +--------------+--------------+--------------+--------------+
> | | | 1 INVITE | |
> +--------------+--------------+--------------+--------------+
> 0/0 0/0 1/1 0/0
session.6: receive: from=UAS:127.0.0.1:15060(UDP) at 08/20/18 21:17:37.571
==============================================
SIP/2.0 486 Busy Here
Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKd5e97e84c6a6-30-2e4886
From: "Ext" <sip:Ext@caller.dns.domain>;tag=4210317052
To: <sip:Callee#@caller.dns.domain;user=phone>;tag=b651622bfp
Call-ID: 2049390325@Ext.ip.ad.re.ss
CSeq: 2 INVITE
Content-Length: 0
==============================================
session.6: pkt#=3 dp=2 st=0 sip:Callee#@caller.dns.domain(127.0.0.1:15060) --> sip:Ext@caller.dns.domain(Ext.ip.ad.re.ss:5060)
send="SIP/2.0 486 Busy Here"
session.6: phase=6: Closing
session.6: processtime=1
session.6: send: to=UAC:Ext.ip.ad.re.ss:5060(UDP) at 08/20/18 21:17:37.571
==============================================
SIP/2.0 486 Busy Here
Via: SIP/2.0/UDP Ext.ip.ad.re.ss:5060;branch=z9hG4bKf1427858b65fb552242826542b180061;rport=5060
From: "Ext" <sip:Ext@caller.dns.domain>;tag=4210317052
To: <sip:Callee#@caller.dns.domain;user=phone>;tag=b651622bfp
Call-ID: 2049390325@Ext.ip.ad.re.ss
CSeq: 2 INVITE
Content-Length: 0
|
|
|
Back to top |
|
Tata Brekeke Master Guru
![](images/spacer.gif)
Joined: 27 Jan 2008 Posts: 223
|
Posted: Tue Aug 21, 2018 10:07 am Post subject: |
|
|
Let you enable "Listener" at [SIP Server log settings] of [Diagnostics]->[Debug Logs] page, and push [Update] button.
After you reproduced the issue, paste the log here again.
The Listener log will show why 401 is not picked. |
|
Back to top |
|
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Tue Aug 21, 2018 1:25 pm Post subject: |
|
|
So this shows several of these:
Code: |
==============================================
svlistener: debug: remote=sipprovider.ip.ad.re.ss:5060 at 08/21/18 22:14:43.088
==============================================
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.105.244:5060;branch=z9hG4bKca0749ec694c-30-2e72e6;received=brekeke.ip.ad.re.ss
From: "Caller#" <sip:Caller#@sipvoice.isp>;tag=b70ec8b3dp
To: <sip:Callee#@sipvoice.isp>;tag=as668c6c2b
Call-ID: e97564c1-97c6c1f7-7f2cf0f8-3aa41874
CSeq: 1 INVITE
Server: isp.name
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="isp.name", nonce="0134a75e"
Content-Length: 0
|
Not sure what this adds to the info i got from the .pcap file...
there is no reason in the log why it dropped this 401..., in stead of generating a new INVITE with authentication data.
(afaict, even brekeke 3.4.3.2 can handle that part. just tried somewhere else) |
|
Back to top |
|
Tata Brekeke Master Guru
![](images/spacer.gif)
Joined: 27 Jan 2008 Posts: 223
|
Posted: Tue Aug 21, 2018 2:39 pm Post subject: |
|
|
Check 401's Call-ID, From tag, Via's IP address and branch parameter whether they are same as INVITE's request. |
|
Back to top |
|
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Wed Aug 22, 2018 1:25 am Post subject: |
|
|
The Via is different.
From & To are equal.
Call-ID matches.
The Via line containing the 192.168.105.244 most probably is a belgacom CPE gateway item.
Brekeke is behind a router behind the Belgacom CPE.
A gigaset phone behind this same router can dial & be called without problems. |
|
Back to top |
|
janP Brekeke Master Guru
![](images/spacer.gif)
Joined: 25 Nov 2007 Posts: 336
|
Posted: Wed Aug 22, 2018 8:17 am Post subject: |
|
|
Disable SIP-ALG at the gateway. |
|
Back to top |
|
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Wed Aug 22, 2018 8:53 am Post subject: |
|
|
There is no option for disabling ALG or not. (user mode config)
Admin access is not provided by PROXIMUS to their BBOX.
There is no possibity to replace the box. |
|
Back to top |
|
janP Brekeke Master Guru
![](images/spacer.gif)
Joined: 25 Nov 2007 Posts: 336
|
Posted: Wed Aug 22, 2018 9:51 am Post subject: |
|
|
Which parts of Via are changed?
IP address? or Branch parameter? or just added received parameter? |
|
Back to top |
|
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Thu Aug 23, 2018 5:37 am Post subject: |
|
|
It is an added received parameter see above packet log:
Transmitted: Via: SIP/2.0/UDP Brekeke.public.ipad.ress:5060;branch=z9hG4bKd5e97fff51c4-30-2e4886
Receved as:
Via: SIP/2.0/UDP 192.168.105.244:5060;branch=z9hG4bKca0749ec694c-30-2e72e6;received=brekeke.public.ipad.ress
The 192.168.105.244 is the ipaddress on the PROXIUMUS network
(Proximus modem has 192.168.105.1) |
|
Back to top |
|
janP Brekeke Master Guru
![](images/spacer.gif)
Joined: 25 Nov 2007 Posts: 336
|
|
Back to top |
|
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Thu Aug 23, 2018 12:22 pm Post subject: |
|
|
Thanks for the document.
I'll read it. atm we are setting up the network for PPPoE (it requires some extra hardware etc. to get it done, then at least we can be sure something that works for 2 years should not automagically fail in the future).
OTOH, why can Gigaset, Cisco phones work by ignoring this extra header and isn't this even an option for brekeke. |
|
Back to top |
|
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Thu Aug 23, 2018 2:12 pm Post subject: |
|
|
Summary:
Ok PPPoE transiotion complete... effectivly a lot less hassle and more reliability. (It will need some cabling and extra WiFi AP...)
Thinks for responces at least it helped solve some issues.
It would be nice if Brekeke could accept Rogue ALG inserted Via Records somehow. (even if it could be made an option).
wrt. Poximus: ADSL is done with ALG disabled, VDSL2 is done with ALG enabled. Probably it canbe disabled from ADMIN mode. That password is not provided.
Chapter 12 mentions that they don't anticipate SBC's on Customer Premises..... so it just S****s. |
|
Back to top |
|
janP Brekeke Master Guru
![](images/spacer.gif)
Joined: 25 Nov 2007 Posts: 336
|
Posted: Thu Aug 23, 2018 2:32 pm Post subject: |
|
|
> OTOH, why can Gigaset, Cisco phones work by ignoring this extra header and isn't this even an option for brekeke.
If they are SIP clients, they may omit the Via header inspection. (because they don't expect concurrent SIP sessions with multiple unique callers and callees).
As a SIP proxy, Brekeke SIP Server inspects Via header's sent-by address.
RFC3261 said:
Quote: |
The sent-by value is used as part of the matching process because there could be accidental or malicious duplication of branch parameters from different clients. |
Quote: |
The Via header field values in the response MUST equal the Via header field values in the request and MUST maintain the same ordering |
So it seems your gateway is not SIP-compliant |
|
Back to top |
|
janP Brekeke Master Guru
![](images/spacer.gif)
Joined: 25 Nov 2007 Posts: 336
|
Posted: Thu Aug 23, 2018 2:57 pm Post subject: |
|
|
> It would be nice if Brekeke could accept Rogue ALG inserted Via Records somehow. (even if it could be made an option).
It might cause a routing issue and also increases a chance of Denial-of-Service attacks.
I'm not sure whether the following DialPlan rule avoid the issue but let you try.
Matching Patterns | $request = ^INVITE To = @sipvoice.isp
| Deploy Patterns | $ifdst = 192.168.105.244 $continue = true
|
Put the above DialPlan rule in the top of DialPlan page. |
|
Back to top |
|
nico-adenc Brekeke Member
![](images/spacer.gif)
Joined: 27 Sep 2017 Posts: 24
Location: NL
|
Posted: Fri Aug 24, 2018 6:39 am Post subject: |
|
|
I cannot test this any more. Yesterday we migrated it to PPPoE with a firewall we actually control, that has no ALG active.
Anyway we now have a standards compliant working environment.
So BBOX behaviour is now irrelevant outside bridging DSL -> Ethernet. |
|
Back to top |
|
|