Provider Not accepting response to 401 Auth challenge

We Recently updated to V17 and it was working great. Our SIP provider did some scheduled maintenance and all the sudden outbound calling stopped working. They claim it was just a router patch and they have hundreds of other SIP endpoints on that router and no one else is complaining of anything.
We dug into the traffic and can see that when we place a call we receive the 401 Unauthorized response to it, to which Asterisk responds with the username and password as defined in the trunk settings. Password is what I assume MD5 encrypted.
The provider then responds again with another 401, claiming something is wrong with the password.
When they disable authentication on their end it now all the sudden works.
I am 99% sure that this is a provider issue but we tried to simplify the password and everything and they just wont take it.

My question is, is there anyway to decrypt that password with a private key from the server to verify in plain text that we are sending the correct password back on the 401 challenge?

They wouldn’t reply with 401, if the password was wrong. It is generally when the supporting information is wrong, that that happens.

The password (more correctly secret) is combined with other information and hashed. They will check the other information,and if some is missing, or stale, will rechallenge with 401. If the hash is wrong, for the supporting information provided, and the shared secret, they should respond with 403.

Without the actual challenge and response, we can’t really go further than that.

Initial Register

Session Initiation Protocol (REGISTER)
Request-Line: REGISTER sip:72.15.21.XXX:5060 SIP/2.0
Message Header
Via: SIP/2.0/UDP 216.107.220.XXX:5060;rport;branch=z9hG4bKPjddbccae0-2df4-4132-a1a5-646be290a277
From: sip:[email protected];tag=73b0044c-dff6-4487-af9d-ad45c23d3712
SIP from address: sip:[email protected]
SIP from tag: 73b0044c-dff6-4487-af9d-ad45c23d3712
To: sip:[email protected]
SIP to address: sip:[email protected]
Call-ID: 9005d6b7-c8f1-4be3-a1e2-d3768181361c
[Generated Call-ID: 9005d6b7-c8f1-4be3-a1e2-d3768181361c]
CSeq: 45398 REGISTER
Sequence Number: 45398
Method: REGISTER
Contact: sip:[email protected]:5060;line=cbwchet
Contact URI: sip:[email protected]:5060;line=cbwchet
Contact URI User Part: SAU80Shaker
Contact URI Host Part: 216.107.220.XXX
Contact URI Host Port: 5060
Contact URI parameter: line=cbwchet
Expires: 0
Max-Forwards: 70
User-Agent: FPBX-17.0.19.23(21.5.0)
Content-Length: 0

Followup

Session Initiation Protocol (401)
Status-Line: SIP/2.0 401 Unauthorized
Message Header
Call-ID: 9005d6b7-c8f1-4be3-a1e2-d3768181361c
[Generated Call-ID: 9005d6b7-c8f1-4be3-a1e2-d3768181361c]
CSeq: 45398 REGISTER
Sequence Number: 45398
Method: REGISTER
From: sip:[email protected];tag=73b0044c-dff6-4487-af9d-ad45c23d3712
SIP from address: sip:[email protected]
SIP from tag: 73b0044c-dff6-4487-af9d-ad45c23d3712
To: sip:[email protected];tag=sip+1+445501bc+9062305c
SIP to address: sip:[email protected]
SIP to tag: sip+1+445501bc+9062305c
Via: SIP/2.0/UDP 216.107.220.XXX:5060;received=216.107.220.XXX;rport=1784;branch=z9hG4bKPjddbccae0-2df4-4132-a1a5-646be290a277
Content-Length: 0
WWW-Authenticate: Digest realm=“192.168.220.25”,nonce=“364b5b1ccf31”,stale=false,algorithm=MD5,qop=“auth”
Authentication Scheme: Digest
Realm: “192.168.220.25”
Nonce Value: “364b5b1ccf31”
Stale Flag: false
Algorithm: MD5
QOP: “auth”
Server: DC-SIP/2.0
Organization: BRMSWA

Auth Challenge Response

Session Initiation Protocol (REGISTER)
Request-Line: REGISTER sip:72.15.21.XXX:5060 SIP/2.0
Message Header
Via: SIP/2.0/UDP 216.107.220.XXX:5060;rport;branch=z9hG4bKPj3b047ba2-2bc4-416f-9caa-2c85d61d04f4
From: sip:[email protected];tag=73b0044c-dff6-4487-af9d-ad45c23d3712
SIP from address: sip:[email protected]
SIP from tag: 73b0044c-dff6-4487-af9d-ad45c23d3712
To: sip:[email protected]
SIP to address: sip:[email protected]
Call-ID: 9005d6b7-c8f1-4be3-a1e2-d3768181361c
[Generated Call-ID: 9005d6b7-c8f1-4be3-a1e2-d3768181361c]
CSeq: 45399 REGISTER
Sequence Number: 45399
Method: REGISTER
Contact: sip:[email protected]:5060;line=cbwchet
Contact URI: sip:[email protected]:5060;line=cbwchet
Contact URI User Part: SAU80Shaker
Contact URI Host Part: 216.107.220.XXX
Contact URI Host Port: 5060
Contact URI parameter: line=cbwchet
Expires: 0
Max-Forwards: 70
User-Agent: FPBX-17.0.19.23(21.5.0)
[truncated]Authorization: Digest username=“SAU80Shaker”, realm=“192.168.220.25”, nonce=“364b5b1ccf31”, uri=“sip:72.15.21.XXX:5060”, response=“4c23d763bd2b752a6181504264caac7f”, algorithm=MD5, cnonce=“adb2dd45a6044fa8931ccd6078d03eb2”, qop
Authentication Scheme: Digest
Username: “SAU80Shaker”
Realm: “192.168.220.25”
Nonce Value: “364b5b1ccf31”
Authentication URI: “sip:72.15.21.XXX:5060”
Digest Authentication Response: “4c23d763bd2b752a6181504264caac7f”
Algorithm: MD5
CNonce Value: “adb2dd45a6044fa8931ccd6078d03eb2”
QOP: auth
Nonce Count: 00000001
Content-Length: 0

I think this should be what your looking for? I’ve cleaned IP’s

My suspicion is the source port rewrite:
Via: SIP/2.0/UDP 216.107.220.XXX:5060;received=216.107.220.XXX;rport=1784;branch=z9hG4bKPjddbccae0-2df4-4132-a1a5-646be290a277
Contact: sip:[email protected]:5060;line=cbwchet
So Asterisk sent the REGISTER from port 5060 but your router/firewall rewrote the source port to 1784, which doesn’t match the port 5060 in the Contact header. Some providers will reject such requests.

Try disabling source port rewrite, use port forwarding or otherwise force the firewall to leave the source port alone.

1 Like

Nothing obviously wrong, although it would be easier to read if taken from the Asterisk logs.

You haven’t shown the re-challenge. In particular, I would like to see the “stale” setting.

Stewart’s reply makes sense.

Also note that, if you don’t fix the Contact header issue, you will probably find that calls fail after 32 seconds.

Interesting! I didn’t catch that. The firewall rule isn’t touching the service side of it. Or at least its not configured to be touching it. Supposed to just be SNAT it and leave the port alone.

I will have to clarify with support and report back.

The calls are staying up as of right now. It’s a production system and I know the calls are lasting long than that.
I will have to work with the provider and do more troubleshooting on it. right now with Auth turned off we aren’t getting the challenge so I can’t update you with those logs.

Here is a packet from the provider.
One thing they noted was the contact with just the letter S

Session Initiation Protocol (REGISTER)
Request-Line: REGISTER sip:72.15.21.XXX:5060 SIP/2.0
Message Header
Via: SIP/2.0/UDP 216.107.220.XXX:5060;rport;branch=z9hG4bKPj0fd32732-99a0-4eb7-bd46-df9b966065d0
From: sip:[email protected];tag=bc44a3f4-877c-4799-a5c0-ee60933341ea
SIP from address: sip:[email protected]
SIP from tag: bc44a3f4-877c-4799-a5c0-ee60933341ea
To: sip:[email protected]
SIP to address: sip:[email protected]
Call-ID: 2558797e-7a9b-4d96-9ea4-9999b50e1ed3
[Generated Call-ID: 2558797e-7a9b-4d96-9ea4-9999b50e1ed3]
CSeq: 9478 REGISTER
Contact: sip:[email protected]:5060;line=tizlmzu
Contact URI: sip:[email protected]:5060;line=tizlmzu
Expires: 3600
Allow: OPTIONS, INVITE, ACK, BYE, CANCEL, UPDATE, PRACK, REGISTER, SUBSCRIBE, NOTIFY, PUBLISH, INFO, MESSAGE, REFER
Max-Forwards: 70
User-Agent: FPBX-17.0.19.23(21.5.0)
Content-Length: 0

I don’t know where that contact sip:[email protected] is coming from. I did go into the trunk advance settings and change contact rewrite to the username that they are expecting but I did not get a follow up capture from them.
The return port is blank on what they see though so I assume that means to send it back on the same port it arrived on.

That’s what Asterisk sends by default (on a REGISTER request). If you have only one DID with the provider, set Contact User for the trunk to that number (or your username if different), which will replace the s. On an incoming INVITE, the URI will have that value in the user part, unless the provider substitutes the called number.

The provider should not care about the user part of the contact; they should simply return the whole value, as the request URI, when sending incoming calls to you. Unfortunately, some providers try and extract account information from it, so there is a Contact User setting that allows you to control it.

As already described, the default is to use the user part of the request URI as the “DID”. Sometimes the real “DID” will be in the To header, and there is an alternative initial context, from-pstn-toheader, to handle that case. However you haven’t got that far, if the REGISTER is being rejected.

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.