[Home]

Summary:ASTERISK-06799: Sip Registration Stale Nonce Problem on long-latency links (satellite)
Reporter:Pedro Niño (ninop)Labels:
Date Opened:2006-04-17 17:12:18Date Closed:2006-05-03 12:51:46
Priority:MajorRegression?No
Status:Closed/CompleteComponents:Channels/chan_sip/Registration
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) Asterisk_Sip.conf__config_Example_for_Cisco_ATA_186_-_Static_Ip\'s.txt
( 1) Cisco_ATA_config.txt
Description:Hi, I am using a few Cisco ATA's (model 186) with *. I have several on my net, and they works pretty fine. Now we tried some sites thru a satellite link, with high latency, (ping time higher than 700 Msec), and got some weird messages, and the ATA's wont' register.

Looks like Asterisk keeps telling to the ATA a 401 message, like Unauthorized, but the ATA re-sends the same message (The Cseq is the same)

I'm running it on Red Hat 9, Intel P-III, Just compiled Asterisk Version 1.2.7.1, but have the same problem since version 1.0.9 (I tried versions 1.2.5  and 1.2.6 too)  

Please, does anybody knows something about this?




****** ADDITIONAL INFORMATION ******

Sip debug Output:



--- (10 headers 0 lines)---
Using latest REGISTER request as basis request
Sending to 10.70.183.2 : 5060 (non-NAT)
Transmitting (no NAT) to 10.70.183.2:5060:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.70.183.2:5060;branch=z9hG4bKcdb534c57e244b82;received=10.70.183.2
From: <sip:45461@<asterisk01>;user=phone>;tag=275866099
To: <sip:45461@<asterisk01>;user=phone>
Call-ID: 3128633449@10.70.183.2
CSeq: 282 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:45461@<asterisk01>>
Content-Length: 0


---
Apr 17 16:53:25 NOTICE[6301]: chan_sip.c:6297 check_auth: stale nonce received from '<sip:45461@<asterisk01>;user=phone>'
Transmitting (no NAT) to 10.70.183.2:5060:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.70.183.2:5060;branch=z9hG4bKcdb534c57e244b82;received=10.70.183.2
From: <sip:45461@<asterisk01>;user=phone>;tag=275866099
To: <sip:45461@<asterisk01>;user=phone>;tag=as791f0352
Call-ID: 3128633449@10.70.183.2
CSeq: 282 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:45461@<asterisk01>>
WWW-Authenticate: Digest realm="asterisk", nonce="2d931ee6", stale=true
Content-Length: 0


---
Scheduling destruction of call '3128633449@10.70.183.2' in 15000 ms
Cancerberro*CLI> stale nonce received from
<-- SIP read from 10.70.150.2:5060:
REGISTER sip:<asterisk01> SIP/2.0
Via: SIP/2.0/UDP 10.70.150.2:5060;branch=z9hG4bK98bdb3f46f60751a
From: <sip:51784@<asterisk01>;user=phone>;tag=113491749
To: <sip:51784@<asterisk01>;user=phone>
Call-ID: 837420125@10.70.150.2
CSeq: 310 REGISTER
Contact: <sip:51784@10.70.150.2:5060;user=phone;transport=udp>;expires=12
User-Agent: Cisco ATA 186  v3.2.0 atasip (041111A)
Authorization: Digest username="51784",realm="asterisk",nonce="50995459",uri="sip:<asterisk01>",response="8fd7372e4dfe32678f93594c805e1014"
Content-Length: 0


--- (10 headers 0 lines)---
Using latest REGISTER request as basis request
Sending to 10.70.150.2 : 5060 (non-NAT)
Transmitting (no NAT) to 10.70.150.2:5060:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.70.150.2:5060;branch=z9hG4bK98bdb3f46f60751a;received=10.70.150.2
From: <sip:51784@<asterisk01>;user=phone>;tag=113491749
To: <sip:51784@<asterisk01>;user=phone>
Call-ID: 837420125@10.70.150.2
CSeq: 310 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:51784@<asterisk01>>
Content-Length: 0


---
Apr 17 16:53:25 NOTICE[6301]: chan_sip.c:6297 check_auth: stale nonce received from '<sip:51784@<asterisk01>;user=phone>'
Transmitting (no NAT) to 10.70.150.2:5060:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.70.150.2:5060;branch=z9hG4bK98bdb3f46f60751a;received=10.70.150.2
From: <sip:51784@<asterisk01>;user=phone>;tag=113491749
To: <sip:51784@<asterisk01>;user=phone>;tag=as2d0b7433
Call-ID: 837420125@10.70.150.2
CSeq: 310 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:51784@<asterisk01>>
WWW-Authenticate: Digest realm="asterisk", nonce="1dec9506", stale=true
Content-Length: 0


---
Scheduling destruction of call '837420125@10.70.150.2' in 15000 ms
Cancerberro*CLI> stale nonce received from
<-- SIP read from 10.70.183.2:5060:
REGISTER sip:<asterisk01> SIP/2.0
Via: SIP/2.0/UDP 10.70.183.2:5060;branch=z9hG4bK3c60174376308d6d
From: <sip:45461@<asterisk01>;user=phone>;tag=275866099
To: <sip:45461@<asterisk01>;user=phone>
Call-ID: 3128633449@10.70.183.2
CSeq: 283 REGISTER
Contact: <sip:45461@10.70.183.2:5060;user=phone;transport=udp>;expires=12
User-Agent: Cisco ATA 186  v3.2.0 atasip (041111A)
Authorization: Digest username="45461",realm="asterisk",nonce="20d7a8aa",uri="sip:<asterisk01>",response="6908f50f797f61f97554052b77c2157b"
Content-Length: 0


--- (10 headers 0 lines)---
Using latest REGISTER request as basis request
Sending to 10.70.183.2 : 5060 (non-NAT)
Transmitting (no NAT) to 10.70.183.2:5060:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.70.183.2:5060;branch=z9hG4bK3c60174376308d6d;received=10.70.183.2
From: <sip:45461@<asterisk01>;user=phone>;tag=275866099
To: <sip:45461@<asterisk01>;user=phone>
Call-ID: 3128633449@10.70.183.2
CSeq: 283 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:45461@<asterisk01>>
Content-Length: 0


---
Apr 17 16:53:26 NOTICE[6301]: chan_sip.c:6297 check_auth: stale nonce received from '<sip:45461@<asterisk01>;user=phone>'
Transmitting (no NAT) to 10.70.183.2:5060:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.70.183.2:5060;branch=z9hG4bK3c60174376308d6d;received=10.70.183.2
From: <sip:45461@<asterisk01>;user=phone>;tag=275866099
To: <sip:45461@<asterisk01>;user=phone>;tag=as791f0352
Call-ID: 3128633449@10.70.183.2
CSeq: 283 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:45461@<asterisk01>>
WWW-Authenticate: Digest realm="asterisk", nonce="4d2b6449", stale=true
Content-Length: 0


---
Scheduling destruction of call '3128633449@10.70.183.2' in 15000 ms
Cancerberro*CLI> stale nonce received from
<-- SIP read from 10.70.150.2:5060:
REGISTER sip:<asterisk01> SIP/2.0
Via: SIP/2.0/UDP 10.70.150.2:5060;branch=z9hG4bK98bdb3f46f60751a
From: <sip:51784@<asterisk01>;user=phone>;tag=113491749
To: <sip:51784@<asterisk01>;user=phone>
Call-ID: 837420125@10.70.150.2
CSeq: 310 REGISTER
Contact: <sip:51784@10.70.150.2:5060;user=phone;transport=udp>;expires=12
User-Agent: Cisco ATA 186  v3.2.0 atasip (041111A)
Authorization: Digest username="51784",realm="asterisk",nonce="56876a8e",uri="sip:<asterisk01>",response="e5dbccb683f9d78653744ad2440c0fd1"
Content-Length: 0


--- (10 headers 0 lines)---
Using latest REGISTER request as basis request
Sending to 10.70.150.2 : 5060 (non-NAT)
Transmitting (no NAT) to 10.70.150.2:5060:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.70.150.2:5060;branch=z9hG4bK98bdb3f46f60751a;received=10.70.150.2
From: <sip:51784@<asterisk01>;user=phone>;tag=113491749
To: <sip:51784@<asterisk01>;user=phone>
Call-ID: 837420125@10.70.150.2
CSeq: 310 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:51784@<asterisk01>>
Content-Length: 0


---
Apr 17 16:53:26 NOTICE[6301]: chan_sip.c:6297 check_auth: stale nonce received from '<sip:51784@<asterisk01>;user=phone>'
Transmitting (no NAT) to 10.70.150.2:5060:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.70.150.2:5060;branch=z9hG4bK98bdb3f46f60751a;received=10.70.150.2
From: <sip:51784@<asterisk01>;user=phone>;tag=113491749
To: <sip:51784@<asterisk01>;user=phone>;tag=as2d0b7433
Call-ID: 837420125@10.70.150.2
CSeq: 310 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:51784@<asterisk01>>
WWW-Authenticate: Digest realm="asterisk", nonce="5b095f4b", stale=true
Content-Length: 0


---
Scheduling destruction of call '837420125@10.70.150.2' in 15000 ms
Cancerberro*CLI> stale nonce received from
<-- SIP read from 10.70.183.2:5060:
REGISTER sip:<asterisk01> SIP/2.0
Via: SIP/2.0/UDP 10.70.183.2:5060;branch=z9hG4bK3c60174376308d6d
From: <sip:45461@<asterisk01>;user=phone>;tag=275866099
To: <sip:45461@<asterisk01>;user=phone>
Call-ID: 3128633449@10.70.183.2
CSeq: 283 REGISTER
Contact: <sip:45461@10.70.183.2:5060;user=phone;transport=udp>;expires=12
User-Agent: Cisco ATA 186  v3.2.0 atasip (041111A)
Authorization: Digest username="45461",realm="asterisk",nonce="2d931ee6",uri="sip:<asterisk01>",response="0bd5c00140b997e29c5237ebc81a7048"
Content-Length: 0


--- (10 headers 0 lines)---
Using latest REGISTER request as basis request
Sending to 10.70.183.2 : 5060 (non-NAT)
Transmitting (no NAT) to 10.70.183.2:5060:
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.70.183.2:5060;branch=z9hG4bK3c60174376308d6d;received=10.70.183.2
From: <sip:45461@<asterisk01>;user=phone>;tag=275866099
To: <sip:45461@<asterisk01>;user=phone>
Call-ID: 3128633449@10.70.183.2
CSeq: 283 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:45461@<asterisk01>>
Content-Length: 0


---
Apr 17 16:53:26 NOTICE[6301]: chan_sip.c:6297 check_auth: stale nonce received from '<sip:45461@<asterisk01>;user=phone>'
Transmitting (no NAT) to 10.70.183.2:5060:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.70.183.2:5060;branch=z9hG4bK3c60174376308d6d;received=10.70.183.2
From: <sip:45461@<asterisk01>;user=phone>;tag=275866099
To: <sip:45461@<asterisk01>;user=phone>;tag=as791f0352
Call-ID: 3128633449@10.70.183.2
CSeq: 283 REGISTER
User-Agent: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY
Contact: <sip:45461@<asterisk01>>
WWW-Authenticate: Digest realm="asterisk", nonce="788289b2", stale=true
Content-Length: 0
Comments:By: rodo (rodo) 2006-04-19 14:17:52

Same issue here. But it reappeared after compiling 1.2.7.1 (from 1.2.5); it looks like that patch http://bugs.digium.com/view.php?id=4343 is needed again.
By: Pedro Niño (ninop) 2006-04-20 10:05:23

Hmm, Rodo, I think that this is a little different, because in the bug http://bugs.digium.com/view.php?id=4343 it appears to be a 403 message, but in this one its a "401" the response.....

Somehow, I made a workaroud by using static IP's and making the calling insecure, but that's not what I would like. Yeap, It appeared again after upgrading to 1.2.7.1
By: rodo (rodo) 2006-04-20 11:06:48

ninop, you're right, here's a 401 message, and I got mess up with the stale=true mssg. For reference, my ATA186 is on firmware v3.1

I'm trying with your workaround with no success. Can you elaborate how did you set up client and ast??
By: Olle Johansson (oej) 2006-04-23 01:42:31

Please read the bug guidelines before opening a bug report. Adding SIP debug output inline is not allowed...  You need to add debug output as an attachment.

Asterisk is right, the client device is not using the latest nonce. There is a timing issue here when you have very long timeouts and the packets cross each other. Does the client support Retry-After headers? Maybe adding one of those could make it wait a bit and receive the proper nonce.
By: Pedro Niño (ninop) 2006-04-24 13:00:23

Oej, sorry for the output. How can I change it?

Rodo, I just uploaded the info you asked, as files. let me know if you need anything else. By using static IP's, its workin, but I am checking the retry-after headers.....
By: rodo (rodo) 2006-04-28 14:48:57

ninop, thx for the configs, that solves the problem. Anyway, my ATA186 are on v3.1, dont know if in 3.2 bug is fixed. Anyway, the problem only appear when the link is too lagged (near 1 sec delay)
By: Pedro Niño (ninop) 2006-05-02 08:02:20

Rodo, I Upgraded My Ata's to version 3.2 almost 6 months ago, but looks like that version doesn't solves the problem.

Besides, it appears like a timer misconfiguration, but still haven't found the parameter on the Cisco ATA.
By: Joshua C. Colp (jcolp) 2006-05-03 12:51:45

Closed because this is a unique scenario that requires a change on the client side (Cisco). If you feel that this is still a chan_sip bug, then feel free to reopen this. Otherwise good luck with the satellite link!