[Home]

Summary:ASTERISK-08785: Sipura 2000 cannot authenticate when both sip identities are in use
Reporter:Scott Russell (queuetue)Labels:
Date Opened:2007-02-12 13:30:16.000-0600Date Closed:2008-02-25 17:19:20.000-0600
Priority:MajorRegression?No
Status:Closed/CompleteComponents:General
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) InviteBadAuthen.txt
( 1) RegisAuthen.txt
( 2) sip_debug_call.txt
( 3) sip_debug_register.txt
( 4) sip-gui-friend.diff
( 5) sipura2000_debug.txt
Description:When both lines on a SPA2000 are in use, the first line cannot authenticate - placing calls results in

WARNING[1103]: chan_sip.c:8023 check_auth: username mismatch, have <306>, digest has <305>
NOTICE[1103]: chan_sip.c:13200 handle_request_invite: Failed to authenticate user

305 is the first line, 306 is the second.  When I disable x306, x305 works fine.

****** ADDITIONAL INFORMATION ******

This is using a standard asterisknow installation, on a local network (no NAT).  If copies of my sip.conf or extensions.conf are required, I can upload, but they are standard from asterisknow, with users 305 and 306 added via asterisk-gui.
Comments:By: Scott Russell (queuetue) 2007-02-12 13:37:52.000-0600

This is the cli with sip debugging when I activate the second line.  (sip_debug_register.txt)


By: Scott Russell (queuetue) 2007-02-12 13:39:04.000-0600

This is the cli with sip debugging active when I place the call from x305 to x306. (sip_debug_call.txt)


By: James Lyons (james) 2007-02-12 14:13:09.000-0600

Attached sipura2000_debug.txt to clearly show that call originates from x305 and asterisk matches based on ip address to user 306. It appears to be a bug in users.conf implementation, as i'm sure sipura users are not experiencing this using sip.conf...


By: Olle Johansson (oej) 2007-02-13 08:41:53.000-0600

Oh, asterisknow with users.conf is outside of the "SIP" scope in the bug tracker. I personally consider users.conf very bad architecture for SIP. This bug needs to move to another category.
By: Chris Eanes (chris_eanes) 2007-02-13 23:30:17.000-0600

This will be the same result with any phone registering with multiple "users".  The attached files show the same result with a Polycom 601 with three users (6001, 6002, 6003).  The register file shows the 401 unauthorized messages.  The Polycom will respond with the correct username.  The end result is registration/authentication works fine.

The second file is where it gets tricky.  Trying to place a call from user 6001, the Polycom sends the invite.  The phone receives the 407 Proxy Authentication required.  It then responds back with the correct username.  The weird part is the Asterisk SIP channel does not recognize the username send in the authorized invite.  Asterisk responds back with user 6003 when the sent username was actually 6001.

When the call is placed from the 6003 user all works fine.
By: James Lyons (james) 2007-02-19 19:05:33.000-0600

moved to core asterisk for lack of a better place, as this is an issue with users.conf.
By: rapidking (rapidking) 2007-04-26 09:25:58

Any progress on resolving this bug?
I had a previous Asterisk installation which worked with my CISCO 7960 phones (using the sip.conf file, with all six lines on each phone well configured). I have replaced that system with Asterisknow, and now I run into the problem described above. All of my phones are now configured in "users.conf" by the AsteriskNow GUI. But the moment that I attempt to add an additional line to any phone, I run into the error "username mismatch, have <xxxx>, digest has <yyyy>".
Is there a current work-around?
By: Christoph Stadlmann (cstadlmann) 2007-05-13 03:33:51

This behavior also comes up when connecting two Asterisk boxes with multiple registrations (* can only register at port 5060, even on multiple registrations to same host). Asterisk always insists on the first peer it finds in sip.conf, and when a different user is transmitted for authentication, it refuses to authenticate.

I tried to open a bug report for that issue, but it was refused due to the architecture of Asterisk which is not going to be changed (* looks up peer on IP/port). It seems that this architectural bug affects more users, so maybe we can find a workaround or fix for that issue.
By: Christoph Stadlmann (cstadlmann) 2007-05-22 02:19:13

Any updates here?
By: Jason Parker (jparker) 2007-08-21 15:50:42

I just uploaded a patch that should, in theory, fix the problem.  It's completely untested though.

This will fix the issue with multiple sip identities on the same device, when configured with users.conf

This basically makes users.conf emulate type=friend, rather than type=peer (chan_iax emulates type=friend, so it seems like the right thing to do here too)


Please report results here, successful or otherwise.
By: Tolga KALE (tolgakale) 2007-08-29 01:19:28

I tryed this pach but it doesn't work. My error is :

WARNING[2623]: chan_sip.c:8197 check_auth: username mismatch, have <7772>, digest has <7771>
NOTICE[2623]: chan_sip.c:13508 handle_request_invite: Failed to authenticate user <sip:7771@172.20.1.4;user=phone>;tag=2475417487

This is cisco Ata (2FXS port) device. (reported:0010582)
By: Per Hjartoy (actimin) 2007-09-07 16:04:12

I have the same issue with Polycom Soundpoint IP 550 and 650.  The multiline features of these phones are not working with AsteriskNow Beta 6 (Asterisk 1.4.9). We are dependent on assigning multiple lines to each phone to work around the limitations of Shared Call Apperances (SLA), Bridged Line Apperances (BLA) and Busy Lamp Fild (BLF) in Asterisk. As recommended in several Wiki articles Ring Groups can be used, but is depended upon the ability to register multiple lines on each phone.

Please let me know if you need me to test anything.
By: Aaron Wickware (_shrike) 2007-09-10 17:29:17

We are seeing the same issue with and Audiocodes MP-114/FXS and an Aastra 57iCT.  When registering multiple lines from the same device we receive:

[Sep 10 17:14:32] WARNING[4459]: chan_sip.c:8196 check_auth: username mismatch, have <3373669049>, digest has <3373669048>
[Sep 10 17:14:32] NOTICE[4459]: chan_sip.c:13499 handle_request_invite: Failed to authenticate user "3373669048" <sip:3373669048@172.16.100.130>;tag=1c127840926

Although the captures verify that the digest and username do match.  It appears to be an issue with most versions of 1.4 we have tried.  Currently 1.4.11 w/ realtime.


By: Tolga KALE (tolgakale) 2007-09-11 01:00:06

My problem id is:(0069590) I solved my problem to install pound key 1.2.x version. All devices run perfectly. I try to audiocodes mp series, Cisco Ata devices. There is no problem.
If I try 1.4x asterisknow version it can't run. I think 1.4x have a sip bug. When will solvethis problem. [asterisk 1.2  pound key haven't got any web interface:( ]
By: Per Hjartoy (actimin) 2007-09-11 01:06:18

Based upon other users feedback, this appears to be a critical bug. Is it possible to raise the priority?
By: Tolga KALE (tolgakale) 2007-09-11 01:19:13

Yes,I think it's priority to fix.
By: aich zed (swiftkick) 2007-09-11 15:29:07

i was having the exact same problem with Asterisk 1.4.11 and Asterisk-gui 1203 and some Cisco 7940's.

well, it appears asterisk-gui only adds extensions to users.conf . once i manually added redundant information about those extensions to sip.conf the issue seems to have gone away.

note: i'm new to asterisk internals in general and i'm only posting this in the hope it helps someone resolve their issues, please forgive if this is old information or somehow in error.
By: Aaron Wickware (_shrike) 2007-09-11 20:37:16

We are having the issue using sip.conf only.  I don't think this issue is isolated to users.conf
By: Patrick Tescher (pat2man) 2007-09-12 16:47:28

I had this problem with type=peer on my spa sip account.

with type=friend it works fine.
By: Aaron Wickware (_shrike) 2007-09-25 17:58:21

It appears that this issue occurs on realtime (mysql) sip accounts as well.  Multiple registrations from the same device cause username/authname mismatches, however when I move the realtime accounts to sip.conf the issue is resolved.  I have tried this with several version of asterisk 1.4 and asterisk-addons and it seems to be persistent.  

Is there anything I can do in assisting to get this issue resolved?
By: Djerk Geurts (dmgeurts) 2007-10-18 17:02:35

Qwell,

Your patch did not work for me. I took the latest asterisk-1.4 branch and applied your patch. Using two lines on a Cisco 7960 will result in both lines getting registered but only the second one can be used by the phone.

[Oct 18 20:08:49] WARNING[2790]: chan_sip.c:8190 check_auth: username mismatch, have <103>, digest has <102>
[Oct 18 20:08:49] NOTICE[2790]: chan_sip.c:13486 handle_request_invite: Failed to authenticate user "102" <sip:102@sip.djerk.nl>;tag=00112189c31700241bd5d4f7-67d5f50d


By: leonidf (leonidf) 2007-10-23 11:15:42

Defining "insecure=port" will fix the problem
By: Djerk Geurts (dmgeurts) 2007-10-23 15:44:35

leonidf, you're my hero! It works like a charm. just asked bkruse whether this could be added to the gui via a tickbox or by default (on an extension).

I'm testing with Cisco 7960's btw... Siemens S450-IP also confirmed to be working now.

Djerk

Please note that Qwell's fix _IS_ required as well!


By: jmls (jmls) 2008-02-17 12:41:13.000-0600

bkruse, any news on this ? (option as a tick box ?)
By: Djerk Geurts (dmgeurts) 2008-02-18 17:14:13.000-0600

jmls,

I wish it would be that easy. The Asterisk code needs to be fixed as per qwell's advice. Not sure if this has been incorporated into * trunk yet.
By: Digium Subversion (svnbot) 2008-02-25 15:33:42.000-0600

Repository: asterisk
Revision: 104095

U   branches/1.4/channels/chan_sip.c

------------------------------------------------------------------------
r104095 | file | 2008-02-25 15:33:41 -0600 (Mon, 25 Feb 2008) | 6 lines

Make it so a users.conf user creates both a SIP peer and a SIP user. The user will be used for inbound authentication for the device, and peer will be used for placing calls to the device.
(closes issue ASTERISK-8785)
Reported by: queuetue
Patches:
     sip-gui-friend.diff uploaded by qwell (license 4)

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=104095
By: Digium Subversion (svnbot) 2008-02-25 15:36:52.000-0600

Repository: asterisk
Revision: 104096

_U  trunk/
U   trunk/channels/chan_sip.c

------------------------------------------------------------------------
r104096 | file | 2008-02-25 15:36:51 -0600 (Mon, 25 Feb 2008) | 14 lines

Merged revisions 104095 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r104095 | file | 2008-02-25 17:37:20 -0400 (Mon, 25 Feb 2008) | 6 lines

Make it so a users.conf user creates both a SIP peer and a SIP user. The user will be used for inbound authentication for the device, and peer will be used for placing calls to the device.
(closes issue ASTERISK-8785)
Reported by: queuetue
Patches:
     sip-gui-friend.diff uploaded by qwell (license 4)

........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=104096
By: Digium Subversion (svnbot) 2008-02-25 17:19:20.000-0600

Repository: asterisk
Revision: 104105

_U  team/murf/bug11210/
U   team/murf/bug11210/apps/app_voicemail.c
U   team/murf/bug11210/channels/chan_agent.c
U   team/murf/bug11210/channels/chan_iax2.c
U   team/murf/bug11210/channels/chan_sip.c
U   team/murf/bug11210/configs/sip.conf.sample
U   team/murf/bug11210/doc/siptls.txt
U   team/murf/bug11210/funcs/func_global.c
U   team/murf/bug11210/main/config.c

------------------------------------------------------------------------
r104105 | murf | 2008-02-25 17:19:19 -0600 (Mon, 25 Feb 2008) | 133 lines

Merged revisions 104081,104083,104085,104087-104089,104093,104096-104098 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

................
r104081 | file | 2008-02-25 08:12:48 -0700 (Mon, 25 Feb 2008) | 2 lines

Fix building of trunk. dbpass is always going to exist.

................
r104083 | file | 2008-02-25 08:19:58 -0700 (Mon, 25 Feb 2008) | 14 lines

Merged revisions 104082 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r104082 | file | 2008-02-25 11:17:18 -0400 (Mon, 25 Feb 2008) | 6 lines

Due to recent changes tag will no longer be NULL if not present so we have to use ast_strlen_zero to see if it's actually blank.
(closes issue ASTERISK-11502)
Reported by: flefoll
Patches:
     chan_sip.c.br14.patch_pedantic_no_totag uploaded by flefoll (license 244)

........

................
r104085 | file | 2008-02-25 09:18:46 -0700 (Mon, 25 Feb 2008) | 14 lines

Merged revisions 104084 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r104084 | file | 2008-02-25 12:16:13 -0400 (Mon, 25 Feb 2008) | 6 lines

If a resubscription comes in for a dialog we no longer know about tell the remote side that the dialog does not exist so they subscribe again using a new dialog.
(closes issue ASTERISK-10305)
Reported by: s0l4rb03
Patches:
     10727-2.diff uploaded by file (license 11)

........

................
r104087 | russell | 2008-02-25 11:38:51 -0700 (Mon, 25 Feb 2008) | 12 lines

Merged revisions 104086 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r104086 | russell | 2008-02-25 12:38:10 -0600 (Mon, 25 Feb 2008) | 4 lines

Ensure that the channel doesn't disappear in agent_logoff().  If it does, it
could cause a crash.
(fixes the crash reported in BE-396)

........

................
r104088 | bbryant | 2008-02-25 12:00:16 -0700 (Mon, 25 Feb 2008) | 1 line

Adding more tls configuration details to sip.conf sample, with a list of valid ciphers provided in both files. .. First commit since July, woot
................
r104089 | file | 2008-02-25 12:02:33 -0700 (Mon, 25 Feb 2008) | 2 lines

Instead of outputting a verbose message every so often let's make it a debug message.

................
r104093 | qwell | 2008-02-25 13:50:57 -0700 (Mon, 25 Feb 2008) | 19 lines

Merged revisions 104092 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r104092 | qwell | 2008-02-25 14:49:42 -0600 (Mon, 25 Feb 2008) | 11 lines

Allow the use of #include and #exec in situations where the max include depth was only 1.
Specifically, this fixes using #include and #exec in extconfig.conf.

This was basically caused because the config file itself raises the include level to 1.

I opted not to raise the include limit, because recursion here could cause very bizarre behavior.

Pointed out, and tested by jmls

(closes issue ASTERISK-11505)

........

................
r104096 | file | 2008-02-25 14:40:30 -0700 (Mon, 25 Feb 2008) | 14 lines

Merged revisions 104095 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r104095 | file | 2008-02-25 17:37:20 -0400 (Mon, 25 Feb 2008) | 6 lines

Make it so a users.conf user creates both a SIP peer and a SIP user. The user will be used for inbound authentication for the device, and peer will be used for placing calls to the device.
(closes issue ASTERISK-8785)
Reported by: queuetue
Patches:
     sip-gui-friend.diff uploaded by qwell (license 4)

........

................
r104097 | tilghman | 2008-02-25 14:53:36 -0700 (Mon, 25 Feb 2008) | 13 lines

Merged revisions 104094 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r104094 | tilghman | 2008-02-25 15:31:47 -0600 (Mon, 25 Feb 2008) | 5 lines

If the destination folder is full, don't delete a message when exiting.
(closes issue ASTERISK-11506)
Reported by: selsky
Patch by: (myself)

........

................
r104098 | tilghman | 2008-02-25 14:56:19 -0700 (Mon, 25 Feb 2008) | 7 lines

Shared space for variables (instead of letting other channels muck with your own)
(closes issue ASTERISK-11392)
Reported by: ramonpeek
Patches:
      20080208__bug11943__2.diff.txt uploaded by Corydon76 (license 14)
Tested by: jmls

................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=104105