Anthony, thanks. Below are my config files for the two gateways from the sip trace. Both files are located in conf/directory/default. --------------------- redvoiss.xml (the one that works) <include> <user id="gateway_redvoiss"> <gateways> <gateway name="redvoiss-pp"> <param name="username" value="xxxxxxx"/> <param name="password" value="xxxxxxx"/> <param name="from-domain" value="pxextmy.redvoiss.net"/> <param name="realm" value="pxextmy.redvoiss.net"/> <param name="proxy" value="pxextmy.redvoiss.net"/> <param name="from-user" value="xxxxxxx"/> <param name="caller-id-in-from" value="false"/> <param name="expire-seconds" value="600"/> <param name="register" value="true"/> <param name="retry_seconds" value="5"/> <param name="extension" value="2010"/> <param name="context" value="public"/> <param name="codec-prefs" value="G729"/> <param name="rfc2833-pt" value="101"/> </gateway> </gateways> <params> <param name="password" value="4321"/> </params> </user> </include> --------------------- orange.xml (the one that doesn't work) <include> <user id="gateway_orange"> <gateways> <gateway name="orange"> <param name="username" value="xxxxxxx"/> <param name="password" value="xxxxxxx"/> <param name="from-domain" value="216.72.10.39"/> <param name="realm" value="216.72.10.39"/> <param name="proxy" value="216.72.10.39"/> <param name="from-user" value="xxxxxxx"/> <param name="caller-id-in-from" value="false"/> <param name="expire-seconds" value="600"/> <param name="register" value="true"/> <param name="retry_seconds" value="5"/> <param name="extension" value="2011"/> <param name="context" value="public"/> <param name="codec-prefs" value="G729"/> <param name="rfc2833-pt" value="101"/> </gateway> </gateways> <params> <param name="password" value="4321"/> </params> </user> </include> --------------------- If I remove the register=true param for the non-working gateway, I don't get the registration error on the cli, but then all call attempts get rejected with a 401 Unauthorized, and I get a hangup cause of NORMAL_UNSPECIFIED. Best, Nicolas On Tue, Sep 29, 2009 at 2:22 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:

900 level errors are sofia internal errors so probably something is wrong with your gateway config xml. if you want to send it with any critical info replaced with XXX maybe we can see the issue for you.

On Tue, Sep 29, 2009 at 1:05 PM, Nicolas Brenner <nicolas@medularis.com>wrote:

...

Hello everyone,

I am trying to add a gateway, but after configuring it just like the others gateways I have, it is failing to register with a message like this:

2009-09-29 12:54:40.853440 [ERR] sofia_reg.c:1402 orange Registration Failed with status Operation has no matching challenge [904]. failure #1 2009-09-29 12:54:40.906798 [WARNING] sofia_reg.c:364 orange Failed Registration, setting retry to 10 seconds.

I captured the sip traffic and noticed that when trying to register with one gateway (the one that works), I get a "Trying" reply immediately followed by a "401 Unauthorized" which contains a "WWW-Authenticate: digest" with a "qop=auth" parameter. Then Freeswitch replies with a second REGISTER including a large "Authorization: digest" section with cnonce and nc=00000001 parameters.

The gateway which doesn't register, doesn't send the "qop=auth" parameter together with the "401 Unauthorized", and then Freeswitch sends a "Authorization: digest" section on the second REGISTER with no cnonce or nc parameters.

I know very little abouth SIP, so I'm wondering what this "qop=auth" parameter means and how does it affect the registration process. Is there any way to do without the qop=auth parameter?

Also, I tried registering with X-Lite directly to the gateway, and it worked, so it appears to be a problem in the Freeswitch/gateway combination. (Note: X-Lite sends an "Authorization: digest" section on the _first_ REGISTER, apparently this makes a difference)

Attached is a sip trace for the registration traffic when doing "sofia profile external restart reloadxml" on the cli, captured with "tshark -i eth0 -o "rtp.heuristic_rtp: TRUE" -w /tmp/capture.pcap -b filesize:51200 -b files:100 -R 'sip or rtp or icmp or dns or rtcp or t38'"

Thanks!

Nicolas

_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Anthony Minessale II

FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire

AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch

FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:213-799-1400

_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

can you send a link of a text sip trace please. On Oct 1, 2009, at 3:29 PM, Nicolas Brenner wrote:

Any ideas about this?

The SIP provider is offering H323, but I'm not quite sure about that, is mod_opal working right?

Thanks!

Nicolas

On Tue, Sep 29, 2009 at 6:42 PM, Nicolas Brenner <nicolas@medularis.com

...

wrote: Anthony, thanks. Below are my config files for the two gateways from the sip trace. Both files are located in conf/directory/default.

---------------------

redvoiss.xml (the one that works)

<include> <user id="gateway_redvoiss"> <gateways> <gateway name="redvoiss-pp"> <param name="username" value="xxxxxxx"/> <param name="password" value="xxxxxxx"/> <param name="from-domain" value="pxextmy.redvoiss.net"/> <param name="realm" value="pxextmy.redvoiss.net"/> <param name="proxy" value="pxextmy.redvoiss.net"/> <param name="from-user" value="xxxxxxx"/> <param name="caller-id-in-from" value="false"/> <param name="expire-seconds" value="600"/> <param name="register" value="true"/> <param name="retry_seconds" value="5"/> <param name="extension" value="2010"/> <param name="context" value="public"/> <param name="codec-prefs" value="G729"/> <param name="rfc2833-pt" value="101"/> </gateway> </gateways> <params> <param name="password" value="4321"/> </params> </user> </include>

---------------------

orange.xml (the one that doesn't work)

<include> <user id="gateway_orange"> <gateways> <gateway name="orange"> <param name="username" value="xxxxxxx"/> <param name="password" value="xxxxxxx"/> <param name="from-domain" value="216.72.10.39"/> <param name="realm" value="216.72.10.39"/> <param name="proxy" value="216.72.10.39"/> <param name="from-user" value="xxxxxxx"/> <param name="caller-id-in-from" value="false"/> <param name="expire-seconds" value="600"/> <param name="register" value="true"/> <param name="retry_seconds" value="5"/> <param name="extension" value="2011"/> <param name="context" value="public"/> <param name="codec-prefs" value="G729"/> <param name="rfc2833-pt" value="101"/> </gateway> </gateways> <params> <param name="password" value="4321"/> </params> </user> </include>

---------------------

If I remove the register=true param for the non-working gateway, I don't get the registration error on the cli, but then all call attempts get rejected with a 401 Unauthorized, and I get a hangup cause of NORMAL_UNSPECIFIED.

Best,

Nicolas

On Tue, Sep 29, 2009 at 2:22 PM, Anthony Minessale <anthony.minessale@gmail.com

...

wrote: 900 level errors are sofia internal errors so probably something is wrong with your gateway config xml. if you want to send it with any critical info replaced with XXX maybe we can see the issue for you.

On Tue, Sep 29, 2009 at 1:05 PM, Nicolas Brenner <nicolas@medularis.com

...

wrote: Hello everyone,

I am trying to add a gateway, but after configuring it just like the others gateways I have, it is failing to register with a message like this:

2009-09-29 12:54:40.853440 [ERR] sofia_reg.c:1402 orange Registration Failed with status Operation has no matching challenge [904]. failure #1 2009-09-29 12:54:40.906798 [WARNING] sofia_reg.c:364 orange Failed Registration, setting retry to 10 seconds.

I captured the sip traffic and noticed that when trying to register with one gateway (the one that works), I get a "Trying" reply immediately followed by a "401 Unauthorized" which contains a "WWW- Authenticate: digest" with a "qop=auth" parameter. Then Freeswitch replies with a second REGISTER including a large "Authorization: digest" section with cnonce and nc=00000001 parameters.

The gateway which doesn't register, doesn't send the "qop=auth" parameter together with the "401 Unauthorized", and then Freeswitch sends a "Authorization: digest" section on the second REGISTER with no cnonce or nc parameters.

I know very little abouth SIP, so I'm wondering what this "qop=auth" parameter means and how does it affect the registration process. Is there any way to do without the qop=auth parameter?

Also, I tried registering with X-Lite directly to the gateway, and it worked, so it appears to be a problem in the Freeswitch/gateway combination. (Note: X-Lite sends an "Authorization: digest" section on the _first_ REGISTER, apparently this makes a difference)

Attached is a sip trace for the registration traffic when doing "sofia profile external restart reloadxml" on the cli, captured with "tshark -i eth0 -o "rtp.heuristic_rtp: TRUE" -w /tmp/capture.pcap -b filesize:51200 -b files:100 -R 'sip or rtp or icmp or dns or rtcp or t38'"

I've never been able to read these, why exactly do I need a text protocol to be decoded for me? Ends up being too much noise so I just don't bother. Mike On Oct 4, 2009, at 6:19 PM, Nicolas Brenner wrote:

Here it is:

- http://pastebin.freeswitch.org/10582

(it is the pcap file I sent on the first email of this thread, converted to text with 'tshark -V -r')

On Sun, Oct 4, 2009 at 5:40 PM, Michael Jerris <mike@jerris.com> wrote: can you send a link of a text sip trace please.

On Oct 1, 2009, at 3:29 PM, Nicolas Brenner wrote:

...

Any ideas about this?

The SIP provider is offering H323, but I'm not quite sure about that, is mod_opal working right?

Thanks!

Nicolas

On Tue, Sep 29, 2009 at 6:42 PM, Nicolas Brenner <nicolas@medularis.com

...

wrote: Anthony, thanks. Below are my config files for the two gateways from the sip trace. Both files are located in conf/directory/default.

---------------------

redvoiss.xml (the one that works)

<include> <user id="gateway_redvoiss"> <gateways> <gateway name="redvoiss-pp"> <param name="username" value="xxxxxxx"/> <param name="password" value="xxxxxxx"/> <param name="from-domain" value="pxextmy.redvoiss.net"/> <param name="realm" value="pxextmy.redvoiss.net"/> <param name="proxy" value="pxextmy.redvoiss.net"/> <param name="from-user" value="xxxxxxx"/> <param name="caller-id-in-from" value="false"/> <param name="expire-seconds" value="600"/> <param name="register" value="true"/> <param name="retry_seconds" value="5"/> <param name="extension" value="2010"/> <param name="context" value="public"/> <param name="codec-prefs" value="G729"/> <param name="rfc2833-pt" value="101"/> </gateway> </gateways> <params> <param name="password" value="4321"/> </params> </user> </include>

---------------------

orange.xml (the one that doesn't work)

<include> <user id="gateway_orange"> <gateways> <gateway name="orange"> <param name="username" value="xxxxxxx"/> <param name="password" value="xxxxxxx"/> <param name="from-domain" value="216.72.10.39"/> <param name="realm" value="216.72.10.39"/> <param name="proxy" value="216.72.10.39"/> <param name="from-user" value="xxxxxxx"/> <param name="caller-id-in-from" value="false"/> <param name="expire-seconds" value="600"/> <param name="register" value="true"/> <param name="retry_seconds" value="5"/> <param name="extension" value="2011"/> <param name="context" value="public"/> <param name="codec-prefs" value="G729"/> <param name="rfc2833-pt" value="101"/> </gateway> </gateways> <params> <param name="password" value="4321"/> </params> </user> </include>

---------------------

If I remove the register=true param for the non-working gateway, I don't get the registration error on the cli, but then all call attempts get rejected with a 401 Unauthorized, and I get a hangup cause of NORMAL_UNSPECIFIED.

Best,

Nicolas

On Tue, Sep 29, 2009 at 2:22 PM, Anthony Minessale <anthony.minessale@gmail.com

...

wrote: 900 level errors are sofia internal errors so probably something is wrong with your gateway config xml. if you want to send it with any critical info replaced with XXX maybe we can see the issue for you.

On Tue, Sep 29, 2009 at 1:05 PM, Nicolas Brenner <nicolas@medularis.com

...

wrote: Hello everyone,

I am trying to add a gateway, but after configuring it just like the others gateways I have, it is failing to register with a message like this:

2009-09-29 12:54:40.853440 [ERR] sofia_reg.c:1402 orange Registration Failed with status Operation has no matching challenge [904]. failure #1 2009-09-29 12:54:40.906798 [WARNING] sofia_reg.c:364 orange Failed Registration, setting retry to 10 seconds.

I captured the sip traffic and noticed that when trying to register with one gateway (the one that works), I get a "Trying" reply immediately followed by a "401 Unauthorized" which contains a "WWW- Authenticate: digest" with a "qop=auth" parameter. Then Freeswitch replies with a second REGISTER including a large "Authorization: digest" section with cnonce and nc=00000001 parameters.

The gateway which doesn't register, doesn't send the "qop=auth" parameter together with the "401 Unauthorized", and then Freeswitch sends a "Authorization: digest" section on the second REGISTER with no cnonce or nc parameters.

I know very little abouth SIP, so I'm wondering what this "qop=auth" parameter means and how does it affect the registration process. Is there any way to do without the qop=auth parameter?

Also, I tried registering with X-Lite directly to the gateway, and it worked, so it appears to be a problem in the Freeswitch/gateway combination. (Note: X-Lite sends an "Authorization: digest" section on the _first_ REGISTER, apparently this makes a difference)

Attached is a sip trace for the registration traffic when doing "sofia profile external restart reloadxml" on the cli, captured with "tshark -i eth0 -o "rtp.heuristic_rtp: TRUE" -w /tmp/ capture.pcap -b filesize:51200 -b files:100 -R 'sip or rtp or icmp or dns or rtcp or t38'"

_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch- users http://www.freeswitch.org

_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch- users http://www.freeswitch.org

On Sun, Oct 4, 2009 at 4:09 PM, Nicolas Brenner <nicolas@medularis.com>wrote:

Mike, how exactly should I format the file? I got the pcap file, how do I convert it to text so that you can easily read it?

you can open it with wireshark, follow the TCP or UDP stream, then just copy & paste the text as needed... -MC

Ignore my previous email, the traces were incomplete, got much better (and complete) traces with ngrep (found a suggestion from Brian in the list archive, thanks!) The gateway that registers: - http://pastebin.freeswitch.org/10607 The one that doesn't: - http://pastebin.freeswitch.org/10608 Thanks again for your time and help! Nicolas On Tue, Oct 6, 2009 at 12:19 AM, Nicolas Brenner <nicolas@medularis.com>wrote:

There was no sane way of doing that, so I ended up logging the trace from the cli.

Here's the bad registration:

- http://pastebin.freeswitch.org/10605

Here's the good one:

- http://pastebin.freeswitch.org/10606

I am not sure if the second one is complete because for some reason the first few packages don't appear on the console when doing 'sofia profile external restart reloadxml' and 'sofia profile external siptrace on' or viceversa.

Anyway, thanks for your time, and I hope those traces help in figuring out what's going on.

Nicolas

PS: Is there anyway to get the same format from a pcap dump as with the siptrace feature on the cli?

On Mon, Oct 5, 2009 at 12:20 PM, Michael Collins <msc@freeswitch.org>wrote:

...

On Sun, Oct 4, 2009 at 4:09 PM, Nicolas Brenner <nicolas@medularis.com>wrote:

...

Mike, how exactly should I format the file? I got the pcap file, how do I convert it to text so that you can easily read it?

you can open it with wireshark, follow the TCP or UDP stream, then just copy & paste the text as needed...

-MC

_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

That happens with both gateways though, one works and the other doesn't. Would the rport have anything to do with the registration failing? The big difference to me is that the working gateway replies a 401 Unauthorized containing: WWW-Authenticate: Digest realm="pxextmy.redvoiss.net", nonce="4acac8fe248a9075a13773274684392a65a40240", qop="auth". Whereas the non-working gateway's 401 has: WWW-Authenticate: Digest realm="216.72.10.39", nonce="4acac08249c439decb2bea539282faf755c80b0c". What does the qop parameter stand for? Apparently because of that parameter, FS sends a new REGISTER including this: Authorization: Digest username="xxxxxxxxx", realm="pxextmy.redvoiss.net", nonce="4acac8fe248a9075a13773274684392a65a40240", cnonce="h1DCSizTEi2eMQAdCe9KJA", algorithm=MD5, uri="sip: pxextmy.redvoiss.net", response="05adb2a7f9d7772e57dc846257484f5d", qop=auth, nc=00000001. Instead, on the non-working gateway case, FS sends a REGISTER with this: Authorization: Digest username="yyyyyyyyy", realm="216.72.10.39", nonce="4acac08249c439decb2bea539282faf755c80b0c", algorithm=MD5, uri="sip: 216.72.10.39", response="8311db7666779df89d5223e16a611826". Notice the absence of the qop and nc parameters. I'm guessing the lack of those parameters causes the gateway (SIP server) to use another nonce and hence reject the mismatching REGISTER. BTW, registration from an X-Lite softphone works. Thanks! Nicolas On Tue, Oct 6, 2009 at 10:31 AM, Brian West <brian@freeswitch.org> wrote:

This looks like you have an ALG messing with packets... notice it says rport 5080 but we are sending to 5060. /b

On Oct 5, 2009, at 11:42 PM, Nicolas Brenner wrote:

Ignore my previous email, the traces were incomplete, got much better (and complete) traces with ngrep (found a suggestion from Brian in the list archive, thanks!)

The gateway that registers:

- http://pastebin.freeswitch.org/10607

The one that doesn't:

- http://pastebin.freeswitch.org/10608

Thanks again for your time and help!

Nicolas

On Tue, Oct 6, 2009 at 12:19 AM, Nicolas Brenner <nicolas@medularis.com>wrote:

...

There was no sane way of doing that, so I ended up logging the trace from the cli.

_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

btw My mistake it doesn't assume auth it just calculates the response hash differently on this case where qop isn't present. /b On Oct 6, 2009, at 4:22 PM, Nicolas Brenner wrote:

What does the qop parameter stand for? Apparently because of that parameter, FS sends a new REGISTER including this:

I would suspect its a PEBKAC. I mean if you could register to a gateway that rejected auth... what purpose would auth serve in the first place? /b On Oct 7, 2009, at 8:48 AM, Nicolas Brenner wrote:

Is there some way to make FS register with the gateway that is rejecting the authentication? is it FS or the SIP server at fault? Why would X-Lite work and FS not?

Thanks again for your time and help.

On Wed, Oct 7, 2009 at 7:43 AM, Nicolas Brenner <nicolas@medularis.com>wrote:

You are missing the point, it is only rejecting auth for FS, Asterisk and X-Lite work fine with the same config for that gateway.

Did you figure this one out yet? If not, snag some SIP captures of working vs. non-working REGISTRATIONs and pastebin them along with your failed reg and your redacted gateway config. -MC

On Wed, Oct 7, 2009 at 10:20 AM, Brian West <brian@freeswitch.org> wrote:

...

I would suspect its a PEBKAC. I mean if you could register to a gateway that rejected auth... what purpose would auth serve in the first place?

/b

On Oct 7, 2009, at 8:48 AM, Nicolas Brenner wrote:

...

Is there some way to make FS register with the gateway that is rejecting the authentication? is it FS or the SIP server at fault? Why would X-Lite work and FS not?

Thanks again for your time and help.

_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org