[Asterisk-Dev] chan_sip.c : ignoring domain part for incoming INVITE's causes conflicts between domains?

[Olle E Johansson]

Bruno Rocha wrote:
> Hi!
> 
> I've configured two Asterisk 1.2.1 machines: astA.domain.tld and 
> astB.domain.tld
> astA sip users: mary (mary at astA.domain.tld), john (john at astA.domain.tld)
> astB sip users: alice (alice at astB.domain.tld), mary (mary at astB.domain.tld)
> 
> All users are behind NAT and using their respective asterisk's as sip 
> proxy and outbound proxy. Both asterisk servers have public IP addresses.
> 
> When mary at astA.domain.tld makes a call to alice at astB.domain.tld, astA 
> receives "407 Proxy Authentication Required".
> 
> If I remove the user mary from astB, the call succeeds.
> 
> After further investigation I guess the problem is in 'chan_sip.c' 
> function 'check_user_full'.
> When asterisk receives an INVITE, the 'From' field is used to check if 
> the user has a local sip account, but just the username part is used. 
> When receiving a call from other domain and a local user exists with the 
> same username, authentication is requested, and the call fails.
> 
> I've already tried the sip options:
> 
> allowguest=yes
> allowexternalinvites=yes
> autocreatepeer=yes
> 
> and the behavior is the same.
> 
> Is this a bug, a feature or am I missing some configuration option?

It is a well known limitation in the current implementation.
Asterisk only matches on user ID and totally ignores the domain part.
User ID has to be the same as the digest user ID.

It is not an easy fix in the current code, I've been trying to fix this 
for a long time. The planned rewrite of chan_sip will take care of this,
hopefully.

At this point, we're not going to do any major functionality changes in 
the current chan_sip.

The solution is to separate your extensions from your accounts. In the 
dial plan you can separate calls to mary at domaina and mary at domainb but 
they need different account names (from: addresses).

/Olle
/O