<div dir="ltr"><div>Hi,<br></div><div>What if some fail2ban magic could keep OpenSIPs response from hitting Asterisk after N attempts ?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mer. 28 oct. 2020 à 18:32, Kingsley Tart - Barritel Ltd <<a href="mailto:kingsley.tart@barritel.com">kingsley.tart@barritel.com</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
We're using Asterisk 13.17.0 with PJSIP 2.8 bundled.<br>
<br>
I've found an issue when Asterisk tries to make a SIP call out using<br>
auth, but has the wrong credentials and keeps getting returned a SIP<br>
407, in this example to an OpenSIPs server requiring user auth.<br>
<br>
Basically this happens:<br>
<br>
1. Asterisk sends plain INVITE to OpenSIPs<br>
2. OpenSIPs responds with SIP 407 auth required with a Proxy-<br>
Authenticate header<br>
3. Asterisk re-sends INVITE to OpenSIPs with Proxy-Authorization<br>
header, but has the wrong password<br>
4. goto step 2 and repeat forever<br>
<br>
So what we're seeing is Asterisk re-sending an INVITE with incorrect<br>
auth (which is clearly never going to work), about every 2ms.<br>
<br>
The Call-ID remains the same all of the time.<br>
<br>
Shouldn't PJSIP realise that this isn't going to work after a few tries<br>
and give up?<br>
<br>
The only way I've found of stopping the seemingly infinite loop is to<br>
either restart Asterisk or temporarily block network traffic between<br>
the two machines in order to break the cycle.<br>
<br>
Any idea whether this has been fixed in a later version?<br>
<br>
This is basically the response coming back from OpenSIPs (anonymised),<br>
whether Asterisk didn't provide <br>
<br>
SIP/2.0 407 Proxy Authentication Required<br>
Via: SIP/2.0/UDP 100.101.102.103:5060;received=100.101.102.103;rport=5060;branch=z9hG4bKPja942e87d-c501-4834-9184-f002c3fd53d2<br>
From: <<a href="mailto:sip%3A01970123456@100.101.102.103" target="_blank">sip:01970123456@100.101.102.103</a>>;tag=075f669f-9115-42a8-8c98-6170a2910e4b<br>
To: <<a href="mailto:sip%3A012345678900@opensips7a.barritel.com" target="_blank">sip:012345678900@opensips7a.barritel.com</a>>;tag=c97b4d1cb1f3d0da549e06a8d482ef63.fefa<br>
Call-ID: f79caf90-5b95-4db7-966b-a42e2d372c90<br>
CSeq: 34157 INVITE<br>
Proxy-Authenticate: Digest realm="<a href="http://sip.example.com" rel="noreferrer" target="_blank">sip.example.com</a>", nonce="5f96c21800011caac9f7e901848de60a1e186b402bd9b710", qop="auth"<br>
Server: OpenSIPS (1.11.6-tls (x86_64/linux))<br>
Content-Length: 0<br>
<br>
The caveat is that whether what OpenSIPs is doing is correct or broken,<br>
our customers can edit the auth on their own SIP gateways, so our<br>
system needs to be able to handle it properly.<br>
<br>
Cheers,<br>
Kingsley.<br>
<br>
<br>
-- <br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" rel="noreferrer" target="_blank">http://www.api-digital.com</a> --<br>
<br>
Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" rel="noreferrer" target="_blank">https://community.asterisk.org/</a><br>
<br>
New to Asterisk? Start here:<br>
<a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" rel="noreferrer" target="_blank">https://wiki.asterisk.org/wiki/display/AST/Getting+Started</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" rel="noreferrer" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a></blockquote></div>