Pjsip outgoing call rejected on 407 authentication

pkirkham · January 5, 2017, 9:29am

On Asterisk 14.2 with pjsip using realtime odbc tables
Registration on OVH is succesful but outgoing calls are rejected

[Jan 5 10:00:36] VERBOSE[3555] res_pjsip_logger.c: <— Received SIP response (767 bytes) from UDP:91.121.129.20:5060 —>
SIP/2.0 407 authentication required
Call-ID: d67da9e1-6281-49e6-bc45-df07100c173c
Contact: sip:0478xxxxxx@10.7.1.60:5060;user=phone
CSeq: 20606 INVITE
From: “Brigitte” sip:1003@192.168.1.40;tag=12cf20a9-047d-4163-bc13-9fdaa7d06909
Proxy-Authenticate: Digest realm=“sip.ovh.fr”,nonce=“2685559d24eccb764928b32f5da93d50”,opaque=“2683b3e33fe7888”,stale=false,algorithm=MD5
Record-Route: sip:91.121.129.20:5060;transport=udp;lr
To: sip:0478xxxxxx@sip.ovh.fr;tag=00-08122-26855bb2-04c353d12
Via: SIP/2.0/UDP 192.168.1.40:5060;received=90.66.193.233;rport=5060;branch=z9hG4bKPj20280564-6566-4dfc-9fb1-c3456cb2cd20
Allow: REFER,INVITE,NOTIFY,ACK,UPDATE,OPTIONS,REGISTER,SUBSCRIBE,NOTIFY,CANCEL,BYE,PRACK
Server: Cirpack/v4.70 (gw_sip)
Content-Length: 0

[Jan 5 10:00:36] VERBOSE[3556] res_pjsip_logger.c: <— Transmitting SIP request (419 bytes) to UDP:91.121.129.20:5060 —>
ACK sip:0478xxxxxx@sip.ovh.fr SIP/2.0
Via: SIP/2.0/UDP 192.168.1.40:5060;rport;branch=z9hG4bKPj20280564-6566-4dfc-9fb1-c3456cb2cd20
From: “Brigitte” sip:1003@192.168.1.40;tag=12cf20a9-047d-4163-bc13-9fdaa7d06909
To: sip:0478xxxxxx@sip.ovh.fr;tag=00-08122-26855bb2-04c353d12
Call-ID: d67da9e1-6281-49e6-bc45-df07100c173c
CSeq: 20606 ACK
Max-Forwards: 70
User-Agent: Asterisk PBX 14.2.0
Content-Length: 0

[Jan 5 10:00:36] VERBOSE[3556] res_pjsip_logger.c: <— Transmitting SIP request (1160 bytes) to UDP:91.121.129.20:5060 —>
INVITE sip:0478xxxxxx@sip.ovh.fr SIP/2.0
Via: SIP/2.0/UDP 192.168.1.40:5060;rport;branch=z9hG4bKPj91ee570b-6245-4ef4-a25b-97a0e39d533d
From: “Brigitte” sip:1003@192.168.1.40;tag=12cf20a9-047d-4163-bc13-9fdaa7d06909
To: sip:0478xxxxxx@sip.ovh.fr
Contact: sip:asterisk@192.168.1.40:5060
Call-ID: d67da9e1-6281-49e6-bc45-df07100c173c
CSeq: 20607 INVITE
Allow: OPTIONS, SUBSCRIBE, NOTIFY, PUBLISH, INVITE, ACK, BYE, CANCEL, UPDATE, PRACK, REGISTER, MESSAGE, REFER
Supported: 100rel, timer, replaces, norefersub
Session-Expires: 1800
Min-SE: 90
Max-Forwards: 70
User-Agent: Asterisk PBX 14.2.0
Proxy-Authorization: Digest username=“0033972xxxxxx”, realm=“sip.ovh.fr”, nonce=“2685559d24eccb764928b32f5da93d50”, uri="sip:0478xxxxxx@sip.ovh.fr", response=“0939e5e094d8959bd353fcedf1820066”, algorithm=MD5, opaque="2683b3e33fe7888"
Content-Type: application/sdp
Content-Length: 261

v=0
o=- 1781863645 1781863645 IN IP4 192.168.1.40
s=Asterisk
c=IN IP4 192.168.1.40
t=0 0
m=audio 17906 RTP/AVP 8 0 101
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=maxptime:150
a=sendrecv

[Jan 5 10:00:36] VERBOSE[3555] res_pjsip_logger.c: <— Received SIP response (347 bytes) from UDP:91.121.129.20:5060 —>
SIP/2.0 100 Trying
Call-ID: d67da9e1-6281-49e6-bc45-df07100c173c
CSeq: 20607 INVITE
From: “Brigitte” sip:1003@192.168.1.40;tag=12cf20a9-047d-4163-bc13-9fdaa7d06909
To: sip:0478xxxxxx@sip.ovh.fr
Via: SIP/2.0/UDP 192.168.1.40:5060;received=90.66.193.233;rport=5060;branch=z9hG4bKPj91ee570b-6245-4ef4-a25b-97a0e39d533d
Content-Length: 0

[Jan 5 10:00:36] VERBOSE[3555] res_pjsip_logger.c: <— Received SIP response (629 bytes) from UDP:91.121.129.20:5060 —>
SIP/2.0 403 Wrong login or password
Call-ID: d67da9e1-6281-49e6-bc45-df07100c173c
Contact: sip:10.7.1.60:5060
CSeq: 20607 INVITE
From: “Brigitte” sip:1003@192.168.1.40;tag=12cf20a9-047d-4163-bc13-9fdaa7d06909
Record-Route: sip:91.121.129.20:5060;transport=udp;lr
To: sip:0478xxxxxx@sip.ovh.fr;tag=00-08165-26855bb4-6399547d4
Via: SIP/2.0/UDP 192.168.1.40:5060;received=90.66.193.233;rport=5060;branch=z9hG4bKPj91ee570b-6245-4ef4-a25b-97a0e39d533d
Allow: REFER,INVITE,NOTIFY,ACK,UPDATE,OPTIONS,REGISTER,SUBSCRIBE,NOTIFY,CANCEL,BYE,PRACK
Reason: q.850;cause=1
Server: Cirpack/v4.70 (gw_sip)
Content-Length: 0

When I compare with the same call made from a softphone logged on to OVH the only difference I can see is that the contact field in the authentication packet contains the OVH identifier 0033972xxxxxx@sip.ovh.fr and not asterisk@192.168.1.40 but I don’t know whether that significant.

I also note that these log entries exist:
[Jan 5 10:00:21] VERBOSE[3556] res_pjsip_registrar.c: Added contact ‘sip:Brigitte@192.168.1.40:41952’ to AOR ‘Brigitte’ with expiration of 600 seconds
[Jan 5 10:00:21] VERBOSE[16654] res_pjsip/pjsip_configuration.c: Contact Brigitte/sip:Brigitte@192.168.1.40:41952 has been created

I would expect to find an entry in the ps_contacts table but it is empty

david551 · January 5, 2017, 10:00pm

should be different as well, even if the password is the same. The password is hashed into the response parameter, along with other information, and is wrong.

Also, please use “unformatted text” when quoting logs, as important information is lost, otherwise.

pkirkham · January 10, 2017, 10:47am

Trying to dial 0478xxxxxx
OVH sends 407
We ack and reply with Authorization Digest with coorect username but difficult to know in the password is wrong since it is encrypted
OVH rejects

Are the contact fields important since they are different from what I see when a softphone registered to OVH makes the same call. In that case the Proxy Authorization Digest contains the OVH username@local address of the client.

INVITE sip:0478xxxxxx@sip.ovh.fr SIP/2.0
Via: SIP/2.0/UDP 192.168.1.34:5060;rport;branch=z9hG4bKPjb0e802c8-fda7-46e9-bad2-932bb100c101
From: “Brigitte” sip:1003@192.168.1.34;tag=09b5fc8d-c015-4497-815b-5ace7c83f610
To: sip:0478754157@sip.ovh.fr
Contact: sip:asterisk@192.168.1.34:5060
Call-ID: 105eb30a-217e-4ad7-9f47-52413a531d5c
CSeq: 19245 INVITE
Allow: OPTIONS, SUBSCRIBE, NOTIFY, PUBLISH, INVITE, ACK, BYE, CANCEL, UPDATE, PRACK, REGISTER, REFER, MESSAGE
Supported: 100rel, timer, replaces, norefersub
Session-Expires: 1800
Min-SE: 90
Max-Forwards: 70
User-Agent: Asterisk PBX 14.2.1
Content-Type: application/sdp
Content-Length: 259

v=0
o=- 278749784 278749784 IN IP4 192.168.1.34
s=Asterisk
c=IN IP4 192.168.1.34
t=0 0
m=audio 16000 RTP/AVP 8 0 101
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=maxptime:150
a=sendrecv

[Jan 10 10:54:25] VERBOSE[3405] res_pjsip_logger.c: <--- Received SIP response (347 bytes) from UDP:91.121.129.20:5060 --->
SIP/2.0 100 Trying
Call-ID: 105eb30a-217e-4ad7-9f47-52413a531d5c
CSeq: 19245 INVITE
From: "Brigitte" <sip:1003@192.168.1.34>;tag=09b5fc8d-c015-4497-815b-5ace7c83f610
To: <sip:0478xxxxxx@sip.ovh.fr>
Via: SIP/2.0/UDP 192.168.1.34:5060;received=90.66.193.233;rport=5060;branch=z9hG4bKPjb0e802c8-fda7-46e9-bad2-932bb100c101
Content-Length: 0


[Jan 10 10:54:25] VERBOSE[3405] res_pjsip_logger.c: <--- Received SIP response (767 bytes) from UDP:91.121.129.20:5060 --->
SIP/2.0 407 authentication required
Call-ID: 105eb30a-217e-4ad7-9f47-52413a531d5c
Contact: <sip:0478754157@10.7.1.60:5060;user=phone>
CSeq: 19245 INVITE
From: "Brigitte" <sip:1003@192.168.1.34>;tag=09b5fc8d-c015-4497-815b-5ace7c83f610
Proxy-Authenticate: Digest realm="sip.ovh.fr",nonce="2c002e6633877a724b40d4ae7d41c87e",opaque="2bef629608eacec",stale=false,algorithm=MD5
Record-Route: <sip:91.121.129.20:5060;transport=udp;lr>
To: <sip:0478xxxxxx@sip.ovh.fr>;tag=00-07816-2c003a2f-6479a6205
Via: SIP/2.0/UDP 192.168.1.34:5060;received=90.66.193.233;rport=5060;branch=z9hG4bKPjb0e802c8-fda7-46e9-bad2-932bb100c101
Allow: REFER,INVITE,NOTIFY,ACK,UPDATE,OPTIONS,REGISTER,SUBSCRIBE,NOTIFY,CANCEL,BYE,PRACK
Server: Cirpack/v4.70 (gw_sip)
Content-Length: 0


[Jan 10 10:54:25] VERBOSE[3406] res_pjsip_logger.c: <--- Transmitting SIP request (419 bytes) to UDP:91.121.129.20:5060 --->
ACK sip:0478xxxxxx@sip.ovh.fr SIP/2.0
Via: SIP/2.0/UDP 192.168.1.34:5060;rport;branch=z9hG4bKPjb0e802c8-fda7-46e9-bad2-932bb100c101
From: "Brigitte" <sip:1003@192.168.1.34>;tag=09b5fc8d-c015-4497-815b-5ace7c83f610
To: <sip:0478xxxxxx@sip.ovh.fr>;tag=00-07816-2c003a2f-6479a6205
Call-ID: 105eb30a-217e-4ad7-9f47-52413a531d5c
CSeq: 19245 ACK
Max-Forwards: 70
User-Agent: Asterisk PBX 14.2.1
Content-Length:  0


[Jan 10 10:54:25] VERBOSE[3406] res_pjsip_logger.c: <--- Transmitting SIP request (1158 bytes) to UDP:91.121.129.20:5060 --->
INVITE sip:0478xxxxxx@sip.ovh.fr SIP/2.0
Via: SIP/2.0/UDP 192.168.1.34:5060;rport;branch=z9hG4bKPjfd43f4c4-0f9b-4770-8a2b-d72fed779445
From: "Brigitte" <sip:1003@192.168.1.34>;tag=09b5fc8d-c015-4497-815b-5ace7c83f610
To: <sip:0478754157@sip.ovh.fr>
Contact: <sip:asterisk@192.168.1.34:5060>
Call-ID: 105eb30a-217e-4ad7-9f47-52413a531d5c
CSeq: 19246 INVITE
Allow: OPTIONS, SUBSCRIBE, NOTIFY, PUBLISH, INVITE, ACK, BYE, CANCEL, UPDATE, PRACK, REGISTER, REFER, MESSAGE
Supported: 100rel, timer, replaces, norefersub
Session-Expires: 1800
Min-SE: 90
Max-Forwards: 70
User-Agent: Asterisk PBX 14.2.1
Proxy-Authorization: Digest username="0033972xxxxxx", realm="sip.ovh.fr", nonce="2c002e6633877a724b40d4ae7d41c87e", uri="sip:0478754157@sip.ovh.fr", response="ca6e34d35dbcdb0e06381470d65b1af6", algorithm=MD5, opaque="2bef629608eacec"
Content-Type: application/sdp
Content-Length:   259

v=0
o=- 278749784 278749784 IN IP4 192.168.1.34
s=Asterisk
c=IN IP4 192.168.1.34
t=0 0
m=audio 16000 RTP/AVP 8 0 101
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=maxptime:150
a=sendrecv

[Jan 10 10:54:25] VERBOSE[3405] res_pjsip_logger.c: <--- Received SIP response (347 bytes) from UDP:91.121.129.20:5060 --->
SIP/2.0 100 Trying
Call-ID: 105eb30a-217e-4ad7-9f47-52413a531d5c
CSeq: 19246 INVITE
From: "Brigitte" <sip:1003@192.168.1.34>;tag=09b5fc8d-c015-4497-815b-5ace7c83f610
To: <sip:0478xxxxxx@sip.ovh.fr>
Via: SIP/2.0/UDP 192.168.1.34:5060;received=90.66.193.233;rport=5060;branch=z9hG4bKPjfd43f4c4-0f9b-4770-8a2b-d72fed779445
Content-Length: 0


[Jan 10 10:54:25] VERBOSE[3405] res_pjsip_logger.c: <--- Received SIP response (629 bytes) from UDP:91.121.129.20:5060 --->
SIP/2.0 403 Wrong login or password
Call-ID: 105eb30a-217e-4ad7-9f47-52413a531d5c
Contact: <sip:10.7.1.60:5060>
CSeq: 19246 INVITE
From: "Brigitte" <sip:1003@192.168.1.34>;tag=09b5fc8d-c015-4497-815b-5ace7c83f610
Record-Route: <sip:91.121.129.20:5060;transport=udp;lr>
To: <sip:0478xxxxxx@sip.ovh.fr>;tag=00-07816-2c003a31-1d0785530
Via: SIP/2.0/UDP 192.168.1.34:5060;received=90.66.193.233;rport=5060;branch=z9hG4bKPjfd43f4c4-0f9b-4770-8a2b-d72fed779445
Allow: REFER,INVITE,NOTIFY,ACK,UPDATE,OPTIONS,REGISTER,SUBSCRIBE,NOTIFY,CANCEL,BYE,PRACK
Reason: q.850;cause=1
Server: Cirpack/v4.70 (gw_sip)
Content-Length: 0

pkirkham · January 31, 2017, 9:50am

It’s probably worth specifying that I’m using realtime configuration for pjsip except, of course, for outbound registration.
I note that when Brigitte logs on her softphone an entry is created in the ps_contacts table but there is no entry in ps_contacts for ovh.

Problem solved thanks to an entry in the ovh forum:
add this to the endpoint item for ovh

from_user=003397XXXXXXX

Now outgoing calls through ovh work correctly.

Topic		Replies	Views
PJSIP incoming call won't authenticate Asterisk SIP	17	4149	February 19, 2019
PJSIP 407 error only with Asterisk Asterisk SIP	17	1832	September 29, 2021
SIP authentication with 7960 phones Asterisk Support	2	546	July 8, 2005
Asterisk banned shortly after a 407 Proxy Authentication Required. Unable to place calls Asterisk SIP	9	1620	June 26, 2022
407 Proxy authentication required Asterisk Support	0	594	June 19, 2006

Pjsip outgoing call rejected on 407 authentication

Related topics