Registration on chan_sip is OK, but on res_pjsip - NO

Asterisk Asterisk SIP
1

Colleagues, please tell me what could be wrong…
I have a certain sip client that I wrote on the PJSIP platform. Everything is very simple there and differs little from the example recommended in the documentation.
Then the riddles begin. I have two installations of asterisk. On the same version of the same operating system. With almost identical versions. 18.20.2 and 18.21.0. On asterisk, where chan_sip is installed, registration goes without problems. On the asterisk where res_pjsip is installed, registration does not work.
Message on asterisk:
[Oct 19 03:57:39] NOTICE[104579]: res_pjsip/pjsip_distributor.c:676 log_failed_request: Request 'REGISTER' from '<sip:sipcc@pbx.ogogon.org>' failed for '192.168.1.23:5070' (callid: 23846d8c-8db5-11ef-babd-c86000bcf23c) - Failed to authenticate
Message on client:

03:57:39.626            pjsua_acc.c  ..Acc 0: Registration sent
Press 'h' to hangup all calls, 'q' to quit
03:57:39.627           pjsua_core.c  .RX 571 bytes Response msg 401/REGISTER/cseq=7739 (rdata0x277a0a795028) from UDP 192.168.1.10:5060:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.1.23:5070;rport=5070;received=192.168.1.23;branch=z9hG4bKPj23847784-8db5-11ef-babd-c86000bcf23c
Call-ID: 23846d8c-8db5-11ef-babd-c86000bcf23c
From: <sip:sipcc@pbx.ogogon.org>;tag=23847227-8db5-11ef-babd-c86000bcf23c
To: <sip:sipcc@pbx.ogogon.org>;tag=z9hG4bKPj23847784-8db5-11ef-babd-c86000bcf23c
CSeq: 7739 REGISTER
WWW-Authenticate: Digest realm="asterisk",nonce="1729299459/d3cdc94005136b0eda8401644e4cc55d",opaque="0072867958a1cdcb",algorithm=MD5,qop="auth"
Server: Asterisk PBX 18.20.2
Content-Length:  0


--end msg--
03:57:39.628      sip_auth_client.c  ...Digest algorithm is "MD5"
03:57:39.628           pjsua_core.c  ....TX 792 bytes Request msg REGISTER/cseq=7740 (tdta0x277a0a80f0a8) to UDP 192.168.1.10:5060:
REGISTER sip:pbx.ogogon.org SIP/2.0
Via: SIP/2.0/UDP 192.168.1.23:5070;rport;branch=z9hG4bKPj2384e3e0-8db5-11ef-babd-c86000bcf23c
Max-Forwards: 70
From: <sip:sipcc@pbx.ogogon.org>;tag=23847227-8db5-11ef-babd-c86000bcf23c
To: <sip:sipcc@pbx.ogogon.org>
Call-ID: 23846d8c-8db5-11ef-babd-c86000bcf23c
CSeq: 7740 REGISTER
Contact: <sip:sipcc@192.168.1.23:5070;ob>
Expires: 300
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Authorization: Digest username="sipcc", realm="asterisk", nonce="1729299459/d3cdc94005136b0eda8401644e4cc55d", uri="sip:pbx.ogogon.org", response="d5ca72aad014e0002bb1340c5f41744b", algorithm=MD5, cnonce="2384d9258db511efbabdc86000bcf23c", opaque="0072867958a1cdcb", qop=auth, nc=00000001
Content-Length:  0


--end msg--
03:57:39.630           pjsua_core.c  .RX 571 bytes Response msg 401/REGISTER/cseq=7740 (rdata0x277a0a795028) from UDP 192.168.1.10:5060:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.1.23:5070;rport=5070;received=192.168.1.23;branch=z9hG4bKPj2384e3e0-8db5-11ef-babd-c86000bcf23c
Call-ID: 23846d8c-8db5-11ef-babd-c86000bcf23c
From: <sip:sipcc@pbx.ogogon.org>;tag=23847227-8db5-11ef-babd-c86000bcf23c
To: <sip:sipcc@pbx.ogogon.org>;tag=z9hG4bKPj2384e3e0-8db5-11ef-babd-c86000bcf23c
CSeq: 7740 REGISTER
WWW-Authenticate: Digest realm="asterisk",nonce="1729299459/d3cdc94005136b0eda8401644e4cc55d",opaque="7a3a7b7d3800886b",algorithm=MD5,qop="auth"
Server: Asterisk PBX 18.20.2
Content-Length:  0


--end msg--
03:57:39.630      sip_auth_client.c  ...Authorization failed for sipcc@asterisk: server rejected with stale=false
03:57:39.630            pjsua_acc.c  ....SIP registration error: Credential failed to authenticate (PJSIP_EFAILEDCREDENTIAL) [status=171100]

pjsip.conf:

...
[sipcc]
type=endpoint
context=ogogon
disallow=all
allow=ulaw
auth=sipcc
aors=sipcc

[sipcc]
type=auth
auth_type=userpass
password=XXXXXXXXXXXXXXXXXXXXX
username=sipcc

[sipcc]
type=aor
max_contacts=1
...

I would appreciate any advice and opinions,
Ogogon.

2

Paste the full output from the following CLI commands:

pjsip show endpoint sipcc
pjsip show aor sipcc
pjsip show auth sipcc
pjsip show settings
3 
Asterisk 18.20.2, Copyright (C) 1999 - 2022, Sangoma Technologies Corporation and others.
Created by Mark Spencer <markster@digium.com>
Asterisk comes with ABSOLUTELY NO WARRANTY; type 'core show warranty' for details.
This is free software, with components licensed under the GNU General Public
License version 2 and other licenses; you are welcome to redistribute it under
certain conditions. Type 'core show license' for details.
=========================================================================
Connected to Asterisk 18.20.2 currently running on pbx (pid = 3899)
pbx*CLI> core set verbose 15
Console verbose was 11 and is now 15.
pbx*CLI> pjsip show endpoint sipcc

 Endpoint:  <Endpoint/CID.....................................>  <State.....>  <Channels.>
    I/OAuth:  <AuthId/UserName...........................................................>
        Aor:  <Aor............................................>  <MaxContact>
      Contact:  <Aor/ContactUri..........................> <Hash....> <Status> <RTT(ms)..>
  Transport:  <TransportId........>  <Type>  <cos>  <tos>  <BindAddress..................>
   Identify:  <Identify/Endpoint.........................................................>
        Match:  <criteria.........................>
    Channel:  <ChannelId......................................>  <State.....>  <Time.....>
        Exten: <DialedExten...........>  CLCID: <ConnectedLineCID.......>
==========================================================================================

 Endpoint:  sipcc                                                Unavailable   0 of inf
     InAuth:  sipcc/sipcc
        Aor:  sipcc                                              1


 ParameterName                      : ParameterValue
 ===================================================================================================
 100rel                             : yes
 accept_multiple_sdp_answers        : false
 accountcode                        :
 acl                                :
 aggregate_mwi                      : true
 allow                              : (ulaw)
 allow_overlap                      : true
 allow_subscribe                    : true
 allow_transfer                     : true
 allow_unauthenticated_options      : false
 aors                               : sipcc
 asymmetric_rtp_codec               : false
 auth                               : sipcc
 bind_rtp_to_media_address          : false
 bundle                             : false
 call_group                         :
 callerid                           : <unknown>
 callerid_privacy                   : allowed_not_screened
 callerid_tag                       :
 codec_prefs_incoming_answer        : prefer:pending, operation:intersect, keep:all, transcode:allow
 codec_prefs_incoming_offer         : prefer:pending, operation:intersect, keep:all, transcode:allow
 codec_prefs_outgoing_answer        : prefer:pending, operation:intersect, keep:all, transcode:allow
 codec_prefs_outgoing_offer         : prefer:pending, operation:union, keep:all, transcode:allow
 connected_line_method              : invite
 contact_acl                        :
 context                            : ogogon
 cos_audio                          : 0
 cos_video                          : 0
 device_state_busy_at               : 0
 direct_media                       : true
 direct_media_glare_mitigation      : none
 direct_media_method                : invite
 disable_direct_media_on_nat        : false
 dtls_auto_generate_cert            : No
 dtls_ca_file                       :
 dtls_ca_path                       :
 dtls_cert_file                     :
 dtls_cipher                        :
 dtls_fingerprint                   : SHA-256
 dtls_private_key                   :
 dtls_rekey                         : 0
 dtls_setup                         : active
 dtls_verify                        : No
 dtmf_mode                          : rfc4733
 fax_detect                         : false
 fax_detect_timeout                 : 0
 follow_early_media_fork            : true
 force_avp                          : false
 force_rport                        : true
 from_domain                        :
 from_user                          :
 g726_non_standard                  : false
 geoloc_incoming_call_profile       :
 geoloc_outgoing_call_profile       :
 ice_support                        : false
 identify_by                        : username,ip
 ignore_183_without_sdp             : false
 inband_progress                    : false
 incoming_call_offer_pref           : local
 incoming_mwi_mailbox               :
 language                           :
 mailboxes                          :
 max_audio_streams                  : 1
 max_video_streams                  : 1
 media_address                      :
 media_encryption                   : no
 media_encryption_optimistic        : false
 media_use_received_transport       : false
 message_context                    :
 moh_passthrough                    : false
 moh_suggest                        : default
 mwi_from_user                      :
 mwi_subscribe_replaces_unsolicited : no
 named_call_group                   :
 named_pickup_group                 :
 notify_early_inuse_ringing         : false
 one_touch_recording                : false
 outbound_auth                      :
 outbound_proxy                     :
 outgoing_call_offer_pref           : remote_merge
 overlap_context                    :
 pickup_group                       :
 preferred_codec_only               : false
 record_off_feature                 : automixmon
 record_on_feature                  : automixmon
 refer_blind_progress               : true
 rewrite_contact                    : false
 rpid_immediate                     : false
 rtcp_mux                           : false
 rtp_engine                         : asterisk
 rtp_ipv6                           : false
 rtp_keepalive                      : 0
 rtp_symmetric                      : false
 rtp_timeout                        : 0
 rtp_timeout_hold                   : 0
 sdp_owner                          : -
 sdp_session                        : Asterisk
 security_mechanisms                :
 security_negotiation               : no
 send_aoc                           : false
 send_connected_line                : yes
 send_diversion                     : true
 send_history_info                  : false
 send_pai                           : false
 send_rpid                          : false
 set_var                            :
 srtp_tag_32                        : false
 stir_shaken                        : off
 stir_shaken_profile                :
 sub_min_expiry                     : 0
 subscribe_context                  :
 suppress_q850_reason_headers       : false
 t38_bind_udptl_to_media_address    : false
 t38_udptl                          : false
 t38_udptl_ec                       : none
 t38_udptl_ipv6                     : false
 t38_udptl_maxdatagram              : 0
 t38_udptl_nat                      : false
 timers                             : yes
 timers_min_se                      : 90
 timers_sess_expires                : 1800
 tone_zone                          :
 tos_audio                          : 0
 tos_video                          : 0
 transport                          :
 trust_connected_line               : yes
 trust_id_inbound                   : false
 trust_id_outbound                  : false
 use_avpf                           : false
 use_ptime                          : false
 user_eq_phone                      : false
 voicemail_extension                :
 webrtc                             : no

pbx*CLI> pjsip show aor sipcc

      Aor:  <Aor..............................................>  <MaxContact>
    Contact:  <Aor/ContactUri............................> <Hash....> <Status> <RTT(ms)..>
==========================================================================================

      Aor:  sipcc                                                1


 ParameterName        : ParameterValue
 =====================================
 authenticate_qualify : false
 contact              :
 default_expiration   : 3600
 mailboxes            :
 max_contacts         : 1
 maximum_expiration   : 7200
 minimum_expiration   : 60
 outbound_proxy       :
 qualify_frequency    : 0
 qualify_timeout      : 3.000000
 remove_existing      : false
 remove_unavailable   : false
 support_path         : false
 voicemail_extension  :

pbx*CLI> pjsip show auth sipcc

  I/OAuth:  <AuthId/UserName.............................................................>
==========================================================================================

     Auth:  sipcc/sipcc

 ParameterName  : ParameterValue
 =======================================
 auth_type      : userpass
 md5_cred       :
 nonce_lifetime : 32
 oauth_clientid :
 oauth_secret   :
 password       : NezeQuacdehybiv3frirv=
 realm          :
 refresh_token  :
 username       : sipcc

pbx*CLI> pjsip show settings

Global Settings:

 ParameterName                              : ParameterValue
 ======================================================================
 all_codecs_on_empty_reinvite               : false
 allow_sending_180_after_183                : false
 contact_expiration_check_interval          : 30
 debug                                      : no
 default_from_user                          : asterisk
 default_outbound_endpoint                  : default_outbound_endpoint
 default_realm                              : asterisk
 default_voicemail_extension                :
 disable_multi_domain                       : false
 endpoint_identifier_order                  : ip,username,anonymous
 ignore_uri_user_options                    : false
 keep_alive_interval                        : 90
 max_forwards                               : 70
 max_initial_qualify_time                   : 0
 mwi_disable_initial_unsolicited            : false
 mwi_tps_queue_high                         : 500
 mwi_tps_queue_low                          : -1
 norefersub                                 : yes
 regcontext                                 :
 send_contact_status_on_update_registration : no
 taskprocessor_overload_trigger             : global
 unidentified_request_count                 : 5
 unidentified_request_period                : 5
 unidentified_request_prune_interval        : 30
 use_callerid_contact                       : no
 user_agent                                 : Asterisk PBX 18.20.2

System Settings:

 ParameterName               : ParameterValue
 ============================================
 accept_multiple_sdp_answers : false
 compact_headers             : false
 disable_rport               : false
 disable_tcp_switch          : true
 follow_early_media_fork     : true
 threadpool_auto_increment   : 5
 threadpool_idle_timeout     : 60
 threadpool_initial_size     : 0
 threadpool_max_size         : 50
 timer_b                     : 32000
 timer_t1                    : 500
pbx*CLI>
4

I don’t see any issues offhand. Could the password have a typo in it?

5

I made a copy-paste. And in the same way I transferred it to the second Asterisk, where сhan_sip. Everything works there.

6

Hmmm. Try turning debug on and repeating the attempt.

Make sure “debug” is listed in the logger.conf “console” entry and/or create a new file entry for “debug” then run the following commands…

CLI> logger reload
CLI> core set debug 9 res_pjsip_registrar.so
CLI> core set debug 9 res_pjsip_authenticator_digest.so

Then retry the registration and post the resulting log entries.

7 
Asterisk 18.20.2, Copyright (C) 1999 - 2022, Sangoma Technologies Corporation and others.
Created by Mark Spencer <markster@digium.com>
Asterisk comes with ABSOLUTELY NO WARRANTY; type 'core show warranty' for details.
This is free software, with components licensed under the GNU General Public
License version 2 and other licenses; you are welcome to redistribute it under
certain conditions. Type 'core show license' for details.
=========================================================================
Connected to Asterisk 18.20.2 currently running on pbx (pid = 3899)
pbx*CLI>  logger reload
 Asterisk Queue Logger restarted
pbx*CLI> core set debug 9 res_pjsip_registrar.so
Core debug was 0 and has been set to 9 for 'res_pjsip_registrar'.
pbx*CLI> core set debug 9 res_pjsip_authenticator_digest.so
Core debug was 0 and has been set to 9 for 'res_pjsip_authenticator_digest'.
[Oct 22 16:22:32] NOTICE[104579]: res_pjsip/pjsip_distributor.c:676 log_failed_request: Request 'REGISTER' from '<sip:sipcc@pbx.ogogon.org>' failed for '192.168.1.23:5070' (callid: b1f56a4b-9078-11ef-babd-c86000bcf23c) - Failed to authenticate
pbx*CLI>

Verbose - 11.
Are you sure what need to enable debugging for res_pjsip_authenticator_digest.so?
I have the following code in the client source:

cfg.cred_info[0].data_type = PJSIP_CRED_DATA_PLAIN_PASSWD;

However, I gave the command:

core set debug 9 res_pjsip_authenticator_plain.so

The result is absolutely the same.

8

The “digest” in res_pjsip_authenticator_digest.so refers to the SIP authentication method, not to how the password itself is stored. There is no res_pjsip_authenticator_plain.so. You need to repeat the test with the original debug command.

Setting debug isn’t going to make it work but the debug messages may give an indication as to why. I don’t see any in the output you pasted. Did you make sure that “debug” appears in the “console” line in logger.conf? It should look something like…

[logfiles]
full => [plain]notice,error,warning,verbose
debug => [plain]debug,trace,error,warning
console => notice,warning,error,debug,trace
9

Thank you. The information obtained in this way allowed me to find the problem and technically fix it.
However, I still have some questions.

On the development machine (devel) there is Asterisk and it maintains a SIP connection with the main Asterisk (pbx), on which PJSIP.
On the development machine I launched my SIP client with different credentials and port 5070.

When my SIP client connected to pbx for authorization, it immediately decided that it was Asterisk, and seeing a different password, it refused authorization. Using tcpdump I saw that my client was authorizing correctly, specifying auth=sipcc and its port 5070.
Now I connected these Asterisks via IAX2 and the problem disappeared - my client’s authorization began to proceed without any comments. Formally, the problem is solved.

But one thing worries me - theoretically, any number of clients can register from one host, if they have different credentials and do not conflict with ports. (I had a case when one legendarily intractable telecom operator did not want to provide a SIP trunk and I had no problem registering 308 accounts on it from one Asterisk at the same time.)

Why can’t my Asterisk recognize the second registration correctly?

10

You may need to enable the line option.

11

It depends on configuration. If you are identifying incoming traffic from something based on IP address, and the endpoint identification order specifies IP first, then all traffic will be associated with that single endpoint. It doesn’t matter if you have others it could match, it would match the single one. To solve that the endpoint identification order can be configured in pjsip.conf to prefer username first, after which it would go to IP address instead.

12

…or auth_username

13

Assuming the configuration and setup is that the even the IP based one is challenged for credentials, yes.