Hi, I think there's a problem with the handling of Record-Routes and Routes when Sems sbc module performs authentication towards a peer host. The initial INVITE is sent out as expected. When the 407 contains a Record-Route set, then this is used as Route set in the following INVITE containing the Proxy-Authorization headers, plus the outbound proxy is also put into the Route. Is this really the correct behaviour? Shouldn't the second INVITE just look like the first one?
Here are the parts of the trace: Sems (127.0.0.1:5080) to my outbound proxy (127.0.0.1:5060): U 2011/05/05 18:06:36.749465 127.0.0.1:5080 -> 127.0.0.1:5060 INVITE sip:[email protected]:5060 SIP/2.0. Via: SIP/2.0/UDP 127.0.0.1:5080;branch=z9hG4bKYjVKcal4;rport. Contact: <sip:127.0.0.1:5080>. Route: <sip:127.0.0.1:5060;lr>. This Route is fine, since I set it in outbound_proxy parameter. U 2011/05/05 18:06:36.798407 127.0.0.1:5060 -> 127.0.0.1:5080 SIP/2.0 407 Proxy Authentication Required. Via: SIP/2.0/UDP 127.0.0.1:5080;branch=z9hG4bKYjVKcal4;rport=5080. Record-Route: <sip:remote-proxy-ip;lr;ftag=12C30567-4DC2CB0C000B6D94-F451A700;vsf=AAAAAAAAAAAAAAA+U10pGBYeHxhZBBYuYXQ-;x-nt-gid=PG02>. Record-Route: <sip:my-public-outbound-ip;lr;r2=on;ftag=12C30567-4DC2CB0C000B6D94-F451A700>. Record-Route: <sip:127.0.0.1;lr;r2=on;ftag=12C30567-4DC2CB0C000B6D94-F451A700>. Here, both the remote proxy ("remote-proxy-ip") and my outbound proxy ("my-public-outbound-ip" and 127.0.0.1) insert themselves into the Record route. So far, so good. U 2011/05/05 18:06:36.798561 127.0.0.1:5080 -> 127.0.0.1:5060 ACK sip:[email protected]:5060 SIP/2.0. Via: SIP/2.0/UDP 127.0.0.1:5080;branch=z9hG4bKYjVKcal4;rport. Route: <sip:127.0.0.1:5060;lr>. The ACK is sent like the initial INVITE, also fine. Now the problematic new INVITE (which should in my opinion look just like the initial INVITE): U 2011/05/05 18:06:36.800359 127.0.0.1:5080 -> 127.0.0.1:5060 INVITE sip:[email protected]:5060 SIP/2.0. Via: SIP/2.0/UDP 127.0.0.1:5080;branch=z9hG4bKcztfca7e;rport. Contact: <sip:127.0.0.1:5080>. Route: <sip:127.0.0.1:5060;lr>,<sip:127.0.0.1;lr;r2=on;ftag=12C30567-4DC2CB0C000B6D94-F451A700>, <sip:my-public-outbound-ip;lr;r2=on;ftag=12C30567-4DC2CB0C000B6D94-F451A700>, <sip:remote-proxy-ip;lr;ftag=12C30567-4DC2CB0C000B6D94-F451A700;vsf=AAAAAAAAAAAAAAA+U10pGBYeHxhZBBYuYXQ-;x-nt-gid=PG02>. Proxy-Authorization: ... So as you can see, the Record-Route from the 407 is put into the Route of the new INVITE, and it is also prefixed by the outbound_proxy parameter (where force_outbound_proxy=no, btw). It completely breaks at least my routing, because suddenly the INVITE gets loose-routed on my outbound proxy (and looped once through itself, since 127.0.0.1:5060 is put there twice), instead of being an initial request. Could someone please double-check this? Thanks, Andreas
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Sems mailing list [email protected] http://lists.iptel.org/mailman/listinfo/sems
