sip
Does the SIP un-register tag value (in the From: field) should match the register tag value?
i.e. if:
REGISTER sip:registrar.biloxi.com SIP/2.0 Via: SIP/2.0/UDP bobspc.biloxi.com:5060;branch=z9hG4bKnashds7 Max-Forwards: 70 To: Bob <sip:bob@biloxi.com> From: Bob <sip:bob@biloxi.com>;tag=456248
Does the un-register MUST use the same tag=456248?
This is a workaround that I found that is OK for my situation, but I'd generally consider it a gross hack. I found this gem in chan_sip.c:
/* Always OK if no secret */ if (ast_strlen_zero(secret) && ast_strlen_zero(md5secret)) return AUTH_SUCCESSFUL;
So, my workaround is to put:
secret=
In the config for each extension. This is OK for me because I'm not worried about someone on my network trying to register for an extension that isn't theirs. In general, however, it's totally insecure because it bypasses any further authentication (including my issue with the username mismatch).
I found the solution after spending roughly 40 hours on this problem.
There is a setting in the switch that enables "Auto DoS" protection. Apparently it considers TCP or UDP traffic that has matching source or destination ports to be a blat attack and drops the packet. This is ridiculously short-sighted since SIP traffic often (always?) relies on source and destination ports being 5060.
In case a textual description was insufficient:
Best Answer
The question you need to ask is, does the REGISTER packet require that tag value?
If it does, the answer is Yes, because an UNREGISTER is just a REGISTER with an Expires Header set to 0 (or some other really small number).