ACK CSeq Not Updated After 407 Re-Authentication

[sabrineLayouni]

Environment

• JsSIP version: 3.12
• Browser: Chrome (latest)

Summary

Current Behavior:

| |
|-------- INVITE (CSeq: 100) ----------------->|
|<------- 100 Trying --------------------------|
|<------- 407 Proxy Auth Required -------------|
|-------- ACK (CSeq: 100) -------------------->| ✓ Correct
| |
|-------- INVITE (CSeq: 101) + Auth --------->| ✓ Correct (incremented)
|<------- 200 OK ------------------------------|
|-------- ACK (CSeq: 100) -------------------->| ✗ BUG: Should be 101

Expected Behavior:

| |
|-------- INVITE (CSeq: 100) ----------------->|
|<------- 100 Trying --------------------------|
|<------- 407 Proxy Auth Required -------------|
|-------- ACK (CSeq: 100) -------------------->| ✓ Matches original INVITE
| |
|-------- INVITE (CSeq: 101) + Auth --------->| ✓ Incremented for retry
|<------- 200 OK ------------------------------|
|-------- ACK (CSeq: 101) -------------------->| ✓ Matches retried INVITE

Impact

After several iterations:

1. Server may reject the session (too many requests)
2. Or session timer expires server-side
3. → Call drops unexpectedly

Root Cause (i think)

In sendACK() function, the ACK uses this.request.cseq which references the original INVITE's CSeq, not the re-authenticated INVITE's CSeq.

[jmillan]

As per RFC 3261:

When a UAC resubmits a request with its credentials after receiving a
   401 (Unauthorized) or 407 (Proxy Authentication Required) response,
   it MUST increment the CSeq header field value as it would normally
   when sending an updated request.

[jmillan]

The Cseq needs to be incremented in the authenticated request. Maybe the credentials are not correct and this is why the server is again challenging the UAC.

[jmillan]

This is the same pattern fixed in #961 for ReferSubscriber (#961),

No, that was a very specific case where the subscriber is stored by its cseq number because the NOTIFY will refer to it. The challenge made the Cseq increment, as it should, and hence the subscriber ID had to be updated with the new Cseq in order to match the future NOTIFY request.

[ibc]

So we should close this issue, right?

[sabrineLayouni]

sorry t think i miss explained things, the probem is actually on the ACK and not the INVITE:

the actual behavior is:

| |
|-------- INVITE (CSeq: 100) ------------>|
|<------- 100 Trying ---------------------|
|<------- 407 Proxy Auth Required --------|
|------- ACK (CSeq: 100) --------------->|
|-------- INVITE (CSeq: 101) ------------>| ← SAME CSeq + credentials
|<------- 200 OK -------------------------|
|------- ACK (CSeq: 100) --------------->| <- CSeq should be 101 and not 100

what should happen:

| |
|-------- INVITE (CSeq: 100) ------------>|
|<------- 100 Trying ---------------------|
|<------- 407 Proxy Auth Required --------|
|------- ACK (CSeq: 100) --------------->|
|-------- INVITE (CSeq: 101) ------------>|
|<------- 200 OK -------------------------|
|------- ACK (CSeq: 101) --------------->| <- CSeq 101

i'll edit the issue details

[jmillan]

Are you sure you are using that version? This was fixed in version 3.10.10 here.

Please upgrade JsSIP and if the problem persists provide us with a plain text full JsSIP logs for the failing session.

[sabrineLayouni]

weird.. yes i'm using version 3.12.0

[sabrineLayouni]

here's a complete log of the issue, the ACK on the second INVITE is not updated with the correct CSEQ (it keeps the value of the FIRST INVITE),
(done the test after updating lib), nothing changes

logs.pdf

[jmillan]

Can you please provide the full logs in plain text? Not in .pdf or image, just .txt or simply pasted here. We need the full JsSIP logs, not just the SIP messages.

[sabrineLayouni]

here it is:

complete-logs.log

[jmillan]

The problem happens still with an outgoing re-invite... I'll check it in detail as soon as I can.

[sabrineLayouni]

Yes the fix done already was not complete..

Thanks already for your response 🙂