<p dir="ltr">I doubt the relay does any authentication. </p>
<p dir="ltr">Any invite seems to be straight to that "tobridge" route which sets the destination and relays it... there's no auth there whatsoever... you might want to do ip auth before sending it to the "tobridge" route?</p>
<br><div class="gmail_quote"><div dir="ltr">On Sat, Jan 20, 2018, 15:14 Dave & Hazel <<a href="mailto:dogbark@indigo.ie">dogbark@indigo.ie</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-IE" link="blue" vlink="purple"><div class="m_2612810507467742168WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Nope, I’m not calling a registered user. Actually, there are no registered users. The function of the Kamailio service in this case is to relay WebRTC calls to a conferencing bridge. The problem is that whoever set it up did so without considering the security implications. And, in fact, it was malevolent SIP traffic hitting the bridge that lead me to looking more closely at the Kamailio solution.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">There appears to be some custom configuration around routing. I’m not sure if route(RELAY) on its own is meant to challenge for authorisation.<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""><u></u> <u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">#!ifdef WITH_CONFERENCEBRIDGE<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> if(is_method("INVITE") && (!route(FROMBRIDGE))) {<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> # if new call from out there - <u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> # - non-INVITE request are routed directly by Kamailio<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> # - traffic from is routed also directy by Kamailio<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> <u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> route(TOBRIDGE);<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> exit;<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> }<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">#!endif<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">#!ifdef WITH_CONFERENCEBRIDGE<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""># Send to bridge<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">route[TOBRIDGE] {<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> $du = "sip:" + $sel(cfg_get.bridge.bindip) + ":"<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> + $sel(cfg_get.bridge.bindport);<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> route(RELAY);<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> exit;<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">}<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""><u></u> <u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">#!endif<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">As I short term solution to filter unwanted traffic, I’ve updated the configuration to only relay calls using a definitive DDI.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">#!ifdef WITH_CONFERENCEBRIDGE<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""># Send to bridge<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">route[TOBRIDGE] {<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""><u></u> <u></u></span></p><p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:"Courier New""> if($rU != "8835100xxxxx")<u></u><u></u></span></b></p><p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.0pt;font-family:"Courier New""> return -1;<u></u><u></u></span></b></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""><u></u> <u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> $du = "sip:" + $sel(cfg_get.bridge.bindip) + ":"<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> + $sel(cfg_get.bridge.bindport);<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> route(RELAY);<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""> exit;<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">}<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New""><u></u> <u></u></span></p><p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Courier New"">#!endif<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Thanks guys for your help.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> sr-users [mailto:<a href="mailto:sr-users-bounces@lists.kamailio.org" target="_blank">sr-users-bounces@lists.kamailio.org</a>] <b>On Behalf Of </b>David Villasmil<br><b>Sent:</b> Saturday, January 20, 2018 1:06 AM</span></p></div></div><div lang="EN-IE" link="blue" vlink="purple"><div class="m_2612810507467742168WordSection1"><p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><br><b>To:</b> Kamailio (SER) - Users Mailing List <<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a>><br><b>Subject:</b> Re: [SR-Users] sip invite proxy-authorization<u></u><u></u></span></p></div></div><div lang="EN-IE" link="blue" vlink="purple"><div class="m_2612810507467742168WordSection1"><p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"></span></p><p class="MsoNormal"><u></u> <u></u></p><p>Again, are you calling a local registeted user?<u></u><u></u></p></div></div><div lang="EN-IE" link="blue" vlink="purple"><div class="m_2612810507467742168WordSection1"><p class="MsoNormal"><u></u> <u></u></p><div><div><p class="MsoNormal">On Fri, Jan 19, 2018, 17:28 Dave & Hazel <<a href="mailto:dogbark@indigo.ie" target="_blank">dogbark@indigo.ie</a>> wrote:<u></u><u></u></p></div><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><p class="MsoNormal">Cheers Alex for your insight.<br><br>My problem still remains in that my invites are not being challenged even though AUTH is defined.<br><br>On 19 Jan 2018, at 15:57, Alex Balashov <<a href="mailto:abalashov@evaristesys.com" target="_blank">abalashov@evaristesys.com</a>> wrote:<br><br>Hi,<br><br>> On Fri, Jan 19, 2018 at 03:38:24PM -0000, Dave & Hazel wrote:<br>><br>> preforming a SIP INVITE without first registering with the Kamailio<br>> service (SJ-Phone speak). I am dialling in remotely via NAT and my<br>> call is being relayed successfully.<br><br>Although many people are led to believe that there is some intrinsic<br>connection between registration and outbound calling by the way phone<br>UIs present these concepts, there is in fact no such connection<br>whatsoever.<br><br>Registration is an inbound concept, not an outbound concept. You can<br>make calls without being registered. You can make outbound calls using<br>different AAA mechanisms. Being registered in no way implies being able<br>to make outbound calls. They're just completely unrelated.<br><br>There is a common authentication mechanism used in both scenarios:<br>digest challenge authentication. As a practical matter, Kamailio sends a<br>407 proxy challenge for requests it is meant to relay (e.g. INVITEs) and<br>a 401 Unauthorized challenge for requests of which it is the logical<br>destination (e.g. REGISTER), and both draw on the same set of<br>authentication credentials and otherwise work the same way. The AUTH<br>route covers both of these cases.<br><br>-- Alex<br><br>--<br>Alex Balashov | Principal | Evariste Systems LLC<br><br>Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free)<br>Web: <a href="http://www.evaristesys.com/" target="_blank">http://www.evaristesys.com/</a>, <a href="http://www.csrpswitch.com/" target="_blank">http://www.csrpswitch.com/</a><br><br>_______________________________________________<br>Kamailio (SER) - Users Mailing List<br><a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br><br><br>_______________________________________________<br>Kamailio (SER) - Users Mailing List<br><a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><u></u><u></u></p></blockquote></div></div></div>_______________________________________________<br>
Kamailio (SER) - Users Mailing List<br>
<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
<a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote></div>