December 2005 - sr-users

[Users] Disabling rtpproxy or mediaproxy when both SIP UA are behind same NAT
by Rafael Risco GV 29 Dec '05

29 Dec '05

Hi I think I am very close to solve this issue, based on suggestions of Tavis and Klaus for openser in: http://openser.org/dokuwiki/doku.php?id=how_to_set_up_nathelper_rtpproxy_wh… I´ve been able to disable rtpproxy in this cases but I have a problem with accounting, if the callee hungup first appears an error and no cdr for BYE is generated until caller hungup the call, bellow the errors and config. thanks for any help rafael 4(22193) BYE - STOP ACCOUNTING 4(22193) DEBUG: add_param: tag=3658302912 4(22193) grep_sock_info - checking if host==us: 13==13 && [192.168.1.205] == [10.0.2.130] 4(22193) grep_sock_info - checking if port 5060 matches port 5060 4(22193) grep_sock_info - checking if host==us: 13==9 && [192.168.1.205] == [127.0.0.1] 4(22193) grep_sock_info - checking if port 5060 matches port 5060 4(22193) check_self: host != me 4(22193) grep_sock_info - checking if host==us: 13==13 && [10.0.2.130] == [10.0.2.130] 4(22193) grep_sock_info - checking if port 5060 matches port 5060 4(22193) check_via_address(10.0.1.25, 192.168.1.100, 0) 4(22193) ERROR: udp_send: sendto(sock,0x4051e800,588,0,0x4051f2ac,16): Operation not permitted(1) 4(22193) msg_send: ERROR: udp_send failed 4(22193) ERROR:tm:t_forward_nonack: sending request failed 4(22193) DEBUG: add_to_tail_of_timer[4]: 0x4051f2cc 4(22193) DEBUG: add_to_tail_of_timer[0]: 0x4051f2dc 4(22193) ERROR:tm:t_relay_to: t_forward_nonack returned error 4(22193) parse_headers: flags=ffffffffffffffff 4(22193) check_via_address(10.0.1.25, 192.168.1.100, 0) 4(22193) WARNING:vqm_resize: resize(0) called . . . # ----------- global configuration parameters ------------------------ #/* Uncomment these lines to enter debugging mode debug=6 fork=yes log_stderror=yes #*/ listen=10.0.2.130 listen=127.0.0.1 port=5060 # hostname matching an alias will satisfy the condition uri==myself". alias=mydomain.com.pe alias=10.0.2.130 alias=127.0.0.1 check_via=no # (cmd. line: -v) dns=no # (cmd. line: -r) rev_dns=no # (cmd. line: -R) children=4 fifo="/tmp/openser_fifo" fifo_mode=0666 # Fifo permissions can be changes from here. # sip_warning - Should replies include extensive warnings? # By default yes, it is good for trouble-shooting. sip_warning=yes # ------------------ module loading ---------------------------------- loadmodule "/usr/local/lib/openser/modules/domain.so" loadmodule "/usr/local/lib/openser/modules/avpops.so" loadmodule "/usr/local/lib/openser/modules/mysql.so" loadmodule "/usr/local/lib/openser/modules/sl.so" loadmodule "/usr/local/lib/openser/modules/tm.so" loadmodule "/usr/local/lib/openser/modules/rr.so" loadmodule "/usr/local/lib/openser/modules/maxfwd.so" loadmodule "/usr/local/lib/openser/modules/usrloc.so" loadmodule "/usr/local/lib/openser/modules/registrar.so" loadmodule "/usr/local/lib/openser/modules/group.so" loadmodule "/usr/local/lib/openser/modules/uri.so" loadmodule "/usr/local/lib/openser/modules/uri_db.so" loadmodule "/usr/local/lib/openser/modules/acc.so" loadmodule "/usr/local/lib/openser/modules/textops.so" loadmodule "/usr/local/lib/openser/modules/xlog.so" # digest authentication loadmodule "/usr/local/lib/openser/modules/auth.so" loadmodule "/usr/local/lib/openser/modules/auth_db.so" # !! Nathelper loadmodule "/usr/local/lib/openser/modules/nathelper.so" # ----------------- setting module-specific parameters --------------- modparam("usrloc", "db_mode", 2) # minimize write back window - default is 60 seconds modparam("usrloc", "timer_interval", 10) # database location modparam("usrloc", "db_url", "mysql://admin:heslo@localhost/openser") modparam("usrloc", "use_domain", 1) modparam("auth_db", "use_domain", 1) modparam("domain", "db_mode", 1) modparam("domain", "domain_table", "domain") modparam("domain", "domain_col", "domain") # ------------- Mysql Accounting parameters modparam("acc", "log_flag", 1) modparam("acc", "log_level", 2) modparam("acc", "db_flag", 1) modparam("acc", "db_missed_flag", 3) modparam("acc", "log_missed_flag", 3) modparam("acc", "db_url", "mysql://admin:heslo@localhost/openser") modparam("acc", "report_ack", 0) modparam("acc", "log_fmt", "miocfsputdr") modparam("tm", "fr_timer", 20 ) modparam("tm", "fr_inv_timer", 40 ) # Timer which hits if no final reply for an INVITE modparam("tm", "wt_timer", 20 ) # add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1) modparam("group", "db_url", "mysql://seradmin:heslo@localhost/openser") modparam("uri_db", "db_url", "mysql://seradmin:heslo@localhost/openser") # ------------- registration parameters modparam("registrar", "nat_flag", 6) modparam("registrar", "min_expires", 60) modparam("registrar", "max_expires", 86400) modparam("registrar", "default_expires", 3600) modparam("registrar", "desc_time_order", 1) modparam("registrar", "append_branches", 1) modparam("registrar", "use_domain", 1) # !! Nathelper # modparam("registrar", "nat_flag", 6) modparam("nathelper", "natping_interval", 30) # Ping interval 30 s modparam("nathelper", "ping_nated_only", 1) # Ping only clients behind NAT # -------------------------- request routing logic -------------------------- route { log(1, "-------------------------------------------\n"); log(1, "entering main loop\n"); # initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); return; }; if ( msg:len >= max_len ) { sl_send_reply("513", "Message too big"); return; }; # set flag for Radius Accounting: if (!method=="OPTIONS") setflag(3); if (method=="INVITE") { log(1, "INVITE MESSAGE RECEIVED - START ACC\n"); setflag(1); /* set for accounting (the same value as in log_flag!) */ }; if (method=="BYE") { log (1, "BYE - STOP ACCOUNTING\n"); setflag(1); }; if (method=="CANCEL") { log (1, "CANCEL - STOP ACCOUNTING\n"); setflag(1); }; # ----------------------------------------------------------------- # Record Route Section # ----------------------------------------------------------------- # record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if (!method=="REGISTER") record_route(); if (method=="BYE" || method=="CANCEL") { unforce_rtp_proxy(); }; # ----------------------------------------------------------------- # Loose Route Section # ----------------------------------------------------------------- if (loose_route() && (!src_ip==10.0.2.130 && !src_port==5070)) { if (has_totag() && (method=="INVITE" || method=="ACK")) { if (nat_uac_test("19")) { setflag(7); force_rport(); fix_nated_contact(); }; force_rtp_proxy("l"); }; route(2); return; }; # ----------------------------------------------------------------- # Call Type Processing Section # ----------------------------------------------------------------- if (!uri==myself && (!src_ip==10.0.2.130 && !src_port==5070)) { route(1); return; }; if (method=="CANCEL") { route(2); return; }; if (method == "REGISTER") { if (!search("^Contact:[ ]*\*") && nat_uac_test("19")) { setflag(6); fix_nated_register(); force_rport(); }; sl_send_reply("100", "Trying"); log(1, "ANALYZING REGISTER REQUEST\n"); # ... to use digest authentication if (is_user_in("Request-URI", "desactivado")) { sl_send_reply("402", "Su cuenta fue desactivada por falta de pago"); return; }; if (!www_authorize("", "subscriber")) { log(1," ----- Fails to Register \n"); www_challenge("", "0"); return; }; # only signed users are allowed if (!check_to()) { log(1, "LOG: Hijack!!!--> unsigned user registration attempt\n"); sl_send_reply("403", "hijack attempt!!!! Only signed users are allowed"); return; }; consume_credentials(); log(1," Registered!!! \n"); if (!save("location")) { sl_reply_error(); }; return; }; # INVITE ? First check the source of the call #******************************************** # If the call comes from the gateways, no authentication is required. if (method == "INVITE" && (src_ip==10.0.2.145 || src_ip==10.0.2.132|| src_ip== 10.0.2.131)) { log(1,"Call from pstn|*, no authentication is required. \n"); # If the call comes from B2BUA, no authentication is required. # The first leg of the call has already been authenticated. } else if (src_ip==10.0.2.130 && src_port==5070) { log(1,"Call from B2BUA, no authentication is required. \n"); } else { log(1, "ANALYZING INVITE REQUESTs\n"); if (method == "INVITE" && !src_ip==10.0.2.130 && !src_port==5070){ if (!proxy_authorize("", "subscriber")) { proxy_challenge("", "0"); return; } else { if (!check_from()) { sl_send_reply("403", "Only registered users are allowed"); log(1," ----> Only registered users are allowed \n"); return; }; consume_credentials(); if (nat_uac_test("19")) { setflag(7); }; }; # Not all the users are PREPAID, so we check the database # to see if the call will be routed through B2BUA. # If every call is to be routed through B2BUA the "is_user_in" # conditional is not required. # Do not use b2bua for local calls (660++++) if (is_user_in("From", "prepaidb") && uri=~"^sip:00") { log(1," ----> Usuario PREPAGO!!! enviando a b2bua... \n"); rewritehostport("10.0.2.130:5070"); t_relay_to_udp("10.0.2.130", "5070"); return; }; }; }; # End of if (method == "INVITE" |... /* *********** Dial out to Local and PSTN logic ********* */ if(uri=~"^sip:00"){ log(1,"00N match - Larga Distancia Internacional \n"); if (!is_user_in("from", "ldix")) { log(1,"No permission for international calls \n"); sl_send_reply("403", "No permission for international calls"); acc_db_request("403 Forbidden", "missed_calls"); return; }; rewritehostport("10.0.2.131:5070"); strip(2); route(1); return; }; /* ******************************************************************** */ lookup("aliases"); if (uri!=myself) { route(1); return; }; # does the user wish redirection on no availability? (i.e., is he # in the voicemail group?) -- determine it now and store it in # flag 4, before we rewrite the flag using UsrLoc if (is_user_in("Request-URI", "voicemail")) { log(1, "requested user is in voicemail group \n"); setflag(4); }; # native SIP destinations are handled using our USRLOC DB if (!lookup("location")) { log(1,"unable to locate user X ... sending to route(4)! \n"); # handle user which was not found route(4); return; }; ### Check if UAS are behind the same NAT system: ### if (isflagset(6) && isflagset(7)){ log(2, "Both Clients are behind NAT"); # Store the destination domain into an AVP avp_printf("i:450", "$dd"); if (avp_check("i:450", "eq/$src_ip/g")){ log(3, "Detected Two Clients Behind the Same NAT - Disabling Mediaproxy"); # Do not use media-proxy as the clients seem to be behind the same NAT resetflag(6); resetflag(7); route(2); return; }; }; route(1); # if user is on-line and is in Voicemail group, enable redirection if (method == "INVITE" && isflagset(4)) { log(1, "invite for voicemail user->initiate failureroute[1]\n"); t_on_failure("1"); }; } ### ##### ####### ########## ########### ############### ################# ##################### route[1] { # if client or server know to be behind a NAT, enable relay if (isflagset(6) || isflagset(7)) { force_rport(); fix_nated_contact(); force_rtp_proxy(); }; # NAT processing of replies; apply to all transactions (for example, # re-INVITEs from public to private UA are hard to identify as # NATed at the moment of request processing); look at replies t_on_reply("1"); # send it out now; use stateful forwarding as it works reliably # even for UDP2TCP if (!t_relay()) { if (method=="INVITE" && (isflagset(6) || isflagset(7))) { unforce_rtp_proxy(); }; sl_reply_error(); }; log(1, "Route[1]: Send it out now!!!\n"); } # !! Nathelper onreply_route[1] { # NATed transaction ? # Not all 2xx messages have a content body so here we # make sure our Content-Length > 0 to avoid a parse error if ((isflagset(6) || isflagset(7)) && status =~ "(183)|2[0-9][0-9]") { fix_nated_contact(); if (!search("^Content-Length:\ 0")) { force_rtp_proxy(); log(1, "onreply_route1: force rtp proxy!!!\n"); }; # otherwise, is it a transaction behind a NAT and we did not # know at time of request processing ? (RFC1918 contacts) } else if (nat_uac_test("1")) { fix_nated_contact(); }; } # -------------- Default Message Handler --------------------- route[2]{ # ---------------------------------------------------- # Default Message Handler # ---------------------------------------------------- t_on_reply("1"); if (!t_relay()) { if (method=="INVITE" && isflagset(7)) { unforce_rtp_proxy(); }; sl_reply_error(); }; } # --------------- Handling of Unavailable user ---------------- route[4] { # non-Voip -- just send "off-line" if (!(method=="INVITE" || method=="ACK" || method=="CANCEL" || method=="BYE" || method=="OPTIONS")) { sl_send_reply("404", "Not Found"); acc_db_request("404 Not Found", "missed_calls"); log(1, "acc 404 Not Found 1 \n"); return; }; # not voicemail subscriber if (!isflagset(4) && !method=="OPTIONS" && !method=="ACK" && !method=="BYE") { sl_send_reply("404", "Not Found and no voicemail turned on !! "); acc_db_request("404 Not Found", "missed_calls"); log(1, " acc 404 Not Found and no voicemail \n"); return; }; # forward to voicemail adding prefix to simplify asterisk " extension.conf" :: # exten => _vmXXXXXXX,1,SetLanguage(es) # exten => _vmXXXXXXX,2,Voicemail(u${EXTEN:2}) # exten => _vmXXXXXXX,3,Hangup prefix("vm"); acc_db_request("404 Not Found -> Vm", "missed_calls"); rewritehostport("10.0.2.131:5070"); t_relay_to_udp("10.0.2.131", "5070"); } # If forwarding downstream did not succeed, try voicemail running at Asterisk failure_route[1]{ if (t_check_status("408")){ # revert_uri (); back to the original URI, makes me loose all lookup/rewrite stuff prefix("vm"); rewritehostport ("10.0.2.131:5070"); acc_db_request("408 Timeout -> Vm", "missed_calls"); append_branch(); t_relay(); return; } else if (t_check_status("486")){ # revert_uri (); back to the original URI, makes me loose all lookup/rewrite stuff prefix("vm"); rewritehostport ("10.0.2.131:5070"); acc_db_request("486 Busy -> Vm", "missed_calls"); append_branch(); t_relay(); return; } }

1 0

[Users] Mediaproxy
by Paul van Schagen 29 Dec '05

29 Dec '05

Gents, Can anybody tell me if mediaproxy works for far-end Nat traversal for symmetric firewalls ? Thanks ahead. Paul vna Schagen

2 1

[Users] Src&Dest ip avpops
by Fernando Rodriguez 29 Dec '05

29 Dec '05

Hello, Is there a place were i can read about avpops module regarding src and dst ip this is for using mediaproxy when the users are in diferent interfaces of the equipment or diferent networks so i can only mediaproxy the ones that need this functionalyty and the ones on the same network connect direct from one to the other. Thanks a lot Fernando Rodriguez V.

3 3

Re: [Users] RE: [Serusers] Distributing "OSP enable SER" binary
by Dmitry Isakbayev 28 Dec '05

28 Dec '05

Hi Elton, Some documentation is available @ http://www.sipfoundry.org/OSP. You can try forwarding your question to osp(a)list.sipfoundry.org (https://list.sipfoundry.org/mailman/listinfo/osp) Regards, Dmitry > From: "Elton Machado" <elton.machado(a)gmail.com> > Subject: [Users] RE: [Serusers] Distributing "OSP enable SER" binary > file w/ source code > To: <vmathur(a)transnexus.com> > Cc: serusers(a)iptel.org, "'users openser.org'" <users(a)openser.org> > Message-ID: <43b1c85f.1e92b00c.4a45.ffffca62(a)mx.gmail.com> > Content-Type: text/plain; charset="us-ascii" > > Hi, > > After some hours around OpenOSP I did it to compile under FreeBSD ;) > > So.. Next step was to try to find documentation about OpenOSP Server. > Problem iscould find much not to say anything. > Everything I found is about the client and about openser and asterisk > modules. > > Can you provide me some sort of configuration for the server? > > I'm trying to using it with Openser 1.0.0 and my system is running Freebsd > 6.0 > > I had a hard time to get it under it as it request some changes in code > and > also very old stuff, it is possible to have it cooworking with openldad > 2.3 > and a newer openssl an berkley db? > > So any information would be usefull as I can't figure out much with > documentation avaible I'm more insterested in OpenOSP Server side as I > have > clear information about client side. > > Regards, > > Elton Machado >

1 0

[Users] Disabling rtpproxy or mediaproxy when both SIP UA are behind same NAT
by Rafael Risco GV 28 Dec '05

28 Dec '05

Hi I think I am very close to solve this issue, based on suggestions of Tavis and Klaus for openser in: http://openser.org/dokuwiki/doku.php?id=how_to_set_up_nathelper_rtpproxy_wh… I´ve been able to disable rtpproxy in this case but I have a problem with accounting, if the callee hungup first appears an error and no cdr for BYE is generated until caller hungup the call, bellow the errors and config. thanks for any help rafael error when callee hungup tha call: 2(21685) entering main loop 2(21685) BYE - STOP ACCOUNTING 2(21685) ERROR: udp_send: sendto(sock,0x4051ea70,588,0,0x4051f27c,16): Operation not permitted(1) 2(21685) msg_send: ERROR: udp_send failed 2(21685) ERROR:tm:t_forward_nonack: sending request failed more detailed (debug=6) ::: 4(22193) ------------------------------------------- 4(22193) entering main loop 4(22193) parse_headers: flags=100 4(22193) DEBUG: add_param: tag=1184914029 4(22193) DEBUG:parse_to:end of header reached, state=29 4(22193) DEBUG: get_hdr_field: <To> [56]; uri=[sip:6606060@mydomain.com.pe] 4(22193) DEBUG: to body [Rafo <sip:6606060@mydomain.com.pe>] 4(22193) get_hdr_field: cseq <CSeq>: <54121> <BYE> 4(22193) DEBUG:maxfwd:is_maxfwd_present: value = 70 4(22193) BYE - STOP ACCOUNTING 4(22193) DEBUG: add_param: tag=3658302912 4(22193) DEBUG:parse_to:end of header reached, state=29 4(22193) parse_headers: flags=40 4(22193) parse_headers: flags=200 4(22193) is_preloaded: No 4(22193) grep_sock_info - checking if host==us: 13==13 && [192.168.1.205] == [10.0.2.130] 4(22193) grep_sock_info - checking if port 5060 matches port 5060 4(22193) grep_sock_info - checking if host==us: 13==9 && [192.168.1.205] == [127.0.0.1] 4(22193) grep_sock_info - checking if port 5060 matches port 5060 4(22193) grep_sock_info - checking if host==us: 13==13 && [192.168.1.205] == [10.0.2.130] 4(22193) grep_sock_info - checking if port 5060 matches port 5060 4(22193) grep_sock_info - checking if host==us: 13==9 && [192.168.1.205] == [127.0.0.1] 4(22193) grep_sock_info - checking if port 5060 matches port 5060 4(22193) check_self: host != me 4(22193) grep_sock_info - checking if host==us: 13==13 && [10.0.2.130] == [10.0.2.130] 4(22193) grep_sock_info - checking if port 5060 matches port 5060 4(22193) after_loose: Topmost route URI: 'sip:10.0.2.130;ftag=1184914029;lr=on' is me 4(22193) parse_headers: flags=200 4(22193) DEBUG: get_hdr_body : content_length=0 4(22193) found end of header 4(22193) find_next_route: No next Route HF found 4(22193) after_loose: No next URI found 4(22193) DEBUG: has_totag: totag found 4(22193) DEBUG: t_newtran: msg id=12 , global msg id=5 , T on entrance=0xffffffff 4(22193) parse_headers: flags=ffffffffffffffff 4(22193) parse_headers: flags=78 4(22193) t_lookup_request: start searching: hash=46346, isACK=0 4(22193) DEBUG: RFC3261 transaction matching failed 4(22193) DEBUG: t_lookup_request: no transaction found 4(22193) DBG: trans=0x4051f1b0, callback type 1, id 0 entered 4(22193) parse_headers: flags=58 4(22193) DEBUG: mk_proxy: doing DNS lookup... 4(22193) check_via_address(10.0.1.25, 192.168.1.100, 0) 4(22193) ERROR: udp_send: sendto(sock,0x4051e800,588,0,0x4051f2ac,16): Operation not permitted(1) 4(22193) msg_send: ERROR: udp_send failed 4(22193) ERROR:tm:t_forward_nonack: sending request failed 4(22193) DEBUG: add_to_tail_of_timer[4]: 0x4051f2cc 4(22193) DEBUG: add_to_tail_of_timer[0]: 0x4051f2dc 4(22193) ERROR:tm:t_relay_to: t_forward_nonack returned error 4(22193) parse_headers: flags=ffffffffffffffff 4(22193) check_via_address(10.0.1.25, 192.168.1.100, 0) 4(22193) WARNING:vqm_resize: resize(0) called 4(22193) DBG: trans=0x4051f1b0, callback type 128, id 0 entered 4(22193) DEBUG: cleanup_uac_timers: RETR/FR timers reset 4(22193) DEBUG: add_to_tail_of_timer[2]: 0x4051f1f8 4(22193) DEBUG:tm:_reply_light: reply sent out. buf=0x8136738: SIP/2.0 4..., shmem=0x40520728: SIP/2.0 4 4(22193) DEBUG:tm:_reply_light: finished 4(22193) ERROR: generation of a stateful reply on error succeeded 4(22193) DEBUG:destroy_avp_list: destroying list (nil) 4(22193) receive_msg: cleaning up 2(22191) udp_rcv_loop: probing packet received from 10.0.1.25 54330 10(22199) DEBUG: timer routine:0,tl=0x4051f2dc next=(nil) 10(22199) DEBUG: timer routine:4,tl=0x4051f2cc next=(nil) 4(22193) SIP Request: 4(22193) method: <REGISTER> 4(22193) uri: <sip:mydomain.com.pe> 4(22193) version: <SIP/2.0> 4(22193) parse_headers: flags=2 4(22193) Found param type 232, <branch> = <z9hG4bK08ac1f39>; state=6 4(22193) Found param type 235, <rport> = <n/a>; state=17 4(22193) end of header reached, state=5 4(22193) parse_headers: Via found, flags=2 4(22193) parse_headers: this is the first via 4(22193) After parse_msg... 4(22193) preparing to run routing scripts... 4(22193) ------------------------------------------- # ----------- global configuration parameters ------------------------ #/* Uncomment these lines to enter debugging mode debug=6 fork=yes log_stderror=yes #*/ listen=10.0.2.130 listen=127.0.0.1 port=5060 # hostname matching an alias will satisfy the condition uri==myself". alias=mydomain.com.pe alias=10.0.2.130 alias=127.0.0.1 check_via=no # (cmd. line: -v) dns=no # (cmd. line: -r) rev_dns=no # (cmd. line: -R) children=4 fifo="/tmp/openser_fifo" fifo_mode=0666 # Fifo permissions can be changes from here. # sip_warning - Should replies include extensive warnings? # By default yes, it is good for trouble-shooting. sip_warning=yes # ------------------ module loading ---------------------------------- loadmodule "/usr/local/lib/openser/modules/domain.so" loadmodule "/usr/local/lib/openser/modules/avpops.so" loadmodule "/usr/local/lib/openser/modules/mysql.so" loadmodule "/usr/local/lib/openser/modules/sl.so" loadmodule "/usr/local/lib/openser/modules/tm.so" loadmodule "/usr/local/lib/openser/modules/rr.so" loadmodule "/usr/local/lib/openser/modules/maxfwd.so" loadmodule "/usr/local/lib/openser/modules/usrloc.so" loadmodule "/usr/local/lib/openser/modules/registrar.so" loadmodule "/usr/local/lib/openser/modules/group.so" loadmodule "/usr/local/lib/openser/modules/uri.so" loadmodule "/usr/local/lib/openser/modules/uri_db.so" loadmodule "/usr/local/lib/openser/modules/acc.so" loadmodule "/usr/local/lib/openser/modules/textops.so" loadmodule "/usr/local/lib/openser/modules/xlog.so" # digest authentication loadmodule "/usr/local/lib/openser/modules/auth.so" loadmodule "/usr/local/lib/openser/modules/auth_db.so" # !! Nathelper loadmodule "/usr/local/lib/openser/modules/nathelper.so" # ----------------- setting module-specific parameters --------------- modparam("usrloc", "db_mode", 2) # minimize write back window - default is 60 seconds modparam("usrloc", "timer_interval", 10) # database location modparam("usrloc", "db_url", "mysql://admin:heslo@localhost/openser") modparam("usrloc", "use_domain", 1) modparam("auth_db", "use_domain", 1) modparam("domain", "db_mode", 1) modparam("domain", "domain_table", "domain") modparam("domain", "domain_col", "domain") # ------------- Mysql Accounting parameters modparam("acc", "log_flag", 1) modparam("acc", "log_level", 2) modparam("acc", "db_flag", 1) modparam("acc", "db_missed_flag", 3) modparam("acc", "log_missed_flag", 3) modparam("acc", "db_url", "mysql://admin:heslo@localhost/openser") modparam("acc", "report_ack", 0) modparam("acc", "log_fmt", "miocfsputdr") modparam("tm", "fr_timer", 20 ) modparam("tm", "fr_inv_timer", 40 ) # Timer which hits if no final reply for an INVITE modparam("tm", "wt_timer", 20 ) # add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1) modparam("group", "db_url", "mysql://seradmin:heslo@localhost/openser") modparam("uri_db", "db_url", "mysql://seradmin:heslo@localhost/openser") # ------------- registration parameters modparam("registrar", "nat_flag", 6) modparam("registrar", "min_expires", 60) modparam("registrar", "max_expires", 86400) modparam("registrar", "default_expires", 3600) modparam("registrar", "desc_time_order", 1) modparam("registrar", "append_branches", 1) modparam("registrar", "use_domain", 1) # !! Nathelper # modparam("registrar", "nat_flag", 6) modparam("nathelper", "natping_interval", 30) # Ping interval 30 s modparam("nathelper", "ping_nated_only", 1) # Ping only clients behind NAT # -------------------------- request routing logic -------------------------- route { log(1, "-------------------------------------------\n"); log(1, "entering main loop\n"); # initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); return; }; if ( msg:len >= max_len ) { sl_send_reply("513", "Message too big"); return; }; # set flag for Radius Accounting: if (!method=="OPTIONS") setflag(3); if (method=="INVITE") { log(1, "INVITE MESSAGE RECEIVED - START ACC\n"); setflag(1); /* set for accounting (the same value as in log_flag!) */ }; if (method=="BYE") { log (1, "BYE - STOP ACCOUNTING\n"); setflag(1); }; if (method=="CANCEL") { log (1, "CANCEL - STOP ACCOUNTING\n"); setflag(1); }; if (method=="ACK") log(1, "ACK message received\n"); if (method=="SUBSCRIBE") log(1, "SUBSCRIBE message received\n"); if (method=="NOTIFY") log(1, "NOTIFY message received\n"); if (method=="OPTIONS") log(1, "OPTIONS MESSAGE RECEIVED\n"); if (method=="INFO") log(1, "INFO message received\n"); if (method=="MESSAGE") log(1, "MESSAGE message received\n"); if (method=="REFER") log(1, "REFER message received\n"); # ----------------------------------------------------------------- # Record Route Section # ----------------------------------------------------------------- # record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if (!method=="REGISTER") record_route(); if (method=="BYE" || method=="CANCEL") { unforce_rtp_proxy(); }; # ----------------------------------------------------------------- # Loose Route Section # ----------------------------------------------------------------- if (loose_route() && (!src_ip==10.0.2.130 && !src_port==5070)) { if (has_totag() && (method=="INVITE" || method=="ACK")) { if (nat_uac_test("19")) { setflag(7); force_rport(); fix_nated_contact(); }; force_rtp_proxy("l"); }; route(2); return; }; # ----------------------------------------------------------------- # Call Type Processing Section # ----------------------------------------------------------------- if (!uri==myself && (!src_ip==10.0.2.130 && !src_port==5070)) { route(1); return; }; if (method=="CANCEL") { route(2); return; }; if (method == "REGISTER") { if (!search("^Contact:[ ]*\*") && nat_uac_test("19")) { setflag(6); fix_nated_register(); force_rport(); }; sl_send_reply("100", "Trying"); log(1, "ANALYZING REGISTER REQUEST\n"); # ... to use digest authentication if (is_user_in("Request-URI", "desactivado")) { sl_send_reply("402", "Su cuenta fue desactivada por falta de pago"); return; }; if (!www_authorize("", "subscriber")) { log(1," ----- Fails to Register \n"); www_challenge("", "0"); return; }; # only signed users are allowed if (!check_to()) { log(1, "LOG: Hijack!!!--> unsigned user registration attempt\n"); sl_send_reply("403", "hijack attempt!!!! Only signed users are allowed"); return; }; consume_credentials(); log(1," Registered!!! \n"); if (!save("location")) { sl_reply_error(); }; return; }; # INVITE ? First check the source of the call #******************************************** # If the call comes from the gateways, no authentication is required. if (method == "INVITE" && (src_ip==10.0.2.145 || src_ip==10.0.2.132|| src_ip== 10.0.2.131)) { log(1,"Call from pstn|*, no authentication is required. \n"); # If the call comes from B2BUA, no authentication is required. # The first leg of the call has already been authenticated. } else if (src_ip==10.0.2.130 && src_port==5070) { log(1,"Call from B2BUA, no authentication is required. \n"); } else { log(1, "ANALYZING INVITE REQUESTs\n"); if (method == "INVITE" && !src_ip==10.0.2.130 && !src_port==5070){ if (!proxy_authorize("", "subscriber")) { proxy_challenge("", "0"); return; } else { if (!check_from()) { sl_send_reply("403", "Only registered users are allowed"); log(1," ----> Only registered users are allowed \n"); return; }; consume_credentials(); if (nat_uac_test("19")) { setflag(7); }; }; # Not all the users are PREPAID, so we check the database # to see if the call will be routed through B2BUA. # If every call is to be routed through B2BUA the "is_user_in" # conditional is not required. # Do not use b2bua for local calls (660++++) if (is_user_in("From", "prepaidb") && uri=~"^sip:00") { log(1," ----> Usuario PREPAGO!!! enviando a b2bua... \n"); rewritehostport("10.0.2.130:5070"); t_relay_to_udp("10.0.2.130", "5070"); return; }; }; }; # End of if (method == "INVITE" |... /* *********** Dial out to Local and PSTN logic ********* */ if(uri=~"^sip:001"){ log(1,"00N match - Larga Distancia Internacional a USA \n"); if (!is_user_in("from", "ldiusa")) { log(1,"No permission for international calls to USA \n"); sl_send_reply("403", "No permission for international calls to USA"); acc_db_request("403 Forbidden", "missed_calls"); return; }; rewritehostport("10.0.2.131:5070"); strip(2); route(1); return; }; if(uri=~"^sip:00"){ log(1,"00N match - Larga Distancia Internacional \n"); if (!is_user_in("from", "ldix")) { log(1,"No permission for international calls \n"); sl_send_reply("403", "No permission for international calls"); acc_db_request("403 Forbidden", "missed_calls"); return; }; rewritehostport("10.0.2.131:5070"); strip(2); route(1); return; }; /* ******************************************************************** */ lookup("aliases"); if (uri!=myself) { route(1); return; }; # does the user wish redirection on no availability? (i.e., is he # in the voicemail group?) -- determine it now and store it in # flag 4, before we rewrite the flag using UsrLoc if (is_user_in("Request-URI", "voicemail")) { log(1, "requested user is in voicemail group \n"); setflag(4); }; # native SIP destinations are handled using our USRLOC DB if (!lookup("location")) { log(1,"unable to locate user X ... sending to route(4)! \n"); # handle user which was not found route(4); return; }; ### if UAS are behind the same NAT system: ### if (isflagset(6) && isflagset(7)){ log(2, "Both Clients are behind NAT"); # Store the destination domain into an AVP avp_printf("i:450", "$dd"); if (avp_check("i:450", "eq/$src_ip/g")){ log(3, "Detected Two Clients Behind the Same NAT - Disabling Mediaproxy"); # Do not use media-proxy as the clients seem to be behind the same NAT resetflag(6); resetflag(7); route(2); return; }; }; route(1); # if user is on-line and is in Voicemail group, enable redirection if (method == "INVITE" && isflagset(4)) { log(1, "invite for voicemail user->initiate failureroute[1]\n"); t_on_failure("1"); }; } ### ##### ####### ########## ########### ############### ################# ##################### route[1] { # if client or server know to be behind a NAT, enable relay if (isflagset(6) || isflagset(7)) { force_rport(); fix_nated_contact(); force_rtp_proxy(); }; # NAT processing of replies; apply to all transactions (for example, # re-INVITEs from public to private UA are hard to identify as # NATed at the moment of request processing); look at replies t_on_reply("1"); # send it out now; use stateful forwarding as it works reliably # even for UDP2TCP if (!t_relay()) { if (method=="INVITE" && (isflagset(6) || isflagset(7))) { unforce_rtp_proxy(); }; sl_reply_error(); }; log(1, "Route[1]: Send it out now!!!\n"); } # !! Nathelper onreply_route[1] { # NATed transaction ? # Not all 2xx messages have a content body so here we # make sure our Content-Length > 0 to avoid a parse error if ((isflagset(6) || isflagset(7)) && status =~ "(183)|2[0-9][0-9]") { fix_nated_contact(); if (!search("^Content-Length:\ 0")) { force_rtp_proxy(); log(1, "onreply_route1: force rtp proxy!!!\n"); }; # otherwise, is it a transaction behind a NAT and we did not # know at time of request processing ? (RFC1918 contacts) } else if (nat_uac_test("1")) { fix_nated_contact(); }; } # -------------- Default Message Handler --------------------- route[2]{ # ---------------------------------------------------- # Default Message Handler # ---------------------------------------------------- t_on_reply("1"); if (!t_relay()) { if (method=="INVITE" && isflagset(7)) { unforce_rtp_proxy(); }; sl_reply_error(); }; } # --------------- Handling of Unavailable user ---------------- route[4] { # non-Voip -- just send "off-line" if (!(method=="INVITE" || method=="ACK" || method=="CANCEL" || method=="BYE" || method=="OPTIONS")) { sl_send_reply("404", "Not Found"); acc_db_request("404 Not Found", "missed_calls"); log(1, "acc 404 Not Found 1 \n"); return; }; # not voicemail subscriber if (!isflagset(4) && !method=="OPTIONS" && !method=="ACK" && !method=="BYE") { sl_send_reply("404", "Not Found and no voicemail turned on !! "); acc_db_request("404 Not Found", "missed_calls"); log(1, " acc 404 Not Found and no voicemail \n"); return; }; # forward to voicemail adding prefix to simplify asterisk " extension.conf" :: # exten => _vmXXXXXXX,1,SetLanguage(es) # exten => _vmXXXXXXX,2,Voicemail(u${EXTEN:2}) # exten => _vmXXXXXXX,3,Hangup prefix("vm"); acc_db_request("404 Not Found -> Vm", "missed_calls"); rewritehostport("10.0.2.131:5070"); t_relay_to_udp("10.0.2.131", "5070"); } # If forwarding downstream did not succeed, try voicemail running at Asterisk failure_route[1]{ if (t_check_status("408")){ # revert_uri (); back to the original URI, makes me loose all lookup/rewrite stuff prefix("vm"); rewritehostport ("10.0.2.131:5070"); acc_db_request("408 Timeout -> Vm", "missed_calls"); append_branch(); t_relay(); return; } else if (t_check_status("486")){ # revert_uri (); back to the original URI, makes me loose all lookup/rewrite stuff prefix("vm"); rewritehostport ("10.0.2.131:5070"); acc_db_request("486 Busy -> Vm", "missed_calls"); append_branch(); t_relay(); return; } }

1 0

[Users] multiple aliases
by Mike Williams 28 Dec '05

28 Dec '05

Is it possible to use aliases to route to multiple sip uri's?I would like to have one user resolve to say, three different users from the database. Also, I assume I can alias a local sip address to a user in another domain / at another server? I want to have a virtual number that rings three seperate phones when called, regardless of whether they are sip or pstn. Ideally, I would be able to do this with aliases. Thanks for any help. Mike Williams

2 1

[Users] openser with radius problem
by Jayesh Nambiar 28 Dec '05

28 Dec '05

hi all, I tried compiling openser with radius support. everything was fine. I did it according to radius howto mentioned in the iptel.org. The test for authentication was also ok. but when i try to start the openserctl, I get the following error in log: load_module: could not open module </usr/local/lib/openser/modules/acc.so>: libradiusclient-ng.so.2: cannot open shared object file: No such file or directory I googled old mailing list and found out that the LD_LIBRARY_PATH needs to be set. But i have no idea how and where to set this. can somebody pls help me understand this problem. thanx in advance jayesh Send instant messages to your online friends http://in.messenger.yahoo.com

2 1

[Users] caller display
by unplug 28 Dec '05

28 Dec '05

I am using an alias mapped to an account. I want the alias to show in the caller display instead of the real account. Is it possible to configure openser for that purpose, how?

2 2

Re: [Serusers] Distributing "OSP enable SER" binary file w/ source code
by vmathur＠transnexus.com 27 Dec '05

27 Dec '05

Hernan, OSP uses Public key based authentication and encrytion schemes, which are stronger than Radius's shared secrets. If you use OSP for authentication and authorization, you need not use Radius. OSP, just like Radius, has a client stack, which is implemented in the SER, and has a Server, which provides centralized call routing, accounting, and security. At the time of startup, the OSP server and the client, the SER in this case, exchange their public keys. The public and private keys can then be used to encode/decode messages as desired. A typical call setup procedure looks like this 1. The source SER goes to the osp server to get the SIP URI corresopnding to the destination. The message is encoded using the source SER's private key. 2. The osp server decodes the message using source SERs public key and after successful decoding (authentication) returns the route back to the source. Along with the route, it also sends back a digitally signed (using the OSP Servers private key) token. 3. The Source uses the route returned by the OSP Srver to send an INVITE. The INVITE message contains the token issued by the OSP Server 4. The destination decodes/validates the token using the OSP Servers public key. Upon successful validation (authorization) it accepts the call. This saves you the effort of mantaining cumbersome access lists for authentication. I can provide you with more documentatin on OSP and how to use SER with OSP if you wish Thanks, Vikrant ------------------------------------------------------------------------------------------------------------- Fogive my ignorance for I have never heard of OSP before ;) You mentioned Radius in your message. How does Radius authentication work in OSP? I am having a tough time getting mine to work. hernan vmathur(a)transnexus.com wrote: Dear All, I have recently implemented OSP w/ SER. OSP is an ETSI defined protocol, which I am using for ceneralised routing, and security of my inter-domain calls. The problem, however, is that the build process is a little lengthy. I want to contribute my implementation to this group so that anyone who is struggling with SER routing configurations or Radius authentication issues may benefit from it. I was, thus, wondering if we can have a binary file of the OSP enabled SER, that can be distributed with the source code. Does anyone have an opinion on this? Also, for anyone who wants to check-out this implementation, I can provide more details. Thanks, Vikrant _______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers

4 3

[Users] UAC
by Kapil Dhawan 26 Dec '05

26 Dec '05

Hi List I am using Cisco 2600 to send calls to OpenSER but 2600 is not sending the username in from field, so i used UAC module. Issues. 1. I need to make changes in openser.cfg and restart service, do we have any other alternative. 2. My calls are getting disconnected after a random time interval say couple of minutes. KD _________________________________________________________________ One and only Ash. Find out all about her. Only on MSN Search http://server1.msn.co.in/profile/aishwarya.asp

2 1