- sr-users - kamailio.org

[Serusers] Session-Expires Header
by Java Rockx 24 Mar '05

24 Mar '05

Hi All. If I include a session-expires header using append_hf(), do I have to do anything else to my ser.cfg script? Also, will this cause re-INVITEs to happen or is there something else needed? Regards, Paul

7 17

[Serusers] override fr_inv_timer
by Aaron Walsh 23 Mar '05

23 Mar '05

It is possible to override the fr_inv_timer setting at the time of doing the t_relay()? For example, I want to try the first umber for 15 seconds, if that fails, I go into a failure route, and do append_branch() and t_relay() but this time I want to try it for 30 seconds before failure. Is that possible? Thanks, Aaron This message has been scanned for viruses by MailControl - www.mailcontrol.com

2 1

Re: [Serusers] Authenticating INVITE requests method
by info＠beeplove.com 23 Mar '05

23 Mar '05

Isn't it the regular practice to use proxy_challenge and proxy_authorize for non REGISER methods. Mohammad Original Message: ----------------- From: Marian Dumitru marian.dumitru(a)voice-sistem.ro Date: Wed, 23 Mar 2005 21:59:27 +0100 To: rrisco(a)millicom.net.pe, serusers(a)iptel.org Subject: Re: [Serusers] Authenticating INVITE requests method Hi Rafael, replace if (method=="INVITE") { with if (method=="INVITE" && src_ip!=xxx.xxx.xxx.xxx) { where that many xxx-s is the GW's IP. Best regards, Marian Rafael J. Risco G.V. wrote: > Hello > I am doing some security improvements to my configuration because I´ve > realized that everyone can sends calls to PSTN gateways and other > registered users even if the caller fails to register in SER, so now I > instruct SER to check the username and password of the CALLER in every > INVITE request like that: > > if (method=="INVITE") { > if (!www_authorize("mydomain", "subscriber")) { > www_challenge("mydomain", "0"); > break; > }; > }; > > > well it works but not when calls are generated in my gateway Cisco > AS5350 (these GWs dont have register comand) so I need some advice to > "exclude" gateway IP for this authorization process. > > thanks > Rafael > > -- Voice System http://www.voice-system.ro _______________________________________________ Serusers mailing list Serusers(a)iptel.org http://mail.iptel.org/mailman/listinfo/serusers -------------------------------------------------------------------- mail2web - Check your email from the web at http://mail2web.com/ .

3 2

[Serusers] Authenticating INVITE requests method
by Rafael J. Risco G.V. 23 Mar '05

23 Mar '05

Hello I am doing some security improvements to my configuration because I´ve realized that everyone can sends calls to PSTN gateways and other registered users even if the caller fails to register in SER, so now I instruct SER to check the username and password of the CALLER in every INVITE request like that: if (method=="INVITE") { if (!www_authorize("mydomain", "subscriber")) { www_challenge("mydomain", "0"); break; }; }; well it works but not when calls are generated in my gateway Cisco AS5350 (these GWs dont have register comand) so I need some advice to "exclude" gateway IP for this authorization process. thanks Rafael -- rrgv

2 1

[Serusers] Calling a break within a secondary routing block
by reticent 23 Mar '05

23 Mar '05

Calling "break;" within a secondary routing block ie -- route[1] { break; } -- will exit the current routing block (route[1]) dumping you back into the primary routing block Aside from setting some flag and checking for it when the secondary routing block returns to the primary route[0], is there a way to break from the whole script (the same effect a break in route[0] would have)?

2 1

[Serusers] [HEADS UP] Multiple media streams (i.e. Video + audio) support is now available in rtpproxy/nathelper
by Maxim Sobolev 23 Mar '05

23 Mar '05

Folks, I've just committed support for handling multiple media streams within single SIP session (i.e. video + audio) into rtpproxy/nathelper. To use it you have to get the latest version of both from CVS. Please let me know if there are any problems after those changes. Thanks! Regards, Maxim

1 0

[Serusers] simple rating process
by Iqbal 23 Mar '05

23 Mar '05

Hi I've looked at the serweb application for calculating time for each call, assuming INVITE/BYE matching, has anyone based on the details in the acc table worked on a simple rating script, which I could beg/steal/borrow :-) The problem I have is on-peak/off-peak , since I know when the call starts hence know which of the blocks (i.e on/off peak) it falls into, but I am getting confused as to howto calculate it. EG peak 1300 to 1500 , and call starts 14:45:00 and last for 16 mins hence finishes 16:01 hence 15 mins is peak and 1 minute is off peak, I just cant work out how to write the algo for this, so if someone has some pseudo code (or even real) that would be great. I have rating tables based on prefix all created, with the on-peak/off -peak entries, and the call time , as I have mentioned, can be pulled using the serweb logic... tks Iqbal

1 0

[Serusers] [Fwd: Troubles calling from a Nated UA to a PSTN gateway on a Public address space using SER 0.9.1 and Mediaproxy Release 1.2.1]
by Alberto Cruz 23 Mar '05

23 Mar '05

Hi Marian Maybe you can give me a tip about this problem. I've been reading the tm module documentation to try to find if it is because I'm doing something wrong at routing but I'm really confused. I haven't found nothing at the INSTALL and README documentation from mediaproxy either. I have analyzed the problem and I'm watching that from some reason when the UA send the CANCEL signal to the SER, the SER is not sending the CANCEL to the PSTN gateway like if the transaction was losing the location or the call id. I don't know if this is because something with the rewritehost function. Thanks in advance. Alberto Cruz -------- Original Message -------- Subject: Troubles calling from a Nated UA to a PSTN gateway on a Public address space using SER 0.9.1 and Mediaproxy Release 1.2.1 Date: Tue, 22 Mar 2005 13:02:25 -0600 From: Alberto Cruz <acruz(a)tekbrain.com> To: serusers(a)lists.iptel.org Hi everybody I having a weird behavior with Mediaproxy I'm using SER 0.9.1 and Mediaproxy Release 1.2.1 The Gateway is a Cisco AS5300 using release 12.2(15)T I have a UA using behind a NAT, the PSTN gateway and the SER server both are using public IP addresses. The behaviors are the following: 1. When I tried to place a call from a NATed UA to the PSTN gateway I'm not receiving the call progress tone or ring back tone at the NATed UA. 2. If I decide to wait until the call is completed (doesn't matter if a heard death air as progress tone) I start hearing the calling party as soon the call is completed and we can talk each other without any troubles. 3. If I cancel the call and hang up the phone at the NATed UA before the call is completed (during the call progress stage) the SER/Mediaproxy don't cancel the call it still in progress until it is completed or cancelled by the PSTN. I'm attaching my ser configuration and the logging I'm getting when I cancel the call before it's completed. Please Help me to know how to fix this If I'm making some mistake with mediaproxy or routing configuration at the ser configuration. Thanks in advanced. Regards Alberto Cruz Mar 20 00:10:02 matrix proxydispatcher[1379]: command request call-80BF3413-4297-D911-0217-21(a)172.31.254.240 172.31.254.240:10286:audio 200.67.33.247 172.31.254.240 remote 65.208.39.219 remote Quintum/1.0.0 info=from:8412@172.31.254.240,to:018183324166@65.208.39.215,fromtag:ac1ffef0-20,totag: Mar 20 00:10:02 matrix proxydispatcher[1379]: will use default mediaproxy for this call. Mar 20 00:10:02 matrix mediaproxy[1376]: command request call-80BF3413-4297-D911-0217-21(a)172.31.254.240 172.31.254.240:10286:audio 200.67.33.247 172.31.254.240 remote 65.208.39.219 remote Quintum/1.0.0 info=from:8412@172.31.254.240,to:018183324166@65.208.39.215,fromtag:ac1ffef0-20,totag:,dispatcher Mar 20 00:10:02 matrix mediaproxy[1376]: session call-80BF3413-4297-D911-0217-21(a)172.31.254.240: started. listening on 65.208.39.215:35150 Mar 20 00:10:02 matrix mediaproxy[1376]: command execution time: 9.23 ms Mar 20 00:10:02 matrix proxydispatcher[1379]: forwarding to mediaproxy on /var/run/mediaproxy.sock: got: '65.208.39.215 35150' Mar 20 00:10:02 matrix proxydispatcher[1379]: command execution time: 13.13 ms Mar 20 00:10:06 matrix proxydispatcher[1379]: command lookup call-80BF3413-4297-D911-0217-21(a)172.31.254.240 65.208.39.219:18342:audio 65.208.39.219 172.31.254.240 remote 65.208.39.215 unknown Cisco-SIPGateway/IOS-12.x info=from:8412@172.31.254.240,to:018183324166@65.208.39.215,fromtag:ac1ffef0-20,totag:711504-73 Mar 20 00:10:06 matrix mediaproxy[1376]: command lookup call-80BF3413-4297-D911-0217-21(a)172.31.254.240 65.208.39.219:18342:audio 65.208.39.219 172.31.254.240 remote 65.208.39.215 unknown Cisco-SIPGateway/IOS-12.x info=from:8412@172.31.254.240,to:018183324166@65.208.39.215,fromtag:ac1ffef0-20,totag:711504-73,dispatcher Mar 20 00:10:06 matrix mediaproxy[1376]: command execution time: 1.63 ms Mar 20 00:10:06 matrix proxydispatcher[1379]: forwarding to mediaproxy on /var/run/mediaproxy.sock: got: '65.208.39.215 35150' Mar 20 00:10:06 matrix proxydispatcher[1379]: command execution time: 4.88 ms Mar 20 00:10:06 matrix mediaproxy[1376]: session call-80BF3413-4297-D911-0217-21(a)172.31.254.240: caller signed in from 200.67.33.247:49125 (RTP) (will return to 200.67.33.247:49125) Mar 20 00:10:06 matrix mediaproxy[1376]: session call-80BF3413-4297-D911-0217-21(a)172.31.254.240: called signed in from 65.208.39.219:18342 (RTP) (will return to 65.208.39.219:18342) Mar 20 00:10:08 matrix mediaproxy[1376]: session call-80BF3413-4297-D911-0217-21(a)172.31.254.240: caller signed in from 200.67.33.247:49126 (RTCP) (will return to 200.67.33.247:49126) Mar 20 00:10:11 matrix mediaproxy[1376]: session call-80BF3413-4297-D911-0217-21(a)172.31.254.240: called signed in from 65.208.39.219:18343 (RTCP) (will return to 65.208.39.219:18343) Mar 20 00:10:13 matrix proxydispatcher[1379]: command delete call-80BF3413-4297-D911-0217-21(a)172.31.254.240 info= Mar 20 00:10:13 matrix mediaproxy[1376]: command delete call-80BF3413-4297-D911-0217-21(a)172.31.254.240 info=dispatcher Mar 20 00:10:13 matrix mediaproxy[1376]: session call-80BF3413-4297-D911-0217-21(a)172.31.254.240: 29/44/73 packets, 1380/5320/6700 bytes (caller/called/relayed) Mar 20 00:10:13 matrix mediaproxy[1376]: session call-80BF3413-4297-D911-0217-21(a)172.31.254.240: ended. Mar 20 00:10:13 matrix mediaproxy[1376]: command execution time: 1.43 ms Mar 20 00:10:13 matrix proxydispatcher[1379]: forwarding to mediaproxy on /var/run/mediaproxy.sock: got: '' Mar 20 00:10:13 matrix proxydispatcher[1379]: command execution time: 4.29 ms Mar 20 00:10:45 matrix proxydispatcher[1379]: command lookup call-80BF3413-4297-D911-0217-21(a)172.31.254.240 65.208.39.219:18342:audio 65.208.39.219 172.31.254.240 remote 65.208.39.215 unknown Cisco-SIPGateway/IOS-12.x info=from:8412@172.31.254.240,to:018183324166@65.208.39.215,fromtag:ac1ffef0-20,totag:711504-73 Mar 20 00:10:45 matrix proxydispatcher[1379]: warning: trying to lookup session with non-existent id: 'call-80BF3413-4297-D911-0217-21(a)172.31.254.240' Mar 20 00:10:45 matrix proxydispatcher[1379]: command execution time: 0.91 ms Mar 20 00:10:45 matrix /usr/local/sbin/ser[11723]: error: use_media_proxy(): empty response from mediaproxy Mar 20 00:10:45 matrix /usr/local/sbin/ser[11723]: ERROR: on_reply processing failed Mar 20 00:10:46 matrix proxydispatcher[1379]: command lookup call-80BF3413-4297-D911-0217-21(a)172.31.254.240 65.208.39.219:18342:audio 65.208.39.219 172.31.254.240 remote 65.208.39.215 unknown Cisco-SIPGateway/IOS-12.x info=from:8412@172.31.254.240,to:018183324166@65.208.39.215,fromtag:ac1ffef0-20,totag:711504-73 Mar 20 00:10:46 matrix proxydispatcher[1379]: warning: trying to lookup session with non-existent id: 'call-80BF3413-4297-D911-0217-21(a)172.31.254.240' Mar 20 00:10:46 matrix proxydispatcher[1379]: command execution time: 1.08 ms Mar 20 00:10:46 matrix /usr/local/sbin/ser[11725]: error: use_media_proxy(): empty response from mediaproxy Mar 20 00:10:46 matrix /usr/local/sbin/ser[11725]: ERROR: on_reply processing failed Mar 20 00:10:47 matrix proxydispatcher[1379]: command lookup call-80BF3413-4297-D911-0217-21(a)172.31.254.240 65.208.39.219:18342:audio 65.208.39.219 172.31.254.240 remote 65.208.39.215 unknown Cisco-SIPGateway/IOS-12.x info=from:8412@172.31.254.240,to:018183324166@65.208.39.215,fromtag:ac1ffef0-20,totag:711504-73 Mar 20 00:10:47 matrix proxydispatcher[1379]: warning: trying to lookup session with non-existent id: 'call-80BF3413-4297-D911-0217-21(a)172.31.254.240' Mar 20 00:10:47 matrix proxydispatcher[1379]: command execution time: 1.09 ms Mar 20 00:10:47 matrix /usr/local/sbin/ser[11723]: error: use_media_proxy(): empty response from mediaproxy Mar 20 00:10:47 matrix /usr/local/sbin/ser[11723]: ERROR: on_reply processing failed # # $Id: ser.cfg,v 1.25.2.1 2005/02/18 14:30:44 andrei Exp $ # # # # ----------- global configuration parameters ------------------------ debug=3 # debug level (cmd line: -dddddddddd) fork=yes log_stderror=no # (cmd line: -E) /* Uncomment these lines to enter debugging mode fork=no log_stderror=yes */ check_via=no # (cmd. line: -v) dns=no # (cmd. line: -r) rev_dns=no # (cmd. line: -R) listen=65.208.39.215 port=5060 alias=65.208.39.215 alias=sip.telereunion.com.mx children=4 fifo_mode=0666 fifo="/tmp/ser_fifo" fifo_db_url="mysql://ser:heslo@localhost/ser" # ------------------ module loading ---------------------------------- # Uncomment this if you want to use SQL database loadmodule "/usr/local/lib/ser/modules/mysql.so" loadmodule "/usr/local/lib/ser/modules/sl.so" loadmodule "/usr/local/lib/ser/modules/tm.so" loadmodule "/usr/local/lib/ser/modules/rr.so" loadmodule "/usr/local/lib/ser/modules/maxfwd.so" loadmodule "/usr/local/lib/ser/modules/usrloc.so" loadmodule "/usr/local/lib/ser/modules/uri.so" loadmodule "/usr/local/lib/ser/modules/uri_db.so" loadmodule "/usr/local/lib/ser/modules/group.so" loadmodule "/usr/local/lib/ser/modules/registrar.so" loadmodule "/usr/local/lib/ser/modules/textops.so" loadmodule "/usr/local/lib/ser/modules/domain.so" loadmodule "/usr/local/lib/ser/modules/mediaproxy.so" # Uncomment this if you want digest authentication # mysql.so must be loaded ! loadmodule "/usr/local/lib/ser/modules/auth.so" loadmodule "/usr/local/lib/ser/modules/auth_db.so" # ----------------- setting module-specific parameters --------------- # -- usrloc params -- #modparam("usrloc", "db_mode", 0) # Uncomment this if you want to use SQL database # for persistent storage and comment the previous line modparam("usrloc", "db_mode", 2) modparam("domain", "db_mode", 1) modparam("auth_db|usrloc|domain|group", "db_url", "mysql://ser:heslo@localhost/ser") modparam("group", "use_domain", 0) # -- auth params -- # Uncomment if you are using auth module # modparam("auth_db", "calculate_ha1", yes) # # If you set "calculate_ha1" parameter to yes (which true in this config), # uncomment also the following parameter) # modparam("auth_db", "password_column", "password") # -- rr params -- # add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1) modparam("mediaproxy", "natping_interval", 60) modparam("registrar", "nat_flag", 2) # ------------------------- request routing logic ------------------- # main routing logic route{ # initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { if (method!="ACK") { sl_send_reply("483","Too Many Hops"); }; break; }; if (msg:len >= 2048 ) { if (method!="ACK") { sl_send_reply("513", "Message too big"); }; break; }; # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if (!method=="REGISTER") record_route(); if (method=="REGISTER") { if (uri==myself || is_from_local()) { # Mark as NAT'ed if (client_nat_test("3")) { setflag(2); force_rport(); fix_contact(); }; if (!www_authorize("", "subscriber")) { www_challenge("", "0"); break; } else if (!check_to()) { sl_send_reply("403", "Username!=To not allowed"); break; }; if (!save("location")) { sl_reply_error(); }; } else { append_hf("P-hint: outbound alias\r\n"); sl_send_reply("403", "This domain is not served here"); }; break; }; if (method=="INVITE") { if (!(is_from_local() || uri==myself || is_uri_host_local())) { sl_send_reply("403", "Relaying is forbidden"); break; }; t_on_failure("1"); } else if (method == "BYE" || method == "CANCEL") { end_media_session(); }; # subsequent messages withing a dialog should take the # path determined by record-routing if (loose_route()) { append_hf("P-hint: rr-enforced\r\n"); # The following lines are added due media proxy if (method=="INVITE" || method=="ACK") { use_media_proxy(); }; # end media session for BYE and CANCEL is done above # before entering the loose route. no need to call it here t_relay(); break; }; if (client_nat_test("3") && !search("^Record-Route:")) { # Mark as NAT'ed force_rport(); fix_contact(); }; ### Begin PSTN evaluation if (method=="INVITE") { if (uri=~"sip:01[1-9][0-9]+@.*") { if (!is_user_in("From", "ld")) { sl_send_reply("403", "LD permissions needed"); break; }; rewritehostport("65.208.39.219:5060"); } else if (uri=~"sip:00[1-9][0-9]+@.*") { if (!is_user_in("From", "int")) { sl_send_reply("403", "International permissions needed"); break; }; rewritehost("65.208.39.219"); }; t_on_reply("1"); }; ### End PSTN evaluation if (is_uri_host_local() || uri==myself) { # join with next if? # native SIP destinations are handled using our USRLOC DB if (!lookup("location")) { sl_send_reply("404", "User not found"); break; }; }; if (method=="INVITE" || method=="ACK") { use_media_proxy(); }; if (!uri==myself) { # mark routing logic in request append_hf("P-hint: outbound\r\n"); }; # forward to current uri now; use stateful forwarding; that # works reliably even if we forward from TCP to UDP if (!t_relay()) { if (method=="INVITE" || method=="ACK") { end_media_session(); }; sl_reply_error(); }; } failure_route[1] { end_media_session(); } onreply_route[1] { if (status=~"(180)|(183)|(2[0-9][0-9])") { if (client_nat_test("1")) { fix_contact(); }; use_media_proxy(); }; }

2 2

[Serusers] LCR outbound and inbound
by Matt Schulte 23 Mar '05

23 Mar '05

All, I was thinking of using LCR outbound and inbound for a couple reasons. Inbound for the sake of some simple redundancy (and load balancing) and outbound for the sake of LCR (cheapest provider). The problem I'm facing is LCR feeds off of one table, while outbound is rather trivial I was wondering how I would work with inbound. I'm assuming I could put 10 digit equivelent users phone number in the LCR table. However, if it did *not* exist in the table it would potentially send it right back out the to the PSTN which could cause a really nasty loop. Has anyone done this? I have a couple thoughts on how to get around this but they all seem too complex and/or hardcoded. I'm trying to avoid external scripts also, if possible. We've had bad luck with those :-)... Matt

1 0

[Serusers] HELP PLZ: Confuse between mediaproxy and STUN
by Charles Wang 23 Mar '05

23 Mar '05

Hi, ALL: I can't not make sure my view point between STUN and mediaproxy. Please explain for me. In my view, if NATed UACs want to make a call, the solutions shall be nathelper, mediaproxy or building a STUN server. If NATed UACs set their own STUN server's IP correctly, and they want to talk with each other will be in a "direct" (RTP will not pass through SER) mode, is it correct? And the STUN server will tell our UACs what's their NAT gateway's IP(behind what kind of network environment , and UACs will send these informations to SER? In another word, it is not necessary to use media proxy to pass their RTP channel? If it is correctly, so we will not to set any mediaproxy daemon for them, is it correct? If it is not, can anyone tell me why it is not? If ignore the STUN issue, I use the mediaproxy's ser.cfg as my template ser.cfg. But I find all UACs's RTP packages will pass through my SER wether behind NAT or not( read IPs ). How can I modify my ser.cfg and make a call directly without pass through SER if two UACs are all real IPs? ----------------- subset of my ser.cfg ------------------------- # ----------- global configuration parameters ------------------------ (skip something........) # -- mediaproxy params -- modparam("mediaproxy", "natping_interval", 30) modparam("mediaproxy", "sip_asymmetrics", "/usr/local/etc/ser/sip-asymmetric-clients") modparam("mediaproxy", "rtp_asymmetrics", "/usr/local/etc/ser/rtp-asymmetric-clients") # -- usrloc params -- modparam("usrloc", "db_mode", 1) modparam("usrloc", "timer_interval", 60) modparam("usrloc", "desc_time_order", 1) # -- registration params -- modparam("registrar", "nat_flag", 2) modparam("registrar", "min_expires", 60) modparam("registrar", "max_expires", 86400) modparam("registrar", "default_expires", 3600) modparam("registrar", "append_branches", 1) # ------------------------- request routing logic ------------------- # main routing logic route { (skip something........) # ------------------------------------------------------------------------ # NAT Test Section #1 # ------------------------------------------------------------------------ if (method=="REGISTER" && client_nat_test("3")) { fix_contact(); force_rport(); setflag(2); }; # ------------------------------------------------------------------------ # Registration Section # ------------------------------------------------------------------------ if (method=="REGISTER") { # allow all requests from user 700 - the Click2Dial controller if (!isflagset(14)) { if (!is_from_local()) { sl_send_reply("403", "Unknown Domain"); break; }; if (!www_authorize("", "subscriber")) { www_challenge("", "0"); break; }; if (!check_to()) { sl_send_reply("401", "Unauthorized"); break; }; # To - Use To username and (optionally) domain to check if (is_user_in("To", "demo-disabled")) { sl_send_reply("403", "Your evaluation period has expired"); break; }; # To - Use To username and (optionally) domain to check if (is_user_in("To", "disabled")) { sl_send_reply("403", "Your account has been disabled"); break; }; }; # snom sip phones use this header to start their # keep-alive mechanism for NAT bindings append_to_reply("P-NAT-Refresh: 15\r\n"); if (!save("location")) { sl_reply_error(); }; break; }; (skip something........) # ------------------------------------------------------------------------ # NAT Tear-Down Section # ------------------------------------------------------------------------ if ((method == "BYE" || method == "CANCEL")) { end_media_session(); }; # ------------------------------------------------------------------------ # Record Route Section # ------------------------------------------------------------------------ if (!method=="REGISTER") { record_route(); }; # ------------------------------------------------------------------------ # Loose Route Section # ------------------------------------------------------------------------ if (loose_route()) { route(2); break; }; # ------------------------------------------------------------------------ # NAT Test Section #1 # ------------------------------------------------------------------------ if (client_nat_test("3") && !search("^Record-Route:")) { force_rport(); fix_contact(); }; # ------------------------------------------------------------------------ # Alias Routing Section # ------------------------------------------------------------------------ lookup("aliases"); if (!uri==myself) { route(2); break; }; (skip something........) route[1] { (skip something........) } route[2] { log(1, "SER: SIP Call On-Net section route(2)\n"); if ((method=="INVITE") && !allow_trusted()) { if (!proxy_authorize("", "subscriber")) { proxy_challenge("", "0"); break; } else if (!check_from()) { log(1, "Spoofed SIP call attempt"); sl_send_reply("403", "Use From=ID"); break; } else if (!(is_from_local() || is_uri_host_local())) { sl_send_reply("403", "Please register to use our service"); break; }; }; if (uri=~"[@:](192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)" && !search("^Route:")){ sl_send_reply("479", "We don't forward to private IP addresses"); break; }; if (method=="INVITE" || method=="ACK") { use_media_proxy(); }; t_on_failure("1"); t_on_reply("1"); if (!t_relay()) { if (method=="INVITE" || method=="ACK") { end_media_session(); }; sl_reply_error(); }; } onreply_route[1] { # Not all 2xx messages have a content body so here we # make sure our Content-Length > 0 to avoid a parse error if (status=~"(180)|(183)|2[0-9][0-9]") { if (!search("^Content-Length:\ 0")) { use_media_proxy(); }; }; if (client_nat_test("1")) { fix_contact(); }; } ---------------- END HERE --------------------------------------- ---------------- default mediaproxy's ser.cfg ---------------- # Example ser.cfg for mediaproxy functionality loadmodule "/usr/lib/ser/modules/registrar.so" loadmodule "/usr/lib/ser/modules/domain.so" loadmodule "/usr/lib/ser/modules/mediaproxy.so" modparam("mediaproxy", "natping_interval", 60) modparam("registrar", "nat_flag", 2) route{ if (!mf_process_maxfwd_header("10")) { if (method!="ACK") { sl_send_reply("483", "Too many hops"); }; break; }; if (msg:len >= max_len) { if (method!="ACK") { sl_send_reply("513", "Message too big"); }; break; }; if (method=="REGISTER") { if (is_from_local()) { # Mark as NAT'ed if (client_nat_test("3")) { setflag(2); force_rport(); fix_contact(); }; if (!www_authorize("", "subscriber")) { www_challenge("", "0"); break; } else if (!check_to()) { sl_send_reply("403", "Username!=To not allowed"); break; }; if (!save("location")) { sl_reply_error(); }; } else { sl_send_reply("403", "This domain is not served here"); }; break; }; if (method=="INVITE") { if (!(is_from_local() || is_uri_host_local())) { sl_send_reply("403", "Relaying is forbidden"); break; }; t_on_failure("1"); } else if (method == "BYE" || method == "CANCEL") { end_media_session(); }; if (loose_route()) { if (method=="INVITE" || method=="ACK") { use_media_proxy(); }; # end media session for BYE and CANCEL is done above # before entering the loose route. no need to call it here t_relay(); break; }; # Force subsequent messages to pass trough this proxy if (method == "INVITE") { record_route(); }; if (client_nat_test("3") && !search("^Record-Route:")) { # Mark as NAT'ed force_rport(); fix_contact(); }; if (method=="INVITE") { t_on_reply("1"); }; if (is_uri_host_local()) { # join with next if? if (!lookup("location")) { sl_send_reply("404", "User not found"); break; }; }; if (method=="INVITE" || method=="ACK") { use_media_proxy(); }; if (!t_relay()) { if (method=="INVITE" || method=="ACK") { end_media_session(); }; sl_reply_error(); }; } failure_route[1] { end_media_session(); } onreply_route[1] { if (status=~"(183)|(2[0-9][0-9])") { if (client_nat_test("1")) { fix_contact(); }; use_media_proxy(); }; } -- Best Regards Charles

3 7

[Serusers] auth_radius
by Kamran Ahmad 23 Mar '05

23 Mar '05

hi can any tell me what is the problem in my configuration i want to use radius with SER when i am trying to send request sipsak -U -n -s sip:3000@mydomain -v it is replying with 401 unauthorized and after that sipsak is saying error: authorization failed request already contains (Proxy-) Authorization, but received 40[1|7], see above and when i am trying to register with SJPhone it is not registering radius is working but SER is not requesting radius for authorization radclient -f digest localhost auth testing123 Received response ID 36, code 3, length = 35 Reply-Message = "Authenticated" here is user file from radius #/usr/local/etc/raddb/user 3000 Auth-Type := Digest, User-Password == "1234" Reply-Message = "Authenticated", Sip-Rpid = "1234" #ser.cfg #------------ # # $Id: ser.cfg,v 1.21.4.1 2003/11/10 15:35:15 andrei Exp $ # # simple quick-start config script # # ----------- global configuration parameters ------------------------ #debug=3 # debug level (cmd line: -dddddddddd) #fork=yes #log_stderror=no # (cmd line: -E) #memlog=3 #sip_warning=yes #server_signature=yes #mhomed=0 #uid="kamran" #gid="kamran" /* Uncomment these lines to enter debugging mode debug=7 fork=no log_stderror=yes */ check_via=no # (cmd. line: -v) dns=no # (cmd. line: -r) rev_dns=no # (cmd. line: -R) port=5060 #children=4 fifo="/tmp/ser_fifo" # ------------------ module loading ---------------------------------- # Uncomment this if you want to use SQL database loadmodule "/usr/local/lib/ser/modules/mysql.so" loadmodule "/usr/local/lib/ser/modules/sl.so" loadmodule "/usr/local/lib/ser/modules/tm.so" loadmodule "/usr/local/lib/ser/modules/rr.so" loadmodule "/usr/local/lib/ser/modules/maxfwd.so" loadmodule "/usr/local/lib/ser/modules/usrloc.so" loadmodule "/usr/local/lib/ser/modules/registrar.so" loadmodule "/usr/local/lib/ser/modules/auth_radius.so" # Uncomment this if you want digest authentication # mysql.so must be loaded ! loadmodule "/usr/local/lib/ser/modules/auth.so" #loadmodule "/usr/local/lib/ser/modules/auth_db.so" # ----------------- setting module-specific parameters --------------- # -- usrloc params -- #modparam("usrloc", "db_mode", 0) # Uncomment this if you want to use SQL database # for persistent storage and comment the previous line modparam("usrloc", "db_mode", 2) # -- auth params -- # Uncomment if you are using auth module # #modparam("auth_db", "calculate_ha1", yes) #modparam("auth_radius", "calculate_ha1", yes) # # If you set "calculate_ha1" parameter to yes (which true in this config), # uncomment also the following parameter) # #modparam("auth_db", "password_column", "password") #modparam("auth_radius", "password_column", "password") # -- rr params -- # add value to ;lr param to make some broken UAs happy #modparam("rr", "enable_full_lr", 1) # ------------------------- request routing logic ------------------- # main routing logic route { # initial sanity checks -- messages with # max_forwards==0, or excessively long requests log(1,"inside route"); if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); break; }; if ( msg:len > max_len ) { sl_send_reply("513", "Message too big"); break; }; # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol log(1,"calling record_route"); record_route(); # loose-route processing if (loose_route()) { t_relay(); break; }; # if the request is for other domain use UsrLoc # (in case, it does not work, use the following command # with proper names and addresses in it) log(1,"checking register:uri="); #log(1,uri); #log(1,myself); #if (uri==myself) { log(1,"checking Register Message received"); if (method=="REGISTER") { # Uncomment this if you want to use digest authentication # if (!www_authorize("mydomain.com", "subscriber")) { # www_challenge("mydomain.com", "0"); # break; # }; log(1,"Register Message received"); if (!radius_www_authorize("MYDOMAIN")) { www_challenge("MYDOMAIN", "0"); break; } save("location"); break; }; # native SIP destinations are handled using our USRLOC DB if (!lookup("location")) { sl_send_reply("404", "Not Found"); break; }; #}; # forward to current uri now; use stateful forwarding; that # works reliably even if we forward from TCP to UDP # if requests URI is numerical and starts with # zero, forward statelessly to a static destination if (!t_relay()) { sl_reply_error(); }; } __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

3 2

[Serusers] When the UA crash (network or power) : the call continue!!!!
by Nicolas Ruiz 23 Mar '05

23 Mar '05

Hi, How can I verify if my UA have a network crash or a power crash, to cut the call ? can I send Keep ALIVE ??? Thansk a lot. Regards Nicolas RUIZ France, Paris

4 11

[Serusers] Re: re-INVITES and dropped calls - ever figure it out?
by Java Rockx 23 Mar '05

23 Mar '05

Mahesh, I now know what the problem is, but I don't have any idea the cause or how to fix it. Fortunately the issue appears to be our PSTN gateway provider. See we use a 3rd party for PSTN access. This 3rd party uses a [unknown] SIP proxy in front of their Sonus box. The problem I have with them is that occasionally their SIP proxy changes the branch= tag in the top VIA which then appears to be a new re-INVITE and I believe SER properly processes it. However, the SIP UA always ignores it and I don't know if it should or not. Anyhow here is a sample of what I'm referring to. The first re-INVITE is OK and is properly processed however we get a seconds re-INVITE from them (also shown) and this second re-INVITE is received __before__ we receive the ACK for our 200OK which we send back to them in response to the first re-INVITE. You can see the top VIA is different. FIRST RE-INVITE U 2005/03/22 18:17:34.949888 216.229.127.80:5060 -> 10.3.0.221:5060 INVITE sip:7246024356@24.154.237.253:5060 SIP/2.0. Via: SIP/2.0/UDP 216.229.127.80:5060;branch=z9hG4bK8152abf9bd6-899f6309. Via: SIP/2.0/UDP 216.229.118.76:4060;branch=z9hG4bK07650ade1b9163d1. To: "Paul" <sip:7246024356@216.229.127.80>;tag=4217611370. From: sip:4075660914@sip.mycompany.com;tag=0a8eb95c. Call-ID: 2063115359(a)24.154.237.253. CSeq: 15749 INVITE. Max-Forwards: 69. Contact: sip:4075660914@216.229.118.76:4060. Record-Route: <sip:216.229.127.80:5060;lr>. Route: <sip:10.3.0.221:5060;ftag=4217611370;lr>. Allow: OPTIONS, INVITE, CANCEL, ACK, BYE, PRACK, INFO. Accept: multipart/mixed, application/sdp, application/isup, application/dtmf, application/dtmf-relay. Supported: timer. Session-Expires: 240;refresher=uac. Content-Disposition: session;handling=required. Content-Type: application/sdp. Content-Length: 249. . v=0. o=Sonus_UAC 10885 11051 IN IP4 216.229.118.76. s=SIP Media Capabilities. c=IN IP4 216.229.118.100. t=0 0. m=audio 19432 RTP/AVP 18 101. a=rtpmap:18 G729/8000. a=fmtp:18 annexb=no. a=rtpmap:101 telephone-event/8000. a=fmtp:101 0-15. a=sendrecv. SECOND RE-INVITE U 2005/03/22 18:17:35.450645 216.229.127.80:5060 -> 10.3.0.221:5060 INVITE sip:7246024356@24.154.237.253:5060 SIP/2.0. Via: SIP/2.0/UDP 216.229.127.80:5060;branch=z9hG4bK9157a393106-899f6309. Via: SIP/2.0/UDP 216.229.118.76:4060;branch=z9hG4bK07650ade1b9163d1. To: "Paul" <sip:7246024356@216.229.127.80>;tag=4217611370. From: sip:4075660914@sip.mycompany.com;tag=0a8eb95c. Call-ID: 2063115359(a)24.154.237.253. CSeq: 15749 INVITE. Max-Forwards: 69. Contact: sip:4075660914@216.229.118.76:4060. Record-Route: <sip:216.229.127.80:5060;lr>. Route: <sip:10.3.0.221:5060;ftag=4217611370;lr>. Allow: OPTIONS, INVITE, CANCEL, ACK, BYE, PRACK, INFO. Accept: multipart/mixed, application/sdp, application/isup, application/dtmf, application/dtmf-relay. Supported: timer. Session-Expires: 240;refresher=uac. Content-Disposition: session;handling=required. Content-Type: application/sdp. Content-Length: 249. . v=0. o=Sonus_UAC 10885 11051 IN IP4 216.229.118.76. s=SIP Media Capabilities. c=IN IP4 216.229.118.100. t=0 0. m=audio 19432 RTP/AVP 18 101. a=rtpmap:18 G729/8000. a=fmtp:18 annexb=no. a=rtpmap:101 telephone-event/8000. a=fmtp:101 0-15. a=sendrecv. I can post a complete example SIP call log which shows this if you would like to look at it. Also, I wonder if the SIP UA ignores the "second" re-INVITE because it is in a transaction with the first re-INVITE (because it didn't get the ACK back from the PSTN GW provider yet). I'm not familiar enough with the RFC to know. The bottom line is that last night I finally got our PSTN GW provider to admit they have something going on. They're looking in to why the top VIA is branching. No solution yet. Regards, Paul On Wed, 23 Mar 2005 07:50:37 -0600, Mahesh Subramanya <mahesh(a)aptela.com> wrote: > We're dealing with (somewhat) the same issue, interestingly, involving > Sonus too. On our end, I've noticed that different UAs deal better (or > worse) with this issue - Snoms seem to have no problem responding > repeatedly to the same INVITE (whether they should or not is a different > issue :-) ), while Polycoms just tend to crap out. > > Anyhow, did you figure out a "correct" soln? > > cheers > >

1 0

[Serusers] Whats the problem with realm in auth_radius module?
by Andres 23 Mar '05

23 Mar '05

Trying to make the auth_radius module to work I ran into a peculiar issue. For example if our UA were to try to register to server "sip.mydomain.com" ...and our ser.cfg had: if (!radius_www_authorize("mydomain.com")) { www_challenge("mydomain.com", "1"); } ...then the authentication is not even fired off to the radius. SER Debugs indicate the radius message is not even constructed. If on the other hand our ser.cfg has: if (!radius_www_authorize("")) { www_challenge("", "1"); } then the authentication is now fired off to the radius server but the REALM is sip.mydomain.com. Why can't one make this work as it does with mysql authentication where the www_authorize does not need the host part? We need REAM to be simply the domain part. The auth_radius readme even says that the realm is **usually** just the domain of the host. Does this mean something is broken here? -------------from readme---------------- * realm - Realm is a opaque string that the user agent should present to the user so he can decide what username and password to use. Usually this is domain of the host the server is running on. Example 1-3. radius_www_authorize usage ... if (!radius_www_authorize("iptel.org")) { www_challenge("iptel.org", "1"); }; -- Andres Network Admin http://www.telesip.net

2 5

Re: [Serusers] is ther any way to debug ser
by Java Rockx 23 Mar '05

23 Mar '05

Check /var/log/messages Assuming a standard Linux distro. Regards, Paul On Wed, 23 Mar 2005 04:19:24 -0800 (PST), Kamran Ahmad <p_kami(a)yahoo.com> wrote: > hi Java Rockx > > do you know when > > #ser.cfg > route { > log(1,"some message"); > } > > how to find this message > in which file ser is filling its log > > thanks > Kamran > > > --- Java Rockx <javarockx(a)gmail.com> wrote: > > The only way I know is to start up gdb and set some > > tracepoints > > > > Regards, > > Paul > > > > > > On Wed, 23 Mar 2005 02:33:25 -0800 (PST), Kamran > > Ahmad <p_kami(a)yahoo.com> wrote: > > > > > > hi all > > > > > > i want to check that if my ser is calling radius > > for > > > authentication. is this posible in ser > > > > > > Kamran > > > > > > __________________________________ > > > Do you Yahoo!? > > > Yahoo! Sports - Sign up for Fantasy Baseball. > > > http://baseball.fantasysports.yahoo.com/ > > > > > > _______________________________________________ > > > Serusers mailing list > > > serusers(a)lists.iptel.org > > > http://lists.iptel.org/mailman/listinfo/serusers > > > > > > > __________________________________ > Do you Yahoo!? > Make Yahoo! your home page > http://www.yahoo.com/r/hs >

1 0

[Serusers] Re: record-route and pstn gateway problem.
by Marian Dumitru 23 Mar '05

23 Mar '05

Hi Jiang, Be sure you record_route() also to calls forwarded to GW - add the record_route() before the forward(). Also don't forget to do loose_route() in your script for requests within the dialog. Best regards, Marian Jiang zhou wrote: > Hi,all > > I have a record route problem: > > sip client===>ser====>(pstn)gateway > > invite: client---->ser---->gw > ring and 200ok : gw--->ser--->client > ack : client--------------->gw > > I use forward command forward pstn call to gateway. > if (uri=~"^sip:9817") { > rewritehost("xxx.xxx.xxx.xxx"); > forward(xxx.xxx.xxx.xxx,5060); > break; > } > > There is no record-route field in the 200ok packet. So client forward to gw > directly. > But when sip client call each other ser insert record-route field. Can > someone tell me > how to config forward command with record-route supported? > > Jiangzhou > Best Regards > > > -- Voice System http://www.voice-system.ro

1 0

[Serusers] Getting Started - Issue 02 covers MySQL Support
by Simon Miles 23 Mar '05

23 Mar '05

Dear All, Paul, Greger and myself would like you to know that the next issue of 'Getting Started' is now available on the www.ONsip.org web site. This new version builds upon the first issue by adding MySQL support. We are already finalising the next issue covering NAT support - a subject that always fills up this mailing list with questions. We are doing this for the community and would welcome any feedback on the document to make it more readable etc. Comments are welcome on the <http://www.onsip.org/> www.ONsip.org web site, goto Forums and select the Getting Started Feedback area. To download the document, go to the download section. We hope this is of benefit to the Community. Thanks Paul, Simon, Greger

3 2

[Serusers] No Dialtone ....Please help
by Nicky 23 Mar '05

23 Mar '05

Hi Uli, Please Help. I still have errors in the startup of the sems. I have tried the ATDT <Telephone> and I get the NO DialTone and No MSN & EAZ error. Please advice what can be the problem as the system already detected the card but there is not response. Thanks in advance. regards, nicky

1 0

[Serusers] SER in FEDORA Core 3
by Luis Leite 23 Mar '05

23 Mar '05

Hello, I've discovered recently the VoIP world. I would like to install SER in Fedora Core 3 I think the latest SER stable version is 0.8.14 and does not have a RPM install package. If you succeeded making SER to work in FC3 could you tell me what is the "best practice" to do it? thanks, luis

5 4

[Serusers] SER 0.8.14 + Radius ACCOUNTING problems
by Nicolas Ruiz 23 Mar '05

23 Mar '05

Hi all ! I use CDRTool for accounting with radiusclient 0.4.3 librairy and freeradius 1.0.2. For Start and Stop status code, I have no problem, I have the CDRs on MySQL Database. But when I want to have MISSED CALL, I have an error on freeradius ! Error : Mon Mar 21 17:10:53 2005 : Error: rlm_radutmp: NAS localhost port 5060 unknown packet type 15) Mon Mar 21 17:10:53 2005 : Info: rlm_sql (sql): Unsupported Acct-Status-Type = 15 Does someone know how to solve this problem?? Is it in the SQL.CONF ?? Thanks a lot Vos Solutions Voix-Data ! Nicolas Ruiz Service Technique Ligne directe : + 33 (0) 1 56 38 39 71 Fax :+ 33 (0) 1 47 24 74 77 nruiz(a)vivaction.com Immeuble Plein Ouest 177 av. Georges Clemenceau 92024 Nanterre - France Tel : 0 811 02 6000 www.vivaction.com ____________________________________________________________________________ ____________________________________________ This e-mail and the information it contains are confidential and legally protected by law. Only access by the intended recipient is authorized. Review, distribution,reproduction, publication or other use of this e-mail is prohibited. Cet e-mail et les informations qu'il contient sont confidentiels et protégés par la loi. L'accès à ce message n'est autorisé qu'au destinataire de celui-ci. Toute modification,distribution, reproduction, publication, ou autre utilisation de cet e-mail est formellement interdite.

5 5

[Serusers] AVPOPS: How long do AVPs live?
by Java Rockx 23 Mar '05

23 Mar '05

Hi All. I'm using ser-0.9.1 If I store a value using avp_write() how long does this AVP exist? Do I need to explicitly call avp_delete() to free memory resources or will they expire and clean themselves up automatically? Regards, Paul

3 2

RE: [Serusers] Question about mystun.
by Ricardo Martinez 23 Mar '05

23 Mar '05

Marian Thanks for your answer... I use netstan -an, but how can i determine the PRIMARY BIND ADDRESS and the ALTERNATIVE BIND ADDRESS..which is which? Thanks.. Regards, Ricardo.- > -----Mensaje original----- > De: Marian Dumitru [mailto:marian.dumitru@voice-sistem.ro] > Enviado el: Martes, 22 de Marzo de 2005 14:53 > Para: Ricardo Martinez > CC: 'serusers(a)lists.iptel.org' > Asunto: Re: [Serusers] Question about mystun. > > > Hi Ricardo, > > Use "netstat -ual" to the interfaces. > > Best regards, > Marian > > Ricardo Martinez wrote: > > Hello. > > When i start the STUN server from iptel (mystun) with this > command line : > > % ./server.exe -D > > as a deamon. > > How can i check which is my bind address and my alternative > bind address? > > > > Thanks! > > > > Ricardo.- > > > > _______________________________________________ > > Serusers mailing list > > serusers(a)lists.iptel.org > > http://lists.iptel.org/mailman/listinfo/serusers > > > > -- > Voice System > http://www.voice-system.ro >

3 2

[Serusers] Help Serweb
by harry gaillac 23 Mar '05

23 Mar '05

Hello, I really need help with Serweb. I use ser 0.10.99-dev5 with latest Serweb from CVS but I can't use most of features missed call, message stored, account, ... I spent time with apache ser and mysql logs but I can't fix problems. I read INSTALL, mailing list, ... I can get missed calls because of I changed a php script in data_layer. Either my serweb configuration is wrong or Serweb need really some fixings. Regards Harry Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/

2 1

[Serusers] aliases
by Llanos Serna García-Conde 22 Mar '05

22 Mar '05

3 2

[Serusers] AVPOPS - How do I to write Call-ID to an AVP???
by Java Rockx 22 Mar '05

22 Mar '05

Hi All. The AVPOPS documentation says that any header can be written to an AVP. For example avp_write("$hdr[My-header]","i:11"); This would right the body of the "My-header" header to AVP i:11 But this does not work. I want to write the Call-ID header to an AVP. How do I do this? Regards, Paul

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users