13 Feb
2007
13 Feb
'07
7:25 p.m.
You could also change the rtp proxy to allow signing in also from other IP
addresses but of course this weakens security.
regards
klaus
On Tue, February 13, 2007 17:58, Andreas Granig said:
Hi Klaus,
I have nearly the same approach. Problem is, that I have to do
fix_nated_sdp if the client is nated to pass the right media IP to
mediaproxy-dispatcher. In this special case, SIP came from 1.2.3.4 and
RTP from 1.2.3.5 (announced in SDP), but since NAT was detected, it was
"fixed" to 1.2.3.4 by fix_nated_sdp, so my RTP-Proxy silently dropped
packets from 1.2.3.5.
If RTP and SIP both always come from the same IP, this problem may
remain undetected, but here it popped up due to the different IP
addresses.
Andreas
Klaus Darilion wrote:
Probably not solving your problem but this is my
newest pragmatic
aproach:
A client should support symmetric SIP. Thus, I use force_rport for all
local clients. As usually also all SIP proxies are symmetric I also do
force_port for requests from external nodes.
For REGISTER I do not trust the information in the Contact header at all
-
I always use fix_nated_register. Further, I always use fix_nated_contact
for local SIP users - thus for SIP NAT traversal I do not need any
tests.
Regarding RTP NAT traversal - if you want to save bandwidth on your RTP
proxy - of course you still need a nat-test.
regards
klaus
On Tue, February 13, 2007 17:36, Andreas Granig said:
This e-mail is confidential and may well also be legally privileged. If
you have received it in error, you are on notice of its status. Please
notify us immediately by reply e-mail and then delete this message from
your system. Please do not copy it or use it for any purposes, or disclose
its contents to any other person: to do so could be a breach of
confidence. Thank you for your cooperation.
Hi,
Today I found a UAC which is *not* located behind NAT (public IP
1.2.3.4) and sends this Via-Header, which seems perfectly valid
according to RFC3261:
SIP/2.0/UDP VINNASUP06C:5060;maddr=1.2.3.4;branch=z9hG4bK-2198d2
I used to check for nated clients using nat_uac_test("3"), which
detects
NAT in this case, because the host-part doesn't match the
received-address. So is the test-flag "2" useless, since the host-part
can be "hostname / IPv4address / IPv6reference", or should this
particular test be extended to also check for the maddr-parameter?
In the meanwhile, I've changed my nat-test to "17" for only testing
Contact and Via-Port instead of Contact and Via-Address, but it's still
not optimal.
Any opinions on this?
Andreas
This e-mail is confidential and may well also be legally privileged. If
you have received it in error, you are on notice of its status. Please
notify us immediately by reply e-mail and then delete this message from
your system. Please do not copy it or use it for any purposes, or
disclose
its contents to any other person: to do so could be a breach of
confidence. Thank you for your cooperation.
_______________________________________________
Users mailing list
Users(a)openser.org
http://openser.org/cgi-bin/mailman/listinfo/users