[Serusers] mod_init: bind_db failed.. - sr-users

6 May 2004

   if (!mf_process_maxfwd_header("10")) {
           log("LOG: Too many hops\n");
           sl_send_reply("483", "Alas Too Many Hops");
           break;
   };

   if (msg:len >= max_len) {
           sl_send_reply("513", "Message too large");
           break;
   };

   # special handling for natted clients; first, nat test is
   # executed: it looks for via!=received and RFC1918 addresses
   # in Contact (may fail if line-folding used); also,
   # the received test should, if complete, should check all
   # vias for presence of received
   if (nat_uac_test("3")) {
           # allow RR-ed requests, as these may indicate that
           # a NAT-enabled proxy takes care of it; unless it is
           # a REGISTER

           if (method == "REGISTER" || !search("^Record-Route:")) {
                   log("LOG: Someone trying to register from private IP, rewriting\n");

                   # This will work only for user agents that support symmetric
                   # communication. We tested quite many of them and majority is
                   # smart smart enough to be symmetric. In some phones, like
                   # it takes a configuration option. With Cisco 7960, it is
                   # called NAT_Enable=Yes, with kphone it is called
                   # "symmetric media" and "symmetric signaling". (The latter
                   # not part of public released yet.)

                   fix_nated_contact(); # Rewrite contact with source IP of signalling
                   if (method == "INVITE") {
                           fix_nated_sdp("1");  # Add direction=active to SDP
                   };
                   force_rport();       # Add rport parameter to topmost Via
                   setflag(6); # Mark as NATed

                   append_to_reply("P-NATed-Caller: Yes\r\n");
           };
   };

   # anti-spam -- if somene claims to belong to our domain in From,
   # challenge him (skip REGISTERs -- we will chalenge them later)
   if (search("(From|F):.*@((192\.168\.0\.223)|(ser\.fonomni\.com))")) {
           # invites forwarded to other domains, like FWD may cause subsequent 
           # request to come from there but have iptel in From -> verify
           # only INVITEs (ignore FIFO/UAC's requests, i.e. src_ip==fox)
           if ((method == "INVITE" || method == "SUBSCRIBE") && !((src_ip == 192.168.0.223) || ((src_ip == 192.168.0.2) || (src_ip == 192.168.0.2)))) {
                   if  (!(proxy_authorize("ser.fonomni.com", "subscriber"))) {
                           proxy_challenge("ser.fonomni.com", "0");
                           break;
                   };

                   # to maintain outside credibility of our proxy, we enforce
                   # username in From to equal digest username; user with
                   # "john.doe" id could advertise "bill.gates" in From otherwise;
                   if (!check_from()) {
                           log("LOG: From Cheating attempt in INVITE\n");
                           sl_send_reply("403", "That is ugly -- use From=id next time (OB)");
                           break;
                   };

                   # we better don't consume credentials -- some requests may be
                   # spiraled through our server (sfo@iptel->7141@iptel) and the
                   # subsequent iteration may challenge too, for example because of
                   # iptel claim in From; UACs then give up because they
                   # already submitted credentials for the given realm
                   #consume_credentials();
           }; # non-REGISTER from other domain
   } else if ((method == "INVITE" || method == "SUBSCRIBE" || method=="REGISTER" ) && 
              !(uri == myself || uri =~ "(@((192\.168\.0\.2)|(192\.168\.0\.2))([;:].*)*)")) {
           # and we serve our gateway too (we RR requests to it, so that
           # its address may show up in subsequent requests after loose_route
           sl_send_reply("403", "No relaying");
           break;
   };

   # By default we record route everything except REGISTERs
   if (!(method=="REGISTER")) record_route();

   # if route forces us to forward to some explicit destination, do so
   #
   # loose_route returns true in case that a request included
   # route header fields instructing SER where to relay a request;
   # if that is the case, stop script processing and just forward there;
   # one could alternatively ignore the return value and treat the
   # request as if it was an outbound one; that would not work however
   # with broken UAs which strip RR parameters from Route. (What happens
   # is that with two RR /tcp2udp, spirals, etc./ and stripped parameters,
   # SER a) rewrites r-uri with RR1 b) matches uri==myself against RR1
   # c) applies mistakenly user-lookup to RR1 in r-uri

   if (loose_route()) {
           # check if someone has not introduced a pre-loaded INVITE -- if so,
           # verify caller's privileges before accepting rr-ing
           if ((method=="INVITE" || method=="ACK" || method=="CANCEL") && uri =~ "(@((192\.168\.0\.2)|(192\.168\.0\.2))([;:].*)*)") {
                   route(3); # Forward to PSTN gateway
           } else {
                   append_hf("P-hint: rr-enforced\r\n");
                   # account all BYEs 
                   if (method=="BYE") setflag(1);
                   route(1);  # Generic forward
           };
           break;
   };

   # -------  check for requests targeted out of our domain... -------
   if (!(uri == myself || uri =~ "(@((192\.168\.0\.2)|(192\.168\.0\.2))([;:].*)*)")) {
           # ... and we serve our gateway too (we RR requests to it, so that
           # its address may show up in subsequent requests after
           # rewriteFromRoute
           append_hf("P-hint: OUTBOUND\r\n");
           route(1);
           break;
   };

   # ------- now, the request is for sure for our domain -----------
   # registers always MUST be authenticated to
   # avoid stealing incoming calls
   if (method == "REGISTER") {
           /*
           if (!allow_register("register.allow", "register.deny")) {
                   log(1, "LOG: alert: Forbidden IP in Contact\n");
                   sl_send_reply("403", "Forbidden");
                   break;
           };
           */

           # prohibit attempts to grab someone else's To address 
           # using  valid credentials; 
           if (!www_authorize("ser.fonomni.com", "subscriber")) {
                   # challenge if none or invalid credentials
                   www_challenge("ser.fonomni.com", "0");
                   break;
           };

           if (!check_to()) {
                   log("LOG: To Cheating attempt\n");
                   sl_send_reply("403", "That is ugly -- use To=id in REGISTERs");
                   break;
           };

           # it is an authenticated request, update Contact database now
           if (!save("location")) {
                   sl_reply_error();
           };

           m_dump();
           break;
   };

   # some UACs might be fooled by Contacts our UACs generate to make MSN
   # happy (web-im, e.g.) -- tell its urneachable
   if (uri =~ "sip:daemon@") {
           sl_send_reply("410", "Daemon is gone");
           break;
   };

   # aliases
   # note: through a temporary error in provisioning interface, there
   # are now aliases 905xx ... they take precedence overy any PSTN numbers
   # as they are resolved first
   lookup("aliases");

   # check again, if it is still for our domain after aliases
   if (!(uri == myself || uri =~ "(@((192\.168\.0\.2)|(192\.168\.0\.2))([;:].*)*)")) {
           append_hf("P-hint: ALIASED-OUTBOUND\r\n");
           route(1);
           break;
   };