[SR-Users] Kamailio example configuration: auth section incomplete?

Jurijs Ivolga jurijs.ivolga at gmail.com
Wed Aug 2 20:41:02 CEST 2017


Hi George,

If you are asking about this part:

if (from_uri!=myself && uri!=myself) {
        sl_send_reply("403","Not relaying");
        exit;
    }

Then this mean that we do not want to deal with sip requests which not send
to us or not by us. So any request which is not related to us we will not
serve.

Keep in mind that "to" header by sip RFC can contain anything and we don't
care in most cases what is there.

https://tools.ietf.org/html/rfc3261#page-36

With kind regards,

Jurijs

On Wed, Aug 2, 2017 at 4:01 PM, George Diamantopoulos <georgediam at gmail.com>
wrote:

> Hello again,
>
> Still getting familiar with kamailio, and I'm wondering about the AUTH
> route in the example configuration file. Here's a reducted-simplified
> version of it for reference (from git master, without IP AUTH and comments):
>
> ______________________________________________
> route[AUTH] {
>     if (is_method("REGISTER") || from_uri==myself) {
>         if (!auth_check("$fd", "subscriber", "1")) {
>             auth_challenge("$fd", "0");
>             exit;
>         }
>         if(!is_method("REGISTER|PUBLISH"))
>             consume_credentials();
>     }
>     if (from_uri!=myself && uri!=myself) {
>         sl_send_reply("403","Not relaying");
>         exit;
>     }
>     return;
> }
> ______________________________________________
>
> So the way I see it, what happens is the following:
>
> * All REGISTERs will be challenged
> * All SIP messages with kamailio's aliases in the "From" header URI will
> be challenged
> * All SIP messages with no reference to kamailio's aliases in both R-URI
> and "From" header URI will be dropped
>
> The question is, what about messages that do not enter either of the two
> conditionals? For example, I expect the following to be very common:
>
> * Method: INVITE
> * R-URI: myself
> * From: username@"UAC's local IP address" (not myself)
> * To: myself
>
> So in the example above, the auth route will return without either having
> challenged or dropped the request, am I correct? This is because:
>
> * For the challenge: Method is not REGISTER and "From URI" is not one of
> kamailio host's aliases (cumulatively)
> * For dropping after sending 403: "From URI" is not one of kamailio's
> host's aliases (which calculates to true) but R-URI is "myself"
>
> So I'm guessing we're expecting the challenge to come from elsewhere in
> cases like the example above? Or is there something else I'm missing here?
> Thanks!
>
> BR,
> George
>
> _______________________________________________
> Kamailio (SER) - Users Mailing List
> sr-users at lists.kamailio.org
> https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.kamailio.org/pipermail/sr-users/attachments/20170802/54dd31ec/attachment.html>


More information about the sr-users mailing list