[Users] Checking received contact against location table

[Daniel-Constantin Mierla]

Hello,

registered() takes the r-uri as (hidden) parameter, but it has to be the 
AoR, not the contact, otherwise will fail. If you use usrloc with mode 1 
or 3, then you can use avp_db_query() to do a select against location 
table -- see the avpops module documentation.

However, this might be a risk, because spoofing SIP messages is quite 
simple. I would suggest at least to check the source IP and port as well.

Cheers,
Daniel


On 10/12/06 13:40, Dimo wrote:
> Hi,
> I want to tweak my openser setup so it allows calls (INVITES) only
> from registered contacts.
> I was wondering if there is a way to check the received contact in the
> invite message against the location table in mysql database, where i
> store the registered users.
>
> I do not want to make additional digest authorization of the Invites.
>
> I see that the registered() function in registrar module has something
> like that, but it makes the check on the request uri, not the contact.
>
> Also if someone can think of a better way to allow calls only from
> registered contacts I would greatly appreciate any tips.
> Thanks.
>
> Best,
> D.
>
> _______________________________________________
> Users mailing list
> Users at openser.org
> http://openser.org/cgi-bin/mailman/listinfo/users
>