I have a little problem, i need to force the UA
(outside NAT with public IP address) to send the BYE
messages
to my Sip Server so I can account them in the acc
table.
I use record_route() to acomplish that but the thing
is the
Record-Route field in the message that an UA recieve,
the IP address is
the SIP SERVER LOCAL IP ADDRESS BEHIND NAT
(Record-Route:
<sip:5000022@192.168.0.2;ftag=192550680;lr=on>)
which means, of course, that the message will not pass
trough the SIP Server.
How Could i force the server to write in the
Record-Route field the valid
IP address of my Sip Server (200.24.99.131)????
Example message sent by the Sip Proxy:
RECEIVE TIME: 1420109
RECEIVE << 200.24.99.131:5060
SIP/2.0 180 Ringing
Via: SIP/2.0/UDP
200.71.103.253:5060;rport=5060;branch=z9hG4bK725C92055C654839934F043974F39E1F
From: Andres Parra
<sip:3304076@ipsofactum.com>;tag=192550680
To: <sip:5000022@ipsofactum.com>;tag=2391513217
Contact: <sip:5000022@68.38.237.35:32805>
Record-Route:
<sip:5000022@192.168.0.2;ftag=192550680;lr=on>
Call-ID:
31517648-DF5F-4A12-BE74-5B1026B4C39D(a)200.71.103.253
CSeq: 29855 INVITE
Server: X-Lite release 1103m
Content-Length: 0
Ser.cfg:
#
# $Id: ser.cfg,v 1.21.4.1 2003/11/10 15:35:15 andrei
Exp $
#
# simple quick-start config script
#
# ----------- global configuration parameters
------------------------
#debug=3 # debug level (cmd line: -dddddddddd)
#fork=yes
#log_stderror=no # (cmd line: -E)
/* Uncomment these lines to enter debugging mode
debug=7
fork=no
log_stderror=yes
*/
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
#port=5060
#children=4
fifo="/tmp/ser_fifo"
# ------------------ module loading
----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
loadmodule "/usr/local/lib/ser/modules/acc.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
# Uncomment this if you want to use SQL database
# ----------------- setting module-specific parameters
---------------
# -- usrloc params --
#modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db", "calculate_ha1", yes)
#
# If you set "calculate_ha1" parameter to yes (which
true in this config),
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")
# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)
# -- acc params -
modparam("acc", "log_missed_flag", 3)
modparam("acc", "log_level", 1)
modparam("acc", "log_flag", 1)
modparam("acc", "db_flag", 1)
modparam("acc", "db_missed_flag", 3)
# ------------------------- request routing logic
-------------------
# main routing logic
route{
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if ( msg:len > max_len ) {
sl_send_reply("513", "Mensaje demasiado grande");
break;
};
# prevents private ip space from being used
if (search("^(Contact|m):
.*(a)(192\.168\.|10\.|172\.16)")) {
if (method=="REGISTER") {
log(1, "LOG: Someone trying to register from
private IP\n");
sl_send_reply("479", "Por favor no utilice
direcciones IP privadas" );
break;
};
};
# loose-route processing
if (loose_route()) {
t_relay();
break;
};
# labeled all transaction for accounting
setflag(1);
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy;
that's
# particularly good if upstream and downstream
entities
# use different transport protocol
# record-route INVITES to make sure BYEs will visit
our server too
if (method=="INVITE") record_route();
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following
command
# with proper names and addresses in it)
if (uri=~"ipsofactum.com" ){#||
!(uri=~"^sip:(192\.168\.|10\.|172\.16)")) {
if (method=="REGISTER") {
# Uncomment this if you want to use digest
authentication
if (!www_authorize("ipsofactum.com", "subscriber"))
{
www_challenge("ipsofactum.com", "0");
break;
};
setflag(3);
save("location");
break;
};
# native SIP destinations are handled using our
USRLOC DB
if (!lookup("location")){ #&&
!lookup("subscribers")) {
# call invitations to off-line users are reported
using the
# acc_request action; to avoid duplicate
reports on request
# retransmissions, request is processed
statefuly (t_newtran,
# t_reply)
if ((method=="INVITE" || method=="ACK") &&
t_newtran() ) {
t_reply("404", "Usuario no registrado!,
contacte el directorio de usuarios registrados");
acc_db_request("404 Not
Found","missed_calls");
break;
};
# all other requests to off-line users are
simply replied
# statelesslyeth0 and no reports are issued
#sl_send_reply("404", "Usuario no existente!,
contacte el directorio de usuarios suscritos");
#break;
} else {
# user on-line; report on failed transactions;
mark the
# transaction for reporting using the same
number as
# configured above; if the call is really
missed, a report
# will be issued
setflag(3);
# forward to user's current destination
t_relay();
break;
};
};
# forward to current uri now; use stateful
forwarding; that
# works reliably even if we forward from TCP to UDP
if (!t_relay()) {
sl_reply_error();
};
}
_______________________________
Do you Yahoo!?
Shop for Back-to-School deals on Yahoo! Shopping.
http://shopping.yahoo.com/backtoschool
Dear Ser Users
I have a PII-400, 64Mb with Fedora Core 1 instaled, and the ser is working
good, but the time in time the SER crash and the message in /Var/Log is :
ser[1512]: WARNING:fm_free: free(0) called
Sep 10 15:30:07 sip ser[1511]: WARNING:fm_free: free(0) called
Sep 10 15:30:11 sip ser[1512]: WARNING:fm_free: free(0) called
Sep 10 15:30:15 sip ser[1512]: WARNING:fm_free: free(0) called
Sep 10 15:30:19 sip ser[1511]: WARNING:fm_free: free(0) called
Sep 10 15:30:23 sip ser[1512]: WARNING:fm_free: free(0) called
Sep 10 15:30:27 sip ser[1511]: WARNING:fm_free: free(0) called
Sep 10 15:30:31 sip ser[1512]: WARNING:fm_free: free(0) called
Sep 10 15:35:10 sip ser[1491]: child process 1512 exited by a signal 11
Sep 10 15:35:10 sip ser[1491]: core was not generated
Sep 10 15:35:10 sip ser[1491]: INFO: terminating due to SIGCHLD
Sep 10 15:35:10 sip ser[1566]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1510]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1511]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1513]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1567]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1572]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1571]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1569]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1532]: INFO: signal 15 received
Sep 10 15:35:10 sip ser[1570]: INFO: signal 15 received
can you help me with this issue ??
best Regards
gustaff
I installed freeradius-0.9.1 to work with SER 0.8.14.
They gave a test example to add a user in users file
with following contents:
test Auth-Type := Digest, User-Password ==
"test"
Reply-Message = "Hello, test with
digest"
But when I run radius with "radiusd -X", it gives
following error:
/usr/local/etc/raddb/users[75]: Parse error (check)
for entry test: Unknown value Digest for attribute
Auth-Type
Errors reading /usr/local/etc/raddb/users
radiusd.conf[921]: files: Module instantiation failed.
Any idea about this....
Thanks,
Jawad
__________________________________
Do you Yahoo!?
Y! Messenger - Communicate in real time. Download now.
http://messenger.yahoo.com
Hi list,
the RFC 3161 gives a chapter about DoS attacks in section 26.3.2.4:
[...]
No matter what security solutions are deployed, floods of messages
directed at proxy servers can lock up proxy server resources and
prevent desirable traffic from reaching its destination. There is
a
computational expense associated with processing a SIP transaction
at
a proxy server, and that expense is greater for stateful proxy
servers than it is for stateless proxy servers. Therefore,
stateful
proxies are more susceptible to flooding than stateless proxy
servers.
UAs and proxy servers SHOULD challenge questionable requests with
only a single 401 (Unauthorized) or 407 (Proxy Authentication
Required), forgoing the normal response retransmission algorithm,
and
thus behaving statelessly towards unauthenticated requests.
Retransmitting the 401 (Unauthorized) or 407 (Proxy
Authentication
Required) status response amplifies the problem of an attacker
using a falsified header field value (such as Via) to direct
traffic to a third party.
[...]
However I tested with a SIP-UA that in case of a wrong password in the
INVITE continously tries to register at the same SIP-Registrar (SER in
my case).
SER in the default stateful configuration of course answers every
single INVITE message with 401. No matter how often it comes.
Is there a way of prohibiting subsequent 401 answers to "false" INVITEs
from the same contact/endpoint or credentials for a defined period,
e.g. 30 seconds in SER?
Thanks in advance for your help!
Best regards,
Gerhard
__________________________________________________________________________________
Dieses Mail wurde vom Infotech SecureMail Service ueberprueft und fuer sicher befunden.
Fuer weitere Informationen zu Infotech SecureMail Service waehlen Sie bitte: www.infotech.at/securemail/
This email has been scanned by Infotech SecureMail Service and it has been classified as secure.
For more information on Infotech SecureMail direct your web browser to: www.infotech.at/securemail/
Hi.
When i try to make a call in a NAT enviroment i get the next error
in the debug from my SER.
1(2825) error: mediaproxy/sendMediaproxyCommand(): can't connect to
MediaProxy
I guess this is because the mediaproxy is not running, but i followed all
the steps in the INSTALL file to start the mediaproxy.
I used :
/etc/init.d/mediaproxy start
and even
[root@sipproxy mediaproxy]# ./mediaproxy.py
File "./mediaproxy.py", line 84
print >>sys.stderr, "Mediaproxy error: %s. Exiting." % why
^
SyntaxError: invalid syntax
[root@sipproxy mediaproxy]#
But i can't see any "mediaproxy" process running.
Any ideas?
Any help will be accepted.
Thanks in advance.
Ricardo
Hi,
I have a problem opening the module mysql. I have no idea where it could
come from... Here are some informations about my configuration :
In my folder /usr/local/lib/ser/modules, I have the 2 shared libraries
libmysqlclient.so.10 and mysql.so
I had to copy the libmysqlclient.so.10 file in the following folder
because SER complained the file didn't exist... : /usr/lib/
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Here is my ser.cfg :
# ----------- global configuration parameters
debug=7
fork=no
log_stderror=yes
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
fifo="/tmp/ser_fifo"
# ------------------ module loading
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
# ----------------- setting module-specific parameters
modparam("usrloc", "db_mode", 2)
modparam("usrloc", "db_url", "mysql://ser:heslo@localhost/ser")
modparam("auth_db", "calculate_ha1", yes)
modparam("auth_db", "password_column", "password")
modparam("rr", "enable_full_lr", 1)
# ------------------------- request routing logic
# Well... not necessary I think...
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Here is the result of the command usr/local/sbin/ser -c :
0(2781) loading module /usr/local/lib/ser/modules/mysql.so
0(2781) ERROR: load_module: could not open module
</usr/local/lib/ser/modules/mysql.so>: /usr/lib/libmysqlclient.so.10:
undefined symbol: mysql_field_count
0(2781) parse error (14,13-49): failed to load module
0(2781) loading module /usr/local/lib/ser/modules/sl.so
0(2781) loading module /usr/local/lib/ser/modules/tm.so
0(2781) loading module /usr/local/lib/ser/modules/rr.so
0(2781) loading module /usr/local/lib/ser/modules/maxfwd.so
0(2781) loading module /usr/local/lib/ser/modules/usrloc.so
0(2781) loading module /usr/local/lib/ser/modules/registrar.so
0(2781) loading module /usr/local/lib/ser/modules/auth.so
0(2781) loading module /usr/local/lib/ser/modules/auth_db.so
0(2781) set_mod_param_regex: usrloc matches module usrloc
0(2781) set_mod_param_regex: found <db_mode> in module usrloc
[/usr/local/lib/ser/modules/usrloc.so]
0(2781) set_mod_param_regex: usrloc matches module usrloc
0(2781) set_mod_param_regex: found <db_url> in module usrloc
[/usr/local/lib/ser/modules/usrloc.so]
0(2781) set_mod_param_regex: auth_db matches module auth_db
0(2781) set_mod_param_regex: found <calculate_ha1> in module auth_db
[/usr/local/lib/ser/modules/auth_db.so]
0(2781) set_mod_param_regex: auth_db matches module auth_db
0(2781) set_mod_param_regex: found <password_column> in module auth_db
[/usr/local/lib/ser/modules/auth_db.so]
0(2781) set_mod_param_regex: rr matches module rr
0(2781) set_mod_param_regex: found <enable_full_lr> in module rr
[/usr/local/lib/ser/modules/rr.so]
0(2781) find_export: found <mf_process_maxfwd_header> in module
maxfwd_module [/usr/local/lib/ser/modules/maxfwd.so]
0(2781) find_export: found <sl_send_reply> in module sl_module
[/usr/local/lib/ser/modules/sl.so]
0(2781) find_export: found <sl_send_reply> in module sl_module
[/usr/local/lib/ser/modules/sl.so]
0(2781) find_export: found <record_route> in module rr
[/usr/local/lib/ser/modules/rr.so]
0(2781) find_export: found <loose_route> in module rr
[/usr/local/lib/ser/modules/rr.so]
0(2781) find_export: found <t_relay> in module tm
[/usr/local/lib/ser/modules/tm.so]
0(2781) parse error (51,16-20): parse error
0(2781) parse error (51,16-20): bad command
0(2781) parse error (51,20-21): bad command
0(2781) parse error (51,20-21): bad command
0(2781) parse error (51,23-24): bad command
0(2781) parse error (51,23-24): bad command
0(2781) parse error (51,25-26): bad command
0(2781) find_export: found <www_authorize> in module auth_db
[/usr/local/lib/ser/modules/auth_db.so]
0(2781) find_export: found <www_challenge> in module auth
[/usr/local/lib/ser/modules/auth.so]
0(2781) find_export: found <save> in module registrar
[/usr/local/lib/ser/modules/registrar.so]
0(2781) find_export: found <lookup> in module registrar
[/usr/local/lib/ser/modules/registrar.so]
0(2781) find_export: found <sl_send_reply> in module sl_module
[/usr/local/lib/ser/modules/sl.so]
0(2781) parse error (65,3-4): parse error
0(2781) parse error (65,3-4):
ERROR: bad config file (10 errors)
0(2781) DEBUG: tm_shutdown : start
0(2781) DEBUG: tm_shutdown : empting hash table
0(2781) DEBUG: tm_shutdown: releasing timers
0(2781) DEBUG: tm_shutdown : removing semaphores
0(2781) DEBUG: tm_shutdown : done
0(2781) shm_mem_destroy
0(2781) destroying the shared memory lock
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Please, help me, I am stuck here for more than 2 weeks ;-(
Thanks in advance
Gwen
Hi list,
the subject says it all:
What happens to the state of ser, when I briefly write-lock the
attached MySQL-database to make a file-copy.
Briefly meaning 0.5 to 2 seconds.
Are requests simply delayed or can serious errors occur?
Thanks,
Gerhard
__________________________________________________________________________________
Dieses Mail wurde vom Infotech SecureMail Service ueberprueft und fuer sicher befunden.
Fuer weitere Informationen zu Infotech SecureMail Service waehlen Sie bitte: www.infotech.at/securemail/
This email has been scanned by Infotech SecureMail Service and it has been classified as secure.
For more information on Infotech SecureMail direct your web browser to: www.infotech.at/securemail/
On 9/10/2004 12:50 AM, Daniel-Constantin Mierla wrote:
Thanks, that worked! Good Idea to use this Solution.
Jan
>When using REGISTER's contact address the message should be sent
>directly to the endpoint, nothing to do with the proxy.
>
>You can set the DNS poiting to server's IP in the /etc/hosts, from
>server machine. That will be available only on that machine.
Good afternoon!
I have a problem.
My SER-proxy is multihomed, one interfaces-192.168.11.11 and two interfaces-
real-internet address -213.130.xxx.xxx. I must worked UA with real-internet
address and my gateway-to-PSTN place in internal address 192.168.11.10.
I try use rtpproxy and nathelper module.
How it is necessary to start rtpproxy, result an example of a command line.
I thank for the help
--
- ---
Alexandr Martynjuk, manager of the Network Technologies Department,
ISP Farlep Lviv, Ukraine, phone +380322403340, http://www.lviv.farlep.net
