sr-users December 2007

sr-users@lists.kamailio.org

130 participants
235 discussions

[OpenSER-Users] openser config issue or asterisk bug
by Patrick Baker 14 Dec '07

14 Dec '07

Internal UA's connecting to the sip proxy work fine, but as soon an External UA connects to the sip proxy via a NAT'd public IP address - the call lasts for approx 20 seconds then disconnects. From what I can see openser is attempting to respond to asterisk after the session is initiated via the public IP NAT'd address - and is unable since asterisk and openser are behind the firewall on the internal network ( ELBOW routing ). Any help getting this working would be most appreciated, I would also like to document the issue to help others that encounter similar problems as mine. External phones: UA -> [(public IP) Firewall (NAT to localip)] -> openser -> asterisk Internal phones: UA -> openser -> asterisk #### Layout ( asterisk and openser are on the same machine ) NATD public ip = xxx.206.xxx.136 -> 10.3.1.33 phone ip = xxx.206.xxx.137 openser = 10.3.1.33 p5060 asteriskSIP = 10.3.1.34 p5060 #### Asterisk SIP Config [general] canreinvite=no externip=xxx.206.xxx.136 localnet=10.3.1.0/255.255.255.0 context=default bindport=5060 bindaddr=10.3.1.34 sipdebug=yes [openser] type=friend context=default insecure=very externalnotify=yes allow=all host=10.3.1.33 #### SER LOG Dec 13 22:15:03 phonesys-slave openser[15976]: New request - M=INVITE RURI=sip:500@xxx.206.xxx.136:5060;user=phone F=sip:pbaker@xxx.206.xxx.136 T=sip:500@xxx.206.xxx.136;user=phone IP=xxx.206.xxx.137 ID=f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 Dec 13 22:15:03 phonesys-slave openser[15976]: Callee is not local - M=INVITE RURI=sip:500@xxx.206.xxx.136:5060;user=phone F=sip:pbaker@xxx.206.xxx.136 T=sip:500@xxx.206.xxx.136;user=phone IP=xxx.206.xxx.137 ID=f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 Dec 13 22:15:03 phonesys-slave openser[15976]: Request leaving server, D-URI='<null>' - M=INVITE RURI=sip:500@10.3.1.34:5060;transport=udp F=sip:pbaker@xxx.206.xxx.136 T=sip:500@xxx.206.xxx.136;user=phone IP=xxx.206.xxx.137 ID=f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 Dec 13 22:15:03 phonesys-slave openser[15973]: Reply - S=100 D=Trying F=sip:pbaker@xxx.206.xxx.136 T=sip:500@xxx.206.xxx.136;user=phone IP=10.3.1.34 ID=f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 Dec 13 22:15:03 phonesys-slave openser[15978]: Reply - S=200 D=OK F=sip:pbaker@xxx.206.xxx.136 T=sip:500@xxx.206.xxx.136;user=phone IP=10.3.1.34 ID=f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 Dec 13 22:15:04 phonesys-slave openser[15989]: Reply - S=200 D=OK F=sip:pbaker@xxx.206.xxx.136 T=sip:500@xxx.206.xxx.136;user=phone IP=10.3.1.34 ID=f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 Dec 13 22:15:05 phonesys-slave openser[15986]: Reply - S=200 D=OK F=sip:pbaker@xxx.206.xxx.136 T=sip:500@xxx.206.xxx.136;user=phone IP=10.3.1.34 ID=f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 Dec 13 22:15:07 phonesys-slave openser[15976]: Reply - S=200 D=OK F=sip:pbaker@xxx.206.xxx.136 T=sip:500@xxx.206.xxx.136;user=phone IP=10.3.1.34 ID=f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 #### Asterisk LOG *CLI> [Dec 13 22:15:03] <--- SIP read from 10.3.1.33:5060 ---> INVITE sip:500@10.3.1.34:5060;transport=udp SIP/2.0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone> CSeq: 2 INVITE Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 Contact: <sip:pbaker@xxx.206.xxx.137> Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER User-Agent: PolycomSoundPointIP-SPIP_501-UA/2.1.0.2708 Supported: 100rel,replaces Allow-Events: talk,hold,conference Max-Forwards: 69 Content-Type: application/sdp Content-Length: 254 v=0 o=- 978310717 978310717 IN IP4 xxx.206.xxx.137 s=Polycom IP Phone c=IN IP4 xxx.206.xxx.137 t=0 0 m=audio 35022 RTP/AVP 0 8 18 101 a=sendrecv a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=rtpmap:101 telephone-event/8000 <-------------> [Dec 13 22:15:03] --- (16 headers 11 lines) --- [Dec 13 22:15:03] == Using TOS bits 0 [Dec 13 22:15:03] == Using CoS mark 5 [Dec 13 22:15:03] Sending to 10.3.1.33 : 5060 (no NAT) [Dec 13 22:15:03] Using INVITE request as basis request - f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 [Dec 13 22:15:03] No user 'pbaker' in SIP users list [Dec 13 22:15:03] Found peer 'openser' for 'pbaker' from 10.3.1.33:5060 [Dec 13 22:15:03] Found RTP audio format 0 [Dec 13 22:15:03] Found RTP audio format 8 [Dec 13 22:15:03] Found RTP audio format 18 [Dec 13 22:15:03] Found RTP audio format 101 [Dec 13 22:15:03] Peer audio RTP is at port xxx.206.xxx.137:35022 [Dec 13 22:15:03] Found audio description format PCMU for ID 0 [Dec 13 22:15:03] Found audio description format PCMA for ID 8 [Dec 13 22:15:03] Found audio description format G729 for ID 18 [Dec 13 22:15:03] Found audio description format telephone-event for ID 101 [Dec 13 22:15:03] Capabilities: us - 0x27f9fff (g723|gsm|ulaw|alaw|g726|adpcm|slin|lpc10|g729|speex|ilbc|g726aal2|g722|slin16|jpeg|png|h261|h263|h263p|h264|mpeg4|t140), peer - audio=0x10c (ulaw|alaw|g729)/video=0x0 (nothing)/text=0x0 (nothing), combined - 0x10c (ulaw|alaw|g729) [Dec 13 22:15:03] Non-codec capabilities (dtmf): us - 0x1 (telephone-event), peer - 0x1 (telephone-event), combined - 0x1 (telephone-event) [Dec 13 22:15:03] Peer audio RTP is at port xxx.206.xxx.137:35022 [Dec 13 22:15:03] Looking for 500 in default (domain 10.3.1.34) [Dec 13 22:15:03] list_route: hop: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> [Dec 13 22:15:03] <--- Transmitting (no NAT) to 10.3.1.33:5060 ---> SIP/2.0 100 Trying Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0;received=10.3.1.33 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone> Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 CSeq: 2 INVITE User-Agent: Asterisk PBX SVN-trunk-r92779 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Contact: <sip:500@10.3.1.34> Content-Length: 0 <------------> [Dec 13 22:15:03] -- Executing [500@default:1] Playback("SIP/xxx.206.xxx.136-090b5380", "demo-abouttotry") in new stack [Dec 13 22:15:03] Audio is at 10.3.1.34 port 47068 [Dec 13 22:15:03] Adding codec 0x4 (ulaw) to SDP [Dec 13 22:15:03] Adding codec 0x8 (alaw) to SDP [Dec 13 22:15:03] Adding codec 0x100 (g729) to SDP [Dec 13 22:15:03] Adding non-codec 0x1 (telephone-event) to SDP [Dec 13 22:15:03] <--- Reliably Transmitting (no NAT) to 10.3.1.33:5060 ---> SIP/2.0 200 OK Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0;received=10.3.1.33 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone>;tag=as26a99907 Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 CSeq: 2 INVITE User-Agent: Asterisk PBX SVN-trunk-r92779 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Contact: <sip:500@10.3.1.34> Content-Type: application/sdp Content-Length: 333 v=0 o=root 45593872 45593872 IN IP4 10.3.1.34 s=Asterisk PBX SVN-trunk-r92779 c=IN IP4 10.3.1.34 t=0 0 m=audio 47068 RTP/AVP 0 8 18 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=silenceSupp:off - - - - a=ptime:20 a=sendrecv <------------> [Dec 13 22:15:04] -- <SIP/xxx.206.xxx.136-090b5380> Playing 'demo-abouttotry.slin' (language 'en') [Dec 13 22:15:04] Retransmitting #1 (no NAT) to 10.3.1.33:5060: SIP/2.0 200 OK Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0;received=10.3.1.33 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone>;tag=as26a99907 Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 CSeq: 2 INVITE User-Agent: Asterisk PBX SVN-trunk-r92779 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Contact: <sip:500@10.3.1.34> Content-Type: application/sdp Content-Length: 333 v=0 o=root 45593872 45593872 IN IP4 10.3.1.34 s=Asterisk PBX SVN-trunk-r92779 c=IN IP4 10.3.1.34 t=0 0 m=audio 47068 RTP/AVP 0 8 18 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=silenceSupp:off - - - - a=ptime:20 a=sendrecv --- [Dec 13 22:15:05] Retransmitting #2 (no NAT) to 10.3.1.33:5060: SIP/2.0 200 OK Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0;received=10.3.1.33 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone>;tag=as26a99907 Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 CSeq: 2 INVITE User-Agent: Asterisk PBX SVN-trunk-r92779 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Contact: <sip:500@10.3.1.34> Content-Type: application/sdp Content-Length: 333 v=0 o=root 45593872 45593872 IN IP4 10.3.1.34 s=Asterisk PBX SVN-trunk-r92779 c=IN IP4 10.3.1.34 t=0 0 m=audio 47068 RTP/AVP 0 8 18 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=silenceSupp:off - - - - a=ptime:20 a=sendrecv --- [Dec 13 22:15:07] Retransmitting #3 (no NAT) to 10.3.1.33:5060: SIP/2.0 200 OK Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0;received=10.3.1.33 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone>;tag=as26a99907 Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 CSeq: 2 INVITE User-Agent: Asterisk PBX SVN-trunk-r92779 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Contact: <sip:500@10.3.1.34> Content-Type: application/sdp Content-Length: 333 v=0 o=root 45593872 45593872 IN IP4 10.3.1.34 s=Asterisk PBX SVN-trunk-r92779 c=IN IP4 10.3.1.34 t=0 0 m=audio 47068 RTP/AVP 0 8 18 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=silenceSupp:off - - - - a=ptime:20 a=sendrecv --- [Dec 13 22:15:11] Retransmitting #4 (no NAT) to 10.3.1.33:5060: SIP/2.0 200 OK Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0;received=10.3.1.33 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone>;tag=as26a99907 Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 CSeq: 2 INVITE User-Agent: Asterisk PBX SVN-trunk-r92779 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Contact: <sip:500@10.3.1.34> Content-Type: application/sdp Content-Length: 333 v=0 o=root 45593872 45593872 IN IP4 10.3.1.34 s=Asterisk PBX SVN-trunk-r92779 c=IN IP4 10.3.1.34 t=0 0 m=audio 47068 RTP/AVP 0 8 18 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=silenceSupp:off - - - - a=ptime:20 a=sendrecv --- [Dec 13 22:15:15] Retransmitting #5 (no NAT) to 10.3.1.33:5060: SIP/2.0 200 OK Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0;received=10.3.1.33 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone>;tag=as26a99907 Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 CSeq: 2 INVITE User-Agent: Asterisk PBX SVN-trunk-r92779 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Contact: <sip:500@10.3.1.34> Content-Type: application/sdp Content-Length: 333 v=0 o=root 45593872 45593872 IN IP4 10.3.1.34 s=Asterisk PBX SVN-trunk-r92779 c=IN IP4 10.3.1.34 t=0 0 m=audio 47068 RTP/AVP 0 8 18 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=silenceSupp:off - - - - a=ptime:20 a=sendrecv --- [Dec 13 22:15:18] -- Executing [500@default:2] Dial("SIP/xxx.206.xxx.136-090b5380", "IAX2/guest@misery.digium.com/s@default") in new stack [Dec 13 22:15:18] -- Called guest@misery.digium.com/s@default [Dec 13 22:15:18] -- Call accepted by 216.207.245.8 (format gsm) [Dec 13 22:15:18] -- Format for call is gsm [Dec 13 22:15:18] -- IAX2/216.207.245.8:4569-1 is ringing [Dec 13 22:15:19] -- IAX2/216.207.245.8:4569-1 answered SIP/xxx.206.xxx.136-090b5380 [Dec 13 22:15:19] Retransmitting #6 (no NAT) to 10.3.1.33:5060: SIP/2.0 200 OK Via: SIP/2.0/UDP 10.3.1.33;branch=z9hG4bK2fc1.94c7bb96.0;received=10.3.1.33 Via: SIP/2.0/UDP xxx.206.xxx.137;rport=5060;branch=z9hG4bKcbd9a65f8D4E5FE0 Record-Route: <sip:10.3.1.33;lr;ftag=CFE2AAA1-5B882804> From: "pbaker" <sip:pbaker@xxx.206.xxx.136>;tag=CFE2AAA1-5B882804 To: <sip:500@xxx.206.xxx.136;user=phone>;tag=as26a99907 Call-ID: f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 CSeq: 2 INVITE User-Agent: Asterisk PBX SVN-trunk-r92779 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Contact: <sip:500@10.3.1.34> Content-Type: application/sdp Content-Length: 333 v=0 o=root 45593872 45593872 IN IP4 10.3.1.34 s=Asterisk PBX SVN-trunk-r92779 c=IN IP4 10.3.1.34 t=0 0 m=audio 47068 RTP/AVP 0 8 18 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=silenceSupp:off - - - - a=ptime:20 a=sendrecv --- [Dec 13 22:15:23] WARNING[16421]: chan_sip.c:2337 retrans_pkt: Maximum retries exceeded on transmission f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 for seqno 2 (Critical Response) [Dec 13 22:15:23] WARNING[16421]: chan_sip.c:2364 retrans_pkt: Hanging up call f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137 - no reply to our critical packet. [Dec 13 22:15:23] -- Hungup 'IAX2/216.207.245.8:4569-1' [Dec 13 22:15:23] == Spawn extension (default, 500, 2) exited non-zero on 'SIP/xxx.206.xxx.136-090b5380' [Dec 13 22:15:24] Really destroying SIP dialog 'f7232b5-5d4b9a93-e6ff617e(a)xxx.206.xxx.137' Method: INVITE #### PCAP Diagram |Time | xxx.206.xxx.137 | 10.3.1.33 | |5.056 | Request: INVITE sip |SIP/SDP: Request: INVITE sip:500@xxx.206.xxx.136:5060;user=phone, with session description | |(5060) ------------------> (5060) | |5.058 | Status: 100 Trying |SIP: Status: 100 Trying | |(5060) <------------------ (5060) | |5.058 | Status: 407 Proxy A |SIP: Status: 407 Proxy Authentication Required | |(5060) <------------------ (5060) | |5.140 | Request: ACK sip:50 |SIP: Request: ACK sip:500@xxx.206.xxx.136:5060 | |(5060) ------------------> (5060) | |5.165 | Request: INVITE sip |SIP/SDP: Request: INVITE sip:500@xxx.206.xxx.136:5060;user=phone, with session description | |(5060) ------------------> (5060) | |5.165 | Status: 100 Trying |SIP: Status: 100 Trying | |(5060) <------------------ (5060) | |5.168 | Status: 200 OK, wit |SIP/SDP: Status: 200 OK, with session description | |(5060) <------------------ (5060) | |6.169 | Status: 200 OK, wit |SIP/SDP: Status: 200 OK, with session description | |(5060) <------------------ (5060) | |7.168 | Status: 200 OK, wit |SIP/SDP: Status: 200 OK, with session description | |(5060) <------------------ (5060) | |9.168 | Status: 200 OK, wit |SIP/SDP: Status: 200 OK, with session description | |(5060) <------------------ (5060) | |13.169 | Status: 200 OK, wit |SIP/SDP: Status: 200 OK, with session description | |(5060) <------------------ (5060) | |17.169 | Status: 200 OK, wit |SIP/SDP: Status: 200 OK, with session description | |(5060) <------------------ (5060) | |21.169 | Status: 200 OK, wit |SIP/SDP: Status: 200 OK, with session description | |(5060) <------------------ (5060) | #### OpenSER Config 1.2 ######################################################################## # This configuration is autogenerated by sip:wizard # (http://www.sipwise.com/wizard) on Thu Dec 13 22:43:43 +0100 2007 # for OpenSER 1.2 # # Copyright (C) 2007 Sipwise (support(a)sipwise.com) ######################################################################## ######################################################################## # By obtaining, using, and/or copying this configuration and/or its # associated documentation, you agree that you have read, understood, # and will comply with the Terms of Usage provided at # http://www.sipwise.com/news/?page_id=6 as well as the following # additions: # # Permission to use, copy, modify, and distribute this configuration and # its associated documentation for any purpose and without fee is hereby # granted, provided that the above copyright notice appears in all # copies, and that both that copyright notice and this permission notice # appear in supporting documentation, and that the name of Sipwise or # the author will not be used in advertising or publicity pertaining to # distribution of the configuration without specific, written prior # permission. ######################################################################## ######################################################################## # Before using this configuration, read the following prerequisites in # order to gain the designated functionallity: # # base: # You have to insert all locally served domains (i.e. # "openserctl domain add your.domain.com"). # # nat-rtpproxy: # You have to install RTPProxy # (http://www.openser.org/downloads/snapshots/rtpproxy/) for relaying # RTP traffic. # # offnet-pstn: # You have to add a routing entry for lcr (i.e. "openserctl lcr # addroute '' '' 1 1"). Additionally, you have to add your gateways # (i.e. "openserctl lcr addgw my-test-gw 1.2.3.4 5060 sip udp 1"). # ######################################################################## ######################################################################## # Configuration 'sip:wizard - Thu Dec 13 22:43:43 +0100 2007' ######################################################################## listen = udp:10.3.1.33:5060 mpath = "/usr/local/lib/openser/modules" children = 8 debug = 3 fork = yes group = "openser" user = "openser" disable_tcp = no log_facility = LOG_DAEMON log_stderror = no tcp_children = 4 mhomed = no server_signature = yes sock_group = "openser" sock_mode = 0600 sock_user = "openser" unix_sock = "/tmp/openser.sock" unix_sock_children = 1 reply_to_via = no sip_warning = yes check_via = no dns = no rev_dns = no disable_core_dump = no dns_try_ipv6 = yes dns_use_search_list = yes loadmodule "usrloc.so" modparam("usrloc", "user_column", "username") modparam("usrloc", "domain_column", "domain") modparam("usrloc", "contact_column", "contact") modparam("usrloc", "expires_column", "expires") modparam("usrloc", "q_column", "q") modparam("usrloc", "callid_column", "callid") modparam("usrloc", "cseq_column", "cseq") modparam("usrloc", "methods_column", "methods") modparam("usrloc", "flags_column", "flags") modparam("usrloc", "user_agent_column", "user_agent") modparam("usrloc", "received_column", "received") modparam("usrloc", "socket_column", "socket") modparam("usrloc", "use_domain", 0) modparam("usrloc", "desc_time_order", 0) modparam("usrloc", "timer_interval", 60) modparam("usrloc", "db_url", "mysql://openser:openserrw@localhost/openser") modparam("usrloc", "db_mode", 1) modparam("usrloc", "matching_mode", 0) modparam("usrloc", "cseq_delay", 20) modparam("usrloc", "nat_bflag", 6) loadmodule "textops.so" loadmodule "rr.so" modparam("rr", "enable_full_lr", 0) modparam("rr", "append_fromtag", 1) modparam("rr", "enable_double_rr", 1) modparam("rr", "add_username", 0) loadmodule "tm.so" modparam("tm", "fr_timer", 30) modparam("tm", "fr_inv_timer", 120) modparam("tm", "wt_timer", 5) modparam("tm", "delete_timer", 2) modparam("tm", "noisy_ctimer", 0) modparam("tm", "ruri_matching", 1) modparam("tm", "via1_matching", 1) modparam("tm", "unix_tx_timeout", 2) modparam("tm", "restart_fr_on_each_reply", 1) modparam("tm", "pass_provisional_replies", 0) loadmodule "xlog.so" modparam("xlog", "buf_size", 4096) modparam("xlog", "force_color", 0) loadmodule "mi_fifo.so" modparam("mi_fifo", "fifo_name", "/tmp/openser_fifo") modparam("mi_fifo", "fifo_mode", 0660) modparam("mi_fifo", "fifo_group", "openser") modparam("mi_fifo", "fifo_user", "openser") modparam("mi_fifo", "reply_dir", "/tmp/") modparam("mi_fifo", "reply_indent", "\t") loadmodule "domain.so" modparam("domain", "db_url", "mysql://openser:openserrw@localhost/openser") modparam("domain", "db_mode", 1) modparam("domain", "domain_table", "domain") modparam("domain", "domain_col", "domain") loadmodule "nathelper.so" modparam("nathelper", "natping_interval", 60) modparam("nathelper", "ping_nated_only", 1) modparam("nathelper", "rtpproxy_sock", "unix:/var/run/rtpproxy.sock") modparam("nathelper", "rtpproxy_disable", 0) modparam("nathelper", "rtpproxy_disable_tout", 60) modparam("nathelper", "rtpproxy_tout", 1) modparam("nathelper", "rtpproxy_retr", 5) modparam("nathelper", "sipping_method", "OPTIONS") modparam("nathelper", "received_avp", "$avp(i:801)") loadmodule "sl.so" modparam("sl", "enable_stats", 1) loadmodule "uri.so" loadmodule "registrar.so" modparam("registrar", "default_expires", 3600) modparam("registrar", "min_expires", 60) modparam("registrar", "max_expires", 0) modparam("registrar", "default_q", 0) modparam("registrar", "append_branches", 1) modparam("registrar", "case_sensitive", 0) modparam("registrar", "received_param", "received") modparam("registrar", "max_contacts", 0) modparam("registrar", "retry_after", 0) modparam("registrar", "method_filtering", 0) modparam("registrar", "path_mode", 2) modparam("registrar", "path_use_received", 0) modparam("registrar", "received_avp", "$avp(i:801)") loadmodule "maxfwd.so" modparam("maxfwd", "max_limit", 256) loadmodule "mysql.so" modparam("mysql", "ping_interval", 300) modparam("mysql", "auto_reconnect", 1) loadmodule "auth.so" modparam("auth", "nonce_expire", 300) modparam("auth", "rpid_suffix", ";party=calling;id-type=subscriber;screen=yes") modparam("auth", "rpid_avp", "$avp(s:rpid)") loadmodule "auth_db.so" modparam("auth_db", "db_url", "mysql://openser:openserrw@localhost/openser") modparam("auth_db", "user_column", "username") modparam("auth_db", "domain_column", "domain") modparam("auth_db", "password_column", "password") modparam("auth_db", "password_column_2", "ha1b") modparam("auth_db", "calculate_ha1", 1) modparam("auth_db", "use_domain", 0) modparam("auth_db", "load_credentials", "rpid") loadmodule "uri_db.so" modparam("uri_db", "db_url", "mysql://openser:openserrw@localhost/openser") modparam("uri_db", "uri_table", "uri") modparam("uri_db", "uri_user_column", "username") modparam("uri_db", "uri_domain_column", "domain") modparam("uri_db", "uri_uriuser_column", "uri_user") modparam("uri_db", "subscriber_table", "subscriber") modparam("uri_db", "subscriber_user_column", "username") modparam("uri_db", "subscriber_domain_column", "domain") modparam("uri_db", "use_uri_table", 0) modparam("uri_db", "use_domain", 0) loadmodule "lcr.so" modparam("lcr", "db_url", "mysql://openser:openserrw@localhost/openser") modparam("lcr", "gw_table", "gw") modparam("lcr", "gw_name_column", "gw_name") modparam("lcr", "ip_addr_column", "ip_addr") modparam("lcr", "port_column", "port") modparam("lcr", "uri_scheme_column", "uri_scheme") modparam("lcr", "transport_column", "transport") modparam("lcr", "grp_id_column", "grp_id") modparam("lcr", "lcr_table", "lcr") modparam("lcr", "strip_column", "strip") modparam("lcr", "prefix_column", "prefix") modparam("lcr", "from_uri_column", "from_uri") modparam("lcr", "priority_column", "priority") modparam("lcr", "gw_uri_avp", "1400") modparam("lcr", "ruri_user_avp", "1402") modparam("lcr", "contact_avp", "1401") modparam("lcr", "fr_inv_timer_avp", "s:fr_inv_timer_avp") modparam("lcr", "fr_inv_timer", 90) modparam("lcr", "fr_inv_timer_next", 30) modparam("lcr", "rpid_avp", "s:rpid") ######################################################################## # Request route 'main' ######################################################################## route[0] { xlog("L_INFO", "New request - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); force_rport(); if(msg:len > max_len) { xlog("L_INFO", "Message too big - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("513", "Message Too Big"); exit; } if (!mf_process_maxfwd_header("10")) { xlog("L_INFO", "Too many hops - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("483", "Too Many Hops"); exit; } if(!is_method("REGISTER")) { if(nat_uac_test("19")) { record_route(";nat=yes"); } else { record_route(); } } if(is_method("CANCEL") || is_method("BYE")) { unforce_rtp_proxy(); } if(loose_route()) { if(!has_totag()) { xlog("L_INFO", "Initial loose-routing rejected - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("403", "Initial Loose-Routing Rejected"); exit; } if(nat_uac_test("19") || search("^Route:.*;nat=yes")) { fix_nated_contact(); setbflag(6); } route(3); } if(is_method("REGISTER")) { route(2); } if(is_method("INVITE")) { route(4); } if(is_method("CANCEL") || is_method("ACK")) { route(8); } route(9); } ######################################################################## # Request route 'stop-rtp-proxy' ######################################################################## route[1] { if(isflagset(22)) { unforce_rtp_proxy(); } } ######################################################################## # Request route 'base-route-register' ######################################################################## route[2] { sl_send_reply("100", "Trying"); if(!www_authorize("", "subscriber")) { xlog("L_INFO", "Register authentication failed - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); www_challenge("", "0"); exit; } if(!check_to()) { xlog("L_INFO", "Spoofed To-URI detected - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("403", "Spoofed To-URI Detected"); exit; } consume_credentials(); if(!search("^Contact:[ ]*\*") && nat_uac_test("19")) { fix_nated_register(); setbflag(6); } if(!save("location")) { xlog("L_ERR", "Saving contact failed - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_reply_error(); exit; } xlog("L_INFO", "Registration successful - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); exit; } ######################################################################## # Request route 'base-outbound' ######################################################################## route[3] { if(isbflagset(6)) { if(!isflagset(22) && !search("^Content-Length:[ ]*0")) { setflag(22); force_rtp_proxy(); } t_on_reply("2"); } else { t_on_reply("1"); } if(!isflagset(21)) { t_on_failure("2"); } if(isflagset(29)) { append_branch(); } if(is_present_hf("Proxy-Authorization")) { consume_credentials(); } xlog("L_INFO", "Request leaving server, D-URI='$du' - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); # no 100 (we already sent it) and no DNS blacklisting if(!t_relay("0x05")) { sl_reply_error(); if(is_method("INVITE") && isbflagset(6)) { unforce_rtp_proxy(); } } exit; } ######################################################################## # Request route 'base-route-invite' ######################################################################## route[4] { sl_send_reply("100", "Trying"); if(from_gw()) { xlog("L_INFO", "Call from PSTN' - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); setflag(23); } else { if(!proxy_authorize("", "subscriber")) { xlog("L_INFO", "Proxy authentication failed - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); proxy_challenge("", "0"); exit; } if(!check_from()) { xlog("L_INFO", "Spoofed From-URI detected - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("403", "Spoofed From-URI Detected"); exit; } } if(nat_uac_test("19")) { fix_nated_contact(); setbflag(6); } route(5); } ######################################################################## # Request route 'invite-find-callee' ######################################################################## route[5] { if(!is_domain_local("$rd")) { setflag(20); route(7); } if(does_uri_exist()) { xlog("L_INFO", "Callee is local - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); route(6); } else { xlog("L_INFO", "Callee is not local - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); route(7); } exit; } ######################################################################## # Request route 'invite-to-internal' ######################################################################## route[6] { if(!lookup("location")) { xlog("L_INFO", "Local user offline - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("404", "User Offline"); } else { xlog("L_INFO", "Local user online - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); route(3); } exit; } ######################################################################## # Request route 'invite-to-external' ######################################################################## route[7] { if(isflagset(20)) { xlog("L_INFO", "Call to foreign domain - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); route(3); exit; } if(!isflagset(23)) { # don't allow calls relaying from PSTN to PSTN, if not explicitely forwarded if(uri =~ "^sip:[0-9]+@") { # only route numeric users to PSTN if(!load_gws()) { xlog("L_ERR", "Error loading PSTN gateways - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("503", "PSTN Termination Currently Unavailable"); exit; } if(!next_gw()) { xlog("L_ERR", "No PSTN gateways available - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("503", "PSTN Termination Currently Unavailable"); exit; } setflag(21); t_on_failure("1"); route(3); } } xlog("L_INFO", "Call to unknown user - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("404", "User Not Found"); exit; } ######################################################################## # Request route 'base-route-local' ######################################################################## route[8] { t_on_reply("1"); if(t_check_trans()) { xlog("L_INFO", "Request leaving server - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); if(!t_relay()) { sl_reply_error(); } } else { xlog("L_INFO", "Dropping mis-routed request - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); } exit; } ######################################################################## # Request route 'base-route-generic' ######################################################################## route[9] { xlog("L_INFO", "Method not supported - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); sl_send_reply("501", "Method Not Supported Here"); exit; } ######################################################################## # Request route 'base-filter-failover' ######################################################################## route[10] { if(!t_check_status("408|500|503")) { xlog("L_INFO", "No failover routing needed for this response code - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); route(1); exit; } } ######################################################################## # Reply route 'base-standard-reply' ######################################################################## onreply_route[1] { xlog("L_INFO", "Reply - S=$rs D=$rr F=$fu T=$tu IP=$si ID=$ci\n"); exit; } ######################################################################## # Reply route 'base-nat-reply' ######################################################################## onreply_route[2] { xlog("L_INFO", "NAT-Reply - S=$rs D=$rr F=$fu T=$tu IP=$si ID=$ci\n"); if(nat_uac_test("1")) { fix_nated_contact(); } if(isbflagset(6) && status=~"(180)|(183)|2[0-9][0-9]") { if(!search("^Content-Length:[ ]*0")) { force_rtp_proxy(); } } exit; } ######################################################################## # Failure route 'pstn-failover' ######################################################################## failure_route[1] { xlog("L_INFO", "Failure route for PSTN entered - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); route(10); if(!next_gw()) { xlog("L_ERR", "Failed to select next PSTN gateway - M=$rm RURI=$ru F=$fu T=$tu IP=$si ID=$ci\n"); route(1); exit; } t_on_failure("1"); route(3); } ######################################################################## # Failure route 'base-standard-failure' ######################################################################## failure_route[2] { route(10); route(1); }

2 1

[OpenSER-Users] Missed calls
by David Villasmil Govea 14 Dec '07

14 Dec '07

Hello all, I've configured Openser 1.2 with accounting + mysql. at the momento i'm only loggin: BYE CANCEL INVITE REGISTER * How do i identify missed calls? * Furthermore, Openser doesn't see all INVITES+BYE, so i can't make cdrs!! I've read somewhere that to log all transaction messages i should have "strict route" as oppossed to "loose route". Is that enabled by: modparam("rr", "enable_full_lr", 0) ?? Thanks a lot! this is my config: # # sample config file to be used with nathelper/rtpproxy # # start RTPProxy with: rtpproxy -l your_public_ip -s udp:localhost:8899 # # ----------- global configuration parameters ------------------------ debug=2 # debug level (cmd line: -dddddddddd) fork=yes log_stderror=yes # (cmd line: -E) # Uncomment these lines to enter debugging mode #fork=no #log_stderror=yes check_via=no # (cmd. line: -v) dns=no # (cmd. line: -r) rev_dns=no # (cmd. line: -R) port=5060 children=20 disable_dns_blacklist=true # # --- module loading mpath="/usr/lib/openser/modules/" loadmodule "mysql.so" loadmodule "sl.so" loadmodule "tm.so" loadmodule "rr.so" loadmodule "maxfwd.so" loadmodule "usrloc.so" loadmodule "registrar.so" loadmodule "textops.so" loadmodule "nathelper.so" loadmodule "auth.so" loadmodule "auth_db.so" loadmodule "mi_fifo.so" loadmodule "dispatcher.so" #loadmodule "domain.so" loadmodule "xlog.so" loadmodule "/usr/lib/openser/modules/acc.so" modparam("acc", "early_media", 1) modparam("acc", "report_cancels", 1) modparam("acc", "db_flag", 2) modparam("acc", "db_url", "mysql://user:password@localhost/openser") modparam("acc", "report_ack", 0) modparam("acc", "db_missed_flag", 3) modparam("acc", "failed_transaction_flag", 4) modparam("acc", "db_extra", "from_uri=$fu ; to_uri=$tu ; from_user=$fU; source_ip=$si") # # CONSTANTS # # --- setting module parameters #modparam("domain","db_url","mysql://user:password@localhost/openser") #modparam("domain", "db_mode", 1) #modparam("domain", "domain_table", "domain") #modparam("domain", "domain_col", "domain") modparam("xlog", "buf_size", 8192) # --- setting module parameters modparam("dispatcher", "list_file", "/etc/openser/dispatcher.list") # -- mi_fifo params -- modparam("mi_fifo", "fifo_name", "/tmp/openser_fifo") modparam("usrloc|auth_db","db_url","mysql://user:password@localhost /openser") # -- usrloc params -- modparam("usrloc", "db_mode", 1) modparam("usrloc", "nat_bflag", 6) #modparam("usrloc", "use_domain", 0) # -- registrar params -- modparam("registrar|nathelper", "received_avp", "$avp(i:42)") # -- auth params -- modparam("auth_db", "calculate_ha1", yes) modparam("auth_db", "password_column", "password") #modparam("auth_db", "use_domain", 0) # -- rr params -- #modparam("rr", "enable_full_lr", 1) # -- nathelper modparam("nathelper", "rtpproxy_sock", "udp:1.2.3.5:8899") modparam("nathelper", "natping_interval", 30) modparam("nathelper", "ping_nated_only", 1) modparam("nathelper", "sipping_bflag", 7) modparam("nathelper", "sipping_from", "sip:pinger@sip2.telmaxi.com.br") #modparam("registrar", "max_contacts", 1) # --- main routing logic route{ if (method=="INVITE") { xlog("L_NOTICE", "INVITE MESSAGE RECEIVED - START ACC\n"); setflag(2); setflag(3); setflag(4); }; if (method=="BYE") { xlog ("L_NOTICE", "BYE - STOP ACCOUNTING\n"); setflag(2); setflag(3); setflag(4); }; if (method=="CANCEL") { xlog ("L_NOTICE", "CANCEL - STOP ACCOUNTING\n"); setflag(2); setflag(3); setflag(4); }; if (method=="REGISTER") { setflag(2); setflag(3); setflag(4); }; if (!mf_process_maxfwd_header("100")) { sl_send_reply("483","Too Many Hops"); exit; }; #if (msg:len >= 2048 ) { # sl_send_reply("513", "Message too big"); # exit; #}; # NAT detection route(2); if (!method=="REGISTER") record_route(); if (loose_route()) { append_hf("P-hint: rr-enforced\r\n"); route(1); }; if (!uri==myself) { # if (!is_uri_host_local() ) { append_hf("P-hint: outbound\r\n"); route(1); }; if (uri==myself) { if (method=="REGISTER") { xlog("L_NOTICE", "\nNew Registration\n"); if (!www_authorize("1.2.3.4", "subscriber")) { xlog("L_NOTICE", "\nRegistration FAILED! CLIENT: $au\n"); www_challenge("1.2.3.4", "0"); exit; }; if (isflagset(5)) { xlog("L_NOTICE", "\nRegistration OK\n"); setbflag(6); # if you want OPTIONS natpings uncomment next # setbflag(7); }; save("location"); exit; }; if (uri=~"^sip:0"){ xlog("L_NOTICE", "\n************** GOT OUTSIDE CALL ************\n"); ds_select_dst("1","2"); sl_send_reply("100","Trying"); forward(); exit(); } if (uri=~"^sip:7"){ ds_select_dst("1","2"); sl_send_reply("100","Trying"); forward(); exit(); } if (uri=~"^sip:1"){ ds_select_dst("1","2"); sl_send_reply("100","Trying"); forward(); exit(); } if (!lookup("location")) { sl_send_reply("404", "Not Found"); exit; }; append_hf("P-hint: usrloc applied\r\n"); #}; }; route(1); } route[1] { xlog("L_NOTICE", "\n**************IN ROUTE 1************\n"); if (subst_uri('/(sip:.*);nat=yes/\1/')){ setbflag(6); }; if (isflagset(5)||isbflagset(6)) { route(3); } if (!t_relay()) { sl_reply_error(); }; exit; } route[2]{ force_rport(); if (nat_uac_test("19")) { if (method=="REGISTER") { fix_nated_register(); } else { fix_nated_contact(); }; setflag(5); }; } route[3] { if (is_method("BYE|CANCEL")) { unforce_rtp_proxy(); } else if (is_method("INVITE")){ force_rtp_proxy(); t_on_failure("1"); }; if (isflagset(5)) search_append('Contact:.*sip:[^>[:cntrl:]]*', ';nat=yes'); t_on_reply("1"); } failure_route[1] { if (isbflagset(6) || isflagset(5)) { unforce_rtp_proxy(); } } onreply_route[1] { if ((isflagset(5) || isbflagset(6)) && status=~"(183)|(2[0-9][0-9])") { force_rtp_proxy(); } search_append('Contact:.*sip:[^>[:cntrl:]]*', ';nat=yes'); if (isbflagset(6)) { fix_nated_contact(); } exit; }

2 1

[OpenSER-Users] Security hole in REGISTER's Contact using domain
by Iñaki Baz Castillo 14 Dec '07

14 Dec '07

Hi, Permissions module tries to avoid REGISTER with privileged IP's in Contact (using "register.deny" file) but I have some doubs about this security. I'll play with the example explained in "register.deny" file: --------------------------------------------------------------------------------------- # Suppose that we have a PSTN gateway with IP address 1.2.3.4 # We should prevent REGISTER messages that contain that IP # address in Contact header field because that can cause serious # security hole (a malicious user might be able to register such # a contact and bypass security checks performed by the SIP proxy). # # The following line prevents registering Contacts with IP 1.2.3.4 # (Don't forget to list also all hostnames that can be used to # reach the PSTN gateway) ALL : "^sip:.*1\.2\.3\.4" --------------------------------------------------------------------------------------- Ok, now a malicious user could just use SipSak to send a malicious REGISTER to call for free to a PSTN number 01666555444: ~# sipsak -U -C sip:01666555444@1.2.3.00004 -a passwd -s sip:200@domain.org Note the "000004" !!!! So this causes a entry in "location" with fields: - username = 200 - domain = domain.org - contact = sip:01666555444@1.2.3.00004 And sure 1.2.3.00004 is a valid IPv4. This is: if the user calls itself (sip:200@domain.org) he'll get a free PSTN call. Oppss... Ok, a solution could be to improve the regular expression by avoiding any number of 0's: ALL : "^sip:.*0*1\.0*2\.0*3\.0*4" Ok, but now the malicious user can register a domain "hacking_my_proxy.com" to resolve to IP 1.2.3.4, and send this REGISTER: ~# sipsak -U -C sip:01666555444@hacking_my_proxy.com -a passwd -s sip:200@domain.org So this will bypass the "register.deny" policy !!!! Note that "register.deny" file says: # (Don't forget to list also all hostnames that can be used to # reach the PSTN gateway) Of course, it's not possible to list all hostnames and domain resolving an IP (anyone can register a domain to any IP). So then... is it really valid this "register.deny" security???? Solution for this? ------------------------- - Forbid hostnames or domains in Contact: Ohh, too much anti-RFC 3261 (what would "alice(a)pc33.atlanta.com" think about it? XDDD). - Do a DNS query for the "Contact" during REGISTER: What about if DNS changes later? - Match the resolved IP against IP's in "register.deny" for every INVITE leaving OpenSer. Humm. - Avoid OpenSer using internet DNS system (so "hacking_my_proxy.com" wouldn't be resolved) and allow just secure domains (internal DNS or /etc/hosts): and what about outbound calls? isn't this solution an atrocity? How to handle it? is it not a real security hole? Comments are welcome. Regards. -- Iñaki Baz Castillo

5 13

[OpenSER-Users] which media server to use to write a Ringback Tone application
by Srinivas Kotamarti 14 Dec '07

14 Dec '07

All, I am trying to write a carrier grade Ringback Tone application on top of OpenSER, does anybody know which media server (preferably OpenSource) to use? Is WeSIP the only way to write an application on top of OpenSER or there are otherways? Also, does anybody know how the applications in WeSIP perform can they be deployed as a carrier grade solution? Regards --Srinivas Kotamarti

2 1

[OpenSER-Users] 1.3.0 FreeBSD port committed to svn
by Jesus Rodriguez 14 Dec '07

14 Dec '07

Hi, Yesterday night i committed to the svn the update of the FreeBSD port to 1.3.0 version. This update will also be committed in the FreeBSD ports tree as soon as possible. Meanwhile, if you want to use the port or create your own packages, you can obtain the port here: http://openser.svn.sourceforge.net/viewvc/openser/branches/1.3/packaging/fr… Regards. Saludos JesusR. ------------------------------------ Jesus Rodriguez VozTelecom Sistemas, S.L. jesusr(a)voztele.com http://www.voztele.com Tel. 902360305 -------------------------------------

1 0

[OpenSER-Users] PARALLEL FORKING
by Gomtesh Jain 14 Dec '07

14 Dec '07

Hi All , I am trying to do parallel forking from Openser.But when I call then one user gets 2 calls and rest of the users get one call . Please any one explain why it is happening. Here I attach my openser.cfg file... # main routing logic route{ # initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); exit; }; if (msg:len >= 2048 ) { sl_send_reply("513", "Message too big"); exit; }; # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities # use different transport protocol if (!method=="REGISTER") record_route(); # subsequent messages withing a dialog should take the # path determined by record-routing if (loose_route()) { # mark routing logic in request append_hf("P-hint: rr-enforced\r\n"); route(1); }; if (!uri==myself) { # mark routing logic in request append_hf("P-hint: outbound\r\n"); # if you have some interdomain connections via TLS #if(uri=~"@tls_domain1.net") { # t_relay("tls:domain1.net"); # exit; #} else if(uri=~"@tls_domain2.net") { # t_relay("tls: domain2.net"); # exit; #} route(1); }; # if the request is for other domain use UsrLoc # (in case, it does not work, use the following command # with proper names and addresses in it) if (uri==myself) { if (method=="REGISTER") { # Uncomment this if you want to use digest authentication #if (!www_authorize("192.168.3.15", "subscriber")) { # www_challenge("192.168.3.15", "0"); # exit; #}; save("location"); exit; }; lookup("aliases"); log("I M IN lookup"); if (!uri==myself) { append_hf("P-hint: outbound alias\r\n"); route(1); }; # native SIP destinations are handled using our USRLOC DB if (!lookup("location")) { sl_send_reply("404", "Not Found"); exit; } else { append_branch(); append_hf("P-hint: usrloc applied\r\n"); t_relay(); } }; route(1); }

2 1

Re: [OpenSER-Users] Preparing the release of OpenSER 1.3 "BlackCat"
by Sergio Gutierrez 14 Dec '07

14 Dec '07

Hi Bogdan. The compilation on Solaris 10/SPARC has ended succesfully. Acording to my current setup, in particular, related to fulfilled dependencies, my final gmake command was: *gmake exclude_modules="jabber mi_xmlrpc osp perl postgres unixodbc snmpstats xmpp tlsops db_berkeley ldap mi_dm perlvdb xcap_client" *I have mysql 5.0.22 and radiusclient 0.5.2 The attached file contains the whole warnings reported at the compilation process; most of them are related to assignments without casting, and implicit declaration of functions. I will peform the TLS compilation, and the testing on Solaris x86, and I will be notifying you as soon as they end. If there is something I can help, or another test you would like I perform, please let me know. Best Regards. Sergio Gutiérrez EPM Telecomunicaciones Medellin, Colombia Tel: +574 - 3802947 On Dec 12, 2007 4:54 PM, Sergio Gutierrez <saguti(a)gmail.com> wrote: > Hi Bogdan. > > Continuing with compilation, this error appeared when compiling LDAP > module: > > In file included from ldap_api_fn.c:40: > ldap_api_fn.h:57: error: conflicting types for 'ldap_url_search' > /usr/include/ldap.h:789: error: previous declaration of 'ldap_url_search' > was here > ldap_api_fn.h:57: error: conflicting types for 'ldap_url_search' > /usr/include/ldap.h:789: error: previous declaration of 'ldap_url_search' > was here > ldap_api_fn.c: In function `ldap_params_search': > ldap_api_fn.c:211: warning: implicit declaration of function > `LDAP_API_ERROR' > > In my case, I do not have OpenLDAP libraries installed, but my system has > the LDAP library which is standard on Solaris since Solaris 9. > > checking at the manual, I see the declaration on Solaris is: > > int *ldap_url_search*(LDAP *ld, char *url, int attrsonly); > > > Please, let me know how can we continue. > > Regards. > > Sergio. > > > > On Dec 12, 2007 4:22 PM, Bogdan-Andrei Iancu < bogdan(a)voice-system.ro> > wrote: > > > Hi Sergio, > > > > Thanks for the feedback - I'm glad we were able to catch this issue in > > last minutes before release :). I also applied your patch for the > > Makefile of the carrierroute module. > > > > Regards, > > Bogdan > > > > Sergio Gutierrez wrote: > > > Hi Bogdan. > > > > > > The compilation so far is going right, with no warnings; > > > > > > A modification I did is I installed libconfuse, because for our > > > particular setup we are interested in exploring the carrierroute > > > module; I installed at my LOCALBASE, and at compiling the module, it > > > failed; trying to fix it I added a couple lines to the Makefile of the > > > module as indicated at the following diff; I am not sure if they are > > > required, but they fixed my problem: > > > > > > > > > ------------------------- BEGIN DIFF > > > --- Makefile Wed Dec 12 16:05:06 2007 > > > +++ Makefile.saguti Wed Dec 12 16:04:58 2007 > > > @@ -8,7 +8,8 @@ > > > include ../../Makefile.defs > > > auto_gen= > > > NAME=carrierroute.so > > > -LIBS=-lconfuse > > > +LIBS+=-L$(LOCALBASE)/lib -lconfuse > > > +DEFS+=-I$(LOCALBASE)/include > > > > > > include ../../Makefile.modules > > > > > > ------------------------ END DIFF > > > > > > I will try again the compilation, and I hope to test it too on Solaris > > > x86. > > > > > > Best regards. > > > > > > Sergio. > > > > > > > >

2 4

[OpenSER-Users] OpenSER 1.3.0 BlackCat is released !
by Bogdan-Andrei Iancu 14 Dec '07

14 Dec '07

Hi, I'm glad to announce that OpenSER 1.3.0 was released - I want to thanks to all people that contributed to it, as code, documentation, assistance, packaging, etc... The SVN branch for 1.3 and tag for 1.3.0 was created, so feel free to download : # svn co https://openser.svn.sourceforge.net/svnroot/openser/branches/1.3 openser As tarballs, only source (tls and non-tls) and linux binaries are available on openser.org site. In the next following days packages will be uploaded on both openser.org and SF sites. There are still pending to upload on the sites a news about the features in 1.3.0, about migration from 1.2 to 1.3 - all these will be done in the following days. More announcement email (for detailed) will follow ;). Regards, Bogdan

4 5

[OpenSER-Users] SUSE packages
by Daniel-Constantin Mierla 13 Dec '07

13 Dec '07

Thanks to Peter Nixon, the OpenSER 1.3.0 packages for different flavors of SUSE are already available: http://download.opensuse.org/repositories/network:/telephony/ More details about how to use the repository with different package managers: http://www.openser.org/mos/view/Download/ Cheers, Daniel

1 0

[OpenSER-Users] openser 1.3.0 release notes
by Daniel-Constantin Mierla 13 Dec '07

13 Dec '07

Hello, the release notes for version 1.3.0 are available at: http://www.openser.org/mos/view/OpenSER-v1.3.x-Release-Notes/ If you feel that something is missing, let me know to update the page. Enjoy the new version! Daniel

1 0

← Newer
1
...
10
11
12
13
14
15
16
...
24
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users December 2007