sr-users

sr-users@lists.kamailio.org

42 participants
37519 discussions

Security in proxy
by Anto 20 Jun '11

20 Jun '11

Hi After reading the modules pike, pipelimit, etc. I wanted to know what measures can be used in the proxy, because like me, there will be more people interested ;-). We see that the module pike is a good security measure, but for users with many channels, we used the configuration of users with few channels (could we discriminate and make different rules for each?). If we have the proxy settings for normal users and have trunk configuration as well, I guess we also mark the traffic of the trunk to see it too aggressive about the user. As you might know if discriminate different types of users according to their traffic, one solution I can think of is to have different proxies for each user type (trunk, normal, etc). Is there any way to implement something that detects unusual behavior on the user (referred to countries that do not ever called, excessive traffic, etc)?. I ask not to try to implement something that exists or perhaps someone can advise me how to do so because it is very likely not get it or do it wrong :-P . Continue to seek information and if I find something to contribute, send him to the list. Can you think of some way more secure proxy (mainly user accounts)? Do some basic safety tips to take into consideration? Any guidance? My advice to avoid trying to schedule something with 100 lines of code when I can do with 5 lines? Does this indicate that I intend to do not I make it :-P ?. What I said, I will try paper on the subject and if I can find information on something (though it may seem a bad code :-( ), which publishes. Thanks ;-) Regards Anto

3 4

Keeping transactions in standby till future events
by Gustavo Garcia Bernardo 20 Jun '11

20 Jun '11

Is it possible to configure sip-router to keep a transaction for an incoming message (f.e. an INVITE) without sending a response and without forwarding it, and then reference and complete it in the future? Using pseudocode this is the logic I would like to implement: //When receiving an INVITE leave it pending if (request is INVITE) { store transactionID // This transactionID will be send somehow to the client return } //When receiving a PUBLISH referencing a pending transaction complete the forwarding if (request is PUBLISH) { transactionId = header("X-TransactionId") destination = header("X-Destination") transactions [transactionID]. forward(destination) } Thank you very much, G. Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo. This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at. http://www.tid.es/ES/PAGINAS/disclaimer.aspx

4 7

Help find out where to modify request uri
by Simone Felici 20 Jun '11

20 Jun '11

Hi to all, I need to edit our ser installation (OLD ser-2.0.0-rc1) implementing a check to rewrite the INVITE URI address in case a flag on a DB is set or not. I'm not proof on this and as always the solution is to find out on the production system without the possibility (for now) to upgrade to most recent version. In fact I would load the flag with the db_ops module. The scenario should be the follow: 1. a call is coming from sip or from pstn to an internal sip account 2. the ser should check if a given flag for the called account is set (db_ops) 3. if it's set it should take the destination URI (taken from location db table) and rewrite the number to another known number. i.e. from sip:123456789@IP;uniqu=... to sip:new987654321@IP;uniq=... My first issue is to identify WHERE ser execute the INVITE to the sip account and how rewrite the URI. Could someone point me to the right place and give me some suggestion? The ser.cfg used could be read from a previous post of me: http://www.mail-archive.com/sr-users@lists.sip-router.org/msg04900.html Thank's a lot! Simon

2 4

Invite replies
by Lucas Alvarez 19 Jun '11

19 Jun '11

Hi, how may I catch the reply of an invite? I did this but it seems is not working: if (method=="INVITE") { $avp(sdp_ret) = fix_nated_sdp("11"); xlog("L_ALERT","#####********###### SDP return: $avp(sdp_ret)\n"); append_hf("P-hint: sdp rewritten\r\n"); t_on_reply("REPLY_TWO"); } onreply_route("REPLY_TWO") { xlog("L_ALERT","ALERT: ################ $rU - $rm from $fu (IP:$si:$sp--------$di)\n"); return; } Any help will be appreciate it, thanks in advance. Lucas

2 1

100rel without direct reachability
by Alex Balashov 19 Jun '11

19 Jun '11

(Sorry for cross-posting from Sip-Implementors; however, upon some reflection this is really more of a Kamailio mechanics question.) Greetings, I have a scenario where endpoint A is calling endpoint B through proxy P. Endpoints A and B are on different networks that are not directly reachable--A is on the public Internet, to which proxy P is connected, but NAT'd, and B is on a private RFC1918 network on which the proxy P has an interface as well. The purpose of proxy P is to make calling A <-> B possible, while providing the appropriate far-end NAT traversal functionality for A and so on and so on. It does this by inserting the correct Record-Route headers into the INVITE from A, and otherwise by staying in the signaling path; both A and B can reach the proxy, so all requests and replies go through it. The problem I'm having is prior to full dialog establishment. Upon receipt of INVITE from A by way of proxy P, B replies with 183 + SDP and also: Require: 100rel In the 183 it provides a Contact on its private network that A obviously cannot reach: Contact: <sip:xxxxx@192.168.0.10:5060> As a result, A attempts to send PRACKs to sip:xxxxx@192.168.0.10, which are obviously not going to go anywhere. After not receiving a few of these expected PRACKs, B replies to the call with a final negative failure. The question is, is there anything I can twiddle on the proxy to make this work? The problem with PRACKs is that although they are sequential requests, they arise (in this case) prior to the point at which RR can be used to guide them through the proxy. The most obvious answer is, "Make B not Require: 100rel", of course. However, that is not an option here. Thanks! -- Alex Balashov - Principal Evariste Systems LLC 260 Peachtree Street NW Suite 2200 Atlanta, GA 30303 Tel: +1-678-954-0670 Fax: +1-404-961-1892 Web: http://www.evaristesys.com/

3 6

HTTP POST
by Matthew Williams 16 Jun '11

16 Jun '11

Hi, I'm working on an application that needs to create an HTTP POST from within Kamailio. The utils module has the http_query function, but that is only for GET. I think I'm looking for something more like the uac module's uac_req_send -- but for http. Any suggestions? Thanks in advance!

2 1

mi_datagram usage example
by Asgaroth 16 Jun '11

16 Jun '11

Hi All, I am trying to send a mi command over the mi_datagram udp socket. I dont seem to be getting a response back from the server. I am certain that it is something I am doing wrong. I have mi_datagram loaded and listening on udp:1.1.1.1:8080. I then try to send the following dispatcher mi command over to the mi_dg interface: echo -ne ":ds_list:\n\n" | nc -w 1 -u 1.1.1.1 8080 I dont see any error in the log file, so it appears that the mi_datagram is processing the request, but I am not getting any response back. The ds_list command works properly if I run it using "kamctl fifo ds_list", or if I go via "sercmd mi_dg ds_list" that works too. Would anyone have an example bash/ksh/perl snippet that would help me on my way to communicating with this mi interface. Any thoughts comments would be greatly appreciated. Thanks

3 3

Kamailio dispatcher
by Evgeniy Spinov 16 Jun '11

16 Jun '11

Hello. I had a Kamailio version of 3.0.3 and during this time configured a failover with simple routine. In short like this: if (ds_next_domain()) { xlog(.....); if (!t_relay()) { xlog(.....); return; } return; } else { t_reply("503"); } Then I've updated to 3.1.3 and was happy enough until I've discovered that my failover is not working anymore. What is observed: - It changes $rd variable, but not changing $du variable, is it ok? - Not any of the nodes receive packet on t_relay after ds_next_domain(). - In route decision section, where t_on_reply() and t_on_failure() are located I have the same t_relay() and it works fine, cause there is no any ds_next_domains(). Is it a bug or I'm doing something wrong? Thanks in advance.

3 11

How to check a bit (1/0) of a pseudo-variable?
by Iñaki Baz Castillo 16 Jun '11

16 Jun '11

Hi, summarizing I have two pseudo-variables: $var(allowed_zones) = 5; $var(id_zone) = 2; The binary representation of 5 (3+2), assuming 8 bits lenght, is: 00000101 so bit 0 = 1, bit 1 = 0, bit 2 = 1 ... Now I just need to know if bit number 2 ($var(id_zone)) of $var(allowed_zones) is 0 or 1. Is there any function like isflagset() but for pseudo-variables? Thanks a lot. -- Iñaki Baz Castillo <ibc(a)aliax.net>

3 6

Re: [SR-Users] Use of mtree module having multiple trees in the same table
by Javier Gallart 16 Jun '11

16 Jun '11

Hello not sure what you want to accomplish, but in case it might help this is how we use the mtree module. Our 3 columns are: partition, prefix, route Partition is just a name that defines a group, this is done inside the script before calling mt_match (via a table lookup for instance). Let's say if a call comes from ip x we assign it to partition 400; if it comes from ip y we assign it to partition 401. Each partition is a different tree. Consider these entries in the tree table: 400,123456,A 401,123456,A 401,1234567,B Let's say both x and y send a call with $rU 1234567; mt_match will return A for ip x, and B for ip y; we use that information for taking further routing decisions. A common situation might be: x has a unique route for a whole country while y has that entry but has more defined routes for more specific area codes inside that country. The column route could also be for instance the setid of a group of gw's for the dispatcher module, etc... Regards Javi > > Message: 3 > > Date: Tue, 14 Jun 2011 14:27:53 +0200 > > From: I?aki Baz Castillo <ibc(a)aliax.net> > > Subject: Re: [SR-Users] Use of mtree module having multiple trees in > > the same table > > To: "SIP Router - Kamailio (OpenSER) and SIP Express Router (SER) - > > Users Mailing List" <sr-users(a)lists.sip-router.org> > > Message-ID: <BANLkTim8h563kUy0YT9pTgOSXJ6W4Qf6ww(a)mail.gmail.com> > > Content-Type: text/plain; charset=UTF-8 > > > > 2011/6/13 jose luis millan <doctore96(a)gmail.com>: > > > I wonder if anyone could help me understanding how can I use this > > > module in a scenario where multiple mtrees are defined behind the same > > > database table. > > > > > > I can't guess how to speficy to 'mt_match' the mtree I want to match > > > against, since the 'mtree' module parameter defines a specific memory > > > tree based on a specific table, but not based on a specific 'tname' > > > value. > > > > Indeed we have a table with these colums: > > > > - prefix: string to identify number destination. This is the regex > > column. > > - id_zone: integer, points to other table. This is the value column. > > - scope: integer, can be 0 or 1. > > > > So wee need two instances of mtree: > > 1) those rows with scope 0. > > 2) those rows with scope 1. > > > > Is it possible with current mtree module? or maybe we'd do better by > > creating two views of the table (one for entries with scope 0 and > > another for entries with scope 1)? > > > > Thanks a lot. > > > > -- > > I?aki Baz Castillo > > <ibc(a)aliax.net> > > > > > > > > >

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users