Hi Nils,
Once again I'm writing to ask about more things and to give you an update on
what is happening with the FCP tests...
We have set up a simple scenario with 2 proxies separated by a firewall/NAT, and
2 UA, one within (UA1) and another outside the firewall (UA2). One UA registers
with the natted proxy (UA1), the other with the "public" proxy (UA2).
At the moment, SIP messages go forwards and backwards without problems, but
media is not flowing across the firewall.
It think the problem is in the replacement of the SDP information. The first
occurrence of the IP address in "v= " and the port in "m= " in the SDP get
replaced, but the second IP in "c=" is not. I have been trying all sorts of
things, but no joy :( . Here are the INVITE messages in more detail. I also
include the latest fcp module for you to play with it.
---------- UA1 to proxy message ------------------
U 172.21.68.78:1129 -> 192.168.6.153:5060
INVITE sip:jaime@asereje.orange.co.uk SIP/2.0
Call-ID: 5812832001907970791(a)172.21.68.78
Content-Length: 121
Content-Type: application/sdp
To: sip:jaime@asereje.orange.co.uk
From: sip:pepe@asereje.orange.co.uk;tag=-779729009
Contact: sip:pepe@172.21.68.78:5061
CSeq: 1 INVITE
Via: SIP/2.0/UDP 172.21.68.78:5061;branch=AC15444E13C5000000F38F819DE5-2*0
v=0..o=- 1046084768435 1046084768465 IN IP4 172.21.68.78
s=-
c=IN IP4 172.21.68.78
t=0 0
m=audio 5006 RTP/AVP 8 3 0
---------- End of UA1 to proxy message -----------------
-------- Proxy to UA2 message ---------------------
U 192.168.6.153:5060 -> 172.21.68.78:15592
INVITE sip:172.21.68.78:15592 SIP/2.0
Call-ID: 5812832001907970791(a)172.21.68.78
Content-Length: 121
Content-Type: application/sdp
To: sip:jaime@asereje.orange.co.uk
From: sip:pepe@asereje.orange.co.uk;tag=-779729009
Contact:<sip:192.168.0.1:33240>
CSeq: 1 INVITE..Via: SIP/2.0/UDP 192.168.6.153;branch=z9hG4bK1019.21c52996.0
Via: SIP/2.0/UDP 172.21.68.78:5061;branch=AC15444E13C5000000F38F819DE5-2*0
v=0..o=- 1046084768435 1046084768465 IN IP4 192.168.0.1
s=-
c=IN IP4 172.21.68.78 <--- Need to change this as well!!!
t=0 0
m=audio 33240 RTP/AVP 8 3 0
------------ End of Proxy to UA2 message -------------------
(See attached file: fcp-module210203.tar.gz)
I have been trying to understand how the proxy builds the forwarded message from
the old one, and realised that for the Via replacement (or adding of more
params), I need to be using a string called add_to_branch_s and
add_to_branch_len (so ignore the replace_via implementation in the current
tar.gz). But for the SDP, whenever I work with get_body, it does not modify it
appropriately. So currently, I'm using msg->orig to get to the initial message,
search for certain IP4 and audio strings and replace them with the information
provided by the fcp server. That means, in the case of the SDP, 2 IP address
replacements (in v=.. and c=..) and 1 port replacement (in m=..). As I mentioned
before, I only manged to change the v=.. and m=... Whenever I try to replace
more than one appearance, strange things happen, like strings in non expected
places, like Via, and cannot work out why. So my question is an open one:): what
is the best way to change the SDP part?
The other of my questions is whether all this mess with NAT's will get solved
when the proxy supports TCP, and whether this is the best approach to solve the
SIP through NAT/FW problem. For example, how about a nathelper module for
netfilter/iptables that gets this working, in the same manner as IRC or ftp
currently? Does anybody know about any work progressing this for linux/FreeBSD?
Greetings,
Jaime
Nils Ohlmeier <nils(a)ohlmeier.de> on 18/02/2003 02:58:47
To: Jaime GILL/EN/HTLUK@HTLUK
cc: Jan Janak <J.Janak(a)sh.cvut.cz>
Jiri Kuthan <jiri(a)iptel.org>
Subject: Re: [Serusers] FCP support in SER: Modifying SDP
Hi Jaime,
debugging without the code is really hard :-)
But maybe your problme with SDP is correlated to a bug in the Via header which
i marked below.
Greetings
Nils
On Monday 17 February 2003 11:58, jaime.gill(a)orange.co.uk wrote:
> U 192.168.6.153:5060 -> 172.21.68.78:5061
> INVITE sip:pepe@172.21.68.78:5061 SIP/2.0..Via: SIP/2.0/UDP
> 192.168.6.153;b ranch=z9hG4bKb848.8a014f84.0..Via: SIP/2.0/UDP
> 192.168.0.1192.168.0.1:9439. .From: "jaime"
^^^^^^^^^^^^^^^^^^^^^^
Here you inserted the external IP twice.
Maybe your SDP replacer did this?
> <sip:jaime@asereje.orange.co.uk>;tag=8c20540f-4259-11d7-9cc5
> -00065b4c11cb..To: <sip:pepe@asereje.orange.co.uk>..Call-ID: 8c205410-4259-
> 11d7-9cc5-00065b4c11cb@172.21.68.78..CSeq: 1 INVITE..Contact:<sip:192.168.0
> .1:33186>.User-Agent: Windows RTC/1.0..Content-Type: application/sdp..Conte
> nt-Length: 211....v=0..o=gill_j 0 0 IN IP4 172.21.68.78..s=session..c=IN IP
> 4 172.21.68.78..b=CT:1000..t=0 0..m=audio 33186 RTP/AVP 97 0 8 4..a=rtpmap:
> 97 red/8000..a=rtpmap:0 PCMU/8000..a=rtpmap:8 PCMA/8000..a=rtpmap:4 G723/80
> 00..
--
gpg-key: http://www.ohlmeier.org/public_key.asc
*******************************************************************************
Important.
Confidentiality: This communication is intended for the above-named person and
may be confidential and/or legally privileged. Any opinions expressed in this
communication are not necessarily those of the company. If it has come to you
in error you must take no action based on it, nor must you copy or show it to
anyone; please delete/destroy and inform the sender immediately.
Monitoring/Viruses
Orange may monitor all incoming and outgoing emails in line with current
legislation. Although we have taken steps to ensure that this email and
attachments are free from any virus, we advise that in keeping with good
computing practice the recipient should ensure they are actually virus free.
Orange PCS Limited is a subsidiary of Orange SA and is registered in England No
2178917, with its address at St James Court, Great Park Road, Almondsbury Park,
Bradley Stoke, Bristol BS32 4QJ.
*******************************************************************************
I have turned on mysql authentication, and was able to add users, but
aliases complain that "table" doesn't exist:
$ serctl add lenny abcdef lenny(a)voiping.com
MySql Password:
new user added
$ serctl alias add 1234 sip:lenny@voiping.com
sip:lenny@voiping.com
400 Table 'aliases' Not Found
$ mysql -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 243 to server version: 3.23.53
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql> connect ser;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Connection id: 244
Current database: ser
mysql> show tables;
+-----------------+
| Tables_in_ser |
+-----------------+
| acc |
| active_sessions |
| aliases |
| config |
| event |
| grp |
| location |
| missed_calls |
| pending |
| phonebook |
| reserved |
| silo |
| subscriber |
| version |
+-----------------+
14 rows in set (0.00 sec)
mysql>
---
Lenny Tropiano E-mail: lenny(a)voiping.com
Partner, Networking Specialist Pager: pager-lenny(a)voiping.com
VoIPing, LLC URL: http://www.voiping.com/
PO Box 867, Cedar Park, TX 78630-0867 Mobile: 512-698-VOIP [8647]
I'm observing increasing number of downloads from CVS and would
like to issue few disclaimers to prevent any disappointments.
The CVS code is work in progress -- it has not been integrated,
tested, it is not complete and we cannot provide help on
incomplete software.
Also, folks should know that compilation of one of the most
frequently asked features, Radius support, is disabled on
purpose. It is an external contribution which deserves
a clean-up, we are working on it but we are not there yet.
My previous forecast for the upcoming release is turning out to
be too optimistic. We decided to carry out some more clean-ups
and the work takes time. Anyway, we think it is better to
clean up now than later -- interest in ser is growing, and
we need to keep the codebase sane despite all the new features.
-Jiri
--
Jiri Kuthan http://iptel.org/~jiri/
Dear all,
after days of trial, I finally load radius_acc.so in my ser.
But when I testing the modules with the new routing config.
Nothing happen. I follow the sample config in the CVS as follow.
I check the radius server with radius -x, no packet seem to send to radius
server.
I also check the Mysql database, no entry is wrote to acc table. Why?
Can anyone tell me what's wrong?
==================
[benny@md benny]$ more /etc/ser/ser.cfg
#
# $Id: ser.cfg,v 1.12 2002/10/21 02:40:06 jiri Exp $
#
# simple quick-start config script
#
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
port=5060
children=4
fifo="/tmp/ser_fifo"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "//usr/lib/ser/modules/mysql.so"
[benny@md benny]$ cat /etc/ser/ser.cfg
#
# $Id: ser.cfg,v 1.12 2002/10/21 02:40:06 jiri Exp $
#
# simple quick-start config script
#
# ----------- global configuration parameters ------------------------
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
port=5060
children=4
fifo="/tmp/ser_fifo"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "//usr/lib/ser/modules/mysql.so"
# Uncomment this to use radius for accounting
loadmodule "/usr/lib/ser/modules/radius_acc.so"
loadmodule "//usr/lib/ser/modules/acc.so"
#--- radius_ acc.so params ---
modparam("radius_acc","log_level",1)
modparam("radius_acc","acc_flag",1)
modparam("radius_acc","report_ack",1)
modparam("radius_acc","early_media",0)
modparam("radius_acc","failed_transactions",0)
#--- acc.so params ---
modparam("acc","log_level",1)
modparam("acc","acc_flag",1)
modparam("acc","report_ack",1)
modparam("acc","early_media",1)
modparam("acc","failed_transactions",1)
loadmodule "//usr/lib/ser/modules/sl.so"
loadmodule "//usr/lib/ser/modules/tm.so"
loadmodule "//usr/lib/ser/modules/rr.so"
loadmodule "//usr/lib/ser/modules/maxfwd.so"
loadmodule "//usr/lib/ser/modules/usrloc.so"
loadmodule "//usr/lib/ser/modules/registrar.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
#loadmodule "//usr/lib/ser/modules/auth.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
#modparam("auth", "secret", "alsdkhglaksdhfkloiwr")
#modparam("auth", "calculate_ha1", yes)
#modparam("auth", "calculate_ha1", no)
#
# If you set "calculate_ha1" parameter to yes (which true in this config),
# uncomment also the following parameter)
#
#modparam("auth", "password_column", "password")
# ------------------------- request routing logic -------------------
# main routing logic
route{
# initial sanity checks -- messages with
# max_forwars==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if (len_gt( max_len )) {
sl_send_reply("513", "Message too big");
break;
};
# Do strict routing if pre-loaded route headers present
# rewriteFromRoute();
#if (method=="INVITE") {
addRecordRoute();
#} else {
rewriteFromRoute();
#};
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if (uri==myself) {
if (method=="REGISTER") {
# Uncomment this if you want to use digest authentication
# if (!www_authorize("iptel.org", "subscriber")) {
# www_challenge("iptel.org", "0");
# break;
# };
save("location");
break;
};
# native SIP destinations are handled using our USRLOC DB
if (!lookup("location")) {
sl_send_reply("404", "Not Found");
break;
};
};
#labeled all transaction for accouting
setflag(1);
#record-route INVITES to make sure BYEs will visit our server too
#if (method=="INVITE") addRecordRoute();
# forward to current uri now
if (!t_relay()) {
sl_reply_error();
};
}
[benny@md benny]$
==================================
Folks,
please help me -- share with me techniques for NAT traversal you
use and have hands-on experience with. People repeatedly ask
about it, and I'd like to create an FAQ that reflects deployment
experience and as wide user feed-back as possible. Just tell me the
technique you use, its requirements, limitations, the devices it
is known (not) to work with, why you prefer one method over the
other, etc. I'll then try to compile it in an FAQ.
So please send me an e-mail, an example is attached. I will appreciate
any practical details.
Thank you,
-Jiri
----------------------------------------------------------------
technique: using symmetric communication
requirements: phone devices that support symmetric communication;
existing species: Cisco's ATA
configuration
practice: ATAs need to be configured to advertise public address
in signaling, or learn it from REGISTER replies;
alternatively, one can rewrite signaling using ser's
nethelper module; one needs to rewrite SIP anyway
because ATAs don't advertise their symmetricity;
see www.foo.bar for info on configuring ATA...
limitations: non-symmetric devices, like Messenger don't work;
misc: ATA has no display, that's why I am anxiously
waiting for more vendors to support symmetric
signaling
----------------------------------------------------------------
technique: UPnP
requirements: NATs and phones with UPnP support; Messenger and
snom are known to support UPnP; there is linux
support for it
configuration
practice: of course, upnp requires by definition no configuration ;-)
(I'm not serious -- anyone actually tried it?)
----------------------------------------------------------------
technique: geek tweaks: set-up port forwading manually
configuration
practice: you need to configure NATs to split its public-side port
numbers accross your private-side phones, and configure
the phones (if they allows so) to use these port numbers;
also, phones need to be configured to use publicly
reachable address in their payloads
requriements: configurable NATs (many residental NATs are configurable)
and configurable phones (ATAs do that, I heard pingtel did
it too)
----------------------------------------------------------------
technique: ALG
requirements: SIP-capable NAT (like Intertex or Cisco/PIX)
issues: intertex freezes my ssh connections after some time on-line
and elderly models don't like all Ethernet devices;
when things don't work, the red-button off-on helps
sometimes
----------------------------------------------------------------
technique: STUN
requirements: STUN-enabled phone (like k-phone, snom)
limitations: doesn't work over symmetric NATs (words-of-mouth propaganda
has been telling me that many residential NATs are fortunately
not symmetric, but I don't know how objective this information
really is)
----------------------------------------------------------------
--
Jiri Kuthan http://iptel.org/~jiri/
Hi-
I am a very Junior designer, and as part of my efforts to impress my boss, I am trying to create a simple email to sms application. Sadly, here in South Africa, the cellular service providers do not provide an sms gateway to the public, and so I am researching the iptel.org SIP Express Router.
I need to know the following: after reading the iptel.org website, I would like to know whether it is possible to install the application on a Windows 2000 server, and run the gateway. From what I read, apparently only the core application can be installed... and this does not appear to include the gateway?
Obviously, I will pass the project on to a programmer who knows more, so you will not be plagued by too-simple questions from an inexperienced designer... but I would appreciate any assistance/info that will allow me to convince my boss.
Thank you!
ph (021) 685 6499
anthony_buckland(a)yahoo.co.uk
70 Strubens Rd, Observatory, Cape Town
---------------------------------
With Yahoo! Mail you can get a bigger mailbox -- choose a size that fits your needs
Hi all,
This message is somewhat related to a preceding one (Simple SER Use
Case), because I realised I did not ask the right question.
Here it is: I want to make a proxy that will try to locate the callee by
sequentially trying n different UA, by sending an INVITE and waiting for
either OK or timeout to occur. On timeout, the proxy will try the next
UA.
The detail here is that the proxy sends a "100 Trying" to the caller
*before* contacting the various UA, and that *no more* "100 Trying" are
forwarded by the proxy, which absorbs those responses from contacted UA.
Jiri indicated that the configuration presented in
<http://www.iptel.org/ser/doc/seruser-html/x510.html#AEN616> realised
the scenario I was mentioning... but it seems to me that the proxy does
not send and then absorb "100" responses, but rather relays this
responses to the caller. This would lead to the caller receiving as many
"100" responses as contacted UAs.
Is it possible to do this with SER ?
TIA,
-- Sebastien
I had the same error msgs when I load the radius_acc modules
the following is the error msgs
[root@md benny]# /usr/sbin/ser restart
0(3699) ERROR: load_module: could not open module
</usr/lib/ser/modules/radius_
acc.so>: libradiusclient.so.0: cannot open shared object file: No such file
or d
irectory
0(3699) parse error (25,13-48): failed to load module
ERROR: bad config file (1 errors)
[root@md benny]#
and I check that the radius_acc.so is in /usr/lib/ser/modules
and the libradiusclient.so.0 is also in /usr/local/lib as it is stated in
the Makefile.
Where is the error came from? Have any one successfully implement it?
Hi Benny,
I had the same problem as you. After I statically linked the radiusclient library in the both radius modules this problem seems to be resolved.
http://lists.iptel.org/pipermail/serusers/2003-February/000419.html
However radius authentication still doesn't work and the developer said:
"the path is not staticaly linked, it should be resolved by you
dynamic linker, I don't know where is the problem, it seems to me that
there is some problem with radiusclient libraries on your system, "
I use Solaris 8. Now I am trying to recompile and reinstall radiusclient library. If I find out something, I'll tell you.
regards, yang