Hi Rafael,
You shouldn't authenticate request within the dialog (with to_tag), but
only the initial requests (which create the dialog).
To be sure "from" is the same as "credentials" call check_from() after
authentication was confirmed - this way , further in your script, you
can check "from" with the same confidence as for "credentials".
Best regards,
Marian
Rafael J. Risco G.V. wrote:
Marian
thanks a lot again, it works with uri "from" instead of
"credentials"
, I also changed my script to challenge all non-register messages just
to ensure CANCELs and INVITEs follow the same path, its that correct?
(...according to Jan "auth module will never challenge ACKs and
CANCELs, it will always return that the authentication was sucessful),
by the way, is there any security disadvantage in to use "from"
instead of credentials?
best regards
rafael
PS: thats my new register and non-register auth method:
if (method == "REGISTER") {
log(1, "ANALYZING REGISTER REQUEST\n");
if (is_user_in("Request-URI",
"deactivated")) {
sl_send_reply("402", "Su cuenta fue
desactivada");
break;
};
### digest authentication
if (!www_authorize("mydomain.com.pe",
"subscriber")) {
www_challenge("mydomain.com.pe",
"0");
break;
};
if (!save("location")) {
sl_reply_error();
};
break;
};
if (!method == "REGISTER" && src_ip!=GW_AS5350_IP) {
log(1, "ANALYZING INVITE||CANCEL... REQUESTs\n");
if (!proxy_authorize("mydomain.com.pe",
"subscriber")) {
proxy_challenge("mydomain.com.pe",
"1");
break;
};
/* ***************** Dial out to Local and PSTN logic
****************** */
# forward n digit requests to gateway AS5350 (Celulares)
if(uri=~"^sip:9"){
log(1," digit expression match - Celulares");
if (!is_user_in("from", "mobile")) {
sl_send_reply("403", "No permission
for mobile calls");
break;
};
rewritehostport("GW_AS5350_IP:5060");
route(1); ##Nathelper
break;
};
};
......
.
.
.
On Sat, 26 Mar 2005 23:55:28 +0100, Marian Dumitru
<marian.dumitru(a)voice-sistem.ro> wrote:
Hi Rafael,
the cancelling doesn't work because you process the INVITEs and CANCELs
in different way and because of this the CANCEL cannot follow the same
path as the INVITE.
As CANCEL is not authenticate (and it should not be), the
is_user_in("credentials", "mobile") will fail for CANCELs and you
will
reply with "403 No permission for mobile calls".
Either replace "credential" with "from", either skip this test for
CANCELS.
Best regards,
Marian
--
Voice System
http://www.voice-system.ro