28 Mar
2005
28 Mar
'05
4:46 p.m.
that´s great, below you can see the changes that works perfect using
check_to and check_from... now I am planning to do all this security
issues using radius modules and I found 2 problems:
1.- I have been able to authenticate and register users but when use
radius_is_user_in I don´t known what attribute to use for Request-URI
to verify if it belongs to a group "deactivated" in Register process
or verify if user is in "voicemail" group, same problem checking
"from" or "credentials"
...This is an example in freeradius user file:
6609876(a)10.0.1.22 Auth-Type := Digest, User-Password == "9876"
2.- There is no "check_to" or "check_from" functions in uri_radius
module... Is there any other way to do this using radius?
regards
Rafael
PS: config:
if (method == "REGISTER") {
log(1, "ANALYZING REGISTER REQUEST\n");
# to use digest authentication
if (is_user_in("Request-URI", "deactivated"))
{
sl_send_reply("402", "Su cuenta fue
desactivada");
break;
};
if (!www_authorize("mydomain.com.pe",
"subscriber")) {
www_challenge("mydomain.com.pe",
"0");
break;
};
# only registered users are allowed
if (!check_to()) {
log(1, "LOG: Hijack!!!--> unregistered
user registration attempt\n");
sl_send_reply("403", "hijack
attempt!!!! Only registered users are allowed");
break;
};
log(1," Registered!!! \n");
if (!save("location")) {
sl_reply_error();
};
break;
};
if (method == "INVITE" || method== "CANCEL" ||
method== "ACK" && src_ip!=GW_IP ) {
log(1, "ANALYZING INVITE||CANCEL REQUESTs\n");
if (!proxy_authorize("mydomain.com.pe",
"subscriber")) {
proxy_challenge("mydomain.com.pe",
"1");
break;
} else {
if (method == "INVITE" && !check_from()) {
sl_send_reply("403", "Only registered
users are allowed");
break;
};
};
/* *********** Dial out to Local and PSTN
logic ********* */
# Forward n digit requests to gateway AS5350 (Celulares)
if(uri=~"^sip:9" ){
log(1," digit expression match - Celulares\n");
if (!is_user_in("from", "mobile")) {
sl_send_reply("403", "No
permission for mobile calls");
break;
};
rewritehostport("GW_IP:5060");
route(1); ## to nathelper...
break;
};
};
Rafael J. Risco G.V.