if (method=="INVITE") { if (!lookup(location)) { sl_send_reply(404,"Not authorized"); break; } }

Well, I have to check if *calling* are registered on my proxy, before to allow him to make any calls! In my tests, if a setup on ata186 sipregon=0 so I can make calls, I have to block this...

perhaps because all calls must be payed, or to prevent non-registered (i.e. blocked) users to place calls to outside...

but it would also prevent outside calls to registered (local) users to be placed, am I right?

Bruno Lopes F. Cabral wrote: If users have to proxy_authenticate() when calling, there's no problem with accounting. Explicitely blocked users can be handled with groups, so you can differ between incoming-blocked and outgoing-blocked, e.a.: # proxy_authenticate() here, then: if(method == "INVITE") { if(!check_from()) { # spoofed From-URI, send 403 here break; } if(is_user_in("credentials", "outblocked")) { # outgoing call attempt of blocked user, deflect to announcement # or send 403 here break; } if(does_uri_exist() && is_user_in("Request-URI", "inblocked")) { # incoming call to local blocked user, see above break; } } and use serctl for blocking users: "serctl acl grant <user> outblocked" So still no need to register. Only if the caller can't proxy_authenticate(). If there are for example PSTN gateways which don't authenticate, you've to create some kind of "trusted network", e.a.: if(method == "INVITE") { if(!(src_ip==gw1.your.domain || src_ip==gw2.your.domain)) { if(!proxy_authenticate(...)) { # untrusted caller failed to authenticate proxy_challenge(...); break; } } else { # trusted sources don't have to authenticate } } Hope this helps, Andy _______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers

sendman wrote: This is the right way to make sure that only authenticated users make calls on your proxy. I'm guessing that you want to allow unauthenticated inbound calls unless you have a way to assign username/passwords to anyone who might want to call one of your registered users. I do not think that there are adequate mechanisms implemented for interdomain authentication of callers. If you do want to authenticate callers who are not registered on your proxy (to prevent SIP spam) these two internet drafts might be of interest: http://www.ietf.org/internet-drafts/draft-ietf-sip-identity-03.txt http://www.ietf.org/internet-drafts/draft-peterson-message-identity-00.txt Hope this helps, Jamey

You are only checking here if the user has SIP REGISTERED a UserAgent to your server, not if the user had a valid username/password. You should check with proxy_challenge (which generates a SIP/2.0 407 Proxy Authorization required message) and only if it is an outbound request (domain not served by your proxy, otherwise your users can't be called). So your code would become something like: # check if it's an outbound request for a domain not on this proxy if (method=="INVITE" && uri !=myself) { #check to see if there are usercredentials (and if they are OK) If(!proxy_authorize("yourdomain", "subscriber")) { #no or wrong credentials, challenge the user Proxy_challenge("yourdomain","0"); Break; } # accept call and goto route 3 route(3); } Kind regards, E. Versaevel Well, what I really want is something like: if (method=="INVITE") { # check if from_user 'caller' are successfully registered in my proxy if (!lookup('%from_user% in location table')) { sl_send_reply(404,"Not authorized - You must bu registered to use this proxy"); break; } # accept call route(3); } Well 'ALL CALLS' in my proxy, must to be authenticated... I don't if this test must to be done on 'invite' or maybe in route(3) subroutine. Regards. On Wed, 01 Dec 2004 08:14:42 -0500, Jamey Hicks &lt;jamey.hicks(a)hp.com&gt; wrote: http://www.ietf.org/internet-drafts/draft-peterson-message-identity-00.txt _______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers _______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers

You are only checking here if the user has SIP REGISTERED a UserAgent to your server, not if the user had a valid username/password. You should check with proxy_challenge (which generates a SIP/2.0 407 Proxy Authorization required message) and only if it is an outbound request (domain not served by your proxy, otherwise your users can't be called). So your code would become something like: # check if it's an outbound request for a domain not on this proxy if (method=="INVITE" && uri !=myself) { #check to see if there are usercredentials (and if they are OK) If(!proxy_authorize("yourdomain", "subscriber")) { #no or wrong credentials, challenge the user Proxy_challenge("yourdomain","0"); Break; } # accept call and goto route 3 route(3); } Kind regards, E. Versaevel Well, what I really want is something like: if (method=="INVITE") { # check if from_user 'caller' are successfully registered in my proxy if (!lookup('%from_user% in location table')) { sl_send_reply(404,"Not authorized - You must bu registered to use this proxy"); break; } # accept call route(3); } Well 'ALL CALLS' in my proxy, must to be authenticated... I don't if this test must to be done on 'invite' or maybe in route(3) subroutine. Regards. On Wed, 01 Dec 2004 08:14:42 -0500, Jamey Hicks &lt;jamey.hicks(a)hp.com&gt;

http://www.ietf.org/internet-drafts/draft-peterson-message-identity-00.txt _______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers