<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: #000000'>TR:<br><br>This was the "easy" part. I ended up making my own table in the database and I wrote some code that essentially does the same as the permission module (with a few minor enhancements). The initial issue was trying to determine which authentication mechanism to apply to an INVITE packet when it comes in, which "is_from_local()" solved. <br><br>Thx!<br><br><div><span style="font-family: arial,helvetica,sans-serif;">Brett Woollum</span><br style="font-family: arial,helvetica,sans-serif;"><span style="font-family: arial,helvetica,sans-serif;">Brett@Woollum.com</span><br></div><br><br>----- Original Message -----<br>From: "T.R. Missner" <tr@voipjedi.com><br>To: "OpenSIPS users mailling list" <users@lists.opensips.org><br>Sent: Tuesday, September 14, 2010 2:00:12 PM GMT -08:00 US/Canada Pacific<br>Subject: Re: [OpenSIPS-Users] Help with Inbound PSTN, and Inbound SIP URI Authentication Sub-Routine<br><br>I've used the permissions module for this in the past.<div>Essentially you can whitelist your carriers' IP addresses using permissions module.</div><div><br></div><div>-tr</div><div><br><div class="gmail_quote">On Tue, Sep 14, 2010 at 4:52 PM, Brett Woollum <span dir="ltr"><<a href="mailto:brett@woollum.com" target="_blank">brett@woollum.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div><div>Hi Kennard,</div><div><br></div><div>I need to provide some level of authentication for incoming calls. This is because I need to allow my PSTN gateways to bring any calls for my DIDs into OpenSIPS, but I don't want to open the door and allow anybody from the internet to call any of my DIDs using a direct URI. I have a database table that contains incoming DIDs that I process calls from my gateway against, and a sepearate database table which contains incoming SIP URI's that I process completely unauthenticated calls against. <br>
<br></div><div>In this scenario, my PSTN gateway can bring calls into sip:<a href="mailto:+13145551212@mysipdomain.com" target="_blank">+13145551212@mysipdomain.com</a>, but an Internet user cannot call that number. On the other hand, an unauthenticated Internet user can call <a href="mailto:sip%3Amycompany@mysipdomain.com" target="_blank">sip:mycompany@mysipdomain.com</a> sucessfully. </div>
<div><br></div><div>Does this make sense?</div><div><br></div><div>Brett W </div><div><br>Sent from my iPhone</div><div class="im"><div><br>On Sep 14, 2010, at 8:44 AM, <a href="mailto:Kennard_White@logitech.com" target="_blank">Kennard_White@logitech.com</a> wrote:<br>
<br></div><div></div></div><blockquote><div>
<p></p><div class="im">Hi Brett,<br>
<br>
For what it is worth, I do it the other way around: I check the source IP, and if from a PSTN provider process the telephone number as appropriate for them; otherwise I do user auth.<br>
<br>
A question: if you're allowing "outside" users to call in, why authenticate any INVITE traffic? (Ok, you have to authenticate traffic going to PSTN from your subscribers, but other than that...)?<br>
<br>
Regards,<br>
Kennard<br>
<br></div>
<graycol.gif><font color="#424282">Brett Woollum ---09/14/2010 02:26:33 AM---David, The "is_from_local" function is just what I needed. It will allow me to decipher whether or</font><div><div></div><div class="h5">
<br>
<br>
<font color="#5f5f5f" size="2">From: </font><font size="2">Brett Woollum <<a href="mailto:brett@woollum.com" target="_blank">brett@woollum.com</a>></font><br>
<font color="#5f5f5f" size="2">To: </font><font size="2">OpenSIPS users mailling list <<a href="mailto:users@lists.opensips.org" target="_blank">users@lists.opensips.org</a>></font><br>
<font color="#5f5f5f" size="2">Date: </font><font size="2">09/14/2010 02:26 AM</font><br>
<font color="#5f5f5f" size="2">Subject: </font><font size="2">Re: [OpenSIPS-Users] Help with Inbound PSTN, and Inbound SIP URI Authentication Sub-Routine</font><br>
<font color="#5f5f5f" size="2">Sent by: </font><font size="2"><a href="mailto:users-bounces@lists.opensips.org" target="_blank">users-bounces@lists.opensips.org</a></font><br>
</div></div><p></p><div><div></div><div class="h5"><hr style="color: rgb(128, 145, 165);" width="100%" align="left" noshade="noshade" size="2"><br>
<br>
<br>
<font face="Arial" size="4">David,<br>
<br>
The "is_from_local" function is just what I needed. It will allow me to decipher whether or not the user appears local or not, and authenticate them if so (ie: a subscriber), or check their IP if not (ie: from my gw).<br>
<br>
Thanks!<br>
</font><br>
<font face="Arial" size="4">Brett Woollum<br>
<a href="mailto:Brett@Woollum.com" target="_blank"></a><a href="mailto:Brett@Woollum.com" target="_blank">Brett@Woollum.com</a></font><br>
<font face="Arial" size="4"><br>
<br>
----- Original Message -----<br>
From: "David J." <<a href="mailto:david@styleflare.com" target="_blank">david@styleflare.com</a>><br>
To: "OpenSIPS users mailling list" <<a href="mailto:users@lists.opensips.org" target="_blank">users@lists.opensips.org</a>><br>
Sent: Tuesday, September 14, 2010 1:08:38 AM GMT -08:00 US/Canada Pacific<br>
Subject: Re: [OpenSIPS-Users] Help with Inbound PSTN, and Inbound SIP URI Authentication Sub-Routine<br>
<br>
It depends on your configuration.<br>
<br>
You can place it before or after.<br>
<br>
Because you dont want to authenticate inbound calls, you can have a simple if statement that checks if the user is not local and alias exists, then relay to that alias.<br>
<br>
Not real code:<br>
<br>
if(not_from_local){<br>
if(alias()){<br>
relay;<br>
}<br>
}<br>
<br>
On 9/14/10 3:32 AM, Brett Woollum wrote: </font>
<ul>
<ul><font face="Arial" size="4"> </font><br>
<font face="Arial" size="4"> </font><br>
<font face="Arial" size="4">Hi David,<br>
<br>
As far as I can tell, the alias module is independent of how the call is authenticated. My understanding is that it will look for a replacement URI based on the current one, and replace if a new one is found. It appears as though this "function" would go into the config file somewhere after the section I'm working on now. <br>
<br>
Is my understanding correct? <br>
<br>
I'll need some way to determine if this is an inbound call (i.e.; not originating from a subscriber's phone) prior to mapping it to the alias module. Also, I'd like to determine if the incoming call is from my PSTN gateway and give different aliases than if the call was a SIP URI call.<br>
<br>
Brett Woollum</font><br>
<a href="mailto:Brett@Woollum.com" target="_blank"><u><font color="#0000ff" face="Arial" size="4">Brett@Woollum.com</font></u></a><br>
<font face="Arial" size="4"><br>
<br>
----- Original Message -----<br>
From: "David J." </font><a href="mailto:david@styleflare.com" target="_blank"><u><font color="#0000ff" face="Arial" size="4"><david@styleflare.com></font></u></a><font face="Arial" size="4"><br>
To: "OpenSIPS users mailling list" </font><a href="mailto:users@lists.opensips.org" target="_blank"><u><font color="#0000ff" face="Arial" size="4"><users@lists.opensips.org></font></u></a><font face="Arial" size="4"><br>
Sent: Tuesday, September 14, 2010 12:20:23 AM GMT -08:00 US/Canada Pacific<br>
Subject: Re: [OpenSIPS-Users] Help with Inbound PSTN, and Inbound SIP URI Authentication Sub-Routine<br>
<br>
Hi Brett,<br>
<br>
The common practice is to use the alias module for inbound routing.<br>
<br>
You can look at the docs for its usage, but essentially you can map DID's to local users.<br>
<br>
<br>
<br>
On 9/14/10 3:18 AM, Brett Woollum wrote: </font>
<ul>
<ul><font face="Arial" size="4"> </font><br>
<font face="Arial" size="4">Hello!<br>
<br>
I have an OpenSIPS 1.6.3 installation that is working well. I have subscribers registering to OpenSIPS, and they can dial between each other and outside of my domain (to my media servers and to the PSTN). All is well.<br>
<br>
I am now beginning to write the configuration that will process inbound calls - meaning calls from non-subscribers. This will include calls from the PSTN gateway, as well as direct SIP URI calls to the OpenSIPS subscribers. For example, a person can call 515-555-1212 from a regular phone, and the call will come to OpenSIPS as an un-authenticated call from my PSTN gateway. Also, I'd like to accept SIP URI's for incoming calls. For example, calling </font><a href="mailto:mycompany@mysipdomain.com" target="_blank"><u><font color="#0000ff" face="Arial" size="4">mycompany@mysipdomain.com</font></u></a><font face="Arial" size="4"> from a soft phone might route the call to subscriber A's phone. <br>
<br>
The code I have that applies to this is: (This is currently configured to authenticate all outbound calls from subscribers only.)<br>
# authenticate if from local subscriber<br>
if (!(method=="REGISTER")) { <br>
if (!proxy_authorize("", "subscriber")) { <br>
proxy_challenge("", "0");<br>
exit;<br>
}<br>
if (!db_check_from()) {<br>
send_reply("403","Forbidden auth ID");<br>
exit;<br>
}<br>
<br>
consume_credentials();<br>
# caller authenticated<br>
}<br>
<br>
I am looking for direction on how to expand this to determine if the call is A) from a subscriber calling outbound, B) inbound from the PSTN, or C) inbound from any other user calling my SIP URI's. Once I am able to determine this information, I'll be able to route the call appropriately within the rest of my scripts.<br>
<br>
My problem is that my SIP phones usually attempt to place calls without including authorization in the header (because they are registered already), then OpenSIPS replies requiring proxy authentication. The SIP phones will then try the call again including the credentials in the header, which works. How can I re-write this section of code to allow inbound SIP URI calls and calls from my PSTN gateway, while still asking my subscribers to authenticate? Or, is there a method that might work better?<br>
<br>
Notes:<br>
- Each of my PSTN gateway's has a static IP. <br>
- It's safe to assume a single-domain setup (<a href="http://mysipdomain.com" target="_blank">mysipdomain.com</a>).<br>
<br>
Thanks in advance!<br>
</font><br>
<font face="Arial" size="4">Brett Woollum</font><u><font color="#0000ff" face="Arial" size="4"><br>
</font></u><a href="mailto:Brett@Woollum.com" target="_blank"><u><font color="#0000ff" face="Arial" size="4">Brett@Woollum.com</font></u></a><br>
<br>
<font face="Arial" size="4"><br>
_______________________________________________<br>
Users mailing list<br>
</font><a href="mailto:Users@lists.opensips.org" target="_blank"><u><font color="#0000ff" face="Arial" size="4">Users@lists.opensips.org</font></u></a><font face="Arial" size="4"><br>
</font><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank"><u><font color="#0000ff" face="Arial" size="4">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</font></u></a><font face="Arial" size="4"><br>
</font></ul>
</ul>
<font face="Arial" size="4"><br>
<br>
_______________________________________________ Users mailing list </font><a href="mailto:Users@lists.opensips.org" target="_blank"><u><font color="#0000ff" face="Arial" size="4">Users@lists.opensips.org</font></u></a><font face="Arial" size="4"> </font><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank"><u><font color="#0000ff" face="Arial" size="4">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</font></u></a><font face="Arial" size="4"> </font><br>
<font face="Arial" size="4"><br>
_______________________________________________<br>
Users mailing list<br>
</font><a href="mailto:Users@lists.opensips.org" target="_blank"><u><font color="#0000ff" face="Arial" size="4">Users@lists.opensips.org</font></u></a><font face="Arial" size="4"><br>
</font><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank"><u><font color="#0000ff" face="Arial" size="4">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</font></u></a><font face="Arial" size="4"><br>
</font></ul>
</ul>
<font face="Arial" size="4"><br>
<br>
_______________________________________________ Users mailing list <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a> </font><font face="Arial" size="4"><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank"></a><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a></font><font face="Arial" size="4"> </font><tt>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank"></a><a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
</tt><tt><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank"></a><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a></tt><tt><br>
</tt><br>
</div></div></div></blockquote><div><div></div><div class="h5"><blockquote><div><span>_______________________________________________</span><br><span>Users mailing list</span><br><span><a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a></span><br>
<span><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a></span><br></div></blockquote></div></div></div><br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
<br></blockquote></div><br></div>
<br>_______________________________________________
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users
</div></body></html>