<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Hi Adam,<br>
<br>
</tt><tt>The idea behind the db_check_from() is that in SIP you have
the SIP user and the auth SIP - and you may have any relation
between them - like <a class="moz-txt-link-abbreviated" href="mailto:bob@sip.com">bob@sip.com</a> may authenticate with whatever
auth credentials (user + pwd) that are valid.<br>
<br>
The function forces either an 1-1 mapping between SIP and auth
users, either uses the uri table to create a custom mapping - like
what SIP user is allowed to use what auth user.<br>
<br>
If you disable the function, any SIP user will be able to use any
valid auth credentials.<br>
<br>
Regards,<br>
</tt>
<pre class="moz-signature" cols="72">Bogdan-Andrei Iancu
OpenSIPS Founder and Developer
<a class="moz-txt-link-freetext" href="http://www.opensips-solutions.com">http://www.opensips-solutions.com</a></pre>
<br>
On 06/21/2012 10:46 AM, Adam Raszynski wrote:
<blockquote
cite="mid:CAJWEF2aAJ1a=87WjCiEmg0GQd4jZ_qA=f28JtVwSr71GZ0Wqeg@mail.gmail.com"
type="cite">Hi
<div><br>
</div>
<div>In default opensips.cfg there is following line:</div>
<div><br>
</div>
<div>
<div>if (!db_check_from()) {</div>
<div> send_reply("403", "Forbidden Auth ID");</div>
<div> exit;</div>
<div>}</div>
</div>
<div><br>
Beside that I authenticate all calls by using proxy_authorize
function</div>
<div><br>
</div>
<div>The problem is that some buggy/cheap ATA's can't be
configured to use user in From field to be identical with
authentication username and it results 403 error for them.</div>
<div>Unfortunately I can't tell my customers to replace their
buggy ATA's</div>
<div><br>
</div>
<div>So, is it safe to disable db_check_from when proxy_authorize
is in place?</div>
<div><br>
</div>
<div>Does it pose any security problems?</div>
<div><br>
</div>
<div>Best Regards</div>
<div><br>
</div>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a>
<a class="moz-txt-link-freetext" href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a>
</pre>
</blockquote>
</body>
</html>