<div dir="ltr"><div><div>Hello Vlad,<br>I tested and confirmed it is OK now.<br></div>Thanks.<br><br></div>Regards,<br>Takeshi<br><div><div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Aug 7, 2013 at 4:52 AM, Vlad Paiu <span dir="ltr"><<a href="mailto:vladpaiu@opensips.org" target="_blank">vladpaiu@opensips.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
What are you thinking about more exactly here in terms of security ?<br>
<br>
The OpenSIPS worker processes that listen for BIN replicated packages do not perform any IP authentication by themselves, so if you leave those UDP ports open from the outside, you are leaving yourself exposed to outside attackers coming in and either deleting some of the existing dialogs ( by sending you some binary packages that destroy an ongoing dialog ) or filling up your shared memory ( by sending you 'new dialog' binary packages ).<br>
<br>
Currently, it's left to the OpenSIPS administrator to properly configure the firewall so that the binary interface listeners ( the ones specified by bin_listen=<a href="http://127.0.0.1:9999" target="_blank">127.0.0.1:9999</a> ) are only open for the other OpenSIPS instance IPs.<br>
<br>
Best Regards,<br>
<br>
Vlad Paiu<br>
OpenSIPS Developer<br>
<a href="http://www.opensips-solutions.com" target="_blank">http://www.opensips-solutions.<u></u>com</a><div class="HOEnZb"><div class="h5"><br>
<br>
On 08/01/2013 07:58 PM, Nick Khamis wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
What needs to be considered in terms of security?<br>
<br>
Nick.<br>
<br>
On 7/31/13, Bogdan-Andrei Iancu <<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Ryan,<br>
<br>
This has nothing to do with dialog pining or accounting - the new<br>
interface allows OpenSIPS to replicate the dialog state to another<br>
OpenSIPS instance. If I misunderstood you, please rephrase :)<br>
<br>
Regards,<br>
<br>
Bogdan-Andrei Iancu<br>
OpenSIPS Founder and Developer<br>
<a href="http://www.opensips-solutions.com" target="_blank">http://www.opensips-solutions.<u></u>com</a><br>
<br>
<br>
On 07/29/2013 08:20 PM, Ryan Bullock wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
This is pretty exciting!<br>
<br>
What are the plans for how this will work with features such as dialog<br>
pinging and accounting?<br>
<br>
Regards,<br>
<br>
Ryan<br>
<br>
<br>
On Mon, Jul 29, 2013 at 9:46 AM, Bogdan-Andrei Iancu<br>
<<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a> <mailto:<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>>> wrote:<br>
<br>
In long term we plan to use the BIN interface to replicate even<br>
more internal data between multiple OpenSIPS instances, like doing<br>
registration replication (instead of doing it from script via<br>
SIP). Theoretically it may be used for replicating even<br>
transaction state between 2 OpenSIPS instances - imagine having a<br>
call ringing on instance A and being accepted on instance B (after<br>
a failover) - 0% losses !<br>
<br>
Aside realtime data replication, the BIN interface is to be used<br>
also for exchanging any other type of information between OpenSIPS<br>
instances, like federating multiple instances.<br>
<br>
The main advantages of the BIN interface over the MI interface :<br>
- BIN is binary encoded so much faster (as performance)<br>
- BIN interface has both sender and receiver in OpenSIPS (MI<br>
has only the receiver)<br>
- MI is for external usage, while BIN is internal<br>
(opensips2opensips)<br>
<br>
Regards,<br>
<br>
Bogdan-Andrei Iancu<br>
OpenSIPS Founder and Developer<br>
<a href="http://www.opensips-solutions.com" target="_blank">http://www.opensips-solutions.<u></u>com</a><br>
<br>
<br>
On 07/29/2013 06:22 PM, Liviu Chircu wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello all,<br>
<br>
OpenSIPS just got better with a /new core interface/ and a /new<br>
failover mechanism/!<br>
<br>
The purpose of the new *Binary Internal Interface *is to offer a<br>
fast and efficient communication channel between OpenSIPS<br>
instances. OpenSIPS modules can now use this core interface to<br>
send/receive packets with specific information. A common usage<br>
case for this feature would be data replication between a primary<br>
instance and a backup one.<br>
<br>
This is especially useful in scenarios with OpenSIPS instances<br>
which handle large amounts of concurrent calls, so that failover<br>
through a database backend is not feasible anymore due to the<br>
significant time required in order to load the needed tables.<br>
<br>
As an example of using the interface, the dialog module now<br>
offers the possibility of *replicating dialogs* to another<br>
instance. The script writer may now configure a set of proxies<br>
which will receive dialog-related events: /creation/,<br>
/confirmation/ and /deletion/, all in /realtime/. These messages<br>
are compact and they are sent over UDP. The dialog module now<br>
also exports several new statistics which show the total<br>
sent/received replication packets.<br>
<br>
Configuring UDP listeners for the new interface is trivial and<br>
explained in the OpenSIPS manuals [1].<br>
<br>
[1]: <a href="http://www.opensips.org/Documentation/Interface-Binary" target="_blank">http://www.opensips.org/<u></u>Documentation/Interface-Binary</a><br>
<br>
Best regards,<br>
--<br>
Liviu Chircu<br>
OpenSIPS Developer<br>
<a href="http://www.opensips-solutions.com" target="_blank">http://www.opensips-solutions.<u></u>com</a><br>
<br>
<br>
<br>
______________________________<u></u>_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a> <mailto:<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.<u></u>org</a>><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-<u></u>bin/mailman/listinfo/users</a><br>
</blockquote>
______________________________<u></u>_________________<br>
Devel mailing list<br>
<a href="mailto:Devel@lists.opensips.org" target="_blank">Devel@lists.opensips.org</a> <mailto:<a href="mailto:Devel@lists.opensips.org" target="_blank">Devel@lists.opensips.<u></u>org</a>><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/devel" target="_blank">http://lists.opensips.org/cgi-<u></u>bin/mailman/listinfo/devel</a><br>
<br>
<br>
<br>
______________________________<u></u>_________________<br>
Devel mailing list<br>
<a href="mailto:Devel@lists.opensips.org" target="_blank">Devel@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/devel" target="_blank">http://lists.opensips.org/cgi-<u></u>bin/mailman/listinfo/devel</a><br>
</blockquote></blockquote>
______________________________<u></u>_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-<u></u>bin/mailman/listinfo/users</a><br>
</blockquote>
<br>
<br>
______________________________<u></u>_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-<u></u>bin/mailman/listinfo/users</a><br>
</div></div></blockquote></div><br></div></div></div></div></div></div>