Tag Archive for 'register'

OpenSIPS battle: REGISTER requests vs permissions module

Sutuation: you have to check the source address of REGISTER messages, going to your OpenSIPS server and decide wether to allow them or to deny.

Use permissions module for this.

You can use it in two variants:

1. with OpenSIPS’ text config files register.allow and register.deny (similar to Unix hosts.allow and hosts.deny).
In this case you should use module’s function ‘allow_register

Example of blocking REGISTERs from 10.145.13.49 IP address:

register.deny file:

ALL : "^sip:.*10\.145\.13\.49"
ALL : "^sip:.*0*10\.145\.0*13\.0*49"   # this is to prevent bypassing
                                       # by the insertion of one or more '0' in the IP address

register.allow file is empty (allow everything except those in .deny file).

OpenSIPS script snippet:

	if ( is_method("REGISTER") ) {
		if (allow_register("register")) {
			save("location");
			exit;
		} else {
			sl_send_reply("403", "Forbidden registration from your IP v2");
			exit;
		}
	}

But this method has one big disadvantage – you need to restart OpenSIPS each time you edit register.allow/register.deny.
OpenSIPS ‘permissions’ module has a MI function ‘address_reload‘ but it reloads the table (see below), not the allow/deny files.
So, it’s more cool to use the second variant, go on reading!..

2. with DB table ‘address‘.
In this case you should use modules’ function ‘check_address

– register.allow and register.deny files are empty.
– add entries to ‘address’ table. In our case we’re using not real SQL DB but dbtext. So, this is how ‘/etc/opensips/dbtext/address’ file looks like:

voip-pbx-sbc ~ # cat /etc/opensips/dbtext/address 
id(int,auto) grp(int) ip(string) mask(int) port(int) proto(string) pattern(string,null) context_info(string,null)
1:0:10.84.2.0:24:0:any
2:0:10.145.13.5:32:0:any
3:0:10.145.13.49:32:0:any
4:0:10.145.14.0:24:0:any

WARNING: every time you add any new txt table (not sure about real SQL, but sure in case of using dbtext), do not forget to add it’s version to another txt-table ‘version’ (I think in case of real SQL it is done automatically, but with dbtext we have to do it manually):

voip-pbx-sbc ~ # cat /etc/opensips/dbtext/version 
table_name(string) table_version(int) 
dispatcher:8
load_balancer:2
address:5

Firstly, I haven’t done it, and that’s why OpenSIPS could not start and I had this message in the system log:

ERROR:core:db_check_table_version: invalid version 0 for table address found, expected 5

So, the script snippet with the ‘check_address’ function:

	if ( is_method("REGISTER") ) {

		if(check_address("0","$si","0","any")) {
			save("location");
			exit;
		} else {
			sl_send_reply("403", "Forbidden registration from your IP v2");
			exit;
		}

	}

And here’s the magic! You may add IP-addresses or subnets to your DB or dbtext file and then run a MI command ‘address_reload‘ without restarting your high-loaded OpenSIPS.

Now the policy is “if address is in the table – allow it, otherwise block”. Look at the images below.

IP is not in the table – REGISTER is forbidden:

IP has been added to dbtext table and table reloaded – registrations passed successfully:

You can also look the table’s contents with MI commands ‘opensipsctl fifo address_dump‘ and ‘opensipsctl fifo subnet_dump‘.

UPD: OpenSIPS core developer’s answer to my question http://lists.opensips.org/pipermail/users/2017-October/038169.html .

FreeSWITCH: dial through VoIP provider

Register against megavoip.com sbc:
Add a file sip.megavoip.com.xml to /usr/local/freeswitch/conf/sip_profiles/external/ to dial through Megavoip.com:

fs-megavoip

Register against multifon.ru sbc:
Add a file multifon.xml to /usr/local/freeswitch/conf/sip_profiles/external/ to dial through multifon.ru:

fs-multifon

Now it’s time to check if the REGISTER is OK.
Execute in the FS CLI:

freeswitch@internal> sofia status
Name Type Data State
=================================================================================================
external profile sip:mod_sofia@10.145.13.21:5080 RUNNING (0)
external::example.com gateway sip:joeuser@example.com NOREG
external::sip.megavoip.com gateway sip:megavoip_username@sip.megavoip.com REGED
external::multifon gateway sip:79221234567@sbc.multifon.ru REGED
10.145.13.21 alias internal ALIASED
internal profile sip:mod_sofia@10.145.13.21:5060 RUNNING (0)
internal-ipv6 profile sip:mod_sofia@[::1]:5060 RUNNING (0)
=================================================================================================
3 profiles 1 alias

or:
freeswitch@internal> sofia status gateway
Profile::Gateway-Name Data State IB Calls(F/T) OB Calls(F/T)
=================================================================================================
external::example.com sip:joeuser@example.com NOREG 0/0 0/0
external::sip.megavoip.com sip:megavoip_username@sip.megavoip.com REGED 0/0 0/0
external::multifon sip:79221234567@sbc.multifon.ru REGED 0/1 0/0
=================================================================================================
3 gateways: Inbound(Failed/Total): 0/1,Outbound(Failed/Total):0/0

or with more info:
freeswitch@internal> sofia status gateway sip.megavoip.com
...

Dial through (let’s dial via megavoip.com):

Add to /usr/local/freeswitch/conf/dialplan/default.xml to the beginning of ‘default’ context:

fs-dial-through