|
|
@@ -18,6 +18,10 @@
|
|
|
# If you look for a simpler version with a lot less dependencies
|
|
|
# please refer to the sip-router-basic.cfg file in your SER distribution.
|
|
|
#
|
|
|
+# If you look for documentation, try http://sip-router.org/wiki/.
|
|
|
+# The right mailing lists for questions about this file is
|
|
|
+# <[email protected]>.
|
|
|
+#
|
|
|
# Requirements:
|
|
|
# ---------------
|
|
|
# running DB, running RTP proxy, one public IP address
|
|
|
@@ -32,6 +36,9 @@
|
|
|
# $ ser_ctl domain add DOMAINNAME
|
|
|
# $ ser_ctl user add USERNAME@DOMAINNAME -p PASSWORD
|
|
|
#
|
|
|
+# (ser_ctl can be obtained from
|
|
|
+# http://ftp.iptel.org/pub/serctl/daily-snapshots/ )
|
|
|
+#
|
|
|
# If you want to have P-Asserted-ID header for your user
|
|
|
#
|
|
|
# $ ser_attr add uid=UID asserted_id="PID"
|
|
|
@@ -45,7 +52,9 @@
|
|
|
# Alternatively, you can simple uncomment the relevant line in this file
|
|
|
# right at the beginning of the main route.
|
|
|
#
|
|
|
-# You can also use serweb to set all the values above.
|
|
|
+# You can also use serweb to set all the values above
|
|
|
+# (http://ftp.iptel.org/pub/serweb/daily-snapshots/ or
|
|
|
+# http://developer.berlios.de/projects/serweb).
|
|
|
#
|
|
|
# Users with permission to call PSTN using this script must have
|
|
|
# the $gw_acl attribute set properly, and shall have $asserted_id
|
|
|
@@ -120,6 +129,31 @@
|
|
|
#
|
|
|
# .... that's it, enough of yadiyada, here the real config begins!
|
|
|
|
|
|
+# ----------- Global Defines / Extra Features -------------------------------
|
|
|
+# (can be enabled either by uncommenting the corresponding #!define
|
|
|
+# statement or by starting with -A WITH_<FEATURE_NAME>, e.g.
|
|
|
+# ser -A WITH_TLS -f /etc/ser/ser-oob.cfg )
|
|
|
+
|
|
|
+# enable TLS
|
|
|
+##!define WITH_TLS
|
|
|
+
|
|
|
+#enable xmlrpc support
|
|
|
+##!define WITH_XMLRPC
|
|
|
+
|
|
|
+# xmlrpc allowed only if it comes on TLS from a client with a valid cert
|
|
|
+##!define XMLRPC_TLS_ONLY
|
|
|
+
|
|
|
+# xmlrpc allowed subnets (if defined XMLRPC requests with source ip matching
|
|
|
+# this network addresses will be allowed, if no XMLRPC_ALLOWED_SUBNETx is
|
|
|
+# defined only requests coming from localhost will be allowed).
|
|
|
+# E.g.: ser -A XMLRPC_ALLOW_NET1=192.168.1.0/24 -f ser-oob.cfg
|
|
|
+##!define XMLRPC_ALLOW_NET1 192.168.0.0/16
|
|
|
+##!define XMLRPC_ALLOW_NET2 10.0.0.0/255.0.0.0
|
|
|
+##!define XMLRPC_ALLOW_NET3 172.16.0.0/12
|
|
|
+
|
|
|
+
|
|
|
+# started from compile directory (not installed)
|
|
|
+##!define LOCAL_TEST_RUN
|
|
|
|
|
|
# ----------- Global Configuration Parameters -------------------------------
|
|
|
|
|
|
@@ -163,7 +197,7 @@ listen=127.0.0.1
|
|
|
#DEBCONF-LISTEN-END
|
|
|
# sip.mcast.net for REGISTER replication
|
|
|
#DEBCONF-LISTEN_REPL-START
|
|
|
-listen=224.0.1.75
|
|
|
+listen=udp:224.0.1.75
|
|
|
#DEBCONF-LISTEN_REPL-END
|
|
|
# administrative interface -- needed for example for multicast source
|
|
|
# or XML-RPC
|
|
|
@@ -199,8 +233,13 @@ dns_cache_gc_interval=60 # garbage collection every minute
|
|
|
dns_try_naptr=yes
|
|
|
dns_srv_lb=yes # srv based load balancing
|
|
|
dns_udp_pref=3 # prefer udp (when resolving naptr record)
|
|
|
-dns_tcp_pref=2 # if no udp availbale accept tcp (for naptr)
|
|
|
+dns_tcp_pref=2 # if no udp available accept tcp (for naptr)
|
|
|
+dns_sctp_pref=2 # same preference as tcp
|
|
|
+#!ifdef WITH_TLS
|
|
|
+dns_tls_pref=1 # low preference (heavy resource use)
|
|
|
+#!else
|
|
|
dns_tls_pref=-1 # ignore / don't accept tls (for naptr)
|
|
|
+#!endif
|
|
|
# dns_cache_delete_nonexpired=no
|
|
|
|
|
|
# ------------------- Blacklist Parameters ----------------------------------
|
|
|
@@ -218,14 +257,14 @@ dst_blacklist_gc_interval=150 # 2.5 min
|
|
|
tcp_connection_lifetime=3600
|
|
|
#tcp_max_connections=10240 # default is 2048
|
|
|
tcp_connect_timeout=1
|
|
|
+tcp_async=yes
|
|
|
|
|
|
# ------------------- TLS Parameters ----------------------------------------
|
|
|
|
|
|
+#!ifdef WITH_TLS
|
|
|
# Enable TLS hooks so that the TLS module can be used
|
|
|
tls_enable=yes
|
|
|
-# This option is required if you want to use TLS as the TLS
|
|
|
-# module does not support the new async TCP mode yet
|
|
|
-tcp_async=no
|
|
|
+#!endif
|
|
|
|
|
|
# -------------------- Custom Parameters ------------------------------------
|
|
|
# These parameters can be modified runtime via RPC interface,
|
|
|
@@ -256,16 +295,18 @@ rtp_proxy.enabled = "detect" desc "indicates whether the RTP Proxy is enabled or
|
|
|
#DEBCONF-RTP_ENABLE-END
|
|
|
|
|
|
# ------------------ Module Loading -----------------------------------------
|
|
|
-
|
|
|
-#loadpath "modules:modules_s"
|
|
|
+#!ifdef LOCAL_TEST_RUN
|
|
|
+loadpath "modules:modules_s"
|
|
|
+#!else
|
|
|
loadpath "/usr/lib/sip-router/modules:/usr/lib/sip-router/modules_s"
|
|
|
+#!endif
|
|
|
|
|
|
# load a SQL database for authentication, domains, user AVPs etc.
|
|
|
loadmodule "db_mysql"
|
|
|
#loadmodule "postgres"
|
|
|
|
|
|
-loadmodule "sl"
|
|
|
loadmodule "tm"
|
|
|
+loadmodule "sl"
|
|
|
loadmodule "rr"
|
|
|
loadmodule "maxfwd"
|
|
|
loadmodule "usrloc"
|
|
|
@@ -281,7 +322,9 @@ loadmodule "uri_db"
|
|
|
loadmodule "avp"
|
|
|
loadmodule "avp_db"
|
|
|
loadmodule "acc_db"
|
|
|
-#loadmodule "xmlrpc"
|
|
|
+#!ifdef WITH_XMLRPC
|
|
|
+loadmodule "xmlrpc"
|
|
|
+#!endif
|
|
|
loadmodule "options"
|
|
|
loadmodule "sanity"
|
|
|
loadmodule "nathelper"
|
|
|
@@ -293,7 +336,9 @@ loadmodule "exec"
|
|
|
loadmodule "cfg_rpc"
|
|
|
loadmodule "eval"
|
|
|
loadmodule "enum"
|
|
|
-#loadmodule "tls"
|
|
|
+#!ifdef WITH_TLS
|
|
|
+loadmodule "tls"
|
|
|
+#!endif
|
|
|
|
|
|
# ----------------- Declaration of Script Flags -----------------------------
|
|
|
flags
|
|
|
@@ -320,12 +365,12 @@ avpflags
|
|
|
#
|
|
|
#DEBCONF-DBURL-START
|
|
|
modparam("speeddial|auth_db|usrloc|domain|uri_db|gflags|avp_db|db_ops",
|
|
|
- "db_url", "mysql://sip-router:[email protected]/sip-router")
|
|
|
+ "db_url", "mysql://ser:[email protected]/ser")
|
|
|
#DEBCONF-DBURL-END
|
|
|
|
|
|
# specify the path to your database for accounting
|
|
|
#DEBCONF-DBURLACC-START
|
|
|
-modparam("acc_db", "db_url", "mysql://sip-router:[email protected]/sip-router")
|
|
|
+modparam("acc_db", "db_url", "mysql://ser:[email protected]/ser")
|
|
|
#DEBCONF-DBURLACC-END
|
|
|
|
|
|
|
|
|
@@ -435,11 +480,11 @@ modparam("domain", "load_domain_attrs", 1)
|
|
|
|
|
|
# By default, ctl listens on unixs:/tmp/sip-router_ctl if no other address is
|
|
|
# specified in modparams; this is also the default for sercmd.
|
|
|
-modparam("ctl", "binrpc", "unixs:/tmp/sip-router_ctl")
|
|
|
+modparam("ctl", "binrpc", "unixs:/tmp/ser_ctl")
|
|
|
# Listen on the "standard" fifo for backward compatibility.
|
|
|
-modparam("ctl", "fifo", "fifo:/tmp/sip-router_fifo")
|
|
|
+modparam("ctl", "fifo", "fifo:/tmp/ser_fifo")
|
|
|
# Listen on tcp on localhost.
|
|
|
-#modparam("ctl", "binrpc", "tcp:localhost:2046")
|
|
|
+modparam("ctl", "binrpc", "tcp:127.0.0.1:2046")
|
|
|
|
|
|
|
|
|
# -- acc_db --
|
|
|
@@ -465,9 +510,11 @@ modparam("tm", "restart_fr_on_each_reply", 0)
|
|
|
|
|
|
# -- xmlrpc --
|
|
|
|
|
|
+#!ifdef WITH_XMLRPC
|
|
|
# Use a sub-route. This is a lot safer then relying on the request method
|
|
|
# to distinguish HTTP from SIP
|
|
|
-#modparam("xmlrpc", "route", "RPC");
|
|
|
+modparam("xmlrpc", "route", "XMLRPC");
|
|
|
+#!endif
|
|
|
|
|
|
|
|
|
# -- nathelper --
|
|
|
@@ -506,8 +553,14 @@ modparam("exec", "setvars", 0);
|
|
|
modparam("timer", "declare_timer",
|
|
|
"ON_1MIN_TIMER=ON_1MIN_TIMER,60000,slow,enable");
|
|
|
|
|
|
+#!ifdef WITH_TLS
|
|
|
# -- tls --
|
|
|
-#modparam("tls", "config", "tls.cfg");
|
|
|
+#!ifdef LOCAL_TEST_RUN
|
|
|
+modparam("tls", "config", "./modules/tls/tls.cfg");
|
|
|
+#!else
|
|
|
+modparam("tls", "config", "tls.cfg");
|
|
|
+#!endif
|
|
|
+#!endif
|
|
|
|
|
|
# -- db_ops --
|
|
|
|
|
|
@@ -1586,3 +1639,49 @@ route[ON_1MIN_TIMER] {
|
|
|
db_close("gattr_reload");
|
|
|
}
|
|
|
|
|
|
+
|
|
|
+#!ifdef WITH_XMLRPC
|
|
|
+# handle xmlrpcs
|
|
|
+route[XMLRPC]{
|
|
|
+ # accept xmlrpc requests only from localhost
|
|
|
+ if (src_ip!=127.0.0.1
|
|
|
+ #!ifdef XMLRPC_ALLOW_NET1
|
|
|
+ && src_ip != XMLRPC_ALLOW_NET1
|
|
|
+ #!endif
|
|
|
+ #!ifdef XMLRPC_ALLOW_NET2
|
|
|
+ && src_ip != XMLRPC_ALLOW_NET2
|
|
|
+ #!endif
|
|
|
+ #!ifdef XMLRPC_ALLOW_NET3
|
|
|
+ && src_ip != XMLRPC_ALLOW_NET3
|
|
|
+ #!endif
|
|
|
+ ) {
|
|
|
+ xmlrpc_reply("400", "xmlrpc not allowed from this address");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if (method!="POST" && method!="GET") {
|
|
|
+ xmlrpc_reply("400", "unsupported HTTP method");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if (msg:len >= 8192) {
|
|
|
+ xmlrpc_reply("513", "request too big");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+#!ifdef XMLRPC_TLS_ONLY
|
|
|
+ # allow xmlrpc only on TLS and only if the client certificate is valid
|
|
|
+ if (proto!=TLS){
|
|
|
+ xmlrpc_reply("400", "xmlrpc allowed only over TLS");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+ if (@tls.peer.verified!=""){
|
|
|
+ xmlrpc_reply("400", "Unauthorized");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+#!endif
|
|
|
+
|
|
|
+ # close connection only for xmlrpclib user agents (there is a bug in
|
|
|
+ # xmlrpclib: it waits for EOF before interpreting the response).
|
|
|
+ if (search("^User-Agent:.*xmlrpclib"))
|
|
|
+ set_reply_close();
|
|
|
+ set_reply_no_connect(); # optional
|
|
|
+ dispatch_rpc();
|
|
|
+}
|
Andrei Pelinescu-Onciul