|
|
@@ -5,6 +5,7 @@
|
|
|
|
|
|
#!substdef "!DBURL!sqlite:///etc/kamailio/db.sqlite!g"
|
|
|
#!substdef "!MY_IP_ADDR!a.b.c.d!g"
|
|
|
+#!substdef "!MY_DOMAIN!example.com!g"
|
|
|
#!substdef "!MY_WS_PORT!80!g"
|
|
|
#!substdef "!MY_WSS_PORT!443!g"
|
|
|
#!substdef "!MY_WS_ADDR!tcp:MY_IP_ADDR:MY_WS_PORT!g"
|
|
|
@@ -20,8 +21,6 @@
|
|
|
fork=yes
|
|
|
children=4
|
|
|
|
|
|
-alias="example.com"
|
|
|
-
|
|
|
#!ifdef WITH_TLS
|
|
|
enable_tls=1
|
|
|
#!endif
|
|
|
@@ -65,6 +64,7 @@ loadmodule "auth.so"
|
|
|
loadmodule "auth_db.so"
|
|
|
loadmodule "kex.so"
|
|
|
loadmodule "mi_rpc.so"
|
|
|
+loadmodule "corex.so"
|
|
|
#!ifdef WITH_TLS
|
|
|
loadmodule "tls.so"
|
|
|
#!endif
|
|
|
@@ -105,6 +105,9 @@ modparam("auth_db", "calculate_ha1", yes)
|
|
|
modparam("auth_db", "password_column", "password")
|
|
|
modparam("auth_db", "load_credentials", "")
|
|
|
|
|
|
+# ----- corex params -----
|
|
|
+modparam("corex", "alias_subdomains", "MY_DOMAIN")
|
|
|
+
|
|
|
#!ifdef WITH_TLS
|
|
|
# ----- tls params -----
|
|
|
modparam("tls", "tls_method", "SSLv23")
|
|
|
@@ -203,10 +206,15 @@ route[REQINIT] {
|
|
|
exit;
|
|
|
}
|
|
|
|
|
|
- if(!sanity_check("1511", "7")) {
|
|
|
+ if (!sanity_check("1511", "7")) {
|
|
|
xlog("Malformed SIP message from $si:$sp\n");
|
|
|
exit;
|
|
|
}
|
|
|
+
|
|
|
+ if (uri == myself && is_method("OPTIONS") && !(uri=~"sip:.*[@]+.*")) {
|
|
|
+ options_reply();
|
|
|
+ exit;
|
|
|
+ }
|
|
|
}
|
|
|
|
|
|
# Handle requests within SIP dialogs
|
|
|
@@ -239,7 +247,7 @@ route[WITHINDLG] {
|
|
|
exit;
|
|
|
}
|
|
|
}
|
|
|
- sl_send_reply("404","Not here");
|
|
|
+ sl_send_reply("404","Not Found");
|
|
|
}
|
|
|
exit;
|
|
|
}
|
|
|
@@ -287,7 +295,7 @@ route[AUTH] {
|
|
|
# if caller is not local subscriber, then check if it calls
|
|
|
# a local destination, otherwise deny, not an open relay here
|
|
|
if (from_uri!=myself && uri!=myself) {
|
|
|
- sl_send_reply("403","Not relaying");
|
|
|
+ sl_send_reply("403","Forbidden");
|
|
|
exit;
|
|
|
}
|
|
|
}
|
|
|
@@ -307,7 +315,11 @@ event_route[xhttp:request] {
|
|
|
set_reply_close();
|
|
|
set_reply_no_connect();
|
|
|
|
|
|
- if ($Rp != MY_WS_PORT && $Rp != MY_WSS_PORT) {
|
|
|
+ if ($Rp != MY_WS_PORT
|
|
|
+#!ifdef WITH_TLS
|
|
|
+ && $Rp != MY_WSS_PORT
|
|
|
+#!endif
|
|
|
+ ) {
|
|
|
xlog("L_WARN", "HTTP request received on $Rp\n");
|
|
|
xhttp_reply("403", "Forbidden", "", "");
|
|
|
exit;
|
|
|
@@ -318,17 +330,25 @@ event_route[xhttp:request] {
|
|
|
if ($hdr(Upgrade)=~"websocket"
|
|
|
&& $hdr(Connection)=~"Upgrade"
|
|
|
&& $rm=~"GET") {
|
|
|
- xlog("L_DBG", "WebSocket\n");
|
|
|
- xlog("L_DBG", " Host: $hdr(Host)\n");
|
|
|
- xlog("L_DBG", " Origin: $hdr(Origin)\n");
|
|
|
|
|
|
- if ($hdr(Host) == $null || !is_myself($hdr(Host))) {
|
|
|
+ # Validate Host - make sure the client is using the correct
|
|
|
+ # alias for WebSockets
|
|
|
+ if ($hdr(Host) == $null || !is_myself("sip:" + $hdr(Host))) {
|
|
|
xlog("L_WARN", "Bad host $hdr(Host)\n");
|
|
|
xhttp_reply("403", "Forbidden", "", "");
|
|
|
exit;
|
|
|
}
|
|
|
|
|
|
- # Optional... validate Origin
|
|
|
+ # Optional... validate Origin - make sure the client is from an
|
|
|
+ # authorised website. For example,
|
|
|
+ #
|
|
|
+ # if ($hdr(Origin) != "http://communicator.MY_DOMAIN"
|
|
|
+ # && $hdr(Origin) != "https://communicator.MY_DOMAIN") {
|
|
|
+ # xlog("L_WARN", "Unauthorised client $hdr(Origin)\n");
|
|
|
+ # xhttp_reply("403", "Forbidden", "", "");
|
|
|
+ # exit;
|
|
|
+ # }
|
|
|
+
|
|
|
# Optional... perform HTTP authentication
|
|
|
|
|
|
# ws_handle_handshake() exits (no further configuration file
|
|
|
@@ -341,7 +361,7 @@ event_route[xhttp:request] {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
- xhttp_reply("404", "Not found", "", "");
|
|
|
+ xhttp_reply("404", "Not Found", "", "");
|
|
|
}
|
|
|
|
|
|
event_route[websocket:closed] {
|
Carsten Bock