[OpenSIPS-Users] Fw: proxy_authorize("","subscriber") bug ??

Pasan Meemaduma pasandev at ymail.com
Thu Aug 5 07:57:46 CEST 2010


Hi Bogdan,

The problem was with my INVITE dispatch route.

following is my complete script.


    if (!allow_trusted()) {
        t_newtran();
        proxy_authorize("","subscriber");

        $var(x) = $retcode;
        xlog("L_INFO","------return code after auth is $var(x) \n");
        if ($var(x)<0) {

            if(!lookup("location")){
                xlog("L_INFO","------challenging to $fU \n");
                proxy_challenge("","0");
                exit;
            }
        } else if (!check_from()) {
            sl_send_reply("403", "Spoofed From-URI detected");
                xlog("L_INFO","Spoofed From-URI detected ! from --> $fu -- IP 
$si PORT:$sp");
            exit;
        }
        if(is_present_hf("Proxy-Authorization")){
            consume_credentials();# Changed on 2010-06-25
        }
    }

      if (!lookup("location")) {
                rewritehostport("192.168.102.5:5070");

       }
       append_hf("P-hint: usrloc applied\r\n");
       route(1);


route[1] {

#      if(is_method("INVITE")) {
#        if(t_check_trans())
#         {
#            xlog("L_INFO", "Duplicate message $ruri M=$rm  F=$fu  IP=$si \n"); 
#           exit;
#       }
       # send it out now; use stateful forwarding as it works reliably
       # even for UDP2TCP
       # xlog("L_INFO", "Request leaving server - M=$rm RURI=$ru F=$fu T=$tu 
IP=$si ID=$ci\n");
       if (!t_relay()) {
               xlog("L_INFO", "(Rewriting) t_relay 1 - M=$rm RURI=$ru F=$fu 
T=$tu IP=$si ID=$ci\n");
               sl_reply_error();
       }
       t_on_reply("1");
       exit;
}

The commented lines has cause opensips to drop the packet as a duplicate one 
(Initial INVITE and subsequent retransmissions) . If I'm using t_newtran(); in 
auth route how to I check the duplicate messages ?

If I'm using t_newtran() don't I need to use t_check_trans() to check for 
duplicates ?

can I create transactions for other requests which by pass the auth route as 
follow in route[1] ?

route[1] {

      if(is_method("INVITE")) {
        if(!t_check_trans())
        {
           t_newtran();
            xlog("L_INFO", "creating transaction $ruri M=$rm  F=$fu  IP=$si 
\n"); 

           exit;
       }
       # send it out now; use stateful forwarding as it works reliably
       # even for UDP2TCP
       # xlog("L_INFO", "Request leaving server - M=$rm RURI=$ru F=$fu T=$tu 
IP=$si ID=$ci\n");
       if (!t_relay()) {
               xlog("L_INFO", "(Rewriting) t_relay 1 - M=$rm RURI=$ru F=$fu 
T=$tu IP=$si ID=$ci\n");
               sl_reply_error();
       }
       t_on_reply("1");
       exit;
}


If I can clarify these things I can  apply the changes in the production server.

Thanks





________________________________
From: Bogdan-Andrei Iancu <bogdan at voice-system.ro>
To: OpenSIPS users mailling list <users at lists.opensips.org>
Sent: Wednesday, August 4, 2010 22:44:53
Subject: Re: [OpenSIPS-Users] Fw:  proxy_authorize("","subscriber") bug ??

Hi Pasan,

please enable full logging (set debug=6)  and make a log capture for the 
whole registration process - like first REGISTER, challenge, second 
REGISTER...

Because in the first set of logs, I see that -3 is returned, which is 
"stale nonce" - see 
http://www.opensips.org/html/docs/modules/1.6.x/auth_db.html#id228268

Regards,
Bogdan

Pasan Meemaduma wrote:
> Hi Bogdan,
>
> I had to setup a test opensips server to try your suggestion as I 
> can't do much testing on production server.
>
> When I have following in auth route opensips doesn't allow call being 
> routed properly
>
>
>     if (!allow_trusted()) {
>         t_newtran();
>         proxy_authorize("","subscriber");
>
>         $var(x) = $retcode;
>         xlog("L_INFO","------return code after auth is $var(x) \n");
>         if ($var(x)<0) {
>                 xlog("L_INFO","------var(x) < 0 \n");
>
>             if(!lookup("location") ){
>                 xlog("L_INFO","------challenging to $fU \n");
>                 proxy_challenge("","0");
>                 exit;
>             }
>         } else if (!check_from()) {
>             sl_send_reply("403", "Spoofed From-URI detected");
>                 xlog("L_INFO","Spoofed From-URI detected ! from --> 
> $fu -- IP $si PORT:$sp");
>             exit;
>         }
>         if(is_present_hf("Proxy-Authorization")){
>             consume_credentials();# Changed on 2010-06-25
>         }
>     }
>
> I get the following in the /var/log/messages
>
> ug  4 14:24:01 devserver /usr/sbin/opensips[12766]: 
> INFO:xlog:mod_init: initializing...
> Aug  4 14:24:01 devserver /usr/sbin/opensips[12766]: 
> INFO:textops:hname_fixup: using hdr type (16) instead of 
> <Proxy-Authorization>
> Aug  4 14:24:01 devserver /usr/sbin/opensips[12766]: 
> INFO:core:probe_max_receive_buffer: using a UDP receive buffer of 255 kb
> Aug  4 14:24:10 devserver /usr/sbin/opensips[12768]: ------return code 
> after auth is -4
> Aug  4 14:24:10 devserver /usr/sbin/opensips[12768]: ------var(x) < 0
> Aug  4 14:24:10 devserver /usr/sbin/opensips[12768]: ------challenging 
> to 1001
> Aug  4 14:24:10 devserver /usr/sbin/opensips[12771]: ------return code 
> after auth is 1
> Aug  4 14:24:18 devserver /usr/sbin/opensips[12771]: ------return code 
> after auth is 1
> Aug  4 14:24:19 devserver /usr/sbin/opensips[12769]: ------return code 
> after auth is -4
> Aug  4 14:24:19 devserver /usr/sbin/opensips[12769]: ------var(x) < 0
> Aug  4 14:24:26 devserver /usr/sbin/opensips[12771]: ------return code 
> after auth is 1
> Aug  4 14:24:42 devserver /usr/sbin/opensips[12768]: ------return code 
> after auth is -3
> Aug  4 14:24:42 devserver /usr/sbin/opensips[12768]: ------var(x) < 0
> Aug  4 14:24:42 devserver /usr/sbin/opensips[12768]: ------challenging 
> to 1001
>
> -------------------------------------------------
>
>
> But if I try commenting the t_newtran It route the call successfully.
>
>           # t_newtran();          <--- commented
>  
>
> Aug  4 14:23:23 devserver /usr/sbin/opensips[12710]: 
> INFO:textops:mod_init: initializing...
> Aug  4 14:23:23 devserver /usr/sbin/opensips[12710]: 
> INFO:uac:mod_init: initializing...
> Aug  4 14:23:23 devserver /usr/sbin/opensips[12710]: 
> INFO:xlog:mod_init: initializing...
> Aug  4 14:23:23 devserver /usr/sbin/opensips[12710]: 
> INFO:textops:hname_fixup: using hdr type (16) instead of 
> <Proxy-Authorization>
> Aug  4 14:23:23 devserver /usr/sbin/opensips[12710]: 
> INFO:core:probe_max_receive_buffer: using a UDP receive buffer of 255 kb
> Aug  4 14:23:29 devserver /usr/sbin/opensips[12713]: ------return code 
> after auth is -4
> Aug  4 14:23:29 devserver /usr/sbin/opensips[12713]: ------var(x) < 0
> Aug  4 14:23:29 devserver /usr/sbin/opensips[12713]: ------challenging 
> to 1001
> Aug  4 14:23:29 devserver /usr/sbin/opensips[12715]: ------return code 
> after auth is 1
>
>
> Looks like we can't t_newtran() like above. any clue ?
>
> Thanks
>  
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.opensips.org/pipermail/users/attachments/20100804/ea8e4b63/attachment-0001.htm 


More information about the Users mailing list