khorsmann · November 7, 2019 09:58 · Nov 7, 2019
diff --git a/kamailio.cfg b/kamailio.cfg
@@ -0,0 +1,1184 @@
+#!KAMAILIO
+
+####### Include Local Config If Exists #########
+import_file "kamailio-local.cfg"
+
+# Content of kamailio-local.cfg
+listen=udp:172.20.xx.xxx:5060       # CORRECT THIS
+listen=tls:212.xx.xx.xxx:5061       # CORRECT THIS
+#!define DBURL "text:///etc/kamailio/database"
+#!define WITH_NAT
+#!define WITH_TLS
+#!define WITH_DISPATCHER
+#!define WITH_AUTH
+#!define WITH_IPAUTH
+#!define WITH_TLS_AUTH
+#!define WITH_TOPOS
+#!define WITH_SDP_REWRITE
+#!substdef "!SBC_DNS_NAME!sbc-d01.domain.example!g"   # CORRECT THIS
+#!substdef "!CFG_PROD_IP!212.xx.xx.xxx!g"               # CORRECT THIS
+
+#!define WITH_HOMER
+
+#!substdef "!MY_HOMER_IP_ADDR!172.20.xxx.xyx!g"          # CORRECT THIS
+#!substdef "!MY_HOMER_PORT!9060!g"
+#!substdef "!MY_LOCAL_SEND_PORT!9060!g"
+#!substdef "!MY_PRV_IP!172.20.xxx.xxx!g"                # CORRECT THIS
+
+server_header="Server: SBC-OS"
+user_agent_header="User-Agent: SBC-OS"
+topology.hostname_hide="sbc-d01.domain.example" desc "Fake topology hostname"
+proxygw.detail="-" desc "Fake sdp servername"
+###############################################
+
+
+# Disable the Server: kamailio x.y.z header
+server_signature=no
+sip_warning=0
+#!define WITH_MB_DEBUG
+####### Defined Values #########
+
+# *** Value defines - IDs used later in config
+#!ifdef WITH_MYSQL
+# - database URL - used to connect to database server by modules such
+#       as: auth_db, acc, usrloc, a.s.o.
+#!ifndef DBURL
+#!define DBURL "mysql://kamailio:kamailiorw@localhost/kamailio"
+#!endif
+#!endif
+#!ifdef WITH_MULTIDOMAIN
+# - the value for 'use_domain' parameters
+#!define MULTIDOMAIN 1
+#!else
+#!define MULTIDOMAIN 0
+#!endif
+
+# - flags
+#   FLT_ - per transaction (message) flags
+#	FLB_ - per branch flags
+#!define FLT_ACC 1
+#!define FLT_ACCMISSED 2
+#!define FLT_ACCFAILED 3
+#!define FLT_NATS 5
+
+#!define FLB_NATB 6
+#!define FLB_NATSIPPING 7
+
+#!define DLG_FLAG 8
+
+####### Global Parameters #########
+
+### LOG Levels: 3=DBG, 2=INFO, 1=NOTICE, 0=WARN, -1=ERR
+#!ifdef WITH_DEBUG
+debug=4
+log_stderror=yes
+#!else
+debug=2
+log_stderror=no
+#!endif
+
+
+memdbg=5
+memlog=5
+
+log_facility=LOG_LOCAL0
+log_prefix="{$mt $hdr(CSeq) $ci} "
+
+/* number of SIP routing processes for each UDP socket
+ * - value inherited by tcp_children and sctp_children when not set explicitely */
+children=8
+
+/* uncomment the next line to disable TCP (default on) */
+# disable_tcp=yes
+
+/* number of SIP routing processes for all TCP/TLS sockets */
+# tcp_children=8
+
+/* uncomment the next line to disable the auto discovery of local aliases
+ * based on reverse DNS on IPs (default on) */
+# auto_aliases=no
+
+/* add local domain aliases */
+# alias="sip.mydomain.com"
+
+/* uncomment and configure the following line if you want Kamailio to
+ * bind on a specific interface/port/proto (default bind on all available) */
+# listen=udp:10.0.0.10:5060
+
+/* life time of TCP connection when there is no traffic
+ * - a bit higher than registration expires to cope with UA behind NAT */
+tcp_connection_lifetime=3605
+
+/* upper limit for TCP connections (it includes the TLS connections) */
+tcp_max_connections=50000
+
+#!ifdef WITH_TLS
+enable_tls=yes
+
+# allows reuse of TCP ports. OS must support SO_REUSPORT
+#tcp_reuse_port=yes
+
+/* upper limit for TLS connections */
+tls_max_connections=50000
+#!endif
+
+####### Custom Parameters #########
+
+####### Modules Section ########
+
+/* set paths to location of modules */
+# mpath="/usr/lib/x86_64-linux-gnu/kamailio/modules/"
+
+#!ifdef WITH_MYSQL
+loadmodule "db_mysql.so"
+#!endif
+
+loadmodule "jsonrpcs.so"
+loadmodule "db_text.so"
+loadmodule "kex.so"
+loadmodule "corex.so"
+loadmodule "tm.so"
+loadmodule "tmx.so"
+loadmodule "sl.so"
+loadmodule "rr.so"
+loadmodule "pv.so"
+loadmodule "maxfwd.so"
+loadmodule "usrloc.so"
+loadmodule "registrar.so"
+loadmodule "textops.so"
+loadmodule "textopsx.so"
+loadmodule "siputils.so"
+loadmodule "xlog.so"
+loadmodule "sanity.so"
+loadmodule "ctl.so"
+loadmodule "cfg_rpc.so"
+loadmodule "acc.so"
+loadmodule "counters.so"
+loadmodule "ndb_redis.so"
+#!ifdef WITH_TOPOS
+loadmodule "topos_redis.so"
+loadmodule "topos.so"
+#!endif
+loadmodule "uac.so"
+loadmodule "avpops.so"
+loadmodule "sdpops.so"
+loadmodule "msrp.so"
+
+#!ifdef WITH_AUTH
+loadmodule "auth.so"
+loadmodule "auth_db.so"
+#!ifdef WITH_IPAUTH
+loadmodule "permissions.so"
+#!endif
+#!endif
+
+#!ifdef WITH_ALIASDB
+loadmodule "alias_db.so"
+#!endif
+
+#!ifdef WITH_SPEEDDIAL
+loadmodule "speeddial.so"
+#!endif
+
+#!ifdef WITH_MULTIDOMAIN
+loadmodule "domain.so"
+#!endif
+
+#!ifdef WITH_PRESENCE
+loadmodule "presence.so"
+loadmodule "presence_xml.so"
+#!endif
+
+#!ifdef WITH_NAT
+loadmodule "nathelper.so"
+loadmodule "rtpengine.so"
+#!endif
+
+#!ifdef WITH_TLS
+loadmodule "tls.so"
+#!endif
+
+#!ifdef WITH_ANTIFLOOD
+loadmodule "htable.so"
+loadmodule "pike.so"
+#!endif
+
+#!ifdef WITH_XMLRPC
+loadmodule "xmlrpc.so"
+#!endif
+
+#!ifdef WITH_DEBUG
+loadmodule "debugger.so"
+#!endif
+
+#!ifdef WITH_HOMER
+loadmodule "siptrace.so"
+#!endif
+
+#!ifdef WITH_DISPATCHER
+loadmodule "dispatcher.so"
+modparam("dispatcher", "list_file", "/etc/kamailio/dispatcher.list")
+modparam("dispatcher", "ds_probing_mode", 1)
+modparam("dispatcher", "ds_ping_interval", 60)
+modparam("dispatcher", "ds_probing_mode", 1)
+modparam("dispatcher", "ds_probing_threshold", 2)
+modparam("dispatcher", "setid_pvname", "$var(setid)")
+modparam("dispatcher", "attrs_pvname", "$var(attrs)")
+modparam("dispatcher", "ds_ping_reply_codes", "class=2")
+modparam("dispatcher", "ds_ping_latency_stats", 1)
+#!endif
+
+#TOPOS
+modparam("ndb_redis", "server", "name=sbc01;addr=127.0.0.1;port=6379;db=8")
+### modparam("ndb_redis", "server", "name=CFG_REDIS_NAME;addr=CFG_REDIS_ADDR;port=6379;db=CFG_REDIS_DB")
+modparam("ndb_redis", "connect_timeout", 1500) # default 1000ms/1sec
+modparam("ndb_redis", "cmd_timeout", 1500) # default 1000ms/1sec
+
+#### $mb message debugging (see event-routes)
+#!ifdef WITH_MB_DEBUG
+modparam("corex", "network_io_intercept", 1)
+modparam("corex", "min_msg_len", 32)
+#!endif
+
+#!ifdef WITH_TOPOS
+modparam("topos", "storage", "redis")
+modparam("topos_redis", "serverid", "sbc01")
+modparam("topos", "branch_expire", 14400)
+modparam("topos", "dialog_expire", 14400)
+modparam("topos", "clean_interval", 60)
+#!endif
+
+# ----------------- setting module-specific parameters ---------------
+#modparam("path", "use_received", 1)
+
+# ----- jsonrpcs params -----
+modparam("jsonrpcs", "pretty_format", 1)
+/* set the path to RPC fifo control file */
+modparam("jsonrpcs", "fifo_name", "/var/run/kamailio/kamailio_rpc.fifo")
+/* set the path to RPC unix socket control file */
+#modparam("jsonrpcs", "dgram_socket", "/var/run/kamailio/kamailio_rpc.sock")
+
+# ----- ctl params -----
+/* set the path to RPC unix socket control file */
+# modparam("ctl", "binrpc", "unix:/var/run/kamailio/kamailio_ctl")
+
+# ----- sanity params -----
+modparam("sanity", "autodrop", 0)
+
+# ----- tm params -----
+# auto-discard branches from previous serial forking leg
+modparam("tm", "failure_reply_mode", 3)
+# default retransmission timeout: 30sec
+modparam("tm", "fr_timer", 30000)
+# default invite retransmission timeout after 1xx: 120sec
+modparam("tm", "fr_inv_timer", 120000)
+
+# ----- rr params -----
+# set next param to 1 to add value to ;lr param (helps with some UAs)
+modparam("rr", "enable_full_lr", 1)
+# do not append from tag to the RR (no need for this script)
+modparam("rr", "append_fromtag", 1)
+
+# ----- registrar params -----
+modparam("registrar", "method_filtering", 1)
+/* uncomment the next line to disable parallel forking via location */
+# modparam("registrar", "append_branches", 0)
+/* uncomment the next line not to allow more than 10 contacts per AOR */
+# modparam("registrar", "max_contacts", 10)
+/* max value for expires of registrations */
+modparam("registrar", "max_expires", 3600)
+/* set it to 1 to enable GRUU */
+modparam("registrar", "gruu_enabled", 0)
+
+# ----- acc params -----
+/* what special events should be accounted ? */
+modparam("acc", "early_media", 0)
+modparam("acc", "report_ack", 0)
+modparam("acc", "report_cancels", 0)
+/* by default ww do not adjust the direct of the sequential requests.
+ * if you enable this parameter, be sure the enable "append_fromtag"
+ * in "rr" module */
+modparam("acc", "detect_direction", 0)
+/* account triggers (flags) */
+modparam("acc", "log_flag", FLT_ACC)
+modparam("acc", "log_missed_flag", FLT_ACCMISSED)
+modparam("acc", "log_extra",
+	"src_user=$fU;src_domain=$fd;src_ip=$si;"
+	"dst_ouser=$tU;dst_user=$rU;dst_domain=$rd")
+modparam("acc", "failed_transaction_flag", FLT_ACCFAILED)
+/* enhanced DB accounting */
+#!ifdef WITH_ACCDB
+modparam("acc", "db_flag", FLT_ACC)
+modparam("acc", "db_missed_flag", FLT_ACCMISSED)
+modparam("acc", "db_url", DBURL)
+modparam("acc", "db_extra",
+	"src_user=$fU;src_domain=$fd;src_ip=$si;"
+	"dst_ouser=$tU;dst_user=$rU;dst_domain=$rd")
+#!endif
+
+# ----- usrloc params -----
+/* enable DB persistency for location entries */
+#!ifdef WITH_USRLOCDB
+modparam("usrloc", "db_url", DBURL)
+modparam("usrloc", "db_mode", 2)
+modparam("usrloc", "use_domain", MULTIDOMAIN)
+#!endif
+
+# ----- auth_db params -----
+#!ifdef WITH_AUTH
+modparam("auth_db", "db_url", DBURL)
+modparam("auth_db", "calculate_ha1", yes)
+modparam("auth_db", "password_column", "password")
+modparam("auth_db", "load_credentials", "")
+modparam("auth_db", "use_domain", MULTIDOMAIN)
+
+# ----- permissions params -----
+#!ifdef WITH_IPAUTH
+modparam("permissions", "db_url", DBURL)
+modparam("permissions", "db_mode", 1)
+#!endif
+
+#!endif
+
+# ----- alias_db params -----
+#!ifdef WITH_ALIASDB
+modparam("alias_db", "db_url", DBURL)
+modparam("alias_db", "use_domain", MULTIDOMAIN)
+#!endif
+
+# ----- speeddial params -----
+#!ifdef WITH_SPEEDDIAL
+modparam("speeddial", "db_url", DBURL)
+modparam("speeddial", "use_domain", MULTIDOMAIN)
+#!endif
+
+# ----- domain params -----
+#!ifdef WITH_MULTIDOMAIN
+modparam("domain", "db_url", DBURL)
+/* register callback to match myself condition with domains list */
+modparam("domain", "register_myself", 1)
+#!endif
+
+#!ifdef WITH_PRESENCE
+# ----- presence params -----
+modparam("presence", "db_url", DBURL)
+
+# ----- presence_xml params -----
+modparam("presence_xml", "db_url", DBURL)
+modparam("presence_xml", "force_active", 1)
+#!endif
+
+#!ifdef WITH_NAT
+# ----- rtpproxy params -----
+modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")
+#modparam("rtpengine", "extra_id_pv", "$avp(extra_id)")
+#!ifdef WITH_SDP_REWRITE
+modparam("rtpengine", "read_sdp_pv", "$avp(sdp)")
+#!endif
+
+# ----- nathelper params -----
+modparam("nathelper", "natping_interval", 30)
+modparam("nathelper", "ping_nated_only", 1)
+modparam("nathelper", "sipping_bflag", FLB_NATSIPPING)
+modparam("nathelper", "sipping_from", "sip:[email protected]")
+
+# params needed for NAT traversal in other modules
+modparam("nathelper|registrar", "received_avp", "$avp(RECEIVED)")
+modparam("usrloc", "nat_bflag", FLB_NATB)
+#!endif
+
+#!ifdef WITH_TLS
+# ----- tls params -----
+modparam("tls", "config", "/etc/kamailio/tls.cfg")
+#!endif
+
+#!ifdef WITH_ANTIFLOOD
+# ----- pike params -----
+modparam("pike", "sampling_time_unit", 2)
+modparam("pike", "reqs_density_per_unit", 16)
+modparam("pike", "remove_latency", 4)
+
+# ----- htable params -----
+/* ip ban htable with autoexpire after 5 minutes */
+modparam("htable", "htable", "ipban=>size=8;autoexpire=300;")
+#!endif
+
+#!ifdef WITH_XMLRPC
+# ----- xmlrpc params -----
+modparam("xmlrpc", "route", "XMLRPC");
+modparam("xmlrpc", "url_match", "^/RPC")
+#!endif
+
+#!ifdef WITH_DEBUG
+# ----- debugger params -----
+modparam("debugger", "cfgtrace", 1)
+modparam("debugger", "log_level_name", "exec")
+#!endif
+
+remove.prack = 1 desc "1 true - 0 false"
+mylog.logint = 1 desc "on the fly logging"
+
+
+# sendsocket for homer
+#!ifdef WITH_HOMER
+#!substdef "!MY_HOMER_CAPTURE!sip:MY_HOMER_IP_ADDR:MY_HOMER_PORT!g"
+#!substdef "!MY_LOCAL_SENDSOCK!sip:MY_PRV_IP:MY_LOCAL_SEND_PORT!g"
+#!substdef "!MY_LOCAL_SENDLISTEN!udp:MY_PRV_IP:MY_LOCAL_SEND_PORT!g"
+socket_workers=2
+listen=MY_LOCAL_SENDLISTEN
+#!endif
+
+
+#!ifdef WITH_HOMER
+#Siptrace
+modparam("siptrace", "force_send_sock", "MY_LOCAL_SENDSOCK")
+modparam("siptrace", "duplicate_uri", "MY_HOMER_CAPTURE")
+modparam("siptrace", "hep_mode_on", 1)
+modparam("siptrace", "hep_version", 3)
+modparam("siptrace", "trace_to_database", 0)
+modparam("siptrace", "trace_flag", 22)
+modparam("siptrace", "trace_on", 1)
+# old hep v2 allows 32767 max as hep_capture_id
+modparam("siptrace", "hep_capture_id", 9)
+#!endif
+
+####### Routing Logic ########
+
+
+/* Main SIP request routing logic
+ * - processing of any incoming SIP request starts with this route
+ * - note: this is the same as route { ... } */
+request_route {
+
+#!ifdef WITH_HOMER
+# start duplicate the SIP message here
+		sip_trace();
+		setflag(22);
+#!endif
+
+	# per request initial checks
+	route(REQINIT);
+
+	# NAT detection
+	route(NATDETECT);
+
+	# CANCEL processing
+	if (is_method("CANCEL")) {
+		if (t_check_trans()) {
+			route(RELAY);
+		}
+		exit;
+	}
+
+	# handle retransmissions
+	if (!is_method("ACK")) {
+		if(t_precheck_trans()) {
+			t_check_trans();
+			exit;
+		}
+		t_check_trans();
+	}
+
+	# handle requests within SIP dialogs
+	route(WITHINDLG);
+
+	### only initial requests (no To tag)
+
+	# authentication
+	#route(AUTH);
+
+	# record routing for dialog forming requests (in case they are routed)
+	# - remove preloaded route headers
+	remove_hf("Route");
+	if (is_method("INVITE|SUBSCRIBE")) {
+		# alternative to record_route to present the correct route-header to outside
+		# important for MS-Teams connections
+		$var(mediagroup) = allow_address_group($Ri, 0);
+		# Group == 1 - 100 - internal GROUP IP
+		# from address database
+		if($var(mediagroup) < 100) {
+			if ($sel(cfg_get.mylog.logint) > 0) {
+				xlog("L_INFO", "[REQUEST] FROM INTERNAL --> INVITE rU: <$rU> rd: <$rd> var(mediagroup): <$var(mediagroup)> \n");
+			}
+			record_route_preset("SBC_DNS_NAME:5061;transport=tls", "$Ri:5060");
+		} else {
+			if ($sel(cfg_get.mylog.logint) > 0) {
+				xlog("L_INFO", "[REQUEST] FROM EXTERNAL --> INVITE rU: <$rU> rd: <$rd> var(mediagroup): <$var(mediagroup)> \n");
+			}
+			record_route();
+		}
+	}
+
+	# account only INVITEs
+	if (is_method("INVITE")) {
+		setflag(FLT_ACC); # do accounting
+		route(REMOVE_PRACK);
+	}
+
+
+	route(TLS_AUTH);
+
+	# dispatch requests to foreign domains
+	# route(SIPOUT);
+
+	### requests for my local domains
+
+	if ($rU==$null) {
+		# request with no Username in RURI
+		sl_send_reply("484","Address Incomplete");
+		exit;
+	}
+
+}
+
+# Wrapper for relaying requests
+route[RELAY] {
+
+	if (is_method("ACK") && has_body("application/sdp")) {
+				route(MEDIAPROXY);
+		}
+	# enable additional event routes for forwarded requests
+	# - serial forking, RTP relaying handling, a.s.o.
+	if (is_method("INVITE|BYE|SUBSCRIBE|UPDATE")) {
+		if(!t_is_set("branch_route")) t_on_branch("MANAGE_BRANCH");
+	}
+	if (is_method("INVITE|SUBSCRIBE|UPDATE")) {
+		if(!t_is_set("onreply_route")) t_on_reply("MANAGE_REPLY");
+	}
+	if (is_method("INVITE")) {
+		if(!t_is_set("failure_route")) t_on_failure("MANAGE_FAILURE");
+	}
+
+	if (!t_relay()) {
+		sl_reply_error();
+	}
+	exit;
+}
+
+# Per SIP request initial checks
+route[REQINIT] {
+	# no connect for sending replies
+	set_reply_no_connect();
+
+#!ifdef WITH_ANTIFLOOD
+	# flood detection from same IP and traffic ban for a while
+	# be sure you exclude checking trusted peers, such as pstn gateways
+	# - local host excluded (e.g., loop to self)
+	if(src_ip!=myself) {
+		if($sht(ipban=>$si)!=$null) {
+			# ip is already blocked
+			xdbg("request from blocked IP - $rm from $fu (IP:$si:$sp)\n");
+			exit;
+		}
+		if (!pike_check_req()) {
+			xlog("L_ALERT","ALERT: pike blocking $rm from $fu (IP:$si:$sp)\n");
+			$sht(ipban=>$si) = 1;
+			exit;
+		}
+	}
+#!endif
+	if($ua =~ "friendly-scanner|sipcli|sipvicious|VaxSIPUserAgent") {
+		# silent drop for scanners - uncomment next line if want to reply
+		# sl_send_reply("200", "OK");
+		exit;
+	}
+
+	if (!mf_process_maxfwd_header("10")) {
+		sl_send_reply("483","Too Many Hops");
+		exit;
+	}
+
+	if(is_method("OPTIONS") && uri==myself && $rU==$null) {
+		sl_send_reply("200","Keepalive");
+		exit;
+	}
+
+	if(!sanity_check("17895", "7")) {
+		xlog("Malformed SIP request from $si:$sp\n");
+		exit;
+	}
+}
+
+# Handle requests within SIP dialogs
+route[WITHINDLG] {
+	if (!has_totag()) return;
+
+	# sequential request withing a dialog should
+	# take the path determined by record-routing
+	if (loose_route()) {
+		route(DLGURI);
+		if (is_method("BYE")) {
+			setflag(FLT_ACC); # do accounting ...
+			setflag(FLT_ACCFAILED); # ... even if the transaction fails
+		} else if ( is_method("ACK") ) {
+			# ACK is forwarded statelessly
+			route(NATMANAGE);
+		} else if ( is_method("NOTIFY") ) {
+			# Add Record-Route for in-dialog NOTIFY as per RFC 6665.
+			record_route();
+		}
+		route(RELAY);
+		exit;
+	}
+
+	if (is_method("SUBSCRIBE") && uri == myself) {
+		# in-dialog subscribe requests
+		route(PRESENCE);
+		exit;
+	}
+	if ( is_method("ACK") ) {
+		if ( t_check_trans() ) {
+			# no loose-route, but stateful ACK;
+			# must be an ACK after a 487
+			# or e.g. 404 from upstream server
+			route(RELAY);
+			exit;
+		} else {
+			# ACK without matching transaction ... ignore and discard
+			exit;
+		}
+	}
+	sl_send_reply("404","Not here");
+	exit;
+}
+
+route[MEDIAPROXY] {
+
+	if(is_method("REGISTER|SUBSCRIBE|OPTIONS") || $rm=~ "^(REGISTER|SUBSCRIBE|OPTIONS)") {
+			return;
+	}
+
+	if(is_method("INVITE") && $rs == $null && !has_totag()) {
+				#Match any port
+				$var(mediagroup) = allow_address_group($Ri, 0);
+		xlog("L_INFO", "[MEDIAPROXY] INVITE rU: <$rU> rd: <$rd> var(mediagroup): <$var(mediagroup)> \n");
+
+		if ($var(mediagroup) == -1) {
+			xlog("IP not activated for trunks [1] IP:[$Ri] Port:[$Rp] Src: [$si]\n");
+			append_to_reply("P-SBC-Error: ip trunks not registered [$Ri] [$Rp] [$si]\r\n");
+			sl_send_reply("500","IP not registered for media");
+			exit;
+		}
+
+		#Group == 1 - 100 - internal GROUP IP
+		if($var(mediagroup) < 100) {
+			$var(destgroup) = $var(mediagroup) + 100;
+
+#!ifdef WITH_SDP_REWRITE
+			sdp_get("$avp(sdp)");
+			if ( !strempty($sel(cfg_get.proxygw.detail)) ) {
+				avp_subst("$avp(sdp)","/(^s=Lin.*)/s=$sel(cfg_get.proxygw.detail)\r/");
+			}
+#!endif
+
+			$var(flags) = "codec-mask=SILK replace-session-connection replace-origin";
+			$var(flags) = $var(flags) + " ICE=remove direction=" + $var(mediagroup) + " direction=" + $var(destgroup);
+			# $var(flags) = "codec-mask=SIKL replace-session-connection replace-origin ICE=remove direction=$var(mediagroup) direction=$var(destgroup)";
+			if ($ru =~ "transport=tls") {
+				$var(flags) = $var(flags) + " RTP/SAVP";
+				xlog("[MEDIAPROXY] REQUEST transport=tls $var(flags) \n");
+			}
+			xlog("[MEDIAPROXY] Group 1-100 received message protocoll: <$proto> Protocoll-id <$prid> direction=$var(mediagroup) direction=$var(destgroup) $var(flags)\n");
+			rtpengine_manage($var(flags));
+			add_rr_param(";proxy_media=yes");
+		}
+		#Group > 100 = external
+		else if($var(mediagroup) >= 100) {
+			$var(destgroup) = $var(mediagroup) - 100;
+
+#!ifdef WITH_SDP_REWRITE
+			sdp_get("$avp(sdp)");
+			if ( !strempty($sel(cfg_get.proxygw.detail)) ) {
+				#xlog("L_INFO","2-REWRITE SDP Server $avp(sdp)!\n");
+				avp_subst("$avp(sdp)","/(^s=Lin.*)/s=$sel(cfg_get.proxygw.detail)\r/");
+			}
+#!endif
+			$var(flags) = "replace-session-connection replace-origin ICE=remove direction=$var(mediagroup) direction=$var(destgroup) RTP/AVP";
+			if (sdp_with_transport_like("AVPF")) {
+					$var(flags) = "$var(flags)F";
+			}
+			xlog("[MEDIAPROXY] Group > 100 received message protocoll: <$proto> Protocoll-id <$prid> direction=$var(mediagroup) direction=$var(destgroup) $var(flags) \n");
+			rtpengine_manage($var(flags));
+			add_rr_param(";proxy_media=yes");
+			#xlog("L_ALERT","THIS IS INVITE Internal -> External, status [$rs]!\n");
+		}
+		else {
+			append_to_reply("P-SBC-Error: unknown group [$var(mediagroup)] for sbc [$Ri][$Rp]\r\n");
+			sl_send_reply("500","Group not registered");
+		}
+	}
+	else if(is_method("INVITE") && $rs == $null && has_totag()) {
+
+#!ifdef WITH_SDP_REWRITE
+		sdp_get("$avp(sdp)");
+		if ( !strempty($sel(cfg_get.proxygw.detail)) ) {
+			#xlog("L_INFO","3-REWRITE SDP Server $avp(sdp)!\n");
+			avp_subst("$avp(sdp)","/(^s=Lin.*)/s=$sel(cfg_get.proxygw.detail)\r/");
+		}
+#!endif
+		# REINVITE ONLY FROM OUTSIDE to INSIDE
+		$var(flags) = "replace-session-connection replace-origin";
+		# proto is tls, so internal is RTP
+		if ($proto =~ "tls") {
+			$var(flags) = $var(flags) + " RTP/AVP";
+		}
+		# Request uri is transport=tls so SRTP is needed
+		if ($ru =~ "transport=tls") {
+			$var(flags) = $var(flags) + " RTP/SAVP";
+		}
+		rtpengine_offer($var(flags));
+		#xlog("L_ALERT", "[MEDIAPROXY] -----> Group ? [$ds][$du] [$ru] [$Ri][$Rp][$si] received message protocoll: <$proto> Protocoll-id <$prid> var(flags) <$var(flags)>\n");
+		#xlog("L_ALERT", "DO reINVITE offer!!\n");
+		}
+	else {
+
+#!ifdef WITH_SDP_REWRITE
+		sdp_get("$avp(sdp)");
+		#xlog("[MEDIAPROXY] Group ? received message protocoll: <$proto> Protocoll-id <$prid>\n");
+		if ( !strempty($sel(cfg_get.proxygw.detail)) ) {
+			#xlog("L_INFO","4-REWRITE SDP Server $avp(sdp)!\n");
+			avp_subst("$avp(sdp)","/(^s=Lin.*)/s=$sel(cfg_get.proxygw.detail)\r/");
+		}
+#!endif
+
+		if(sdp_with_transport("RTP/SAVP")){
+			# the session has a SRTP/SAVP stream
+			xlog("L_ALERT","[$rs] [$rm] HAS SRTP/SAVP !\n");
+		}
+
+		$var(flags) = "replace-session-connection replace-origin ICE=remove";
+		rtpengine_manage($var(flags));
+		xlog("L_ALERT","THIS IS status [$rs] [$rm] $var(flags) !\n");
+	}
+
+		return;
+}
+
+# Handle SIP registrations
+route[REGISTRAR] {
+	if (!is_method("REGISTER")) return;
+
+	if(isflagset(FLT_NATS)) {
+		setbflag(FLB_NATB);
+#!ifdef WITH_NATSIPPING
+		# do SIP NAT pinging
+		setbflag(FLB_NATSIPPING);
+#!endif
+	}
+	if (!save("location")) {
+		sl_reply_error();
+	}
+	exit;
+}
+
+# User location service
+route[LOCATION] {
+	return;
+}
+
+# Presence server processing
+route[PRESENCE] {
+	if(!is_method("PUBLISH|SUBSCRIBE")) return;
+
+	if(is_method("SUBSCRIBE") && $hdr(Event)=="message-summary") {
+		# returns here if no voicemail server is configured
+		sl_send_reply("404", "No voicemail service");
+		exit;
+	}
+
+#!ifdef WITH_PRESENCE
+	if (!t_newtran()) {
+		sl_reply_error();
+		exit;
+	}
+
+	if(is_method("PUBLISH")) {
+		handle_publish();
+		t_release();
+	} else if(is_method("SUBSCRIBE")) {
+		handle_subscribe();
+		t_release();
+	}
+	exit;
+#!endif
+
+	# if presence enabled, this part will not be executed
+	if (is_method("PUBLISH") || $rU==$null) {
+		sl_send_reply("404", "Not here");
+		exit;
+	}
+	return;
+}
+
+route[TLS_AUTH] {
+#!ifdef WITH_TLS_AUTH
+	xlog("L_ALERT", "This request come from [$si]!\n");
+
+	if($proto =~ "tls") {
+		xlog("L_INFO", "-----------> tls_peer_subject <$tls_peer_subject> tls_peer_subject_cn <$tls_peer_subject_cn> tls_peer_verified <$tls_peer_verified> tls_peer_server_name <$tls_peer_server_name> \n");
+		xlog("L_INFO", "-----------> $Ri:$Rp src_user=$fU src_domain=$fd src_ip=$si dst_ouser=$tU dst_user=$rU dst_domain=$rd\n");
+
+		if($tls_peer_verified == -1) {
+			xlog("L_INFO", "[TLS_AUTH] tls_peer_subject_cn $tls_peer_subject_cn is NOT verfied!\n");
+			return;
+		}
+		$var(dns) = $tls_peer_subject_cn;
+	} else {
+		$var(dns) = "tls-trunk-["+$Ri+"]-["+$si+"].sbc";
+	}
+	$var(group) = allow_address_group($var(dns), $Rp);
+	xlog("L_INFO", "-----------> allow_address_group var(group) $var(group) var(dns) $var(dns) Rp $Rp\n");
+	if ($var(group) == -1) {
+		xlog("L_INFO", "[TLS_AUTH] Trunk is not activate for registrar DNS_GROUP:[$var(dns)], Source: [$si], Destination: [$Ri] Port:[$Rp]\n");
+		return;
+	}
+
+		xlog("L_INFO", "[TLS_AUTH] Trunk is ACTIVE [$var(group)] DNS_GROUP:[$var(dns)], Source: [$si], Destination: [$Ri] Port:[$Rp]\n");
+		if(ds_is_from_list("$var(group)")) {
+				$var(setid) = $(var(group){s.int});
+				xlog("L_INFO", "[TLS_AUTH] INCOMING FROM: $var(attrs) and $var(setid)\n");
+				#TRUNK UN2TR
+				if($var(setid) >= 1000 && $var(setid) < 2000)
+				{
+						#TOPOS
+						route(TOPOLOGYHIDE);
+
+						$var(destgroup) = $var(setid) + 1000;
+						if(!ds_select_domain("$var(destgroup)", "8"))
+						{
+								xlog("There is no destination $var(destgroup)\n");
+								append_to_reply("P-SBC-Error: b leg trunks is not available  $var(destgroup)\r\n");
+								sl_send_reply("500","B-Trunk is not available");
+								exit;
+						}
+
+						xlog("L_INFO", "USING: UN2TR $var(destgroup)\n");
+						append_hf("X-Group-SBC: $var(destgroup)\r\n");
+						append_hf("X-Routing-SBC: un2tr-cgn-trunk\r\n");
+						route(RELAY);
+						exit;
+				}
+				#TRUNK TR2UN
+				else if($var(setid) >= 2000 && $var(setid) < 3000)
+				{
+						#TOPOS
+						route(TOPOLOGYHIDE);
+
+						$var(destgroup) = $var(setid) - 1000;
+
+						xlog("L_INFO", "routing to $var(destgroup) with algo 9\n");
+
+						if(!ds_select_domain("$var(destgroup)", "9"))
+						{
+								xlog("There is no destination $var(destgroup)\n");
+								append_to_reply("P-SBC-Error: a leg trunks is not available  $var(destgroup)\r\n");
+								sl_send_reply("500","A-Trunk is not available");
+								exit;
+						}
+
+						xlog("L_INFO", "USING: TR2UN $var(access_socket) and $var(destgroup)\n");
+						append_hf("X-Group-SBC: $var(destgroup)\r\n");
+						append_hf("X-Routing-SBC: tr2un\r\n");
+						route(RELAY);
+						exit;
+				}
+				else {
+						xlog("There is no destination for trunk $var(setid), $var(group)\n");
+						append_to_reply("P-SBC-Error: wrong trunk group $var(setid) $var(group)\r\n");
+						sl_send_reply("500","Wrong trunk group");
+						exit;
+				}
+	}
+
+#!endif
+}
+
+# IP authorization and user authentication
+route[AUTH] {
+#!ifdef WITH_AUTH
+
+#!ifdef WITH_IPAUTH
+	if((!is_method("REGISTER")) && allow_source_address()) {
+		# source IP allowed
+		return;
+	}
+#!endif
+
+	if (is_method("REGISTER") || from_uri==myself) {
+		# authenticate requests
+		if (!auth_check("$fd", "subscriber", "1")) {
+			auth_challenge("$fd", "0");
+			exit;
+		}
+		# user authenticated - remove auth header
+		if(!is_method("REGISTER|PUBLISH"))
+			consume_credentials();
+	}
+	# if caller is not local subscriber, then check if it calls
+	# a local destination, otherwise deny, not an open relay here
+	if (from_uri!=myself && uri!=myself) {
+		sl_send_reply("403","Not relaying");
+		exit;
+	}
+
+#!else
+
+	# authentication not enabled - do not relay at all to foreign networks
+	if(uri!=myself) {
+		sl_send_reply("403","Not relaying");
+		exit;
+	}
+
+#!endif
+	return;
+}
+
+# Caller NAT detection
+route[NATDETECT] {
+#!ifdef WITH_NAT
+	force_rport();
+	if (nat_uac_test("19")) {
+		if (is_method("REGISTER")) {
+			fix_nated_register();
+		} else {
+			if(is_first_hop()) {
+				set_contact_alias();
+			}
+		}
+		setflag(FLT_NATS);
+	}
+#!endif
+	return;
+}
+
+# RTPProxy control and signaling updates for NAT traversal
+route[NATMANAGE] {
+#!ifdef WITH_NAT
+	if (is_request()) {
+		if(has_totag()) {
+			if(check_route_param("nat=yes")) {
+				setbflag(FLB_NATB);
+			}
+		}
+	}
+
+	route(MEDIAPROXY);
+
+	if (!(isflagset(FLT_NATS) || isbflagset(FLB_NATB))) return;
+
+	if (is_request()) {
+		if (!has_totag()) {
+			if(t_is_branch_route()) {
+				add_rr_param(";nat=yes");
+			}
+		}
+	}
+	if (is_reply()) {
+		if(isbflagset(FLB_NATB)) {
+			if(is_first_hop())
+				set_contact_alias();
+		}
+	}
+
+	if(isbflagset(FLB_NATB)) {
+		# no connect message in a dialog involving NAT traversal
+		if (is_request()) {
+			if(has_totag()) {
+				set_forward_no_connect();
+			}
+		}
+	}
+#!endif
+	return;
+}
+
+# URI update for dialog requests
+route[DLGURI] {
+#!ifdef WITH_NAT
+	if(!isdsturiset()) {
+		handle_ruri_alias();
+	}
+#!endif
+	return;
+}
+
+# Routing to foreign domains
+route[SIPOUT] {
+	if (uri==myself) return;
+
+	append_hf("P-hint: outbound\r\n");
+	route(RELAY);
+	exit;
+}
+
+# PSTN GW routing
+route[PSTN] {
+#!ifdef WITH_PSTN
+	# check if PSTN GW IP is defined
+	if (strempty($sel(cfg_get.pstn.gw_ip))) {
+		xlog("SCRIPT: PSTN routing enabled but pstn.gw_ip not defined\n");
+		return;
+	}
+
+	# route to PSTN dialed numbers starting with '+' or '00'
+	# (international format)
+	# - update the condition to match your dialing rules for PSTN routing
+	if(!($rU=~"^(\+|00)[1-9][0-9]{3,20}$")) return;
+
+	# only local users allowed to call
+	if(from_uri!=myself) {
+		sl_send_reply("403", "Not Allowed");
+		exit;
+	}
+
+	# normalize target number for pstn gateway
+	# - convert leading 00 to +
+	if (starts_with("$rU", "00")) {
+		strip(2);
+		prefix("+");
+	}
+
+	if (strempty($sel(cfg_get.pstn.gw_port))) {
+		$ru = "sip:" + $rU + "@" + $sel(cfg_get.pstn.gw_ip);
+	} else {
+		$ru = "sip:" + $rU + "@" + $sel(cfg_get.pstn.gw_ip) + ":"
+					+ $sel(cfg_get.pstn.gw_port);
+	}
+
+	route(RELAY);
+	exit;
+#!endif
+
+	return;
+}
+
+route[REMOVE_PRACK] {
+	if ($sel(cfg_get.remove.prack) == 1) {
+		if (is_present_hf("Supported")) {
+			if ( exclude_hf_value("Supported", "100rel") ) {
+				if ($sel(cfg_get.mylog.logint) > 0) {
+					xlog("L_INFO", "[$rm] [$ci] remove 100rel\n");
+				}
+				return;
+			}
+		}
+	}
+	return;
+}
+
+route[TOPOLOGYHIDE] {
+		if(is_method("INVITE") && !strempty($sel(cfg_get.topology.hostname_hide)))
+		{
+				if(defined $fU && !strempty($fU)) {
+					$var(from)="sip:"+$fU+"@"+$sel(cfg_get.topology.hostname_hide);
+				}
+				else {
+					$var(from)="sip:"+$sel(cfg_get.topology.hostname_hide);
+				}
+
+				if(defined $tU && !strempty($tU)) {
+					$var(to)="sip:"+$tU+"@"+$sel(cfg_get.topology.hostname_hide);
+				}
+				else {
+					$var(to)="sip:"+$sel(cfg_get.topology.hostname_hide);
+				}
+				uac_replace_from("$var(from)");
+				uac_replace_to("$var(to)");
+		}
+}
+
+
+# XMLRPC routing
+#!ifdef WITH_XMLRPC
+route[XMLRPC] {
+	# allow XMLRPC from localhost
+	if ((method=="POST" || method=="GET")
+			&& (src_ip==127.0.0.1)) {
+		# close connection only for xmlrpclib user agents (there is a bug in
+		# xmlrpclib: it waits for EOF before interpreting the response).
+		if ($hdr(User-Agent) =~ "xmlrpclib")
+			set_reply_close();
+		set_reply_no_connect();
+		dispatch_rpc();
+		exit;
+	}
+	send_reply("403", "Forbidden");
+	exit;
+}
+#!endif
+
+
+# Manage outgoing branches
+branch_route[MANAGE_BRANCH] {
+	xdbg("new branch [$T_branch_idx] to $ru\n");
+	route(NATMANAGE);
+}
+
+# Manage incoming replies
+reply_route {
+	if(!sanity_check("17604", "6")) {
+		xlog("Malformed SIP response from $si:$sp\n");
+		drop;
+	}
+}
+
+# Manage incoming replies in transaction context
+onreply_route[MANAGE_REPLY] {
+	xdbg("incoming reply\n");
+	if(status=~"[12][0-9][0-9]") {
+		route(NATMANAGE);
+	}
+}
+
+
+# Manage failure routing cases
+failure_route[MANAGE_FAILURE] {
+	route(NATMANAGE);
+
+	if (t_is_canceled()) exit;
+
+#!ifdef WITH_BLOCK3XX
+	# block call redirect based on 3xx replies.
+	if (t_check_status("3[0-9][0-9]")) {
+		t_reply("404","Not found");
+		exit;
+	}
+#!endif
+
+#!ifdef WITH_BLOCK401407
+	# block call redirect based on 401, 407 replies.
+	if (t_check_status("401|407")) {
+		t_reply("404","Not found");
+		exit;
+	}
+#!endif
+}
+
+
+event_route[tm:local-request] {
+#!ifdef SBC_DNS_NAME
+		if(is_method("OPTIONS") && $ru =~ "pstnhub.microsoft.com") {
+			   append_hf("Contact: <sip:SBC_DNS_NAME:5061;transport=tls>\r\n");
+		}
+#!endif
+#	xlog("L_INFO", "Sent out tm request: $mb\n");
+}
+
+#!ifdef WITH_MB_DEBUG
+event_route[network:msg] {
+	if (is_incoming()) {
+		xlog("L_INFO", "Received message '$mb' \n");
+	} else {
+		xlog("L_INFO", "Sending message '$mb' \n");
+	}
+}
+#!endif
+
+#!ifdef WITH_DROP_TOPOS
+event_route[topos:msg-outgoing] {
+	if($sndto(ip)=="172.20.120.59") {
+		xlog("L_ERR", "NOT SEND TOPOS TO $sndto(ip)\n");
+		drop;
+	}
+}
+#!endif
No results found