OpenPKG Specs / file comparison

comparison: opensips/opensips.cfg

opensips/opensips.cfg

changeset 377
67e813202d53
parent 376
8f552d1cd671
child 382
b972dc20871f
equal deleted inserted replaced
0:b8f87346fde6 1:14b31eac7d5c
1 ## 1 ##
2 ## opensips.cfg -- OpenSIPS server configuration 2 ## opensips.cfg -- OpenSIPS server configuration
3 ## 3 ##
4 4
5 # 5
6 # GLOBAL CONFIGURATION PARAMETERS 6 # General configuration help available at:
7 # 7 # http://siprouter.teigre.com/doc/gettingstarted/
8 8
9 # Specific routing help available at:
10 # http://www.opensips.org/index.php?n=Resources.DocsCoreRoutes
11
12 # Information on debug and log levels
13 # http://www.voice-system.ro/docs/ser-syslog/
14
15 # Die Konfigbloecke sind:
16 # Global Configuration Parameters
17 # Extension Module Loading
18 # Extension Module Configuration
19 # Main Request Routing Logic
20 # Secondary Request Routing Logic
21 # Branch Request Routing Logic
22 # Reply Request Routing Logic
23 # Failure Request Routing Logic
24 # Local Request Routing Logic
25 # Error Request Routing Logic
26 #
27 # Logging:
28 # L_ALERT (-3) - used if the error requires immediate action.
29 # L_CRIT (-2) - used if the error is a critical situation.
30 # L_ERR (-1) - used if the error doesn't cause system malfunctioning.
31 # L_WARN (1) - used to write warning messages.
32 # L_NOTICE (2) - used to report unusual situations.
33 # L_INFO (3) - used to write informational messages.
34 # L_DBG (4) - used to write messages for debugging.
35
36
37 #
38 # Global Configuration Parameters
39 #
9 # process configuration 40 # process configuration
10 debug=1 41 debug=4
11 log_stderror=no 42 log_stderror=no
12 fork=yes 43 fork=yes
13 check_via=no 44 children=2
14 dns=no 45 tcp_children=2
15 rev_dns=no
16 children=4
17 user="@l_rusr@" 46 user="@l_rusr@"
18 group="@l_rgrp@" 47 group="@l_rgrp@"
19 fifo="@l_prefix@/var/opensips/opensips.fifo" 48 wdir="@l_prefix@/var/opensips"
20 workdir="@l_prefix@/var/opensips"
21 49
22 # network configuration 50 # network configuration
23 alias="sip.example.com" 51 listen=udp:voip.realhost.tld:5060
24 listen="127.0.0.1" 52 #listen = tls:voip.realhost.tld:5061
25 port=5060 53
26 54 # network aliases
27 # 55 alias=voip.firsthost.tld:5060
28 # EXTENSION MODULE LOADING 56 #alias=voip.firsthost.tld:5061
29 # 57 alias=voip.secondhost.tld:5060
30 58 #alias=voip.secondhost.tld:5061
31 #loadmodule "@l_prefix@/lib/opensips/modules/dbtext.so" 59
32 60 # enable TLS
33 loadmodule "@l_prefix@/lib/opensips/modules/sl.so" 61 #https://confluence.terena.org/display/IPTelCB/3.5.2.+TLS+for+OpenSER+(UA-Proxy)
34 loadmodule "@l_prefix@/lib/opensips/modules/tm.so" 62 #http://www.opensips.org/html/docs/tutorials/tls-1.4.x.html
35 loadmodule "@l_prefix@/lib/opensips/modules/rr.so" 63 #
36 loadmodule "@l_prefix@/lib/opensips/modules/maxfwd.so" 64 #Run 'openserctl tls rootCA' to create @l_prefix@/etc/openser/tls/rootCA/cacert.pem.
37 loadmodule "@l_prefix@/lib/opensips/modules/usrloc.so" 65 #Run 'openserctl tls userCERT' to create user-calist.pem, user-cert.pem, user-cert_req.pem, and user-privkey.pem in @l_prefix@/etc/openser/tls/user/.
38 loadmodule "@l_prefix@/lib/opensips/modules/registrar.so" 66 #Copy @l_prefix@/etc/openser/tls/rootCA/cacert.pem to the client host.
39 loadmodule "@l_prefix@/lib/opensips/modules/textops.so" 67 #On Windows XP client hosts, run 'certmrg.msc' to import the certificate into the root certificate store.
40 68 #
41 #loadmodule "@l_prefix@/lib/opensips/modules/auth.so" 69 #disable_tls = 0
42 #loadmodule "@l_prefix@/lib/opensips/modules/auth_db.so" 70 #tls_method = TLSv1
43 71 #tls_verify_server = 1
44 #loadmodule "@l_prefix@/lib/opensips/modules/nathelper.so" 72 #tls_verify_client = 1
45 73 #tls_require_client_certificate = 1
46 # 74 #tls_ciphers_list = "HIGH:MEDIUM:!ADH" # openssl ciphers -v HIGH:MEDIUM
47 # EXTENSION MODULE CONFIGURATION 75 #tls_certificate = "@l_prefix@/etc/opensips/tls/user/user-cert.pem"
48 # 76 #tls_private_key = "@l_prefix@/etc/opensips/tls/user/user-privkey.pem"
49 77 #tls_ca_list = "@l_prefix@/etc/opensips/tls/user/user-calist.pem"
50 # module rr: 78
51 modparam("rr", "enable_full_lr", 1) 79
52 80 #
53 # module usrloc: 81 # Extension Module Loading
54 modparam("usrloc", "db_mode", 0) 82 # http://www.opensips.org/index.php?n=Resources.DocsModules
55 #modparam("usrloc", "db_mode", 2) 83 #
56 #modparam("usrloc|auth_db", "db_url", "dbtext://@l_prefix@/var/opensips/db") 84 # set module path
57 85 mpath="@l_prefix@/lib/opensips/modules/"
58 # module auth: 86
59 #modparam("auth_db", "calculate_ha1", 1) 87 loadmodule "sl.so" # Stateless replier
60 #modparam("auth_db", "password_column", "password") 88 loadmodule "tm.so" # Transaction stateful
61 #modparam("auth_db", "user_column", "username") 89 loadmodule "signaling.so" # Signaling wrapper of sl/tm
62 #modparam("auth_db", "domain_column", "domain") 90 loadmodule "rr.so" # Record Route and Route
63 91 loadmodule "maxfwd.so" # Maximum Forward processor
64 # module nathelper: 92 loadmodule "db_text.so" # Text backend for database API
65 #modparam("registrar", "nat_flag", 6) 93 loadmodule "usrloc.so" # User location implementation
66 #modparam("nathelper", "natping_interval", 30) 94 loadmodule "registrar.so" # SIP Registrar implementation
67 #modparam("nathelper", "ping_nated_only", 1) 95 loadmodule "uri.so" # Generic URI operation
68 #modparam("nathelper", "rtpproxy_sock", "unix:@l_prefix@/var/opensips/opensips_rtpproxy.sock") 96 loadmodule "auth.so" # Authentication Interface
69 #modparam("nathelper", "rtpproxy_disable", 0) 97 loadmodule "textops.so" # Text based manipulations
70 #modparam("nathelper", "rtpproxy_disable_tout", 20) 98 loadmodule "acc.so" # Accounting
71 #modparam("nathelper", "sipping_from", "sip:pinger@sip.example.com") 99 loadmodule "auth_db.so" # Database backend authentication
72 100 loadmodule "mi_fifo.so" # FIFO support for Management Interface
73 # 101 #loadmodule "flatstore.so" # Fast writing only text database
74 # MAIN ROUTING LOGIC 102 #loadmodule "alias_db.so" # Database aliases
75 # 103 #loadmodule "domain.so" # Multidomain support
76 104 #loadmodule "nathelper.so" # NAT traversal helper
77 route{ 105 #loadmodule "enum.so" # ENUM lookup
78 # initial sanity checks -- messages with 106
79 # max_forwards==0, or excessively long requests 107
80 if (!mf_process_maxfwd_header("10")) { 108 #
81 sl_send_reply("483", "Too Many Hops"); 109 # Extension Module Configuration
110 #
111 # ----- dbtext params -----
112 modparam("db_text", "db_mode", 0) # caching for persistence
113
114 # ----- multimodule params -----
115 modparam("usrloc|uri|auth_db", "db_url", "text://@l_prefix@/var/opensips/db")
116
117 # ----- rr params -----
118 modparam("rr", "append_fromtag", 1) # important when using detect_direction
119
120 # ----- usrloc params -----
121 /* see 'multimodule params' as well */
122 modparam("usrloc", "db_mode", 2) # Write back database persistence scheme
123
124 # ----- registrar params -----
125 modparam("registrar", "max_contacts", 10) # contacts per AOR allowed
126
127 # ----- acc params -----
128 /* see 'multimodule params' as well */
129 modparam("acc", "db_url", "dbtext://@l_prefix@/var/opensips/db")
130 #modparam("acc", "db_url", "flatstore:@l_prefix@/var/opensips/acc")
131 modparam("acc", "early_media", 1)
132 modparam("acc", "report_cancels", 1)
133 modparam("acc", "detect_direction", 1)
134 modparam("acc", "log_level", 2)
135 modparam("acc", "log_flag", 1)
136 modparam("acc", "log_missed_flag", 2)
137 modparam("acc", "db_flag", 1)
138 modparam("acc", "db_missed_flag", 2)
139 modparam("acc", "failed_transaction_flag", 4)
140
141 # ----- mi_fifo params -----
142 modparam("mi_fifo", "fifo_name", "@l_prefix@/var/opensips/opensips.fifo")
143 modparam("mi_fifo", "reply_dir", "@l_prefix@/var/opensips/tmp/")
144
145
146 #
147 # Main Request Routing Logic
148 #
149 route {
150 # message diagnostics
151 #log(3, "new branch at $ru\n");
152 xlog("L_INFO", "$rm: Orig - $ou\n");
153 xlog("L_INFO", "$rm: Req - $ru\n");
154 xlog("L_INFO", "$rm: To - $tu\n");
155 xlog("L_INFO", "$rm: Dest - $du\n");
156 xlog("L_INFO", "$rm: From - $fu\n");
157
158 # sanity checks
159 if (!mf_process_maxfwd_header("10")) { # avoid loops in forward logic
160 sl_send_reply("483","Too Many Hops");
161 exit;
162 }
163 if (msg:len > max_len) { # repel DoS attacks
164 sl_send_reply("513", "Message Too Large");
82 exit; 165 exit;
83 }; 166 };
84 if (msg:len >= max_len) { 167
85 sl_send_reply("513", "Message too big"); 168 # sequential request within a dialog should
86 exit; 169 # take the path determined by record routing
87 }; 170 if (has_totag()) {
88 171 if (loose_route()) {
89 #if (method == "INVITE" && uri != myself) { 172 if (is_method("BYE")) {
90 # sl_send_reply("403", "No relaying"); 173 setflag(1); # do accouting...
174 setflag(4); # ...even if the transaction fails
175 }
176 # mark routing logic in request
177 append_hf("P-hint: rr-enforced\r\n");
178 route(1);
179 } else {
180 sl_send_reply("404", "Not Found");
181 }
182 exit;
183 }
184
185 #
186 # initial requests
187 #
188 if (is_method("CANCEL")) { # CANCEL processing
189 if (t_check_trans())
190 t_relay();
191 exit;
192 }
193
194 t_check_trans();
195
196 # authenticate if from local subscriber (uncomment to enable auth)
197 #if (!is_method("REGISTER") && from_uri == myself) {
198 # if (!proxy_authorize("", "subscriber")) {
199 # proxy_challenge("", "0");
200 # exit;
201 # }
202 # if (!check_from()) {
203 # sl_send_reply("403","Forbidden");
204 # exit;
205 # }
206 #
207 # consume_credentials();
208 # # caller authenticated
209 #}
210
211 # record route all messages to ensure that subsequent messages
212 # will go through our proxy, particularly good if upstream
213 # and downstream entities use different transport protocol
214 if (!is_method("REGISTER|MESSAGE")) {
215 record_route();
216 }
217
218 # account only INVITEs
219 if (is_method("INVITE")) {
220 setflag(1);
221 }
222
223 if (!uri == myself) {
224 /* replace with following line if multidomain support is used */
225 #if (!is_uri_host_local()) {
226 append_hf("P-hint: outbound\r\n");
227 # if you have some interdomain connections via TLS
228 #if ($rd == "tls_domain1.net") {
229 # t_relay("tls:domain1.net");
230 # exit;
231 #} else if ($rd == "tls_domain2.net") {
232 # t_relay("tls:domain2.net");
233 # exit;
234 #}
235 route(1);
236 }
237
238 #
239 # requests for my domain
240 #
241 if (is_method("PUBLISH")) {
242 sl_send_reply("503", "Service Unavailable");
243 exit;
244 }
245
246 if (is_method("REGISTER")) {
247 # authenticate the REGISTER requests (uncomment to enable auth)
248 #if (!www_authorize("", "subscriber")) {
249 # www_challenge("", "0");
250 # exit;
251 #}
252 #
253 #if (!check_to()) {
254 # sl_send_reply("403","Forbidden");
255 # exit;
256 #}
257
258 if (!save("location"))
259 sl_reply_error();
260
261 exit;
262 }
263
264 if ($rU == NULL) {
265 # request with no Username in RURI
266 sl_send_reply("484","Address Incomplete");
267 exit;
268 }
269
270 lookup("location");
271 switch ($retcode) {
272 case 1:
273 append_hf("P-hint: usrloc applied\r\n");
274 break;
275 case -1:
276 t_newtran();
277 t_reply("404", "Not Found");
278 exit;
279 case -2:
280 sl_send_reply("405", "Method Not Allowed");
281 exit;
282 case -3:
283 t_newtran();
284 t_reply("500", "Server Internal Error");
285 exit;
286 }
287
288 setflag(2); # when routing via usrloc then
289 route(1); # log the missed calls as well
290 }
291
292
293 #
294 # Secondary Request Routing Logic
295 #
296 route[1] {
297 # for INVITEs enable some additional helper routes
298 if (is_method("INVITE")) {
299 t_on_branch("1");
300 t_on_reply("1");
301 t_on_failure("1");
302 }
303
304 # send with stateful forwarding which works reliably even for UDP2TCP
305 if (!t_relay())
306 sl_reply_error();
307
308 exit; # safeguard
309 }
310
311
312 #
313 # Branch Request Routing Logic
314 #
315 branch_route[1] {
316 xlog("L_INFO", "new branch at $ru\n");
317 }
318
319
320 #
321 # Reply Request Routing Logic
322 #
323 onreply_route[1] {
324 xlog("L_INFO", "incoming reply at $ru\n");
325 # if ($ua =~ fritz.box)
326 # xlog("L_ERR", "$rm: The Fritzbox replied!\n");
327 # if ($ua =~ fritz.box && has_body("application/sdp"))
328 # search_append_body("a=sendrecv.*", "\na=ptime:30");
329 }
330
331
332 #
333 # Failure Request Routing Logic
334 #
335 failure_route[1] {
336 xlog("L_INFO", "failed route at $ru\n");
337 if (t_was_cancelled())
338 exit;
339
340 # uncomment the following lines to block
341 # client redirect based on 3xx replies
342 #if (t_check_status("3[0-9][0-9]")) {
343 #t_reply("404","Not Found");
91 # exit; 344 # exit;
92 #}; 345 #}
93 346
94 # NAT: special handling for NAT'ed clients; first, NAT test is 347 # uncomment the following lines to redirect
95 # executed: it looks for via!=received and RFC1918 addresses in 348 # failed calls to a different new destination
96 # Contact (may fail if line-folding is used); also, the received 349 #if (t_check_status("486|408")) {
97 # test should, if completed, should check all vias for presence of 350 # sethostport("192.168.2.100:5060");
98 # received. 351 # append_branch();
99 #if (nat_uac_test("3")) { 352 # # do not set the missed call flag again
100 # # allow RR-ed requests, as these may indicate that NAT-enabled 353 # t_relay();
101 # # aproxy takes care of it; unless it is REGISTER 354 #}
102 # if (method == "REGISTER" || ! search("^Record-Route:")) { 355 }
103 # log("LOG: Someone trying to register from private IP, rewriting\n"); 356
104 # fix_nated_contact(); # rewrite contact with source IP of signalling 357
105 # if (method == "INVITE") { 358 #
106 # fix_nated_sdp("1"); # add direction=active to SDP 359 # Local Request Routing Logic
107 # }; 360 #
108 # force_rport(); # add rport parameter to topmost Via 361 local_route {
109 # setflag(6); # mark as NAT'ed 362 if (is_method("INVITE") && $ru=~"@foreign.tld") {
110 # }; 363 append_hf("P-hint: foreign request\r\n");
111 #}; 364 exit;
112 365 }
113 # we record-route all messages -- to make sure that 366 if (is_method("BYE"))
114 # subsequent messages will go through our proxy; that's 367 xlog("L_INFO", "internally generated BYE\n");
115 # particularly good if upstream and downstream entities 368 }
116 # use different transport protocol 369
117 if (method != "REGISTER") { 370
118 record_route(); 371 #
119 }; 372 # Error Request Routing Logic
120 373 #
121 # subsequent messages withing a dialog should take the 374 error_route {
122 # path determined by record-routing 375 xlog("L_ERR", "error route class=$(err.class) level=$(err.level) info=$(err.info) rcode=$(err.rcode) rreason=$(err.rreason)\n");
123 if (loose_route()) { 376 xlog("L_ERR", "error from [$si:$sp]\n");
124 # mark routing logic in request 377 xlog("L_ERR", "++++\n$mb\n++++\n");
125 append_hf("P-hint: rr-enforced\r\n"); 378 sl_send_reply("$err.rcode", "$err.rreason");
126 route(1); 379 exit;
127 }; 380 }
128 381
129 if (uri != myself) {
130 # mark routing logic in request
131 append_hf("P-hint: outbound\r\n");
132 route(1);
133 };
134
135 # if the request is for other domain use USRLOC
136 # (in case, it does not work, use the following command
137 # with proper names and addresses in it)
138 if (uri == myself) {
139 if (method == "REGISTER") {
140 # uncomment this if you want to use digest authentication
141 #if (!www_authorize("sip.example.com", "subscriber")) {
142 # www_challenge("sip.example.com", "0");
143 # exit;
144 #};
145 save("location");
146 exit;
147 };
148
149 lookup("aliases");
150 if (uri != myself) {
151 append_hf("P-hint: outbound alias\r\n");
152 route(1);
153 };
154
155 # native SIP destinations are handled using our USRLOC DB
156 if (!lookup("location")) {
157 sl_send_reply("404", "Not Found");
158 exit;
159 };
160 append_hf("P-hint: usrloc applied\r\n");
161 };
162
163 route(1);
164 }
165
166 route[1] {
167 # disable RFC1918 peers
168 if (uri =~ "[@:](192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)" && !search("^Route:")) {
169 sl_send_reply("479", "We don't forward to RFC 1918 IPv4 addresses");
170 exit;
171 };
172
173 # NAT: if client or server know to be behind a NAT, enable relay
174 #if (isflagset(6)) {
175 # force_rtp_proxy();
176 #};
177
178 # NAT: processing of replies; apply to all transactions
179 #t_on_reply("1");
180
181 # send it out now; use stateful forwarding as it works reliably even for UDP2TCP
182 if (!t_relay()) {
183 sl_reply_error();
184 };
185 }
186
187 #onreply_route[1] {
188 # NAT: is it a NAT'ed transaction ?
189 # otherwise, is it a transaction behind a NAT and we did not
190 # know at time of request processing ? (RFC1918 contacts)
191 #if (isflagset(6) && status =~ "(183)|2[0-9][0-9]") {
192 # fix_nated_contact();
193 # force_rtp_proxy();
194 #} else if (nat_uac_test("1")) {
195 # fix_nated_contact();
196 #};
197 #}
198

Mercurial Repository: OpenPKG Specs

Europalab SCM Repository Server

mercurial