ruhnet
/
kazoo-configs-kamailio
1
0
Fork 0
Code Issues 0 Pull Requests 0 Projects 0 Releases 183 Wiki Activity
Browse Source

update logs

3.20
SIPLABS, LLC 11 years ago
parent
418a1820a3
commit
317d8b6bdf
1 changed files with 34 additions and 33 deletions
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. +34
    -33
      kamailio/acl-role.cfg

+ 34
- 33
kamailio/acl-role.cfg View File

@ -17,7 +17,7 @@ route[ACL_CHECK] {
# If packet came from platform or from 4 class MERA, do not check it # If packet came from platform or from 4 class MERA, do not check it
if (isflagset(FLAG_INTERNALLY_SOURCED) || isflagset(FLAG_TRUSTED_SOURCE) ) { if (isflagset(FLAG_INTERNALLY_SOURCED) || isflagset(FLAG_TRUSTED_SOURCE) ) {
xlog("L_DEBUG", "$ci |ACL| Trusted source IP($si) ignoring");
xlog("L_DEBUG", "$ci|ACL|Trusted source IP($si) ignoring");
return; return;
} }
@ -30,7 +30,7 @@ route[ACL_CHECK] {
# FIX for BYE method with IP instead of REALM in From, take REALM from To header # FIX for BYE method with IP instead of REALM in From, take REALM from To header
if ($fd =~ IP_REGEX) { if ($fd =~ IP_REGEX) {
xlog("L_WARNING","$ci |ACL-realm| Fixup for $var(sip-packet) with IP in from URI: use to-domain");
xlog("L_WARNING","$ci|ACL-realm|Fix for $var(sip-packet) with IP in from URI: use to-domain");
$var(realm) = $td; $var(realm) = $td;
} else { } else {
$var(realm) = $fd; $var(realm) = $fd;
@ -44,18 +44,18 @@ route[ACL_CHECK] {
if ($var(realm-decision) == -1) { # we do not have cached decision if ($var(realm-decision) == -1) { # we do not have cached decision
$var(acl-realm-request) = "true"; $var(acl-realm-request) = "true";
} else if ($var(realm-decision) == 1 ){ # We have cached decision, let's use it } else if ($var(realm-decision) == 1 ){ # We have cached decision, let's use it
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(realm)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(realm)\n");
} else { } else {
if (!isflagset(FLAG_IS_REPLY)) { if (!isflagset(FLAG_IS_REPLY)) {
sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY); sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY);
} }
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is rejected by ACL for $var(realm)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is rejected by ACL for $var(realm)\n");
exit; exit;
} }
if (not_empty("$fU")) { if (not_empty("$fU")) {
if ($fd =~ IP_REGEX) { if ($fd =~ IP_REGEX) {
xlog("L_WARNING","$ci |ACL-device| Fixup for $var(sip-packet) with IP in from URI: use to-domain");
xlog("L_WARNING","$ci|ACL-device|Fix for $var(sip-packet) with IP in from URI: use to-domain");
$var(device) = $fU + "@" + $td; $var(device) = $fU + "@" + $td;
} else { } else {
$var(device) = $fU + "@" + $fd; $var(device) = $fU + "@" + $fd;
@ -65,24 +65,25 @@ route[ACL_CHECK] {
if ($var(device-decision) == -1) { # we do not have cached decision if ($var(device-decision) == -1) { # we do not have cached decision
$var(acl-device-request) = "true"; $var(acl-device-request) = "true";
} else if ($var(device-decision) == 1 ){ # We have cached decision, let's use it } else if ($var(device-decision) == 1 ){ # We have cached decision, let's use it
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(device)\n");
} else { } else {
if (!isflagset(FLAG_IS_REPLY)) { if (!isflagset(FLAG_IS_REPLY)) {
sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY); sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY);
} }
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is rejected by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is rejected by ACL for $var(device)\n");
exit; exit;
} }
} }
if ($var(acl-realm-request) == "true" || $var(acl-device-request) == "true") { if ($var(acl-realm-request) == "true" || $var(acl-device-request) == "true") {
if (not_empty("$fU")) if (not_empty("$fU"))
$var(query) = "{'Event-Category': 'acl', 'Event-Name': 'query', 'Entity': '" + $var(device) + "', 'With-Realm': " + $var(acl-realm-request) + "}"; $var(query) = "{'Event-Category': 'acl', 'Event-Name': 'query', 'Entity': '" + $var(device) + "', 'With-Realm': " + $var(acl-realm-request) + "}";
else else
$var(query) = "{'Event-Category': 'acl', 'Event-Name': 'query', 'Entity': '" + $var(realm) + "'}"; $var(query) = "{'Event-Category': 'acl', 'Event-Name': 'query', 'Entity': '" + $var(realm) + "'}";
xlog("L_INFO", "$ci |ACL log| Query: $var(query)");
xlog("L_DBG", "$ci|ACL log|Query: $var(query)");
if (kazoo_query("frontier", "sbc_config", $var(query), "$var(acl-response)")) { if (kazoo_query("frontier", "sbc_config", $var(query), "$var(acl-response)")) {
xlog("L_INFO", "$ci |ACL log| Response: $var(acl-response)");
xlog("L_DBG", "$ci|ACL log|Response: $var(acl-response)");
kazoo_json($var(acl-response), "Realm.Order", "$var(acl-realm-order)"); kazoo_json($var(acl-response), "Realm.Order", "$var(acl-realm-order)");
kazoo_json($var(acl-response), "Realm.CIDR", "$var(acl-realm-cidr)"); kazoo_json($var(acl-response), "Realm.CIDR", "$var(acl-realm-cidr)");
@ -91,18 +92,18 @@ route[ACL_CHECK] {
kazoo_json($var(acl-response), "Device.User-Agent", "$var(acl-device-ua)"); kazoo_json($var(acl-response), "Device.User-Agent", "$var(acl-device-ua)");
} else { } else {
xlog("L_ERROR","$ci |ACL log| DB is unreachable");
xlog("L_ERROR","$ci|ACL log|DB is unreachable");
$sht(acl=>$var(device)/$si) = 1; $sht(acl=>$var(device)/$si) = 1;
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(device)\n");
return; return;
} }
}
route(ACL_CHECK_REALM); route(ACL_CHECK_REALM);
if (not_empty("$fU")) { if (not_empty("$fU")) {
route(ACL_CHECK_DEVICE); route(ACL_CHECK_DEVICE);
} }
} }
} }
# Check ORDER setting for REALM # Check ORDER setting for REALM
@ -114,9 +115,9 @@ route[ACL_CHECK_REALM] {
route(ACL_CHECK_REALM_DENY); route(ACL_CHECK_REALM_DENY);
} }
} else { } else {
xlog("L_INFO","$ci |ACL-realm| undefined Order in response for $var(realm)");
xlog("L_INFO","$ci|ACL-realm|undefined Order in response for $var(realm)");
$sht(acl=>$var(realm)/$si) = 1; $sht(acl=>$var(realm)/$si) = 1;
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(realm)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(realm)\n");
} }
} }
@ -125,24 +126,24 @@ route[ACL_CHECK_REALM_ALLOW] {
$var(i) = 0; $var(i) = 0;
kazoo_json($var(acl-response), "Realm.CIDR[$var(i)]", "$var(record)");; kazoo_json($var(acl-response), "Realm.CIDR[$var(i)]", "$var(record)");;
while(not_empty("$var(record)")) { while(not_empty("$var(record)")) {
xlog("L_INFO", "$ci |ACL-realm| checking if $si is in $var(record)");
xlog("L_INFO", "$ci|ACL-realm|checking if $si is in $var(record)");
if (($var(record) == ACL_IP_ADDR_ANY) || is_in_subnet("$si", $var(record))) { if (($var(record) == ACL_IP_ADDR_ANY) || is_in_subnet("$si", $var(record))) {
$sht(acl=>$var(realm)/$si) = 1; $sht(acl=>$var(realm)/$si) = 1;
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(realm)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(realm)\n");
return; return;
} }
$var(i) = $var(i) + 1; $var(i) = $var(i) + 1;
kazoo_json($var(acl-response), "Realm.CIDR[$var(i)]", "$var(record)");; kazoo_json($var(acl-response), "Realm.CIDR[$var(i)]", "$var(record)");;
} }
} else { } else {
xlog("L_INFO", "$ci |ACL-realm| undefined CIDR in response for $var(realm)");
xlog("L_INFO", "$ci|ACL-realm|undefined CIDR in response for $var(realm)");
} }
# Remember in CACHE and DENY # Remember in CACHE and DENY
$sht(acl=>$var(realm)/$si) = 0; $sht(acl=>$var(realm)/$si) = 0;
if (!isflagset(FLAG_IS_REPLY)) { if (!isflagset(FLAG_IS_REPLY)) {
sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY); sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY);
} }
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is rejected by ACL for $var(realm)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is rejected by ACL for $var(realm)\n");
exit; exit;
} }
@ -152,24 +153,24 @@ route[ACL_CHECK_REALM_DENY] {
$var(i) = 0; $var(i) = 0;
kazoo_json($var(acl-response), "Realm.CIDR[$var(i)]", "$var(record)");; kazoo_json($var(acl-response), "Realm.CIDR[$var(i)]", "$var(record)");;
while(not_empty("$var(record)")) { while(not_empty("$var(record)")) {
xlog("L_INFO", "$ci |ACL-realm| checking if $si is in $var(record)");
xlog("L_INFO", "$ci|ACL-realm|checking if $si is in $var(record)");
if (($var(record) == ACL_IP_ADDR_ANY) || is_in_subnet("$si", $var(record))) { if (($var(record) == ACL_IP_ADDR_ANY) || is_in_subnet("$si", $var(record))) {
$sht(acl=>$var(realm)/$si) = 0; $sht(acl=>$var(realm)/$si) = 0;
if (!isflagset(FLAG_IS_REPLY)) { if (!isflagset(FLAG_IS_REPLY)) {
sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY); sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY);
} }
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is rejected by ACL for $var(realm)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is rejected by ACL for $var(realm)\n");
exit; exit;
} }
$var(i) = $var(i) + 1; $var(i) = $var(i) + 1;
kazoo_json($var(acl-response), "Realm.CIDR[$var(i)]", "$var(record)");; kazoo_json($var(acl-response), "Realm.CIDR[$var(i)]", "$var(record)");;
} }
} else { } else {
xlog("L_INFO", "$ci |ACL-realm| undefined CIDR in response for $var(realm)");
xlog("L_INFO", "$ci|ACL-realm|undefined CIDR in response for $var(realm)");
} }
# Remember in CACHE and ALLOW # Remember in CACHE and ALLOW
$sht(acl=>$var(realm)/$si) = 1; $sht(acl=>$var(realm)/$si) = 1;
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(realm)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(realm)\n");
return; return;
} }
@ -182,9 +183,9 @@ route[ACL_CHECK_DEVICE] {
route(ACL_CHECK_DEVICE_DENY); route(ACL_CHECK_DEVICE_DENY);
} }
} else { } else {
xlog("L_INFO","$ci |ACL-device| undefined Order in response for $var(device)");
xlog("L_INFO","$ci|ACL-device|undefined Order in response for $var(device)");
$sht(acl=>$var(device)/$si) = 1; $sht(acl=>$var(device)/$si) = 1;
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(device)\n");
} }
} }
@ -194,17 +195,17 @@ route[ACL_CHECK_DEVICE_ALLOW] {
$var(i) = 0; $var(i) = 0;
kazoo_json($var(acl-response), "Device.CIDR[$var(i)]", "$var(record)");; kazoo_json($var(acl-response), "Device.CIDR[$var(i)]", "$var(record)");;
while(not_empty("$var(record)")) { while(not_empty("$var(record)")) {
xlog("L_INFO", "$ci |ACL-realm| checking if $si is in $var(record)");
xlog("L_INFO", "$ci|ACL-realm|checking if $si is in $var(record)");
if (($var(record) == ACL_IP_ADDR_ANY) || is_in_subnet("$si", $var(record))) { if (($var(record) == ACL_IP_ADDR_ANY) || is_in_subnet("$si", $var(record))) {
$sht(acl=>$var(device)/$si) = 1; $sht(acl=>$var(device)/$si) = 1;
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(device)\n");
return; return;
} }
$var(i) = $var(i) + 1; $var(i) = $var(i) + 1;
kazoo_json($var(acl-response), "Device.CIDR[$var(i)]", "$var(record)");; kazoo_json($var(acl-response), "Device.CIDR[$var(i)]", "$var(record)");;
} }
} else { } else {
xlog("L_INFO", "$ci |ACL-realm| undefined CIDR in response for $var(device)");
xlog("L_INFO", "$ci|ACL-realm|undefined CIDR in response for $var(device)");
} }
} }
# Remember in CACHE and DENY # Remember in CACHE and DENY
@ -212,7 +213,7 @@ route[ACL_CHECK_DEVICE_ALLOW] {
if (!isflagset(FLAG_IS_REPLY)) { if (!isflagset(FLAG_IS_REPLY)) {
sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY); sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY);
} }
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is rejected by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is rejected by ACL for $var(device)\n");
exit; exit;
} }
@ -222,7 +223,7 @@ route[ACL_CHECK_DEVICE_DENY] {
if (!isflagset(FLAG_IS_REPLY)) { if (!isflagset(FLAG_IS_REPLY)) {
sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY); sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY);
} }
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is rejected by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is rejected by ACL for $var(device)\n");
exit; exit;
} }
@ -230,23 +231,23 @@ route[ACL_CHECK_DEVICE_DENY] {
$var(i) = 0; $var(i) = 0;
kazoo_json($var(acl-response), "Device.CIDR[$var(i)]", "$var(record)");; kazoo_json($var(acl-response), "Device.CIDR[$var(i)]", "$var(record)");;
while(not_empty("$var(record)")) { while(not_empty("$var(record)")) {
xlog("L_INFO", "$ci |ACL-device| checking if $si is in $var(record)");
xlog("L_INFO", "$ci|ACL-device|checking if $si is in $var(record)");
if (($var(record) == ACL_IP_ADDR_ANY) || is_in_subnet("$si", $var(record))) { if (($var(record) == ACL_IP_ADDR_ANY) || is_in_subnet("$si", $var(record))) {
$sht(acl=>$var(device)/$si) = 0; $sht(acl=>$var(device)/$si) = 0;
if (!isflagset(FLAG_IS_REPLY)) { if (!isflagset(FLAG_IS_REPLY)) {
sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY); sl_send_reply(ACL_CODE_DENY, ACL_MESSAGE_DENY);
} }
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is rejected by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is rejected by ACL for $var(device)\n");
exit; exit;
} }
$var(i) = $var(i) + 1; $var(i) = $var(i) + 1;
kazoo_json($var(acl-response), "Device.CIDR[$var(i)]", "$var(record)");; kazoo_json($var(acl-response), "Device.CIDR[$var(i)]", "$var(record)");;
} }
} else { } else {
xlog("L_INFO", "$ci |ACL-device| undefined CIDR in response for $var(device)");
xlog("L_INFO", "$ci|ACL-device|undefined CIDR in response for $var(device)");
} }
# Remember in CACHE and ALLOW # Remember in CACHE and ALLOW
$sht(acl=>$var(device)/$si) = 1; $sht(acl=>$var(device)/$si) = 1;
xlog("L_INFO", "$ci |ACL| $var(sip-packet) from $si is permitted by ACL for $var(device)\n");
xlog("L_INFO", "$ci|ACL|$var(sip-packet) from $si is permitted by ACL for $var(device)\n");
return; return;
} }

Write Preview
Loading…
Cancel
Save