allow trusted IPs to bypass all checks

kamailio/default.cfg

@@ -22,7 +22,8 @@ flags
     FLAG_INTERNALLY_SOURCED:  1,
     FLAG_ASSOCIATE_SERVER:    2,
     FLAG_SKIP_NAT_CORRECTION: 3,
-    FLAG_ASSOCIATE_USER:      4;
+    FLAG_ASSOCIATE_USER:      4,
+    FLAG_TRUSTED_SOURCE:      5;
 
 #!define FLB_NATB 1
 #!define FLB_NATSIPPING 2
@@ -274,7 +275,8 @@ route[HANDLE_OPTIONS]
     if (is_method("OPTIONS")) {
         if (isflagset(FLAG_INTERNALLY_SOURCED)) {
             route(INTERNAL_TO_EXTERNAL_RELAY);
-        } else if ($rd =~ "[0-9]{1,3}\.[0-9]{1,3}.[0-9]{1,3}\.[0-9]{1,3}") {
+        } else if (!isflagset(FLAG_TRUSTED_SOURCE)
+            && $rd =~ "[0-9]{1,3}\.[0-9]{1,3}.[0-9]{1,3}\.[0-9]{1,3}") {
             xlog("L_WARN", "$ci|end|dropping OPTIONS request with IP domain");
         } else {
             sl_send_reply("200", "Rawr!!");
@@ -408,7 +410,8 @@ route[DOS_PREVENTION]
 {
     # allow request from internal network or from whitelist
     if (isflagset(FLAG_INTERNALLY_SOURCED) || allow_source_address(TRUSTED_ADR_GROUP)) {
-        xlog("L_DBG", "$ci|log|request from trusted IP");
+        xlog("L_INFO", "$ci|log|request from trusted IP");
+        setflag(FLAG_TRUSTED_SOURCE);
         return;
     }
 

kamailio/dispatcher-role.cfg

@@ -78,23 +78,7 @@ route[DISPATCHER_FIND_ROUTES]
             sl_send_reply("480", "All servers busy");
             exit;
         }
-    } else {
-
-        # if we selected from group 1 and there are less than 3 available servers, choose from group 2
-        if ($var(ds_group) == 1 && $var(ds_cnt)< 3) {
-
-            # clear $avp(ds_dst) and search in group 2
-            $(avp(ds_dst)[*]) = $null;
-
-            if (!ds_select_dst("2", "0")) {
-                xlog("L_ERR", "$ci|end|no servers avaliable in group 2");
-                sl_send_reply("480", "All servers busy");
-                exit;
-            }
-
-        }
-
-    }
+    } 
 
     $var(contact_uri) = $(ct{tobody.user}) + "@" + $(ct{tobody.host});
     $var(from_uri) = @from.uri.user + "@" + @from.uri.host;

kamailio/kamailio.cfg

@@ -9,4 +9,4 @@ include_file "default.cfg"
 ####### Local Configuration ########
 include_file "local.cfg"
 
-## vim:set tabstop=4 softtabstop=4 shiftwidth=4 expandtab
+# vim: tabstop=4 softtabstop=4 shiftwidth=4 expandtab

kamailio/local.cfg

@@ -47,4 +47,4 @@ modparam("auth_db|usrloc", "db_url", "kazoo://guest:guest@127.0.0.1:5672/callmgr
 modparam("presence", "db_url", "kazoo://guest:guest@127.0.0.1:5672/dialoginfo")
 #!endif
 
-## vim:set tabstop=4 softtabstop=4 shiftwidth=4 expandtab
+# vim: tabstop=4 softtabstop=4 shiftwidth=4 expandtab

kamailio/nat-traversal-role.cfg

@@ -34,4 +34,4 @@ route[NAT_TEST_AND_CORRECT]
     }
 }
 
-## vim:set tabstop=4 softtabstop=4 shiftwidth=4 expandtab
+# vim: tabstop=4 softtabstop=4 shiftwidth=4 expandtab

kamailio/presence-role.cfg

@@ -45,4 +45,4 @@ route[HANDLE_PUBLISH]
     }
 }
 
-## vim:set tabstop=4 softtabstop=4 shiftwidth=4 expandtab
+# vim: tabstop=4 softtabstop=4 shiftwidth=4 expandtab

kamailio/registrar-role.cfg

@@ -91,6 +91,10 @@ route[HANDLE_REGISTER]
 # AUTH: check to see if user if present in failed_auth_hash
 route[PREVENT_BRUTEFORCE]
 {
+    if (isflagset(FLAG_TRUSTED_SOURCE)) {
+        return(1);
+    }
+
     if($sht(failed_auth_hash=>$Au::count) >= 2) {
         $var(exp) = $Ts - 120;
         if($sht(failed_auth_hash=>$Au::last) > $var(exp)){
@@ -106,6 +110,10 @@ route[PREVENT_BRUTEFORCE]
 #AUTH: add to failed_auth_hash in case of authentication password error
 route[FAILED_AUTH_COUNT]
 {
+    if (isflagset(FLAG_TRUSTED_SOURCE)) {
+        return;
+    }
+
     if ($rc == -2) {
         if($sht(failed_auth_hash=>$Au::count) == $null) {
             $sht(failed_auth_hash=>$Au::count) = 0;
@@ -117,6 +125,10 @@ route[FAILED_AUTH_COUNT]
 
 route[DOMAIN_FORMAT_CHECK]
 {
+    if (isflagset(FLAG_TRUSTED_SOURCE)) {
+        return;
+    }
+
     if ($rd =~ "([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})" ||
         $td =~ "([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})" ) {
         xlog("L_WARN", "$ci|end|denying request with IP domain in From or To header");