#!trydef INCLUDE-DB-KAZOO

######## Generic Hash Table container in shared memory ########
modparam("htable", "htable", "auth_cache=>size=16;autoexpire=7200")
modparam("htable", "htable", "failed_auth_hash=>size=14;autoexpire=180;")

####### Authentication Interface module ##########
loadmodule "auth.so"
loadmodule "auth_db.so"
modparam("auth_db", "use_domain", 1)
modparam("auth_db", "version_table", 0)
modparam("auth_db", "calculate_ha1", 1)
modparam("auth_db", "password_column", "password")
modparam("auth_db", "load_credentials", "$avp(password)=password")

####### User Location Implementation module ##########
loadmodule "usrloc.so"
modparam("usrloc", "db_mode", 1)
modparam("usrloc", "db_update_as_insert", 1)
modparam("usrloc", "use_domain", 1)
modparam("usrloc", "nat_bflag", FLB_NATB)

######## NAT Traversal module - signaling functions ########
#!ifdef NAT-TRAVERSAL-ROLE
#!trydef NATHELPER-LOADED
loadmodule "nathelper.so"
modparam("nathelper", "natping_interval", 30)
modparam("nathelper", "ping_nated_only", 1)
modparam("nathelper", "natping_processes", 5)
modparam("nathelper", "sipping_bflag", FLB_NATSIPPING)
#!endif

####### SIP Registrar implementation module ##########
loadmodule "registrar.so"
modparam("registrar", "received_avp", "$avp(AVP_RECV_PARAM)")

####### Registrar Logic ########
route[HANDLE_REGISTER]
{
    if (is_method("REGISTER")) {

        route(DOMAIN_FORMAT_CHECK);

        #!ifdef NAT-TRAVERSAL-ROLE
        if (nat_uac_test("3")) {
            xlog("L_INFO", "$ci|log|Correcting NATed contact in registration\n");
            force_rport();

            setbflag(FLB_NATB);
            setbflag(FLB_NATSIPPING);

            fix_nated_register();
        }
        #!endif

        if (is_present_hf("Authorization")) {

           if (!route(PREVENT_BRUTEFORCE)) {
                auth_challenge("$fd", "0");
                exit;
            }

            if ($sht(auth_cache=>$Au) != $null && pv_auth_check("$fd", "$sht(auth_cache=>$Au)", "0", "0")) {
                xlog("L_INFO", "$ci|log|Authenticated $Au via cached SIP creds\n");
            } else {
                ## RABBITMQ - Credentials fetch
                if (!auth_check("$fd", "subscriber", "1")) {
                    route(FAILED_AUTH_COUNT);
                    auth_challenge("$fd", "0");
                    xlog("L_INFO", "$ci|log|Issued new auth challenge to failed registration attempt\n");
                    exit;
                } else {
                    xlog("L_INFO", "$ci|log|Caching SIP credentials for $Au\n");
                    $sht(auth_cache=>$Au) = $avp(password);
                }
            }
        } else {
            auth_challenge("$fd", "0");
            xlog("L_INFO", "$ci|log|Issued new auth challenge to new registration attempt\n");
            exit;
        }

        # user authenticated - remove auth header
        consume_credentials();

        save("location");
        exit;
    }
}

# AUTH: check to see if user if present in failed_auth_hash
route[PREVENT_BRUTEFORCE]
{
    if (isflagset(FLAG_TRUSTED_SOURCE)) {
        return(1);
    }

    if($sht(failed_auth_hash=>$Au::count) >= 2) {
        $var(exp) = $Ts - 120;
        if($sht(failed_auth_hash=>$Au::last) > $var(exp)){
            xlog("L_WARN", "$ci|log|possible password brute force, from $ct on user $Au");
            return(-1);
        } else {
            $sht(failed_auth_hash=>$Au::count) = 0;
        }
    }
    return(1);
}

#AUTH: add to failed_auth_hash in case of authentication password error
route[FAILED_AUTH_COUNT]
{
    if (isflagset(FLAG_TRUSTED_SOURCE)) {
        return;
    }

    if ($rc == -2) {
        if($sht(failed_auth_hash=>$Au::count) == $null) {
            $sht(failed_auth_hash=>$Au::count) = 0;
        }
        $sht(failed_auth_hash=>$Au::count) = $sht(failed_auth_hash=>$Au::count) + 1;
        $sht(failed_auth_hash=>$Au::last) = $Ts;
    }
}

route[DOMAIN_FORMAT_CHECK]
{
    if (isflagset(FLAG_TRUSTED_SOURCE)) {
        return;
    }

    if ($rd =~ "([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})" ||
        $td =~ "([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})" ) {
        xlog("L_WARN", "$ci|end|denying request with IP domain in From or To header");
        send_reply("403", "Forbidden");
        exit;
    }

}

# vim:tabstop=4 softtabstop=4 shiftwidth=4 expandtab