TLS配置OpenSIPS

我试图配置我的OpenSIPS服务器以允许TLS加密通信。TLS配置OpenSIPS

首先，我尝试使用OpenSIPS提供的内置证书。我迄今为止所做的是生成一个新的Residential Script（opensips_residential.cfg），其中启用了ENABLE_TCP & ENABLE_TLS。现在我有两个配置文件，与后续的线opensips.cfg：

# 
# $Id$ 
# 
# OpenSIPS residential configuration script 
#  by OpenSIPS Solutions <[email protected]> 
# 
# This script was generated via "make menuconfig", from 
# the "Residential" scenario. 
# You can enable/disable more features/functionalities by 
# re-generating the scenario with different options.# 
# 
# Please refer to the Core CookBook at: 
#  http://www.opensips.org/Resources/DocsCookbooks 
# for a explanation of possible statements, functions and parameters. 
# 


####### Global Parameters ######### 

log_level=3 
log_stderror=no 
log_facility=LOG_LOCAL0 

children=4 

/* uncomment the following line to enable debugging */ 
#debug_mode=yes 

/* uncomment the next line to enable the auto temporary blacklisting of 
    not available destinations (default disabled) */ 
#disable_dns_blacklist=no 

/* uncomment the next line to enable IPv6 lookup after IPv4 dns 
    lookup failures (default disabled) */ 
#dns_try_ipv6=yes 

/* comment the next line to enable the auto discovery of local aliases 
    based on revers DNS on IPs */ 
auto_aliases=no 


listen=udp:192.168.1.57:5060 # CUSTOMIZE ME 

####### Modules Section ######## 

#set module path 
mpath="/usr/local//lib64/opensips/modules/" 

#### SIGNALING module 
loadmodule "signaling.so" 

#### StateLess module 
loadmodule "sl.so" 

#### Transaction Module 
loadmodule "tm.so" 
modparam("tm", "fr_timeout", 5) 
modparam("tm", "fr_inv_timeout", 30) 
modparam("tm", "restart_fr_on_each_reply", 0) 
modparam("tm", "onreply_avp_mode", 1) 

#### Record Route Module 
loadmodule "rr.so" 
/* do not append from tag to the RR (no need for this script) */ 
modparam("rr", "append_fromtag", 0) 

#### MAX ForWarD module 
loadmodule "maxfwd.so" 

#### SIP MSG OPerationS module 
loadmodule "sipmsgops.so" 

#### FIFO Management Interface 
loadmodule "mi_fifo.so" 
modparam("mi_fifo", "fifo_name", "/tmp/opensips_fifo") 
modparam("mi_fifo", "fifo_mode", 0666) 


#### URI module 
loadmodule "uri.so" 
modparam("uri", "use_uri_table", 0) 

#### USeR LOCation module 
loadmodule "usrloc.so" 
modparam("usrloc", "nat_bflag", "NAT") 
modparam("usrloc", "db_mode", 0) 

#### REGISTRAR module 
loadmodule "registrar.so" 

/* uncomment the next line not to allow more than 10 contacts per AOR */ 
#modparam("registrar", "max_contacts", 10) 

#### ACCounting module 
loadmodule "acc.so" 
/* what special events should be accounted ? */ 
modparam("acc", "early_media", 0) 
modparam("acc", "report_cancels", 0) 
/* by default we do not adjust the direct of the sequential requests. 
    if you enable this parameter, be sure the enable "append_fromtag" 
    in "rr" module */ 
modparam("acc", "detect_direction", 0) 


#### UDP protocol 
loadmodule "proto_udp.so" 

####### Routing LogiC######## 

# main request routing logic 

route{ 
    if (!mf_process_maxfwd_header("10")) { 
     sl_send_reply("483","Too Many Hops"); 
     exit; 
    } 

    if (has_totag()) { 
     # sequential requests within a dialog should 
     # take the path determined by record-routing 
     if (loose_route()) { 

      if (is_method("BYE")) { 
       # do accunting, even if the transaction fails 
       do_accounting("log","failed"); 
      } else if (is_method("INVITE")) { 
       # even if in most of the cases is useless, do RR for 
       # re-INVITEs alos, as some buggy clients do change route set 
       # during the dialog. 
       record_route(); 
      } 

      # route it out to whatever destination was set by loose_route() 
      # in $du (destination URI). 
      route(relay); 
     } else { 

      if (is_method("ACK")) { 
       if (t_check_trans()) { 
        # non loose-route, but stateful ACK; must be an ACK after 
        # a 487 or e.g. 404 from upstream server 
        t_relay(); 
        exit; 
       } else { 
        # ACK without matching transaction -> 
        # ignore and discard 
        exit; 
       } 
      } 
      sl_send_reply("404","Not here"); 
     } 
     exit; 
    } 

    # CANCEL processing 
    if (is_method("CANCEL")) 
    { 
     if (t_check_trans()) 
      t_relay(); 
     exit; 
    } 

    t_check_trans(); 

    if (!(is_method("REGISTER") )) { 
     if (from_uri==myself) 
     { 
     } else { 
      # if caller is not local, then called number must be local 
      if (!uri==myself) { 
       send_reply("403","Rely forbidden"); 
       exit; 
      } 
     } 
    } 

    # preloaded route checking 
    if (loose_route()) { 
     xlog("L_ERR", 
     "Attempt to route with preloaded Route's [$fu/$tu/$ru/$ci]"); 
     if (!is_method("ACK")) 
      sl_send_reply("403","Preload Route denied"); 
     exit; 
    } 

    # record routing 
    if (!is_method("REGISTER|MESSAGE")) 
     record_route(); 

    # account only INVITEs 
    if (is_method("INVITE")) { 
     do_accounting("log"); 
    } 

    if (!uri==myself) { 
     append_hf("P-hint: outbound\r\n"); 
     route(relay); 
    } 

    # requests for my domain 
    if (is_method("PUBLISH|SUBSCRIBE")) 
    { 
     sl_send_reply("503", "Service Unavailable"); 
     exit; 
    } 

    if (is_method("REGISTER")) 
    { 
     if (!save("location")) 
      sl_reply_error(); 

     exit; 
    } 

    if ($rU==NULL) { 
     # request with no Username in RURI 
     sl_send_reply("484","Address Incomplete"); 
     exit; 
    } 

    # do lookup with method filtering 
    if (!lookup("location","m")) { 
     t_newtran(); 
     t_reply("404", "Not Found"); 
     exit; 
    } 

    # when routing via usrloc, log the missed calls also 
    do_accounting("log","missed"); 
    route(relay); 
} 


route[relay] { 
    # for INVITEs enable some additional helper routes 
    if (is_method("INVITE")) { 
     t_on_branch("per_branch_ops"); 
     t_on_reply("handle_nat"); 
     t_on_failure("missed_call"); 
    } 

    if (!t_relay()) { 
     send_reply("500","Internal Error"); 
    }; 
    exit; 
} 




branch_route[per_branch_ops] { 
    xlog("new branch at $ru\n"); 
} 


onreply_route[handle_nat] { 

    xlog("incoming reply\n"); 
} 


failure_route[missed_call] { 
    if (t_was_cancelled()) { 
     exit; 
    } 

    # uncomment the following lines if you want to block client 
    # redirect based on 3xx replies. 
    ##if (t_check_status("3[0-9][0-9]")) { 
    ##t_reply("404","Not found"); 
    ## exit; 
    ##} 

}

而其他配置文件是我用menuconfig的工具生成的一个：我不知道

# 
# OpenSIPS residential configuration script 
#  by OpenSIPS Solutions <[email protected]> 
# 
# This script was generated via "make menuconfig", from 
# the "Residential" scenario. 
# You can enable/disable more features/functionalities by 
# re-generating the scenario with different options.# 
# 
# Please refer to the Core CookBook at: 
#  http://www.opensips.org/Resources/DocsCookbooks 
# for a explanation of possible statements, functions and parameters. 
# 


####### Global Parameters ######### 

log_level=3 
log_stderror=no 
log_facility=LOG_LOCAL0 

children=4 

/* uncomment the following lines to enable debugging */ 
#debug_mode=yes 

/* uncomment the next line to enable the auto temporary blacklisting of 
    not available destinations (default disabled) */ 
#disable_dns_blacklist=no 

/* uncomment the next line to enable IPv6 lookup after IPv4 dns 
    lookup failures (default disabled) */ 
#dns_try_ipv6=yes 

/* comment the next line to enable the auto discovery of local aliases 
    based on revers DNS on IPs */ 
auto_aliases=no 


listen=udp:192.168.1.57:5060 # CUSTOMIZE ME 

listen=tcp:192.168.1.57:5060 # CUSTOMIZE ME 
listen=tls:192.168.1.57:5061 # CUSTOMIZE ME 

####### Modules Section ######## 

#set module path 
mpath="/usr/local/lib/opensips/modules/" 

#### SIGNALING module 
loadmodule "signaling.so" 

#### StateLess module 
loadmodule "sl.so" 

#### Transaction Module 
loadmodule "tm.so" 
modparam("tm", "fr_timeout", 5) 
modparam("tm", "fr_inv_timeout", 30) 
modparam("tm", "restart_fr_on_each_reply", 0) 
modparam("tm", "onreply_avp_mode", 1) 

#### Record Route Module 
loadmodule "rr.so" 
/* do not append from tag to the RR (no need for this script) */ 
modparam("rr", "append_fromtag", 0) 

#### MAX ForWarD module 
loadmodule "maxfwd.so" 

#### SIP MSG OPerationS module 
loadmodule "sipmsgops.so" 

#### FIFO Management Interface 
loadmodule "mi_fifo.so" 
modparam("mi_fifo", "fifo_name", "/tmp/opensips_fifo") 
modparam("mi_fifo", "fifo_mode", 0666) 


#### URI module 
loadmodule "uri.so" 
modparam("uri", "use_uri_table", 0) 











#### USeR LOCation module 
loadmodule "usrloc.so" 
modparam("usrloc", "nat_bflag", "NAT") 
modparam("usrloc", "db_mode", 0) 

#### REGISTRAR module 
loadmodule "registrar.so" 
modparam("registrar", "tcp_persistent_flag", "TCP_PERSISTENT") 

/* uncomment the next line not to allow more than 10 contacts per AOR */ 
#modparam("registrar", "max_contacts", 10) 

#### ACCounting module 
loadmodule "acc.so" 
/* what special events should be accounted ? */ 
modparam("acc", "early_media", 0) 
modparam("acc", "report_cancels", 0) 
/* by default we do not adjust the direct of the sequential requests. 
    if you enable this parameter, be sure the enable "append_fromtag" 
    in "rr" module */ 
modparam("acc", "detect_direction", 0) 




















loadmodule "proto_udp.so" 

loadmodule "proto_tcp.so" 
loadmodule "proto_tls.so" 
modparam("proto_tls","verify_cert", "1") 
modparam("proto_tls","require_cert", "0") 
modparam("proto_tls","tls_method", "TLSv1") 
modparam("proto_tls","certificate", "/usr/local/etc/opensips/tls/user/user-cert.pem") 
modparam("proto_tls","private_key", "/usr/local/etc/opensips/tls/user/user-privkey.pem") 
modparam("proto_tls","ca_list", "/usr/local/etc/opensips/tls/user/user-calist.pem") 



####### Routing LogiC######## 

# main request routing logic 

route{ 


    if (!mf_process_maxfwd_header("10")) { 
     sl_send_reply("483","Too Many Hops"); 
     exit; 
    } 

    if (has_totag()) { 
     # sequential request withing a dialog should 
     # take the path determined by record-routing 
     if (loose_route()) { 

      if (is_method("BYE")) { 
       # do accounting even if the transaction fails 
       do_accounting("log","failed"); 
      } else if (is_method("INVITE")) { 
       # even if in most of the cases is useless, do RR for 
       # re-INVITEs alos, as some buggy clients do change route set 
       # during the dialog. 
       record_route(); 
      } 



      # route it out to whatever destination was set by loose_route() 
      # in $du (destination URI). 
      route(relay); 
     } else { 

      if (is_method("ACK")) { 
       if (t_check_trans()) { 
        # non loose-route, but stateful ACK; must be an ACK after 
        # a 487 or e.g. 404 from upstream server 
        t_relay(); 
        exit; 
       } else { 
        # ACK without matching transaction -> 
        # ignore and discard 
        exit; 
       } 
      } 
      sl_send_reply("404","Not here"); 
     } 
     exit; 
    } 

    # CANCEL processing 
    if (is_method("CANCEL")) 
    { 
     if (t_check_trans()) 
      t_relay(); 
     exit; 
    } 

    t_check_trans(); 

    if (!(is_method("REGISTER") )) { 

     if (from_uri==myself) 

     { 

     } else { 
      # if caller is not local, then called number must be local 

      if (!uri==myself) { 
       send_reply("403","Rely forbidden"); 
       exit; 
      } 
     } 

    } 

    # preloaded route checking 
    if (loose_route()) { 
     xlog("L_ERR", 
     "Attempt to route with preloaded Route's [$fu/$tu/$ru/$ci]"); 
     if (!is_method("ACK")) 
      sl_send_reply("403","Preload Route denied"); 
     exit; 
    } 

    # record routing 
    if (!is_method("REGISTER|MESSAGE")) 
     record_route(); 

    # account only INVITEs 
    if (is_method("INVITE")) { 

     do_accounting("log"); 
    } 


    if (!uri==myself) { 
     append_hf("P-hint: outbound\r\n"); 

     # if you have some interdomain connections via TLS 
     ## CUSTOMIZE IF NEEDED 
     ##if ($rd=="tls_domain1.net" 
     ## || $rd=="tls_domain2.net" 
     ##) { 
     ## force_send_socket(tls:127.0.0.1:5061); # CUSTOMIZE 
     ##} 

     route(relay); 
    } 

    # requests for my domain 

    if (is_method("PUBLISH|SUBSCRIBE")) 
    { 
     sl_send_reply("503", "Service Unavailable"); 
     exit; 
    } 

    if (is_method("REGISTER")) 
    { 


     if (proto==TCP || proto==TLS || 0) setflag(TCP_PERSISTENT); 



     if (!save("location")) 
      sl_reply_error(); 

     exit; 
    } 

    if ($rU==NULL) { 
     # request with no Username in RURI 
     sl_send_reply("484","Address Incomplete"); 
     exit; 
    } 







    # do lookup with method filtering 
    if (!lookup("location","m")) { 


     t_newtran(); 
     t_reply("404", "Not Found"); 
     exit; 
    } 



    # when routing via usrloc, log the missed calls also 
    do_accounting("log","missed"); 
    route(relay); 
} 


route[relay] { 
    # for INVITEs enable some additional helper routes 
    if (is_method("INVITE")) { 



     t_on_branch("per_branch_ops"); 
     t_on_reply("handle_nat"); 
     t_on_failure("missed_call"); 
    } 



    if (!t_relay()) { 
     send_reply("500","Internal Error"); 
    }; 
    exit; 
} 




branch_route[per_branch_ops] { 
    xlog("new branch at $ru\n"); 
} 


onreply_route[handle_nat] { 

    xlog("incoming reply\n"); 
} 


failure_route[missed_call] { 
    if (t_was_cancelled()) { 
     exit; 
    } 

    # uncomment the following lines if you want to block client 
    # redirect based on 3xx replies. 
    ##if (t_check_status("3[0-9][0-9]")) { 
    ##t_reply("404","Not found"); 
    ## exit; 
    ##} 


}

如果我必须用opensips_residential.cfg替换我的opensips.cfg文件。我试过了，当我试图用命令'opensipsctl start'启动我的服务器时，我得到了几个错误，如果有必要，我可以在另一个消息中提供它们。

来源

2017-02-20 Alex Docasar

如果使用opensipsctl start，寻找在/usr/local/opensips/etc/opensipsctlrc的# STARTOPTIONS=变量，并将其定义为：

STARTOPTIONS="-f /path/to/opensips_residential.cfg"

安装时从包OpenSIPS，注意，启动脚本的配置文件路径变得/etc/opensips/opensips.cfg，你将不得不修改/替换此文件以使更改生效。

来源

2017-02-21 09:02:38

请确保您的证书路径设置正确，我也不会使用自签名证书。转到letsencrypt获取证书并将路径放在opensips.cfg文件中。用新生成的配置替换现有配置。

来源

2017-12-04 21:11:49 user37664

回答

相关问题