#!KAMAILIO

####### Defined Values #########

# *** Value defines - IDs used later in config
#!define DBURL "postgres://xxxx:xxxx@1.1.1.1/db"

# - flags
#   FLT_ - per transaction (message) flags
#   FLB_ - per branch flags
#!define FLT_ACC 1
#!define FLT_ACCMISSED 2
#!define FLT_ACCFAILED 3
#!define FLT_NATS 4
#!define FLT_FIXUSER 5
#!define FLT_FROMPROXY 7
#!define FLT_FROMUSER 8
#!define FLT_TOUSER 10
#!define FLT_SIPTRACE 11
#!define FLT_LIMIT 12
#!define FLT_DIALOG 13

#!define FLB_NATB 15
#!define FLB_NATSIPPING 16


####### Global Parameters #########

#debug=4
#log_stderror=yes

debug=0
log_stderror=no

memdbg=5
memlog=5

log_facility=LOG_LOCAL0

#fork=no
fork=yes
children=2
tcp_children=1
#disable_tcp=yes
syn_branch=0
auto_aliases=no
alias="sip.domain.com"

/* uncomment and configure the following line if you want Kamailio to
   bind on a specific interface/port/proto (default bind on all available) */
#listen=udp:C.C.C.C4:5060
#listen=udp:127.0.0.1:5060

/* port to listen to
 * - can be specified more than once if needed to listen on many ports */
port=5060

# life time of TCP connection when there is no traffic
# - a bit higher than registration expires to cope with UA behind NAT
tcp_connection_lifetime=3605

server_header="Server: 5Nine SIP Registrar"
user_agent_header="User-Agent: 5Nine SIP Registrar"

####### Custom Parameters #########

# These parameters can be modified runtime via RPC interface
# - see the documentation of 'cfg_rpc' module.
#
# Format: group.id = value 'desc' description
# Access: $sel(cfg_get.group.id) or @cfg_get.group.id
#

proxy1.bindip = "C.C.C.C" desc "Proxy 1 IP Address"
proxy1.bindport = "5060" desc "Proxy 1 Port"

proxy2.bindip = "E.E.E.E" desc "Proxy 2 IP Address"
proxy2.bindport = "5060" desc "Proxy 2 Port"

####### Modules Section ########

mpath="/usr/lib64/kamailio/modules_k/:/usr/lib64/kamailio/modules/"

loadmodule "db_postgres.so"
#loadmodule "mi_fifo.so"
loadmodule "mi_datagram.so"
#loadmodule "mi_xmlrpc.so"
loadmodule "kex.so"
loadmodule "tm.so"
loadmodule "sl.so"
loadmodule "rr.so"
loadmodule "pv.so"
loadmodule "maxfwd.so"
loadmodule "usrloc.so"
loadmodule "registrar.so"
loadmodule "textops.so"
loadmodule "siputils.so"
loadmodule "xlog.so"
loadmodule "sanity.so"
loadmodule "ctl.so"
loadmodule "mi_rpc.so"
loadmodule "acc.so"
loadmodule "auth.so"
loadmodule "auth_db.so"
loadmodule "nathelper.so"
loadmodule "rtpproxy.so"
loadmodule "htable.so"
loadmodule "pike.so"

# ----- mi_fifo params -----
#modparam("mi_fifo", "fifo_name", "/tmp/kamailio_fifo")

# ----- mi_datagram params -----
modparam("mi_datagram", "socket_name", "udp:127.0.0.1:8033")

# ----- tm params -----
# auto-discard branches from previous serial forking leg
modparam("tm", "failure_reply_mode", 3)
# default retransmission timeout: 2sec
modparam("tm", "fr_timer", 2000)
# default invite retransmission timeout after 1xx: 120sec
modparam("tm", "fr_inv_timer", 120000)

# ----- rr params -----
modparam("rr", "append_fromtag", 1)

# ----- pv params -----
modparam("pv","avp_aliases",
    "acct_id=i:100;user_id=i:101;ouser=i:102;received=i:103;def_clid=i:104;
    channels=i:105;route=i:106;fail_route=i:107;aor=i:108")

# ----- registrar params -----
modparam("registrar", "method_filtering", 1)
modparam("registrar", "default_expires", 3600)
modparam("registrar", "min_expires", 120)
modparam("registrar", "max_expires", 7200)
modparam("registrar", "max_contacts", 10)
modparam("registrar", "aor_avp", "$avp(aor)")

# ----- acc params -----
/* what special events should be accounted ? */
modparam("acc", "early_media", 0)
modparam("acc", "report_ack", 0)
modparam("acc", "report_cancels", 0)
/* by default ww do not adjust the direct of the sequential requests.
   if you enable this parameter, be sure the enable "append_fromtag"
   in "rr" module */
modparam("acc", "detect_direction", 0)
/* account triggers (flags) */
modparam("acc", "log_flag", FLT_ACC)
modparam("acc", "log_missed_flag", FLT_ACCMISSED)
modparam("acc", "log_extra",
    "src_user=$fU;src_domain=$fd;dst_ouser=$tU;dst_user=$rU;dst_domain=$rd")
modparam("acc", "failed_transaction_flag", FLT_ACCFAILED)

# ----- usrloc params -----
/* enable DB persistency for registration entries */
modparam("usrloc", "db_url", DBURL)
modparam("usrloc", "db_mode", 2)
modparam("usrloc", "timer_interval", 120)

# ----- auth_db params -----
modparam("auth_db", "db_url", DBURL)
modparam("auth_db", "calculate_ha1", 1)
modparam("auth_db", "user_column", "ep_id")
modparam("auth_db", "password_column", "password")
modparam("auth_db", "load_credentials", "channels;default_clid;user_id")
modparam("auth_db", "version_table", 0)

# ----- rtpproxy params -----
modparam("rtpproxy", "rtpproxy_sock", "udp:127.0.0.1:7722")

# ----- nathelper params -----
modparam("nathelper", "natping_interval", 45)
modparam("nathelper", "ping_nated_only", 1)
modparam("nathelper", "sipping_bflag", FLB_NATSIPPING)
modparam("nathelper", "sipping_from", "sip:pinger@sip.domain.com")

# params needed for NAT traversal in other modules
modparam("nathelper|registrar", "received_avp", "$avp(received)")
modparam("usrloc", "nat_bflag", FLB_NATB)

# ----- pike params -----
modparam("pike", "sampling_time_unit", 2)
modparam("pike", "reqs_density_per_unit", 16)
modparam("pike", "remove_latency", 4)

# ----- htable params -----
# ip ban htable with autoexpire after 5 minutes
modparam("htable", "htable", "ipban=>size=8;autoexpire=300;")


# Main SIP request routing logic
route {
    route(LOOKUPSRC);

    # per request initial checks
    route(REQINIT);

    # NAT detection
    route(NATDETECT);

    # handle requests within SIP dialogs
    route(WITHINDLG);

    ### only initial requests (no To tag)

    # CANCEL processing
    if (is_method("CANCEL")) {
        if (t_check_trans()) {
            t_relay();
        }
        exit;
    }

    t_check_trans();

    # record routing for dialog forming requests (in case they are routed)
    # - remove preloaded route headers
    remove_hf("Route");
    if (!is_method("REGISTER|MESSAGE"))
        record_route();

    # authentication
    route(AUTH);

    if (is_method("INVITE")) {
        setflag(FLT_ACC); # do accounting

        if (!isflagset(FLT_FROMPROXY)) {
            # Send all INVITEs to our proxies
            $rd = "sip.domain.com";
            route(RELAY);
        }
    }

    ### requests for my local domains

    # handle registrations
    route(REGISTRAR);

    if ($rU==$null) {
        # request with no Username in RURI
        sl_send_reply("484","Address Incomplete");
        exit;
    }

    # registered users
    route(LOCATION);

    # nothing matched
    sl_send_reply("404", "Not Found");
}


# Lookup source of request
route[LOOKUPSRC] {

    if($si==$sel(cfg_get.proxy1.bindip) && $sp==$sel(cfg_get.proxy1.bindport))
        setflag(FLT_FROMPROXY);

    if($si==$sel(cfg_get.proxy2.bindip) && $sp==$sel(cfg_get.proxy2.bindport))
        setflag(FLT_FROMPROXY);
}


# Per SIP request initial checks
route[REQINIT] {
    # calls from our proxies have already been checked
    if (isflagset(FLT_FROMPROXY))
        return;

    # flood dection from same IP and traffic ban for a while
    # be sure you exclude checking trusted peers, such as pstn gateways
    # - local host excluded (e.g., loop to self)
    if(src_ip!=myself) {
        if($sht(ipban=>$si)!=$null) {
            # ip is already blocked
            xdbg("request from blocked IP - $rm from $fu (IP:$si:$sp)\n");
            exit;
        }
        if (!pike_check_req()) {
            xlog("L_ALERT","ALERT: pike blocking $rm from $fu (IP:$si:$sp)\n");
            $sht(ipban=>$si) = 1;
            exit;
        }
    }

    if (!mf_process_maxfwd_header("10")) {
        sl_send_reply("483","Too Many Hops");
        exit;
    }

    if(!sanity_check("1511", "7")) {
        xlog("L_INFO","Malformed SIP message from $si:$sp\n");
        exit;
    }

    if (is_method("PUBLISH|MESSAGE|SUBSCRIBE|REFER")) {
        sl_send_reply("405", "Method not allowed");
        exit;
    }
}


# Caller NAT detection route
route[NATDETECT] {
    if (is_method("INVITE")) {
        if (nat_uac_test("31")) {
            force_rport();
            fix_nated_contact();
            setflag(FLT_NATS);
        }
    } else {
         if (nat_uac_test("19")) {
            force_rport();
            if (is_method("REGISTER")) {
                fix_nated_register();
            } else {
                fix_nated_contact();
            }
            setflag(FLT_NATS);
        }
    }
    return;
}


# Handle requests within SIP dialogs
route[WITHINDLG] {
    if (has_totag()) {
        # sequential request withing a dialog should
        # take the path determined by record-routing
        if (loose_route()) {
            if (is_method("BYE")) {
                setflag(FLT_ACC); # do accounting ...
                setflag(FLT_ACCFAILED); # ... even if the transaction fails
            }
            if (is_method("ACK")) {
                # ACK is forwarded statelessy
                    route(NATMANAGE);
                }
            route(RELAY);
        } else {
            if ( is_method("ACK") ) {
                if (t_check_trans()) {
                    # no loose-route, but stateful ACK;
                    # must be an ACK after a 487
                    # or e.g. 404 from upstream server
                    t_relay();
                    exit;
                } else {
                    # ACK without matching transaction ... ignore and discard
                    exit;
                }
            }
            sl_send_reply("404","Not here");
        }
        exit;
    }
}


# Authentication route
route[AUTH] {

    if (isflagset(FLT_FROMPROXY))
        return;

    if (is_method("REGISTER")) {

        # authenticate the REGISTER requests
        if (!www_authorize("$td", "endpoints")) {
            www_challenge("$td", "0");
            exit;
        }

    } else {
        setflag(FLT_FROMUSER);
    }
    return;
}


route[RELAY] {

    if (is_method("INVITE")) {
        t_on_branch("BRANCH_ONE");
        t_on_reply("REPLY_ONE");
        t_on_failure("FAIL_ONE");
    }

    if (!t_relay()) {
        sl_reply_error();
    }
    exit;
}


# Handle SIP registrations
route[REGISTRAR] {
    if (is_method("REGISTER")) {
        if (isflagset(FLT_NATS)) {
            setbflag(FLB_NATB);
            setbflag(FLB_NATSIPPING);
        }
        # Use auth username as aor
        $avp(aor) = "sip:" + $Au;

        if (isflagset(FLT_NATS)) {
            # Don't store NATed registrations in the db
            if (!save("registrations", "0x01"))
                sl_reply_error();
        } else {
            if (!save("registrations"))
                sl_reply_error();
        }

        # Replicate the request to other proxy
        route(REGFWD);
        exit;
    }
}


route[LOCATION] {
    # Only our proxies can route to registered users
    if (!isflagset(FLT_FROMPROXY)) {
        sl_send_reply("403", "Unauthorized");
    }

    if (!lookup("registrations")) {
        switch ($rc) {
            case -1:
            case -3:
                sl_send_reply("480", "Temporarily Unavailable");
                exit;
            case -2:
                sl_send_reply("405", "Method Not Allowed");
                exit;
        }
    }

    # when routing via usrloc, log the missed calls also
    if (is_method("INVITE")) {
        setflag(FLT_ACCMISSED);
        setflag(FLT_FIXUSER);
        $rU=$avp(ouser);
    }

    route(RELAY);
    exit;
}


# RTPProxy control
route[NATMANAGE] {
    if (is_request()) {
        if(has_totag()) {
            if(check_route_param("nat=yes")) {
                setbflag(FLB_NATB);
            }
        }
    }
    if (!(isflagset(FLT_NATS) || isbflagset(FLB_NATB)))
        return;

    rtpproxy_manage();

    if (is_request()) {
        if (!has_totag()) {
            add_rr_param(";nat=yes");
        }
    }

    if (is_reply()) {
        if(isbflagset(FLB_NATB)) {
            fix_nated_contact();
        }
    }
    return;
}

# Forward REGISTER to Proxies
route[REGFWD] {
    if (!is_method("REGISTER"))
        return;

    subst('/^From:(.*)sip:.*@[a-zA-Z0-9.:]+(.*)$/From:\1sip:$au@sip.domain.com\2/ig');
    subst('/^To:(.*)sip:.*@[a-zA-Z0-9.:]+(.*)$/To:\1sip:$au@sip.domain.com\2/ig');

    # If UAC is behind NAT, rewrite the Contact
    if (isflagset(FLT_NATS))
        subst('/^Contact:(.*)sip:(.*)@[a-zA-Z0-9.:]+(.*)$/Contact:\1sip:$au@$Ri:$Rp\3/ig');

    $du = "sip:" + $sel(cfg_get.proxy1.bindip) + ":" + $sel(cfg_get.proxy1.bindport);
    t_replicate($du);

    $du = "sip:" + $sel(cfg_get.proxy2.bindip) + ":" + $sel(cfg_get.proxy2.bindport);
    t_replicate($du);

}

# outgoing branches
branch_route[BRANCH_ONE] {
    if (isflagset(FLT_FIXUSER)) {
        $rU=$avp(ouser);
    }

    xdbg("new branch at $ru\n");
    route(NATMANAGE);
}

onreply_route[REPLY_ONE] {
    xdbg("incoming reply\n");

    if (status=~"[12][0-9][0-9]")
        route(NATMANAGE);
}

# manage failure routing cases
failure_route[FAIL_ONE] {
    route(NATMANAGE);

    if (t_is_canceled())
        exit;

}