Table of Contents
List of Tables
List of Examples
The WSS (Secure WebSocket) module provides the ability to communicate with a WebSocket (RFC 6455) client or server over a secure (TLS encrypted) channel. As part of the WebRTC specifications, this protocol can be used to provide secure VoIP calls to HTTPS enabled browsers.
This module behaves as any other transport protocol module: in order to
use it, you must define one or more listeners that will handle the secure
WebSocket traffic, after the mpath
parameter:
... mpath=/path/to/modules ... listen=wss:10.0.0.1 # change with the listening IP listen=wss:10.0.0.1:5060 # change with the listening IP and port ...
Besides that, you need to define the TLS parameters for securing the connection. This is done through the tls_mgm module interface, similar to the proto_tls module:
modparam("tls_mgm", "certificate", "/certs/biloxy.com/cert.pem") modparam("tls_mgm", "private_key", "/certs/biloxy.com/privkey.pem") modparam("tls_mgm", "ca_list", "/certs/wellknownCAs") modparam("tls_mgm", "tls_method", "tlsv1") modparam("tls_mgm", "verify_cert", "1") modparam("tls_mgm", "require_cert", "1")
Check the tls_mgm module documentation for more info.
All these parameters can be used from the opensips.cfg file, to configure the behavior of OpenSIPS-WSS.
This is a global parameter that specifies what interface/IP and port should handle WSS traffic.
The default port to be used for all WSS related operation. Be careful as the default port impacts both the SIP listening part (if no port is defined in the WSS listeners) and the SIP sending part (if the destination WSS URI has no explicit port).
If you want to change only the listening port for WSS, use the port option in the SIP listener defintion.
Default value is 443.
The maximum number of chunks in which a SIP message is expected to arrive via WSS. If a received packet is more fragmented than this, the connection is dropped (either the connection is very overloaded and this leads to high fragmentation - or we are the victim of an ongoing attack where the attacker is sending very fragmented traffic in order to decrease server performance).
Default value is 4.
Example 1.3. Set wss_max_msg_chunks
parameter
... modparam("proto_wss", "wss_max_msg_chunks", 8) ...
The resource queried for when a WebSocket handshake is initiated.
Default value is “/”.
This parameter specifies the time in milliseconds the proto_wss module waits for a WebSocket handshake reply from a WebSocket server.
Default value is 100.
Example 1.5. Set wss_handshake_timeout
parameter
... modparam("proto_wss", "wss_handshake_timeout", 300) ...
Trace destination as defined in the tracing module. Currently the only tracing module is proto_hep. Network events such as connect, accept and connection closed events shall be traced along with errors that could appear in the process. For each connection that is created an event containing information about the client and server certificate, master key, http request and reply belonging to web socket protocol handshake and network layer information shall be sent.
WARNING: A tracing module must be loaded in order for this parameter to work. (for example proto_hep).
Default value is none(not defined).
Example 1.6. Set trace_destination
parameter
... modparam("proto_hep", "trace_destination", "[hep_dest]10.0.0.2;transport=tcp;version=3") modparam("proto_wss", "trace_destination", "hep_dest") ...
This controls whether tracing for wss is on or not. You still need to define
Section 1.3.6, “trace_destination
(string)”in order to work, but this value will be
controlled using mi function Section 1.4.1, “
wss_trace
”.
Define the name of a route in which you can filter which connections will
be trace and which connections won't be. In this route you will have
information regarding source and destination ips and ports for the current
connection. To disable tracing for a specific connection the last call in
this route must be drop, any other exit
mode resulting in tracing the current connection ( of course you still
have to define a Section 1.3.6, “trace_destination
(string)” and trace must be
on at the time this connection is opened.
IMPORTANT Filtering on ip addresses and ports can be made using $si and $sp for matching either the entity that is connecting to OpenSIPS or the entity to which OpenSIPS is connecting. The name might be misleading ( $si meaning the source ip if you read the docs) but in reality it is simply the socket other than the OpenSIPS socket. In order to match OpenSIPS interface (either the one that accepted the connection or the one that initiated a connection) $Ri (ip) and $Rp (port) can be used.
WARNING: IF Section 1.3.7, “trace_on
(int)” is
set to 0 or tracing is deactived via the mi command Section 1.4.1, “
wss_trace
”
this route won't be called.
Example 1.8. Set trace_filter_route
parameter
... modparam("proto_wss", "trace_filter_route", "wss_filter") ... /* all wss connections will go through this route if tracing is activated * and a trace destination is defined */ route[wss_filter] { ... /* all connections opened from/by ip 1.1.1.1:8000 will be traced on interface 1.1.1.10:5060(opensips listener) all the other connections won't be */ if ( $si == "1.1.1.1" && $sp == 8000 && $Ri == "1.1.1.10" && $Rp == 5060) exit; else drop; } ...
Name: wss_trace
Parameters:
trace_mode(optional): set wss tracing on and off. This parameter can be missing and the command will show the current tracing status for this module( on or off ); Possible values:
on
off
MI FIFO Command Format:
:wss_trace:_reply_fifo_file_ trace_mode _empty_line_
Table 3.1. Top contributors by DevScore(1), authored commits(2) and lines added/removed(3)
Name | DevScore | Commits | Lines ++ | Lines -- | |
---|---|---|---|---|---|
1. | Razvan Crainea (@razvancrainea) | 16 | 9 | 697 | 34 |
2. | Ionut Ionita (@ionutrazvanionita) | 14 | 10 | 362 | 19 |
3. | Bogdan-Andrei Iancu (@bogdan-iancu) | 11 | 8 | 176 | 10 |
4. | Liviu Chircu (@liviuchircu) | 5 | 3 | 12 | 27 |
5. | Vlad Patrascu (@rvlad-patrascu) | 3 | 1 | 2 | 2 |
6. | Maksym Sobolyev (@sobomax) | 2 | 1 | 1 | 0 |
(1) DevScore = author_commits + author_lines_added / (project_lines_added / project_commits) + author_lines_deleted / (project_lines_deleted / project_commits)
(2) including any documentation-related commits, excluding merge commits. Regarding imported patches/code, we do our best to count the work on behalf of the proper owner, as per the "fix_authors" and "mod_renames" arrays in opensips/doc/build-contrib.sh. If you identify any patches/commits which do not get properly attributed to you, please submit a pull request which extends "fix_authors" and/or "mod_renames".
(3) ignoring whitespace edits, renamed files and auto-generated files
Table 3.2. Most recently active contributors(1) to this module
Name | Commit Activity | |
---|---|---|
1. | Vlad Patrascu (@rvlad-patrascu) | Aug 2018 - Aug 2018 |
2. | Bogdan-Andrei Iancu (@bogdan-iancu) | Jan 2016 - Jun 2018 |
3. | Liviu Chircu (@liviuchircu) | Mar 2016 - Jun 2018 |
4. | Razvan Crainea (@razvancrainea) | Jan 2016 - Sep 2017 |
5. | Ionut Ionita (@ionutrazvanionita) | Mar 2017 - Apr 2017 |
6. | Maksym Sobolyev (@sobomax) | Feb 2017 - Feb 2017 |
(1) including any documentation-related commits, excluding merge commits
Last edited by: Bogdan-Andrei Iancu (@bogdan-iancu), Liviu Chircu (@liviuchircu), Ionut Ionita (@ionutrazvanionita), Razvan Crainea (@razvancrainea).
doc copyrights:
Copyright © 2015 www.opensips-solutions.com