# &adminguide;

## Overview

This is a module to help with &nat; traversal and reuse of TCP connections. In particular, it helps symmetric &ua;s that don't advertise they are symmetric and are not able to determine their public address.

The function `fix_nated_contact()` rewrites the Contact header field with request's source address:port pair. The function `fix_nated_sdp()` adds the active direction indication to &sdp; (flag 0x01) and updates the source &ip; address too (flag 0x02). The function `fix_nated_register()` exports the request's source address:port into an AVP to be used during `save()` and should be used for REGISTER requests.

Note: `fix_nated_contact()` changes the Contact header, thus it breaks the RFC. Although this is not always an issue, it may cause problems with strict SIP clients. An alternative is to use `add_contact_alias()` (or `set_contact_alias()`) that together with the `handle_ruri_alias()` is standards conforming and also supports reuse of TCP/TLS connections.

## NAT pinging types

Currently, the nathelper module supports two types of NAT pings:

- UDP packet - 4 bytes (zero filled) UDP packets are sent to the contact address.

  - Advantages: low bandwidth traffic, easy to generate by &kamailio;;

  - Disadvantages: unidirectional traffic through NAT (inbound - from outside to inside); As many NATs do update the bind timeout only on outbound traffic, the bind may expire and get closed.

- SIP request - a stateless SIP request is sent to the UDP contact address.

  - Advantages: bidirectional traffic through NAT, since each PING request from &kamailio; (inbound traffic) will force the SIP client to generate a SIP reply (outbound traffic) - the NAT bind will be surely kept open.

  - Disadvantages: higher bandwidth traffic, more expensive (as time) to generate by &kamailio;;

## Dependencies

### &kamailio; Modules

The following modules must be loaded before this module:

- usrloc module - only if the NATed contacts are to be pinged.

### External Libraries or Applications

The following libraries or applications must be installed before running &kamailio; with this module loaded:

- None.

## Parameters

### `force_socket` (string)

Socket to be used when sending NAT pings for UDP communication. If no one specified, the OS will choose a socket.

Default value is NULL.

#### Set `force_socket` parameter

    ...
    modparam("nathelper", "force_socket", "127.0.0.1:5060")
    ...

### `natping_interval` (integer)

Period of time in seconds between sending the NAT pings to all currently registered &ua;s to keep their &nat; bindings alive. Value of 0 disables this functionality.

Enabling the NAT pinging functionality will force the module to bind itself to USRLOC module.

Default value is 0.

#### Set `natping_interval` parameter

    ...
    modparam("nathelper", "natping_interval", 10)
    ...

### `ping_nated_only` (integer)

If this parameter is set to 1 then only contacts that have the behind NAT nat_bflag flag set in user location records get the NAT ping (the nat_bflag is specified via modparam of usrloc module). By default the ping is done with 4-bytes UDP packet. If sipping_bflag is also set, then the ping is done with a stateless SIP request (by default: OPTIONS request).

If it is 0, then all contacts get a NAT ping, by default being the 4-bytes UDP packet. If it is 0 and sipping_bflag parameter is set, then SIP-request-based pinging is sent to all contacts.

Default value is 0.

#### Set `ping_nated_only` parameter

    ...
    modparam("nathelper", "ping_nated_only", 1)
    ...

### `natping_processes` (integer)

How many timer processes should be created by the module for the exclusive task of sending the NAT pings.

Default value is 1.

#### Set `natping_processes` parameter

    ...
    modparam("nathelper", "natping_processes", 3)
    ...

### `natping_socket` (string)

Spoof the natping's source-ip to this address. Works only for IPv4.

Default value is NULL.

#### Set `natping_socket` parameter

    ...
    modparam("nathelper", "natping_socket", "192.168.1.1:5006")
    ...

### `received_avp` (str)

The name of the Attribute-Value-Pair (AVP) used to store the URI containing the received IP, port, and protocol. The URI is created by fix_nated_register function of nathelper module and the attribute is then used by the registrar to store the received parameters. Do not forget to change the value of corresponding parameter in registrar module if you change the value of this parameter.

You must set this parameter if you use `fix_nated_register`. In such case you must set the parameter with same name in the registrar module to same value.

Default value is "NULL" (disabled).

#### Set `received_avp` parameter

    ...
    modparam("nathelper", "received_avp", "$avp(i:42)")
    ...

### `sipping_bflag` (integer)

Which branch flag should be used by the module to identify NATed contacts for which it should perform NAT ping via a SIP request instead of dummy UDP packet.

Default value is -1 (disabled).

#### Set `sipping_bflag` parameter

    ...
    modparam("nathelper", "sipping_bflag", 7)
    ...

### `sipping_from` (string)

The parameter sets the SIP URI to be used in generating the SIP requests for NAT ping purposes. To enable the SIP request pinging feature, you have to set this parameter. The SIP request pinging will be used only for requests marked so.

Default value is NULL.

#### Set `sipping_from` parameter

    ...
    modparam("nathelper", "sipping_from", "sip:pinger@siphub.net")
    ...

### `sipping_method` (string)

The parameter sets the SIP method to be used in generating the SIP requests for NAT ping purposes.

Default value is OPTIONS.

#### Set `sipping_method` parameter

    ...
    modparam("nathelper", "sipping_method", "INFO")
    ...

### `natping_disable_bflag` (integer)

What branch flag should be used by the module to disable NAT pings on a per-registration basis. If the given flag is set for a particular registration, then no NAT pings will be sent at all, regardless of any other conditions.

Default value is -1 (disabled).

#### Set `natping_disable_bflag` parameter

    ...
    modparam("nathelper", "natping_disable_bflag", 8)
    ...

### `nortpproxy_str` (string)

The parameter sets the SDP attribute used by nathelper to mark the packet SDP that information have already been mangled.

If empty string, no marker will be added or checked.

The string must be a complete SDP line, including the EOH (\r\n).

Default value is a=nortpproxy:yes\r\n.

#### Set `nortpproxy_str` parameter

    ...
    modparam("nathelper", "nortpproxy_str", "a=sdpmangled:yes\r\n")
    ...

### `keepalive_timeout` (int)

The parameter sets the interval in seconds after which a natted contact is removed from location table if it does not reply to SIP keepalives (usually OPTIONS ping requests).

The features is available only for UDP contacts that are stored in memory (not working for db only mode for usrloc module).

Keepalives are sent stateless, not using TM module. The value of this parameter has to be few times higher than natping_interval.

Default value is 0 (feature disabled).

#### Set `keepalive_timeout` parameter

    ...
    modparam("nathelper", "keepalive_timeout", 120)
    ...

### `udpping_from_path` (int)

Enable sending UDP pings (keepalives) using raw socket from Path address.

Default value is 0 (feature disabled).

#### Set `udpping_from_path` parameter

    ...
    modparam("nathelper", "udpping_from_path", 1)
    ...

### `ignore_path` (int)

Enable ignore of Path header address when sending UDP pings (keepalives).

Default value is 0 (feature disabled). UDP pings are sent to Path header if header is present.

#### Set `ignore_path` parameter

    ...
    modparam("nathelper", "ignore_path", 1)
    ...

### `append_sdp_oldmediaip` (int)

The parameter controls if oldmediaip field should be appended to the SDP.

Default value is 1 (feature enabled).

#### Set `append_sdp_oldmediaip` parameter

    ...
    modparam("nathelper", "append_sdp_oldmediaip", 1)
    ...

### `filter_server_id` (int)

Filter contacts by server_id core parameter. Use this parameter to limit pinging. When set to 1, only proxy instances which send packets are those where core server_id matches server_id saved in usrloc. Default value is 0 (disabled).

#### Set `filter_server_id` parameter

    ...
    modparam("nathelper", "filter_server_id", 1)
    ...

### `nat_addr_mode` (int)

If set to 0, only default private net addresses are checked by nat_uac_test(). If set to 1, other reserved net addresses are checked by nat_uac_test() as well.

Default private net addresses are:

- 10.0.0.0/8

- 172.16.0.0/12

- 192.168.0.0/16

- 100.64.0.0/10 - RFC6598 - Carrier Grade NAT

- 192.0.0.0/29 - RFC7335 - IPv4 Service Continuity Prefix

Reserved net addresses are:

- 192.0.0.0/24 - RFC7335 - IETF Protocol Assignments

Default value is 1.

#### Set `nat_addr_mode` parameter

    ...
    modparam("nathelper", "nat_addr_mode", 0)
    ...

### `alias_name` (string)

The parameter sets the name of the Contact URI parameter set by set_contact_alias() or add_contact_alias() and processed by handle_ruri_alias() in R-URI.

Default value is alias.

#### Set `alias_name` parameter

    ...
    modparam("nathelper", "alias_name", "saddr")
    ...

## Functions

### `fix_nated_contact()`

Rewrites the Contact header to contain the request's source address:port.

This function can be used from REQUEST_ROUTE, ONREPLY_ROUTE, BRANCH_ROUTE.

#### `fix_nated_contact` usage

    ...
    if (search("User-Agent: Cisco ATA.*") {fix_nated_contact();};
    ...

### `fix_nated_sdp(flags [, ip_address])`

Alters the SDP information in order to facilitate NAT traversal. What changes to be performed may be controlled via the flags parameter. Return value is -1 if error occurred, 1 if ip's were replaced, 2 if no ip's were replaced.

Meaning of the parameters is as follows:

- flags - the value may be a bitwise OR of the following flags:

  - 0x01 - adds a=direction:active SDP line;

  - 0x02 - rewrite media &ip; address (c=) with source address of the message or the provided IP address. (a=rtcp) param will be rewritten if exists. (the provided IP address take precedence over the source address).

  - 0x04 - adds a=nortpproxy:yes SDP line;

  - 0x08 - rewrite IP from origin description (o=) with source address of the message or the provided IP address. (a=rtcp) param will be rewritten if exists. (the provided IP address take precedence over the source address).

- ip_address - IP to be used for rewriting SDP. If not specified, the received signalling IP will be used. The parameter allows pseudo-variables usage. NOTE: For the IP to be used, you need to use 0x02 or 0x08 flags, otherwise it will have no effect. Must be IPv4 address family.

This function can be used from REQUEST_ROUTE, ONREPLY_ROUTE, FAILURE_ROUTE, BRANCH_ROUTE.

#### `fix_nated_sdp` usage

    ...
    if (search("User-Agent: Cisco ATA.*") {fix_nated_sdp("3");};
    ...

### `add_rcv_param([flag])`,

Add a received parameter to the Contact header fields (available for all transports) or to the Contact URI (available only for UDP traffic).

The parameter will contain the URI created from the source IP, port, and protocol (if different than UDP) of the packet containing the SIP message. The parameter can be then processed by another registrar. This is useful, for example, when replicating register messages using `t_replicate` function to another registrar.

Meaning of the parameters is as follows:

- flag - flags to indicate if the parameter should be added to Contact URI or Contact header. If the flag is non-zero, the parameter will be added to the Contact URI. If not used or equal to zero, the parameter will go to the Contact header.

This function can be used from REQUEST_ROUTE.

#### `add_rcv_param` usage

    ...
    add_rcv_param(); # add the parameter to the Contact header
    ....
    add_rcv_param("1"); # add the parameter to the Contact URI
    ...

### `fix_nated_register()`

The function creates a URI consisting of the source IP, port, and protocol and stores the URI in an Attribute-Value-Pair. The URI will be appended as "received" parameter to Contact in 200 OK and registrar will store it in the received column in the location table.

Note: You have to set the received_avp parameter of the nathelper module and the registrar module (both module parameters must have the same value) to use this function.

This function can be used from REQUEST_ROUTE.

#### `fix_nated_register` usage

    ...
    fix_nated_register();
    ...

### `nat_uac_test(flags)`

Tries to guess if client's request originated behind a nat. The parameter determines what heuristics is used.

Meaning of the flags is as follows:

- 1 - The Contact header field is searched for occurrence of RFC1918 or RFC6598 addresses.

- 2 - the "received" test is used: address in the Via header is compared against source IP address of signaling. If the Via header contains no port, it uses the default SIP port 5060

- 4 - The Top Most Via is searched for occurrence of RFC1918 or RFC6598 addresses

- 8 - The SDP is searched for occurrence of RFC1918 or RFC6598 addresses

- 16 - Test if the source port is different from the port in the Via header. If the Via header contains no port, it uses the default SIP port 5060

- 32 - Test if the source IP address of signaling is a RFC1918 or RFC6598 address

- 64 - Test if the source connection of signaling is a WebSocket

- 128 - Test if the Contact header URI port differs from the source port of the request (Warning: this is might be legal or even intended combination in non NATted scenarios)

- 256 - Test if the SDP connection address is different from source IP address. It will work also with multiple connection address lines.

- 512 - Test if the target addresses are different or over websocket. For requests, it compares host and port in R-URI ($rU) and D-URI ($du). For replies, it compares host and port in 2nd Via with received and rport parameters.

All flags can be bitwise combined, the test returns true if any of the tests identified a NAT.

This function can be used from REQUEST_ROUTE, ONREPLY_ROUTE, FAILURE_ROUTE, BRANCH_ROUTE.

#### `nat_uac_test` usage

    ...
    if(nat_uac_test("19")) {
        rtpproxy_manage("co");
    }
    ...

### `is_rfc1918(ip_address)`

Determines if the address in the parameter is an rfc1918 or rfc6598 address. The parameter allows pseudo-variables usage.

This function can be used from ANY_ROUTE.

#### `is_rfc1918` usage

    ...
    if(is_rfc1918("$rd")) {
        # domain in r-uri is private address
    }
    ...

### `add_contact_alias([ip_addr, port, proto])`

Adds an ;alias=ip~port~transport parameter to the contact URI containing either received ip, port, and transport protocol or those given as parameters. If called without parameters, ;alias parameter is only added if received ip, port, or transport protocol differs from that in contact URI.

This function can be used from REQUEST_ROUTE, ONREPLY_ROUTE, BRANCH_ROUTE, and LOCAL_ROUTE.

#### `add_contact_alias` usage

    ...
        if (!is_present_hf("Record-Route")) {
            if (!add_contact_alias("$var(src_ip)", "$Rp", "tcp")) {
                xlog("L_ERR", "Error in aliasing contact $ct\n");
                send_reply("400", "Bad request");
                exit;
            };
        };
    ...

### `handle_ruri_alias([mode])`

Checks if the Request URI has an alias parameter and if so, removes it and sets the $du based on its value. Note that this means that routing of request is based on ;alias parameter value of the Request URI rather than the Request URI itself. If you call `handle_ruri_alias()` on a request, make sure that you screen the alias parameter value of Request URI the same way as you would screen the Request URI itself.

The optional parameter mode can be 0 to consume first alias parameter, otherwise it consumes the last alias parameter. If the parameter mode is not provided, it consumes the first parameter.

Returns 1 if ;alias parameter was found and $du was set and the $ru rewritten, 2 if the alias parameter was not found and nothing was done, or -1 in case of error.

This function can be used from REQUEST_ROUTE, BRANCH_ROUTE, and LOCAL_ROUTE.

#### `handle_ruri_alias` usage

    ...
        if ($du == "") {
            handle_ruri_alias();
            switch ($rc) {
            case -1:
                xlog("L_ERR", "Failed to handle alias of R-URI $ru\n");
                send_reply("400", "Bad request");
                exit;
            case 1:
                xlog("L_INFO", "Routing in-dialog $rm from $fu to $du\n");
                break;
            case 2:
                xlog("L_INFO", "Routing in-dialog $rm from $fu to $ru\n");
                break;
             };
        };
    ...

### `set_contact_alias([trim])`

Adds an ;alias=ip~port~transport parameter to the contact URI containing the received ip, port, and transport protocol. The update of contact URI is signaled to a few other modules in the way the `fix_nated_contact()` does it by using the internal flags. The new value is not visible to pseudo-variables and it does not change the SIP message buffer.

Meaning of parameters:

- trim - by default, set_contact_alias() will not detect and trim an already existing alias parameter. If this optional parameter is set to "1", set_contact_alias() will trim the existing alias before adding a new one.

This function can be used from REQUEST_ROUTE, ONREPLY_ROUTE, BRANCH_ROUTE, and FAILURE_ROUTE.

#### `set_contact_alias` usage

    ...
        if (!is_present_hf("Record-Route")) {
            if (!set_contact_alias()) {
                xlog("L_ERR", "Error in aliasing contact $ct\n");
                send_reply("400", "Bad request");
                exit;
            };
        };
    ...

### `set_alias_to_pv(target_avp)`

Reads ;alias=ip~port~transport from Contact header then writes to target pseudo-variable as a sip uri.

This function can be used from REQUEST_ROUTE, ONREPLY_ROUTE, BRANCH_ROUTE, and FAILURE_ROUTE.

#### `set_alias_to_pv` usage

    ...
    		set_alias_to_pv("$avp(aliasuri)");
    ...

## Exported Pseudo Variables

### `$rr_count`

Number of Record Routes in received SIP request or reply.

#### $rr_count usage

    ...
        $avp(rr_count) = $rr_count;
    ...

### `$rr_top_count`

If topmost Record Route in received SIP request or reply is a double Record Route, value of $rr_top_count is 2. If it a single Record Route, value of $rr_top_count is 1. If there is no Record Route(s), value of $rr_top_count is 0.

#### $rr_top_count usage

    ...
        if ($rr_count == $avp(rr_count) + $rr_top_count) {
            route(ADD_CONTACT_ALIAS);
        };
    ...

## RPC Commands

### `nathelper.enable_ping`

Enables natping if parameter value different than 0. Disables natping if parameter value is 0.

The function takes only one parameter - a number in decimal format.

#### `nathelper.enable_ping` usage

    ...
    $ &kamctl; rpc nathelper.enable_ping 1
    ...

## Selects

### @nathelper.rewrite_contact[n]

Get n-th Contact value with IP:Port rewritten to source ip:port. N is counted from 1. Only IP:port is rewritten, remaining parts are left unchanged. Full nameaddr is supported.

#### @nathelper.rewrite_contact usage

    ...
    $c = @nathelper.rewrite_contact[1];
    ...
    $c2 = @nathelper.rewrite_contact[1].nameaddr.uri;