837 lines
24 KiB
Markdown
837 lines
24 KiB
Markdown
# OpenSIPS installation notes
|
||
|
||
中文说明：OpenSIPS 安装与修复备忘。
|
||
|
||
This file records the installation performed on workstation `100.93.185.30`
|
||
and the missing pieces found afterwards. Use `install-opensips-stack.sh` for a
|
||
repeatable production install.
|
||
|
||
中文说明：这个文件记录了 `100.93.185.30` 工作站上的安装过程、后来补齐的缺失模块，以及生产环境一键安装时应复用的脚本。
|
||
|
||
## Target stack
|
||
|
||
中文说明：目标软件栈。
|
||
|
||
- OS: Ubuntu 24.04 Noble
|
||
- OpenSIPS: 3.6.x from `https://apt.opensips.org`
|
||
- OpenSIPS Control Panel: 9.3.6
|
||
- RTPengine: Ubuntu `rtpengine-daemon`
|
||
- Database: MariaDB
|
||
- Web server: Apache + PHP
|
||
|
||
## Production one-shot install
|
||
|
||
中文说明：生产环境一键安装方式。
|
||
|
||
Copy `install-opensips-stack.sh` to a fresh Ubuntu 24.04 server and run:
|
||
|
||
中文说明：把 `install-opensips-stack.sh` 拷贝到一台全新的 Ubuntu 24.04 服务器上，然后执行下面命令。
|
||
|
||
```bash
|
||
sudo -E SIP_IP=YOUR_SERVER_IP DB_PASS='CHANGE_ME' bash install-opensips-stack.sh
|
||
```
|
||
|
||
Useful variables:
|
||
|
||
中文说明：下面这些环境变量可以按生产环境修改，例如服务器 IP、数据库密码、MI 端口、RTPengine 端口范围、Monit 账号等。
|
||
|
||
```bash
|
||
SIP_IP=100.93.185.30
|
||
SIP_DOMAIN=100.93.185.30
|
||
DB_NAME=opensips
|
||
DB_USER=opensips
|
||
DB_PASS=opensipsrw
|
||
CP_VERSION=9.3.6
|
||
MI_HTTP_IP=127.0.0.1
|
||
MI_HTTP_PORT=8888
|
||
RTPENGINE_NG=127.0.0.1:2223
|
||
RTPENGINE_PORT_MIN=30000
|
||
RTPENGINE_PORT_MAX=40000
|
||
MONIT_IP=127.0.0.1
|
||
MONIT_PORT=2812
|
||
MONIT_USER=admin
|
||
MONIT_PASS=monit
|
||
```
|
||
|
||
After installation:
|
||
|
||
中文说明：安装完成后，OpenSIPS-CP 管理页面和默认账号如下。
|
||
|
||
```text
|
||
OpenSIPS-CP: http://YOUR_SERVER_IP/cp/
|
||
Default user: admin
|
||
Default pass: opensips
|
||
```
|
||
|
||
Change the OpenSIPS-CP admin password before production use.
|
||
|
||
中文说明：生产环境必须修改 OpenSIPS-CP 默认管理员密码，避免后台被默认口令登录。
|
||
|
||
## Startup and boot enablement
|
||
|
||
中文说明：服务启动和开机自启。
|
||
|
||
OpenSIPS itself is a systemd service:
|
||
|
||
中文说明：OpenSIPS 本体是 systemd 服务，下面命令用于设置开机自启、重启、查看是否运行和是否启用。
|
||
|
||
```bash
|
||
sudo systemctl enable opensips
|
||
sudo systemctl restart opensips
|
||
systemctl is-active opensips
|
||
systemctl is-enabled opensips
|
||
```
|
||
|
||
Expected result:
|
||
|
||
中文说明：期望看到 `active` 和 `enabled`，表示服务正在运行并已设置开机启动。
|
||
|
||
```text
|
||
active
|
||
enabled
|
||
```
|
||
|
||
OpenSIPS-CP is the web control panel at:
|
||
|
||
中文说明：OpenSIPS-CP 是 Web 管理后台，通过 `/cp/` 访问。
|
||
|
||
```text
|
||
http://YOUR_SERVER_IP/cp/
|
||
```
|
||
|
||
It is served by Apache and uses MariaDB, so there is no separate
|
||
`opensips-cp.service` to enable. Enable and start these services instead:
|
||
|
||
中文说明：OpenSIPS-CP 不是独立服务，它依赖 Apache 提供网页、MariaDB 存配置和数据，所以要启用的是 `apache2` 和 `mariadb`。
|
||
|
||
```bash
|
||
sudo systemctl enable apache2 mariadb
|
||
sudo systemctl restart mariadb
|
||
sudo systemctl restart apache2
|
||
systemctl is-active apache2 mariadb
|
||
systemctl is-enabled apache2 mariadb
|
||
```
|
||
|
||
Expected result:
|
||
|
||
```text
|
||
active
|
||
active
|
||
enabled
|
||
enabled
|
||
```
|
||
|
||
Useful verification commands:
|
||
|
||
中文说明：下面命令用于确认 SIP 端口、Web 端口、CP 页面和 MI HTTP 接口都正常。
|
||
|
||
```bash
|
||
ss -lunp | grep ':5060'
|
||
ss -ltnp | grep ':80'
|
||
curl -fsSI http://127.0.0.1/cp/
|
||
curl -fsS -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"ps"}'
|
||
```
|
||
|
||
On the current workstation, the public access URL is:
|
||
|
||
中文说明：当前这台工作站的访问地址如下。
|
||
|
||
```text
|
||
http://100.93.185.30/cp/
|
||
```
|
||
|
||
## Packages that must not be missed
|
||
|
||
中文说明：容易漏装但必须安装的软件包。
|
||
|
||
Base OpenSIPS packages:
|
||
|
||
中文说明：OpenSIPS 主程序、CLI、MySQL、认证和 TLS 相关基础包。
|
||
|
||
```bash
|
||
opensips
|
||
opensips-cli
|
||
opensips-mysql-module
|
||
opensips-auth-modules
|
||
opensips-tls-module
|
||
```
|
||
|
||
Database schema package:
|
||
|
||
中文说明：OpenSIPS 数据库建表脚本包。
|
||
|
||
```bash
|
||
opensips-mysql-dbschema
|
||
```
|
||
|
||
This one is easy to miss. Without it, `/usr/share/opensips/mysql/*.sql` is not
|
||
available and `opensipsdbctl` may not exist on OpenSIPS 3.6 installs.
|
||
|
||
中文说明：这个包很容易漏。没有它就找不到 `/usr/share/opensips/mysql/*.sql`，后续建表和导入模块表会很麻烦。
|
||
|
||
OpenSIPS-CP MI support:
|
||
|
||
中文说明：OpenSIPS-CP 通过 MI 接口控制 OpenSIPS，下面两个包提供 HTTP MI 和 JSON 支持。
|
||
|
||
```bash
|
||
opensips-http-modules
|
||
opensips-json-module
|
||
```
|
||
|
||
These provide `httpd.so`, `mi_http.so` and JSON support. Without them,
|
||
OpenSIPS-CP actions such as `Reload on Server` will fail when configured for
|
||
`json:127.0.0.1:8888/mi`.
|
||
|
||
中文说明：没有这些模块时，CP 页面里的 `Reload on Server` 会连不上 `127.0.0.1:8888/mi` 或提示 MI 命令不可用。
|
||
|
||
SIP user authentication and database registration:
|
||
|
||
中文说明：SIP 用户认证和注册落库需要的模块。
|
||
|
||
```bash
|
||
opensips-auth-modules
|
||
opensips-mysql-module
|
||
```
|
||
|
||
Enable these modules in `opensips.cfg`:
|
||
|
||
中文说明：在 `opensips.cfg` 中启用认证模块和位置服务模块，让用户可以用数据库账号注册到 OpenSIPS。
|
||
|
||
```opensips
|
||
loadmodule "auth.so"
|
||
loadmodule "auth_db.so"
|
||
modparam("auth_db", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("auth_db", "calculate_ha1", 1)
|
||
|
||
loadmodule "usrloc.so"
|
||
modparam("usrloc", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("usrloc", "working_mode_preset", "single-instance-sql-write-through")
|
||
```
|
||
|
||
Then protect REGISTER requests:
|
||
|
||
中文说明：下面这段用于保护 REGISTER 请求；没有正确账号密码的终端不能注册。
|
||
|
||
```opensips
|
||
if (is_method("REGISTER")) {
|
||
if (!www_authorize("$fd", "subscriber")) {
|
||
www_challenge("$fd", "auth");
|
||
exit;
|
||
}
|
||
|
||
if (!save("location"))
|
||
xlog("failed to register AoR $tu\n");
|
||
|
||
exit;
|
||
}
|
||
```
|
||
|
||
`calculate_ha1=1` lets OpenSIPS calculate the digest hash from the plain
|
||
`subscriber.password` column created by OpenSIPS-CP.
|
||
|
||
中文说明：`calculate_ha1=1` 表示 OpenSIPS 可以根据 `subscriber.password` 明文密码计算 SIP Digest 认证需要的 hash。
|
||
|
||
Dialog tracking for the OpenSIPS-CP Dialog page:
|
||
|
||
中文说明：Dialog 页面用于查看在线通话/会话状态，需要启用 `dialog.so`。
|
||
|
||
```opensips
|
||
loadmodule "dialog.so"
|
||
modparam("dialog", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("dialog", "profiles_no_value", "inbound;outbound")
|
||
modparam("dialog", "profiles_with_value", "caller;callee")
|
||
```
|
||
|
||
Create dialog state for initial INVITEs:
|
||
|
||
中文说明：初始 INVITE 到来时创建 dialog 状态，并把主叫、被叫等信息放进 profile，便于 CP 页面查看。
|
||
|
||
```opensips
|
||
if (is_method("INVITE")) {
|
||
create_dialog();
|
||
set_dlg_profile("outbound");
|
||
set_dlg_profile("caller", "$fU");
|
||
set_dlg_profile("callee", "$rU");
|
||
do_accounting("log");
|
||
}
|
||
```
|
||
|
||
Without `dialog.so`, OpenSIPS-CP Dialog pages fail with:
|
||
|
||
中文说明：如果没加载 `dialog.so`，Dialog 页面会报下面这个 MI 方法不存在。
|
||
|
||
```text
|
||
MI command failed with code -32601 (Method not found)
|
||
```
|
||
|
||
Validation:
|
||
|
||
中文说明：验证 Dialog MI 命令是否可用。
|
||
|
||
```bash
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"dlg_list"}'
|
||
```
|
||
|
||
Dispatcher support for the OpenSIPS-CP Dispatcher page:
|
||
|
||
中文说明：Dispatcher 页面用于管理/查看后端服务器分发列表，需要启用 `dispatcher.so`。
|
||
|
||
```opensips
|
||
loadmodule "dispatcher.so"
|
||
modparam("dispatcher", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("dispatcher", "persistent_state", 1)
|
||
```
|
||
|
||
Without `dispatcher.so`, OpenSIPS-CP Dispatcher pages fail with:
|
||
|
||
中文说明：如果没加载 `dispatcher.so`，Dispatcher 页面会报下面这个 MI 方法不存在。
|
||
|
||
```text
|
||
MI command failed with code -32601 (Method not found)
|
||
```
|
||
|
||
Validation:
|
||
|
||
```bash
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"ds_list"}'
|
||
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":2,"method":"ds_reload"}'
|
||
```
|
||
|
||
Dynamic Routing support for the OpenSIPS-CP Dashboard and Dynamic Routing pages:
|
||
|
||
中文说明：Dynamic Routing 是动态路由/LCR 能力，用于管理落地网关、路由规则、网关状态，也支撑 Dashboard 的动态路由小组件。
|
||
|
||
```opensips
|
||
loadmodule "drouting.so"
|
||
modparam("drouting", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("drouting", "drd_table", "dr_gateways")
|
||
modparam("drouting", "drr_table", "dr_rules")
|
||
modparam("drouting", "drg_table", "dr_groups")
|
||
modparam("drouting", "drc_table", "dr_carriers")
|
||
```
|
||
|
||
The Dashboard `Dynamic Routing` widget calls MI commands such as
|
||
`dr_gw_status` and `dr_reload_status`. Without `drouting.so`, Dashboard may show:
|
||
|
||
中文说明：Dashboard 上的 `Dynamic Routing` 卡片会调用 `dr_gw_status` 等命令；如果没加载 `drouting.so`，Dashboard 会出现 Method not found。
|
||
|
||
```text
|
||
MI command failed with code -32601 (Method not found)
|
||
```
|
||
|
||
Validation:
|
||
|
||
```bash
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"dr_gw_status"}'
|
||
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":2,"method":"dr_reload_status"}'
|
||
```
|
||
|
||
On a fresh system with no dynamic-routing gateways configured, `dr_gw_status`
|
||
should return an empty `Gateways` list, not `Method not found`.
|
||
|
||
中文说明：新系统没有配置网关时，返回空网关列表是正常的；错误是 `Method not found`，说明模块没加载。
|
||
|
||
RTPengine:
|
||
|
||
中文说明：RTPengine 是媒体代理，负责 RTP 媒体流转发、NAT 穿透，也可配合录音。
|
||
|
||
```bash
|
||
rtpengine-daemon
|
||
```
|
||
|
||
OpenSIPS-CP has two separate media relay pages:
|
||
|
||
中文说明：OpenSIPS-CP 里 RTPProxy 和 RTPEngine 是两个不同页面，分别对应不同 OpenSIPS 模块。
|
||
|
||
- `RTPProxy` uses the OpenSIPS `rtpproxy.so` module and MI commands such as
|
||
`rtpproxy_show`, `rtpproxy_reload`, and `rtpproxy_enable`.
|
||
- `RTPEngine` uses the OpenSIPS `rtpengine.so` module and MI commands such as
|
||
`rtpengine_show`, `rtpengine_reload`, and `rtpengine_enable`.
|
||
|
||
If either module is not loaded, its page fails with:
|
||
|
||
中文说明：对应模块没加载时，页面会报 MI 命令不存在。
|
||
|
||
```text
|
||
MI command failed with code -32601 (Method not found)
|
||
```
|
||
|
||
For this workstation, RTPengine is the actual media proxy daemon. RTPProxy is
|
||
loaded only so the OpenSIPS-CP RTPProxy page can call its MI commands; without
|
||
RTPProxy sockets configured, the page should show an empty list instead of a
|
||
Method not found error.
|
||
|
||
中文说明：当前工作站实际使用的是 RTPengine。RTPProxy 模块只是为了让 CP 的 RTPProxy 页面不报错；没有配置 RTPProxy socket 时显示空列表是正常的。
|
||
|
||
OpenSIPS module config:
|
||
|
||
中文说明：下面配置同时启用 `rtpengine.so` 和 `rtpproxy.so`，分别对应两个 CP 页面。
|
||
|
||
```opensips
|
||
loadmodule "rtpengine.so"
|
||
modparam("rtpengine", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("rtpengine", "db_table", "rtpengine")
|
||
|
||
loadmodule "rtpproxy.so"
|
||
modparam("rtpproxy", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("rtpproxy", "db_table", "rtpproxy_sockets")
|
||
```
|
||
|
||
RTPengine DB row used on the current workstation:
|
||
|
||
中文说明：当前工作站的 RTPengine 控制 socket 是 `udp:127.0.0.1:2223`，需要写入 `rtpengine` 表。
|
||
|
||
```sql
|
||
INSERT INTO rtpengine (socket, set_id)
|
||
SELECT 'udp:127.0.0.1:2223', 0
|
||
WHERE NOT EXISTS (
|
||
SELECT 1 FROM rtpengine WHERE socket='udp:127.0.0.1:2223' AND set_id=0
|
||
);
|
||
```
|
||
|
||
Validation:
|
||
|
||
```bash
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"rtpengine_show"}'
|
||
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":2,"method":"rtpproxy_show"}'
|
||
```
|
||
|
||
## OpenSIPS-CP SIP Trace page
|
||
|
||
中文说明：OpenSIPS-CP 的 SIP Trace 页面。
|
||
|
||
The SIP Trace page displays SIP messages captured by OpenSIPS and stored in the
|
||
`sip_trace` table. It is useful for troubleshooting registration, INVITE call
|
||
setup, routing, authentication challenges, and failed SIP responses. It lets
|
||
you filter by:
|
||
|
||
中文说明：SIP Trace 用于查看 OpenSIPS 抓到的 SIP 报文，适合排查注册失败、呼叫不通、路由错误、认证失败和 SIP 响应异常。
|
||
|
||
- `RegExp`: text or regex to search in captured SIP messages.
|
||
- `Call ID`: one SIP dialog/transaction identifier.
|
||
- `Traced User`: the trace attribute saved by the script, here `$fU`.
|
||
- `Start Date` / `End Date`: time range.
|
||
- `Group results by Call ID`: groups multiple SIP messages from the same call.
|
||
|
||
If the page shows:
|
||
|
||
中文说明：如果 SIP Trace 页面出现下面的错误，说明 `trace` MI 命令不存在。
|
||
|
||
```text
|
||
MI command failed with code -32601 (Method not found)
|
||
```
|
||
|
||
then OpenSIPS-CP called the `trace` MI command, but OpenSIPS did not load the
|
||
`tracer.so` module.
|
||
|
||
中文说明：原因是 CP 调用了 `trace` 命令，但 OpenSIPS 没加载 `tracer.so`。
|
||
|
||
OpenSIPS module config:
|
||
|
||
中文说明：下面配置开启 tracer 模块，并把 trace 数据写入 MySQL 的 `sip_trace` 表。
|
||
|
||
```opensips
|
||
loadmodule "tracer.so"
|
||
modparam("tracer", "trace_on", 1)
|
||
modparam("tracer", "trace_id", "[tid]uri=mysql://opensips:opensipsrw@localhost/opensips;table=sip_trace;")
|
||
```
|
||
|
||
Main route hook used on the current workstation:
|
||
|
||
中文说明：仅启用模块还不会自动写入数据，路由脚本里需要调用 `trace()`。
|
||
|
||
```opensips
|
||
route{
|
||
trace("tid", "m", "sip", "$fU");
|
||
```
|
||
|
||
The `trace` MI command only toggles tracing on/off. The `trace()` call in the
|
||
routing script is what actually writes messages to the `sip_trace` database
|
||
table.
|
||
|
||
中文说明：MI 的 `trace` 命令只是开关；真正把 SIP 消息写进数据库的是路由脚本中的 `trace()` 函数。
|
||
|
||
Validation:
|
||
|
||
```bash
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"trace"}'
|
||
|
||
mysql -D opensips -e "SELECT COUNT(*) FROM sip_trace;"
|
||
```
|
||
|
||
SIP Trace can grow quickly on a busy server. In production, keep it disabled by
|
||
default or clean old rows regularly.
|
||
|
||
中文说明：生产环境要谨慎开启 SIP Trace，因为话务量大时 `sip_trace` 表会增长很快，应定期清理或只在排障时开启。
|
||
|
||
Web/database dependencies:
|
||
|
||
中文说明：Web 前端和数据库依赖包。
|
||
|
||
```bash
|
||
mariadb-server mariadb-client
|
||
apache2 libapache2-mod-php
|
||
php php-cli php-mysql php-gd php-pear php-apcu php-curl php-xml php-mbstring
|
||
git unzip curl
|
||
```
|
||
|
||
Monit support for the OpenSIPS-CP Monit page:
|
||
|
||
中文说明：Monit 页面用于查看服务器服务和系统状态，需要安装 `monit`。
|
||
|
||
```bash
|
||
monit
|
||
```
|
||
|
||
OpenSIPS-CP's Monit page is a proxy to Monit's own HTTP interface. If `monit`
|
||
is not installed or the OpenSIPS-CP box has no `monit_conn`, the page may show:
|
||
|
||
中文说明：CP 的 Monit 页面实际是代理访问 Monit 自带 HTTP 页面；如果 Monit 没装或 CP 的 box 没配置 `monit_conn`，就会报空地址。
|
||
|
||
```text
|
||
Failed to parse address ""
|
||
Error: 1
|
||
I can't connect!
|
||
```
|
||
|
||
Configure Monit to listen locally:
|
||
|
||
中文说明：Monit 只监听本机 `127.0.0.1:2812`，避免暴露到外网。
|
||
|
||
```monit
|
||
set httpd port 2812 and
|
||
use address 127.0.0.1
|
||
allow 127.0.0.1
|
||
allow admin:monit
|
||
```
|
||
|
||
Enable it:
|
||
|
||
```bash
|
||
sudo monit -t
|
||
sudo systemctl enable monit
|
||
sudo systemctl restart monit
|
||
```
|
||
|
||
Configure the OpenSIPS-CP default box:
|
||
|
||
中文说明：把 OpenSIPS-CP 默认 box 的 Monit 连接地址、账号和密码写入数据库。
|
||
|
||
```sql
|
||
UPDATE ocp_boxes_config
|
||
SET monit_conn='127.0.0.1:2812',
|
||
monit_user='admin',
|
||
monit_pass='monit',
|
||
monit_ssl=0
|
||
WHERE id=1;
|
||
```
|
||
|
||
Validation:
|
||
|
||
```bash
|
||
systemctl is-active monit
|
||
systemctl is-enabled monit
|
||
ss -ltnp | grep ':2812'
|
||
curl -fsS -u admin:monit http://127.0.0.1:2812/ | grep -m1 Monit
|
||
```
|
||
|
||
On the current workstation, Monit is installed, enabled, and bound to
|
||
`127.0.0.1:2812`. The OpenSIPS-CP default box uses `admin` / `monit`.
|
||
|
||
中文说明：当前工作站已经安装并启用 Monit，CP 使用 `admin / monit` 连接本机 Monit。生产环境请修改密码。
|
||
|
||
## OpenSIPS config added during the fix
|
||
|
||
中文说明：安装后补加到 OpenSIPS 配置里的关键修复项。
|
||
|
||
The initial installation only had `mi_fifo`. OpenSIPS-CP was configured to call:
|
||
|
||
中文说明：最初只有 `mi_fifo`，但 CP 配置的是 JSON HTTP MI，所以页面 reload 会失败。
|
||
|
||
```text
|
||
json:127.0.0.1:8888/mi
|
||
```
|
||
|
||
So `Reload on Server` failed with:
|
||
|
||
中文说明：因此 CP 页面点击 `Reload on Server` 时会连接不上 8888 端口。
|
||
|
||
```text
|
||
Failed to connect to 127.0.0.1 port 8888
|
||
```
|
||
|
||
The fix was to load HTTP MI:
|
||
|
||
中文说明：修复方法是加载 `httpd.so` 和 `mi_http.so`，让 OpenSIPS 提供本地 HTTP MI 接口。
|
||
|
||
```opensips
|
||
loadmodule "httpd.so"
|
||
modparam("httpd", "ip", "127.0.0.1")
|
||
modparam("httpd", "port", 8888)
|
||
|
||
loadmodule "mi_http.so"
|
||
modparam("mi_http", "root", "mi")
|
||
```
|
||
|
||
After that, the MI endpoint worked, but `address_reload` returned:
|
||
|
||
中文说明：HTTP MI 通了以后，`address_reload` 又报方法不存在，这是因为还没加载权限模块。
|
||
|
||
```text
|
||
Method not found
|
||
```
|
||
|
||
That command is provided by `permissions.so`, so the next fix was:
|
||
|
||
中文说明：`address_reload` 由 `permissions.so` 提供，所以需要加载 permissions 模块并配置数据库。
|
||
|
||
```opensips
|
||
loadmodule "db_mysql.so"
|
||
|
||
loadmodule "permissions.so"
|
||
modparam("permissions", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("permissions", "address_table", "address")
|
||
```
|
||
|
||
Validation command:
|
||
|
||
```bash
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"address_reload"}'
|
||
```
|
||
|
||
Expected result:
|
||
|
||
中文说明：期望返回 OK。
|
||
|
||
```json
|
||
{"jsonrpc":"2.0","result":"OK","id":1}
|
||
```
|
||
|
||
## OpenSIPS-CP Addresses page
|
||
|
||
中文说明：OpenSIPS-CP 的 Addresses 页面。
|
||
|
||
The Addresses page writes to the `address` table used by the `permissions`
|
||
module.
|
||
|
||
中文说明：Addresses 页面配置的是 IP 访问规则/白名单类规则，写入 `permissions` 模块使用的 `address` 表。
|
||
|
||
It is not where the local OpenSIPS listening IP is configured. The listening IP
|
||
belongs in:
|
||
|
||
中文说明：这里不是配置 OpenSIPS 本机监听 IP 的地方；本机监听 IP 要写在 `opensips.cfg` 的 `socket`。
|
||
|
||
```text
|
||
/etc/opensips/opensips.cfg
|
||
```
|
||
|
||
Example:
|
||
|
||
```opensips
|
||
socket=udp:100.93.185.30:5060
|
||
```
|
||
|
||
Typical Address entry:
|
||
|
||
中文说明：典型地址规则示例如下。
|
||
|
||
```text
|
||
Group: 1
|
||
IP: 47.97.162.65
|
||
Mask: 32
|
||
Port: 5060
|
||
Protocol: any
|
||
Pattern:
|
||
Context Info: lisglo
|
||
```
|
||
|
||
Notes:
|
||
|
||
中文说明：字段注意事项。
|
||
|
||
- `Group` must be numeric.
|
||
- `Pattern` is an optional wildcard pattern used by `permissions` matching.
|
||
- `Context Info` is returned to the OpenSIPS script when the rule matches.
|
||
- Click `Reload on Server` after editing Addresses.
|
||
|
||
## OpenSIPS-CP Domains validation issue
|
||
|
||
中文说明：OpenSIPS-CP Domains 页面表单校验问题。
|
||
|
||
On OpenSIPS-CP 9.3.6, the Domains page may reject both IP addresses and normal
|
||
FQDNs in the `SIP Domain` field. The symptom is a red validation icon next to
|
||
the field and the `Add New Domain` button stays disabled.
|
||
|
||
中文说明：在 OpenSIPS-CP 9.3.6 中，Domains 页面可能错误拒绝 IP 和普通域名，表现为输入框旁边红色校验图标，添加按钮不可点。
|
||
|
||
This is not a SIP limitation. SIP domains may be IPs or FQDNs, and the Domains
|
||
tool itself says:
|
||
|
||
中文说明：这不是 SIP 协议限制，SIP domain 可以是 IP，也可以是 FQDN 域名。
|
||
|
||
```text
|
||
A SIP Domain to be considered local by OpenSIPS - can be an IP or a FQDN
|
||
```
|
||
|
||
The issue is in the browser-side form validation generator:
|
||
|
||
中文说明：问题在 CP 前端表单校验生成器。
|
||
|
||
```text
|
||
/var/www/html/opensips-cp/web/common/forms.php
|
||
```
|
||
|
||
The code uses `preg_quote()` when embedding validation regexes into JavaScript.
|
||
That escapes the regex into a literal string, so JavaScript's `RegExp()` no
|
||
longer receives the intended regex.
|
||
|
||
中文说明：代码用 `preg_quote()` 把正则转给 JavaScript，导致正则被转义成普通字符串，浏览器端校验失效。
|
||
|
||
Patch:
|
||
|
||
中文说明：下面补丁把 `preg_quote()` 改成更适合 JS 字符串的 `addslashes()`。
|
||
|
||
```bash
|
||
sudo cp -a /var/www/html/opensips-cp/web/common/forms.php \
|
||
/var/www/html/opensips-cp/web/common/forms.php.bak.regexfix.$(date +%Y%m%d%H%M%S)
|
||
|
||
sudo python3 - <<'PY'
|
||
from pathlib import Path
|
||
p = Path('/var/www/html/opensips-cp/web/common/forms.php')
|
||
s = p.read_text()
|
||
s = s.replace("preg_quote($re, '/')", "addslashes($re)")
|
||
s = s.replace("preg_quote($value['validation_regex'], '/')", "addslashes($value['validation_regex'])")
|
||
p.write_text(s)
|
||
PY
|
||
|
||
php -l /var/www/html/opensips-cp/web/common/forms.php
|
||
```
|
||
|
||
On some OpenSIPS-CP 9.3.6 installs, the Domains page can still reject input
|
||
after the common form-generator patch because the Domains template ships its
|
||
own over-escaped field regex. If both IPs and normal FQDNs still show a red
|
||
validation icon, patch the Domains form itself:
|
||
|
||
中文说明：有些安装即使修了通用表单生成器，Domains 页面自己的字段正则仍然会过度转义，需要单独修 Domains 模板。
|
||
|
||
```bash
|
||
sudo cp -a /var/www/html/opensips-cp/web/tools/system/domains/template/domains.form.php \
|
||
/var/www/html/opensips-cp/web/tools/system/domains/template/domains.form.php.bak.domain-regex.$(date +%Y%m%d%H%M%S)
|
||
|
||
sudo python3 - <<'PY'
|
||
from pathlib import Path
|
||
p = Path('/var/www/html/opensips-cp/web/tools/system/domains/template/domains.form.php')
|
||
s = p.read_text()
|
||
lines = []
|
||
for line in s.splitlines():
|
||
if '"domain", "n", $domain_form' in line:
|
||
indent = line[:len(line) - len(line.lstrip())]
|
||
lines.append(indent + '"domain", "n", $domain_form[\'domain\'], 128, null);')
|
||
else:
|
||
lines.append(line)
|
||
p.write_text('\n'.join(lines) + '\n')
|
||
PY
|
||
|
||
php -l /var/www/html/opensips-cp/web/tools/system/domains/template/domains.form.php
|
||
sudo systemctl reload apache2 || sudo systemctl restart apache2
|
||
```
|
||
|
||
This only disables the browser-side regex for the `SIP Domain` field; the field
|
||
remains required, and the database/OpenSIPS domain module still determine what
|
||
is actually usable. After patching, hard refresh the browser with `Ctrl+F5`.
|
||
|
||
中文说明：这个修复只关闭 SIP Domain 字段的浏览器端正则，字段仍是必填；真正是否可用仍由数据库和 OpenSIPS domain 模块决定。修完后浏览器要 `Ctrl+F5` 强制刷新。
|
||
|
||
The one-shot installer already applies both equivalent patches automatically.
|
||
|
||
中文说明：一键安装脚本已经自动包含这两个补丁。
|
||
|
||
For the current workstation, `100.93.185.30` was also inserted directly into the
|
||
`domain` table to unblock user creation:
|
||
|
||
中文说明：当前工作站为了先让用户创建功能可用，已经把 `100.93.185.30` 直接写入 `domain` 表。
|
||
|
||
```sql
|
||
INSERT INTO domain (domain, attrs, accept_subdomain, last_modified)
|
||
SELECT '100.93.185.30', NULL, 0, NOW()
|
||
WHERE NOT EXISTS (SELECT 1 FROM domain WHERE domain='100.93.185.30');
|
||
```
|
||
|
||
The `domain` runtime module was enabled:
|
||
|
||
中文说明：同时启用了 OpenSIPS 的 `domain.so` 模块，并使用数据库模式。
|
||
|
||
```opensips
|
||
loadmodule "domain.so"
|
||
modparam("domain", "db_url", "mysql://opensips:opensipsrw@localhost/opensips")
|
||
modparam("domain", "db_mode", 1)
|
||
```
|
||
|
||
Validation:
|
||
|
||
```bash
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"domain_reload"}'
|
||
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":2,"method":"domain_dump"}'
|
||
```
|
||
|
||
Expected `domain_dump` output includes:
|
||
|
||
中文说明：期望 `domain_dump` 输出中包含当前服务器域名/IP。
|
||
|
||
```text
|
||
100.93.185.30
|
||
```
|
||
|
||
## Security notes
|
||
|
||
中文说明：安全注意事项。
|
||
|
||
- Keep MI HTTP bound to `127.0.0.1`.
|
||
- Do not expose `0.0.0.0:8888` to the network.
|
||
- Change the OpenSIPS-CP admin password.
|
||
- Use a stronger database password in production.
|
||
- Restrict SIP source IPs using `permissions` / `address` rules.
|
||
- Open RTP port range only where needed, for example `30000-40000/udp`.
|
||
|
||
## Runtime checks
|
||
|
||
中文说明：运行状态检查命令。
|
||
|
||
```bash
|
||
systemctl is-active mariadb apache2 opensips rtpengine-daemon
|
||
ss -ltnup | grep -E '(:80|:5060|:8888|:2223|:2812)'
|
||
curl -I http://127.0.0.1/cp/
|
||
curl -fsS -u admin:monit http://127.0.0.1:2812/ | grep -m1 Monit
|
||
curl -X POST http://127.0.0.1:8888/mi \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"jsonrpc":"2.0","id":1,"method":"ps"}'
|
||
```
|