302 Redirect for STIR/SHAKEN Service

JRayfield · Post by **JRayfield** » Tue Apr 12, 2022 6:54 am

1. Brekeke Product Name and Version:
SIP Server, 3.9.6.1

2. Java version:
1.8.0_231

3. OS type and the version:
Windows Server 2016 Standard

4. UA (phone), gateway or other hardware/software involved:
3CX PBX Servers

5. Your problem:
Currently I'm using BSS as a proxy server, where 3CX PBXs register with the BSS and it handles incoming and outgoing calls from/to an upstream VoIP service provider using IP authentication.

Here's an example of a Matching and Deploy Patterns in my DialPlan:

Inbound Calls -

Matching Pattern:

$request = ^INVITE
$registered("registration_name") = true
$addr = ^xxx.xxx.xxx.xxx$
To = sip:(1xxxxxxxxxx)@

Deploy Pattern:

$auth = false
$rtp = false
$b2bua = false
To = sip:%1@yyy.yyy.yyy.yyy

I need to retain these patterns, but I need to add 302 redirection.

So, for inbound calls, I'll receive an inbound call from the upstream service provider. Then I need to do a 302 redirect to send that call to a STIR/SHAKEN service, where it will be Verified. The STIR/SHAKEN service will then send the call back to me where I'll 'process it', using the above Deploy Pattern, sending it on to the 3CX server.

I need to do the same with the outbound calls, too.

Example of Outbound Call Patterns:

Outbound Calls -

Matching Pattern:

$request = ^INVITE
$registered("registration_name") = true
$addr = ^yyy.yyy.yyy.yyy$
To = sip:zzzzzz(.+)@

Deploy Pattern:

$auth = false
$rtp = false
$b2bua = false
&failover.timer.provisional = 120
To = sip:zzzzzz%1@xxx.xxx.xxx.xxx
$session = failover sip:zzzzzz1@bbb.bbb.bbb.bbb

So for outbound calls, the 3CX PBX will send the INVITE to the BSS. The BSS needs to do a 302 redirect to the STIR/SHAKEN service, where it will be Authenticated/Signed. Then the STIR/SHAKEN service will send the call back to the BSS where it will be 'processed' and sent to the upstream service provider using the Deploy Pattern.

This is currently beyond my capabilities of progrmaming in the BSS so I'd appreciate any help that I can get.

John

Laurie · Post by **Laurie** » Thu Apr 14, 2022 6:06 pm

Do you need to send "302 Moved Temporarily" to INVITE for letting the caller make a redirection?
or do you need to redirect a call with "302 Moved Temporarily" sent from a STIR/SHAKEN service?

JRayfield · Post by **JRayfield** » Sat Apr 16, 2022 8:18 am

I need to get some more details from the STIR/SHAKEN service provider, which I should have this next week.

Basically, what I need to do is to redirect an incoming INVITE from an upstream VoIP service provider to the STIR/SHAKEN service provider, and then when they finish their 'analysis' of the INVITE, they'll send it back to me, where I need to go ahead and process it as I process INVITEs now from my upstream VoIP service provider.

I could do this with a session border controller (SBC) on the front end of my BSS, but I'd rather do it in BSS.

John

Harold · Post by **Harold** » Mon Apr 25, 2022 2:03 pm

A STIR/SHAKEN service provider will return "302 Moved Temporarily" after their evaluation.
Use the Failover plugin to redirect an INVITE with "302".

Like this..
[Deploy Patterns]
To = %{$getSIPuser(To)}@<STIR/SHAKEN_Provider>
$session = failover

JRayfield · Post by **JRayfield** » Mon May 09, 2022 12:38 pm

Client outbound calls (mostly, but not all, from 3CX IP PBX server) are coming into my BSS. I need to 'route' those INVITEs from my BSS to my STIR/SHAKEN service provider, using a 302 redirect. Then my STIR/SHAKEN service provider, after doing the Attestation will return the INVITE to me, where I will then send it on to my upstream VoIP service provider (where I am sending it now).

So what kind of dial plan do I need to accomplish this?

John

Harold · Post by **Harold** » Wed May 18, 2022 11:04 am

Who sends a "302" redirect? If it is STIR/SHAKEN service provider, try the DialPlan rule I pasted in my previous post.

Which STIR/SHAKEN service provider are you using?

JRayfield · Post by **JRayfield** » Wed May 18, 2022 11:08 am

I did not understand who was sending what to whom. Now I think I understand. I'll be forwarding INVITEs to the STIR/SHAKEN service (Sansay). They'll send me back a 302 redirect.

I'll try your dial plan.

John

JRayfield · Post by **JRayfield** » Thu Jun 02, 2022 7:28 am

So here's what happens:

A 3CX IP PBX sends an INVITE to the BSS.

Until now, I would forward that INVITE on to my upstream service provider.

But, now, I forward this INVITE to the STIR/SHAKEN service.

The STIR/SHAKEN service sends me back a '302 Moved Temporarily' message.

Now, I need to forward that on to my upstream service provider, the same as how I was forwarding the INVITEs to the upstream service provider.

The problem I'm having is 'recognizing' the '302 Moved Temporarily' message in the Matching Pattern, in the same way that I would 'recognize' the incoming INVITE before.

Harold · Post by **Harold** » Thu Jun 02, 2022 8:09 pm

The Failover plugin can forward a call based on '302 Moved Temporarily' in the default.

Refer to "Example-5: Handle 30x redirect response".
https://docs.brekeke.com/sip/failover-w ... -dial-plan

JRayfield · Post by **JRayfield** » Thu Jun 02, 2022 8:56 pm

I saw that, but it states:

If sip:100@192.168.0.100 responds with error code 30x, the SIP Server sends a new INVITE to the contact address indicated in the 30x response

I don't want to send a new INVITE to the Contact address. I need to specify IP addresses of my upstream service provider to which the new INVITE will be sent.

redroof · Post by **redroof** » Fri Jun 03, 2022 10:32 am

That's why you need to specify the IP address of the upstream service provider at the redirect server in STIR/SHAKEN service.

JRayfield · Post by **JRayfield** » Fri Jun 03, 2022 3:03 pm

That makes sense. I actually have about 9 IP addresses (lot's of redundancy/failover) for my upstream provider's systems. I don't know if the STIR/SHAKEN service that I'm trying to use can handle this. We'll see....

JRayfield · Post by **JRayfield** » Mon Jun 06, 2022 3:30 pm

Example #5, for 302 Move Temporarily, only shows the Deploy Pattern. What does the Matching Pattern need to look like, to implement this properly?

redroof · Post by **redroof** » Tue Jun 07, 2022 7:45 pm

Matching Pattern is depending on your routing needs.

Simply it can be written as
Matching Pattern
$request = ^INVITE