456 x forwarded for header#178
Merged
Merged
Conversation
Replace dead ADD_X_REAL_IP route with ADD_X_FORWARDED_FOR and wire it into request_route so every initial INVITE forwarded downstream carries the original source IP. Lets Asterisk identify IP-based trunks via 'match header' when the INVITE reaches it from the proxy instead of the provider. - Renamed route ADD_X_REAL_IP -> ADD_X_FORWARDED_FOR; switched header from X-Real-IP to X-Forwarded-For (no trailing space) - Invoked in request_route for direction=in INVITE with !has_totag() (initial dialog only, no re-INVITEs) Refs helpdesk ticket #456
The route HANDLE_ALIAS shortcuts to RELAY when handle_ruri_alias() rewrites the RURI (any INVITE with ;alias= param from the provider). That shortcut skipped the main flow where the X-Forwarded-For header was being added, so the downstream Asterisk never saw the header. Verified on lab GNS3 (Vianova FreePBX -> proxy -> NethVoice Asterisk): the INVITE forwarded to Asterisk now carries 'X-Forwarded-For: <provider-ip>'.
Adds 02_kamailio_routing.robot with 5 regression assertions on the running kamailio config inside the container: - route[ADD_X_FORWARDED_FOR] is defined - it removes existing X-Forwarded-For and inserts one with $si - route(ADD_X_FORWARDED_FOR) is wired in at >= 2 sites (main inbound flow + HANDLE_ALIAS shortcut) - HANDLE_ALIAS body contains the call (prevents the alias-rewrite shortcut from silently skipping the header) - kamcmd answers (running config parsed cleanly) Verified against the lab NS8 node: 5/5 passing.
|
🔨 PR testing image: |
Stell0
approved these changes
May 27, 2026
|
🔨 PR testing image: |
|
🔨 PR testing image: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the
X-Forwarded-Forheader to every initial INVITE forwarded downstream to Asterisk, valued with the source IP of the upstream peer (typically the provider). This lets the NethVoice PBX identify IP-based trunks via amatch headerrule onX-Forwarded-Foreven when the INVITE reaches Asterisk from the proxy IP instead of directly from the provider.Refs helpdesk ticket #456.
Changes
ADD_X_FORWARDED_FORreplaces the deadADD_X_REAL_IProute (header switched fromX-Real-IPtoX-Forwarded-For, removed trailing space, removes existing header before inserting to avoid stacking).is_method("INVITE") && !has_totag()so only initial INVITEs are tagged (no re-INVITEs, no other methods):request_route(direction=in), right beforeRELAY.HANDLE_ALIAS, before the shortcutRELAY. This was needed becausehandle_ruri_alias()bypasses the main flow whenever the RURI carries an;alias=parameter — i.e. virtually all real inbound INVITEs going to a registered peer.tests/02_kamailio_routing.robotwith 5 regression assertions on the running config inside the container.Test plan
Verified end-to-end on lab GNS3 (Vianova FreePBX provider → proxy → NethVoice Asterisk) — pcap evidence available in the helpdesk ticket. Coverage:
;alias=(HANDLE_ALIAS path) — INVITE reaching Asterisk carriesX-Forwarded-For: <provider-ip>.WITHINDLG → loose_route → RELAYbypasses both main flow and HANDLE_ALIAS).;alias=parameter — not exercised at runtime (all registered Contacts in lab carry;alias=); covered by symmetric code path and the Robot static assertions.Asterisk
match headerconfiguration is out of scope (Nethesis side).NethServer/dev#7138