PROTO_WSS module

Admin Guide

Overview

The WSS (Secure WebSocket) module provides the ability to communicate with a WebSocket (RFC 6455) client or server over a secure (TLS encrypted) channel. As part of the WebRTC specifications, this protocol can be used to provide secure VoIP calls to HTTPS enabled browsers.

This module behaves as any other transport protocol module: in order to use it, you must define one or more listeners that will handle the secure WebSocket traffic, after the mpath parameter:

...
mpath=/path/to/modules
...
socket=wss:10.0.0.1      # change with the listening IP
socket=wss:10.0.0.1:5060  # change with the listening IP and port
...

Besides that, you need to define the TLS parameters for securing the connection. This is done through the tls_mgm module interface, similar to the proto_tls module:

modparam("tls_mgm", "certificate", "/certs/biloxy.com/cert.pem")
modparam("tls_mgm", "private_key", "/certs/biloxy.com/privkey.pem")
modparam("tls_mgm", "ca_list", "/certs/wellknownCAs")
modparam("tls_mgm", "tls_method", "tlsv1")
modparam("tls_mgm", "verify_cert", "1")
modparam("tls_mgm", "require_cert", "1")

Check the tls_mgm module documentation for more info.

Dependencies

OpenSIPS Modules

The following modules must be loaded before this module:

• tls_mgm.

Dependencies of external libraries

OpenSIPS TLS v1.0 support requires the following packages:

• openssl or libssl >= 0.9.6
• openssl-dev or libssl-dev

OpenSIPS TLS v1.1/1.2 support requires the following packages:

• openssl or libssl >= 1.0.1e
• openssl-dev or libssl-dev

Exported Parameters

All these parameters can be used from the opensips.cfg file, to configure the behavior of OpenSIPS-WSS.

listen=interface

This is a global parameter that specifies what interface/IP and port should handle WSS traffic.

Set listen variable

...
socket= wss:1.2.3.4:44344
...

wss_port (integer)

The default port to be used for all WSS related operation. Be careful as the default port impacts both the SIP listening part (if no port is defined in the WSS listeners) and the SIP sending part (if the destination WSS URI has no explicit port).

If you want to change only the listening port for WSS, use the port option in the SIP listener defintion.

Default value is 443.

Set wss_port variable

...
modparam("proto_wss", "wss_port", 44344)
...

wss_max_msg_chunks (integer)

The maximum number of chunks in which a SIP message is expected to arrive via WSS. If a received packet is more fragmented than this, the connection is dropped (either the connection is very overloaded and this leads to high fragmentation - or we are the victim of an ongoing attack where the attacker is sending very fragmented traffic in order to decrease server performance).

Default value is 4.

Set wss_max_msg_chunks parameter

...
modparam("proto_wss", "wss_max_msg_chunks", 8)
...

wss_resource (string)

The resource queried for when a WebSocket handshake is initiated.

Default value is ”/“.

Set wss_resource parameter

...
modparam("proto_wss", "wss_resource", "/wss")
...

wss_handshake_timeout (integer)

This parameter specifies the time in milliseconds the proto_wss module waits for a WebSocket handshake reply from a WebSocket server.

Default value is 100.

Set wss_handshake_timeout parameter

...
modparam("proto_wss", "wss_handshake_timeout", 300)
...

cert_check_on_conn_reusage (integer)

This parameter turns on or off the extra checking/matching of the TLS domain (SSL certificate) when comes to reusing an existing TLS connection. Without this extra check, only IP and port of the connections will be check (in order to re-use an existing connection). With this extra check, the connection to be reused must have the same SSL certificate as the one set for the current signaling operation.

This checking is done only when comes to send SIP traffic via TLS and it is applied only against connections that were created / initiated by OpenSIPS (as TLS client). Any accepte connection (as TLS server) will automatically match (the extra test will be skipped).

Default value is 0 (disabled).

Set cert_check_on_conn_reusage parameter

...
modparam("proto_wss", "cert_check_on_conn_reusage", 1)
...

trace_destination (string)

Trace destination as defined in the tracing module. Currently the only tracing module is proto_hep. Network events such as connect, accept and connection closed events shall be traced along with errors that could appear in the process. For each connection that is created an event containing information about the client and server certificate, master key, http request and reply belonging to web socket protocol handshake and network layer information shall be sent.

Danger

A tracing module must be loaded in order for this parameter to work. (for example proto_hep).

Default value is none(not defined).

Set trace_destination parameter

...
modparam("proto_hep", "hep_id", "[hep_dest]10.0.0.2;transport=tcp;version=3")
modparam("proto_wss", "trace_destination", "hep_dest")
...

trace_on (int)

This controls whether tracing for wss is on or not. You still need to define trace destinationin order to work, but this value will be controlled using mi function mi wss trace.

Set trace_on parameter

...
modparam("proto_wss", "trace_on", 1)
...

trace_filter_route (string)

Define the name of a route in which you can filter which connections will be trace and which connections won’t be. In this route you will have information regarding source and destination ips and ports for the current connection. To disable tracing for a specific connection the last call in this route must be drop, any other exit mode resulting in tracing the current connection ( of course you still have to define a trace destination and trace must be on at the time this connection is opened.

Caution

Filtering on ip addresses and ports can be made using $si and $sp for matching either the entity that is connecting to OpenSIPS or the entity to which OpenSIPS is connecting. The name might be misleading ($si meaning the source ip if you read the docs) but in reality it is simply the socket other than the OpenSIPS socket. In order to match OpenSIPS interface (either the one that accepted the connection or the one that initiated a connection) $socket_in(ip) (ip) and $socket_in(port) (port) can be used.

Danger

If trace on is set to 0 or tracing is deactived via the mi command mi trace this route won’t be called.

Set trace_filter_route parameter

...
modparam("proto_wss", "trace_filter_route", "wss_filter")
...
/* all wss connections will go through this route if tracing is activated
 * and a trace destination is defined */
route[wss_filter] {
  ...
  /* all connections opened from/by ip 1.1.1.1:8000 will be traced
     on interface 1.1.1.10:5060(opensips listener)
     all the other connections won't be */
   if ( $si == "1.1.1.1" && $sp == 8000 &&
    $socket_in(ip) == "1.1.1.10"  && $socket_in(port) == 5060)
    exit;
  else
    drop;
}
...

wss_tls_handshake_timeout (integer)

Sets the timeout (in milliseconds) for the SSL handshake sequence to complete. It may be necessary to increase this value when using a CPU intensive cipher for the connection to allow time for keys to be generated and processed.

The timeout is invoked during acceptance of a new connection (inbound) and during the wait period when a new session is being initiated (outbound).

Default value is 100.

Set wss_tls_handshake_timeout variable

param("proto_wss", "wss_tls_handshake_timeout", 200) # number of milliseconds

wss_send_timeout (integer)

Sets the timeout (in milliseconds) for the send operations to complete

The send timeout is invoked for all TLS write operations, excluding the handshake process (see: wss_tls_handshake_timeout)

Default value is 100.

Set wss_send_timeout variable

modparam("proto_wss", "wss_send_timeout", 200) # number of milliseconds

Exported MI Functions

wss_trace

Name: wss_trace

Parameters:

• trace_mode(optional): set wss tracing on and off. This parameter can be missing and the command will show the current tracing status for this module( on or off ); Possible values:
  • on
  • off

MI FIFO Command Format:

opensips-cli -x mi wss_trace on

Frequently Asked Questions

Q: Does OpenSIPS support fragmented Secure WebSocket messages?

No, the WebSocket fragmentation mechanism is not supported.

Contributors

By Commit Statistics

Top contributors by DevScore⁽¹⁾, authored commits⁽²⁾ and lines added/removed⁽³⁾

#	Name	DevScore	Commits	Lines++	Lines—
1.	Razvan Crainea (@razvancrainea)	29	19	766	128
2.	Bogdan-Andrei Iancu (@bogdan-iancu)	18	14	252	36
3.	Ionut Ionita (@ionutrazvanionita)	15	10	366	23
4.	Vlad Patrascu (@rvlad-patrascu)	13	10	95	84
5.	Stefan Darius (@dariusstefan)	12	5	490	113
6.	Liviu Chircu (@liviuchircu)	8	6	33	46
7.	Maksym Sobolyev (@sobomax)	4	2	2	22
8.	Dan Pascu (@danpascu)	3	1	3	5
9.	Peter Lemenkov (@lemenkov)	3	1	1	1

(1) DevScore = author_commits + author_lines_added / (project_lines_added / project_commits) + author_lines_deleted / (project_lines_deleted / project_commits)

(2) including any documentation-related commits, excluding merge commits

(3) ignoring whitespace edits, renamed files and auto-generated files

By Commit Activity

#	Name	Commit Activity
1.	Stefan Darius (@dariusstefan)	Jun 2026 - Jul 2026
2.	Razvan Crainea (@razvancrainea)	Jan 2016 - Jun 2026
3.	Vlad Patrascu (@rvlad-patrascu)	May 2017 - Oct 2021
4.	Bogdan-Andrei Iancu (@bogdan-iancu)	Jan 2016 - Apr 2021
5.	Maksym Sobolyev (@sobomax)	Feb 2017 - Sep 2020
6.	Liviu Chircu (@liviuchircu)	Mar 2016 - Jan 2020
7.	Dan Pascu (@danpascu)	Jan 2020 - Jan 2020
8.	Peter Lemenkov (@lemenkov)	Jun 2018 - Jun 2018
9.	Ionut Ionita (@ionutrazvanionita)	Mar 2017 - Apr 2017

(1) including any documentation-related commits, excluding merge commits

Documentation

Contributors

Last edited by: Razvan Crainea (@razvancrainea), Vlad Patrascu (@rvlad-patrascu), Bogdan-Andrei Iancu (@bogdan-iancu), Peter Lemenkov (@lemenkov), Liviu Chircu (@liviuchircu), Ionut Ionita (@ionutrazvanionita).

License

All documentation files (i.e. .md extension) are licensed under the Creative Common License 4.0