<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
PR adds new core option `tls_connection_match_domain` with the default value 0 (old behavior)
to solve the problem when we need to have multiple TLS connections with different SNI to the same host:port endpoint.
for example: multiple customers (authorized by cert) for MS Teams on the single kamailio instance.
originally, functions `_tcpconn_find` and `_tcpconn_add_alias_unsafe` use only endpoint and protocol to match connections.
setting `tls_connection_match_domain` to `1` will match additionaly with `tls_domain_str()` output for matched TLS domain.
as a result, we will be able to establish new TLS connections if TLS domain is changed instead of reusing of the existent one with the wrong SNI.
i'm not considering this PR as the final version but we need something to start with. looking forward for any input.
FIXME: not found the right place where new core option should be documented.
#### Behavior difference example
* /etc/kamailio/kamailio.cfg
(relays all requests to 127.0.0.1:5081 using TLS domain matched by server_id retreived from RURI-User):
```
#!KAMAILIO
listen=udp:127.0.0.1:5060
listen=tls:127.0.0.1:5061
enable_tls = yes
tls_connection_match_domain = 1
debug = 3
loadmodule "tls.so"
modparam("tls", "config", "/etc/kamailio/tls.cfg")
modparam("tls", "xavp_cfg", "tls")
loadmodule "ctl.so"
loadmodule "pv.so"
loadmodule "tm.so"
route {
$xavp(tls=>server_id) = $rU;
t_relay_to_tls("127.0.0.1", 5081);
}
```
* /etc/kamailio/tls.cfg:
```
[server:default]
certificate = /etc/ssl/certs/ssl-cert-snakeoil.pem
private_key = /etc/ssl/private/ssl-cert-snakeoil.key
[client:any]
server_name = server_name_1.invalid
server_id = 1
[client:any]
server_name = server_name_2.invalid
server_id = 2
```
* run tls server:
```bash
$ openssl s_server -port 5081 -cert /etc/ssl/certs/ssl-cert-snakeoil.pem -key /etc/ssl/private/ssl-cert-snakeoil.key
```
* send `INVITE sip:1@127.0.0.1:5060` and `INVITE sip:2@127.0.0.1:5060` using sipp:
```bash
$ for u in 1 2; do sipp -sn uac -m 1 -nd -recv_timeout 1 -bg -s $u 127.0.0.1:5060; done
```
* resulting `tls.list` for kamailio instance WITHOUT `tls_connection_match_domain = 1` (old behavior):
```bash
# kamcmd tls.list
{
id: 1
dom: TLSc<any:server_name_1.invalid>
sni: N/A
timestamp: 2025-04-24 14:07:20
timeout: 118
src_ip: 127.0.0.1
src_port: 5081
dst_ip: 127.0.0.1
dst_port: 58808
cipher: unknown
ct_wq_size: 1162
enc_rd_buf: 0
flags: 1
state: tls_connect
}
```
* `tls.list` for kamailio instance WITH `tls_connection_match_domain = 1` (new behavior):
```bash
# kamcmd tls.list
{
id: 1
dom: TLSc<any:server_name_1.invalid>
sni: N/A
timestamp: 2025-04-24 14:09:10
timeout: 117
src_ip: 127.0.0.1
src_port: 5081
dst_ip: 127.0.0.1
dst_port: 55480
cipher: unknown
ct_wq_size: 581
enc_rd_buf: 0
flags: 1
state: tls_connect
}
{
id: 2
dom: TLSc<any:server_name_2.invalid>
sni: N/A
timestamp: 2025-04-24 14:09:10
timeout: 117
src_ip: 127.0.0.1
src_port: 5081
dst_ip: 127.0.0.1
dst_port: 55488
cipher: unknown
ct_wq_size: 581
enc_rd_buf: 0
flags: 1
state: tls_connect
}
```
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4222
-- Commit Summary --
* core: support tls connection domain matching
* tls: implement match_domain,match_connections_domain hooks
* tls_wolfssl: implement match_domain,match_connections_domain hooks
-- File Changes --
M src/core/cfg.lex (3)
M src/core/cfg.y (9)
M src/core/globals.h (1)
M src/core/tcp_main.c (14)
M src/core/tls_hooks.h (9)
M src/main.c (4)
M src/modules/tls/tls_mod.c (2)
M src/modules/tls/tls_rpc.c (12)
M src/modules/tls/tls_server.c (97)
M src/modules/tls/tls_server.h (8)
M src/modules/tls_wolfssl/tls_rpc.c (12)
M src/modules/tls_wolfssl/tls_server.c (94)
M src/modules/tls_wolfssl/tls_server.h (7)
M src/modules/tls_wolfssl/tls_wolfssl_mod.c (2)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4222.patchhttps://github.com/kamailio/kamailio/pull/4222.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4222
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4222(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [x] PR should be backported to stable branches
- [x] Tested changes locally
- [x] Related to issue #4226
#### Description
<!-- Describe your changes in detail -->
- Improve and add missing function documentation `list_peers`.
- Use correct identifier in `struct_add` rpc function and cast `time_t` for time_t field.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4227
-- Commit Summary --
* cdp: Cast time_t and use 'L' (long long) identifier in rpc function.
* cdp/docs: Add missing list_peers function
-- File Changes --
M src/modules/cdp/cdp_rpc.c (4)
M src/modules/cdp/doc/cdp_admin.xml (29)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4227.patchhttps://github.com/kamailio/kamailio/pull/4227.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4227
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4227(a)github.com>
- format as well
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [] PR should be backported to stable branches
- [ ] Tested changes locally
- [x] Related to issue #4227
#### Description
<!-- Describe your changes in detail -->
There was missing information of type identifiers that can be used in [rpc tutorial docs](https://www.kamailio.org/docs/docbooks/5.7.x/rpc_api/rpc_api.html#rpc…. This is an update to those docs. The most recent I could find was for 5.7.
Maybe there is a need for manual updating the page?
Also during the relevant PR #4227 , we found the `t` identifier is never used in the code. since it can overflow on 64bit systems due to being a `long` and not `int` type when saved/load, maybe we can remove it completely?. One can just cast the `time_t` to the relevant type and use the correct identifier as done in https://github.com/kamailio/kamailio/blob/2081b3aac394223b68b849fbac2a9e5ac…
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4228
-- Commit Summary --
* Update type identifiers that can be used in the RPC API
-- File Changes --
M doc/tutorials/rpc/kamailio_rpc.xml (86)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4228.patchhttps://github.com/kamailio/kamailio/pull/4228.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4228
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4228(a)github.com>
### Description
We are using Kamailio 5.7.4 on Debian 12 (from http://deb.kamailio.org/kamailio57) with rtpengine as an Edgeproxy for our clients. The instance terminates SIP/TLS (with Cliencertificates) and forwards the SIP Traffic to internal systems.
After some days we are getting errors like this
`tls_complete_init(): tls: ssl bug #1491 workaround: not enough memory for safe operation: shm=7318616 threshold1=8912896`
First we thought Kamailio just doesnt have enough memory, so we doubled it..
But after some days the Logmessage (and Userissues) occured again.
So we monitored the shmmem statistics and found that used and max_used are constantly growing til it reaches the limit.
As i mentioned we are using client-certificates and so we are also using the CRL feature.
We do have a systemd-timer which fetches the CRL every hour and runs 'kamcmd tls.reload' when finished.
Our tls.cfg looks like this:
```
[server:default]
method = TLSv1.2+
private_key = /etc/letsencrypt/live/hostname.de/privkey.pem
certificate = /etc/letsencrypt/live/hostname.de/fullchain.pem
ca_list = /etc/kamailio/ca_list.pem
ca_path = /etc/kamailio/ca_list.pem
crl = /etc/kamailio/combined.crl.pem
verify_certificate = yes
require_certificate = yes
[client:default]
verify_certificate = yes
require_certificate = yes
```
After testing a bit we found that every time tls.reload is executed Kamailio consumes a bit more memory which eventually leads to all the memory being consumed which leads to issues for our users.
See following example:
```
[0][root@edgar-dev:~]# while true ; do /usr/sbin/kamcmd tls.reload ; /usr/sbin/kamcmd core.shmmem ; sleep 1 ; done
Ok. TLS configuration reloaded.
{
total: 268435456
free: 223001520
used: 41352552
real_used: 45433936
max_used: 45445968
fragments: 73
}
Ok. TLS configuration reloaded.
{
total: 268435456
free: 222377960
used: 41975592
real_used: 46057496
max_used: 46069232
fragments: 78
}
Ok. TLS configuration reloaded.
{
total: 268435456
free: 221748664
used: 42604992
real_used: 46686792
max_used: 46698080
fragments: 77
}
Ok. TLS configuration reloaded.
{
total: 268435456
free: 221110832
used: 43242408
real_used: 47324624
max_used: 47335608
fragments: 81
}
^C
[130][root@edgar-dev:~]#
```
### Troubleshooting
#### Reproduction
Everytime tls.reload is called the memory consumptions grows..
#### Debugging Data
<!--
If you got a core dump, use gdb to extract troubleshooting data - full backtrace,
local variables and the list of the code at the issue location.
gdb /path/to/kamailio /path/to/corefile
bt full
info locals
list
If you are familiar with gdb, feel free to attach more of what you consider to
be relevant.
-->
```
If you let me know what would be interesting for tracking this down, i am happy to provide logs/debugging data!
```
#### Log Messages
<!--
Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
If you let me know what would be interesting for tracking this down, i am happy to provide logs/debugging data!
```
#### SIP Traffic
SIP doesnt seem to be relevant here
### Possible Solutions
Calling tls.reload less often or restart kamailio before memory is consumed ;)
### Additional Information
```
version: kamailio 5.7.4 (x86_64/linux)
flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, MEM_JOIN_FREE, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED
ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown
compiled with gcc 12.2.0
```
* **Operating System**:
```
* Debian GNU/Linux 12 (bookworm)
* Linux edgar-dev 6.1.0-20-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.85-1 (2024-04-11) x86_64 GNU/Linux
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3823
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3823(a)github.com>
Discussion to define cmake format options and coding/naming styles. It is better to define most of them now to have coherency in the future. Started from the discussion on #4066.
Comment with what you would like to have, describing when useful why your proposal is a good/better option.
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/4075
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/4075(a)github.com>
Fr-Soltanzadeh created an issue (kamailio/kamailio#4164)
### Description
In a IMS lab using Kamailio PCSCF, ICSCF and SCSCF default configs, I have used TOPOH module in PCSCF for topology hiding. Topoh config is as follows:
```
modparam("topoh", "mask_key", "my-key")
modparam("topoh", "mask_ip", "127.0.0.2")
modparam("topoh", "sanity_checks", 1)
```
As shown in attached traffic, SCSCF IP is not hided in 180 ringing and 200ok messages to the caller. In invite, ack and bye messages hiding is performed well.
[topoh.zip](https://github.com/user-attachments/files/19086420/topoh.zip)
[topoh.zip](https://github.com/user-attachments/files/19086428/topoh.zip)
[topoh.zip](https://github.com/user-attachments/files/19086431/topoh.zip)
<!--
Explain what you did, what you expected to happen, and what actually happened.
-->
### Troubleshooting
#### Reproduction
<!--
If the issue can be reproduced, describe how it can be done.
-->
#### Debugging Data
<!--
If you got a core dump, use gdb to extract troubleshooting data - full backtrace,
local variables and the list of the code at the issue location.
gdb /path/to/kamailio /path/to/corefile
bt full
info locals
list
If you are familiar with gdb, feel free to attach more of what you consider to
be relevant.
-->
```
(paste your debugging data here)
```
#### Log Messages
<!--
Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
(paste your log messages here)
```
#### SIP Traffic
<!--
If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
(paste your sip traffic here)
```
### Possible Solutions
<!--
If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix.
-->
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
```
(paste your output here)
```
* **Operating System**:
<!--
Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...;
Kernel details (output of `lsb_release -a` and `uname -a`)
-->
```
(paste your output here)
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/4164
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/4164(a)github.com>
I'm sorry @miconda
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/commit/c92795b672ce8cfc7ff0ff361e5fdbd…
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/commit/c92795b672ce8cfc7ff0ff361e5fdbd15ba3e32d/156150906(a)github.com>
For the records and future consideration: the README file for a module must not be changed manually, it is generated from the xml files located in the `doc/` subfolder of the module directory. If you want to change something in the README file, change inside the xml files and a job on kamailio.org server will generate and push to git the updated README content.
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/commit/c92795b672ce8cfc7ff0ff361e5fdbd…
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/commit/c92795b672ce8cfc7ff0ff361e5fdbd15ba3e32d/156146968(a)github.com>