September 2010 - sr-users

Setting up TLS between proxy and authentication server
by Couprie Geoffroy 01 Nov '10

01 Nov '10

Hello, I am testing TLS communication with Kamailio 3.0.2, and I encounter a strange problem. My setup is like this: Client <-UDP-> Proxy server <- TLS with client certificate authentication -> Authentication server 192.168.24.1 192.168.24.128 192.168.24.129 The two servers are instance of Kamailio 3.0.2 When the client sends a REGISTER, the proxy retransmits the message to the authentication server, which sends back a 401 Unauthorized. But it seems the proxy closes the TLS connexion right after forwarding the REGISTER, and doesn't receive the 401 message. The TLS handshake is OK, and the client certificate is required (I didn't add the verification part yet). The REGISTER message goes through TLS, and is received by the authentication server. Then, the proxy sends a TLS alert (Close-notify), and after that message, the authentication server sends back the 401, and the proxy ignores that message. Could it be caused by a timeout? Is there a way to keep the TLS connection opened? Here are the relevant files (I don't like to send mails of more than 100 lines): authentication server configuration: http://pastebin.com/QBmnNc4e authentication server log: http://pastebin.com/uYdHDG5G proxy server configuration: http://pastebin.com/8WPPJBtM proxy server log: http://pastebin.com/JTwJSKtk I am just testing TLS, so I have tried to remove most of the irrelevant parts. Best regards, Geoffroy ________________________________ Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet, la responsabilit? du groupe Atos Origin ne pourra ?tre recherch?e quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'exp?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre recherch?e pour tout dommage r?sultant d'un virus transmis. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Atos Origin group liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.

3 5

Re: [SR-Users] Kamailio 3.0 cann't access the RTPProxy
by Daniel-Constantin Mierla 22 Oct '10

22 Oct '10

Hello, apart of the email with logs, or private data that was required, please continue the discussion on public mailing list. I need some time to check the logs, the first inconvenience is the rar archive, a zip or tgz is much better -- not a fan of installing binaries from unknown companies on mac os x, going to get unrar from macports. Then solaris is not an OS i have at hand nor use frequently, so need to read about. It is also why using mailing list keeps you in touch with others that can help. Cheers, Daniel On 8/18/10 7:04 PM, KevinJin wrote: > Hi Daniel, > > Does the logs have any hint for what's cause of the issue? I didn't > include the user list in the previous email since logs have the actual > IP info. > > Thanks in advance! > > Best Regard > Kevin > > ------------------------------------------------------------------------ > From: kevin.jzh(a)hotmail.com > To: miconda(a)gmail.com > Subject: RE: [SR-Users] Kamailio 3.0 cann't access the RTPProxy > Date: Tue, 17 Aug 2010 18:51:02 +0800 > > > Hi Daniel, > > Attached are the two kamailio logs, > unix_socket_log --- run rtp proxy wth -s unix:/tmp/rtpproxy.sock > udp_rtpproxy_log --- run rtp proxy with -s udp:*:7722 > > Please help to check what's wrong with it. > > Thanks, > Kevin > ------------------------------------------------------------------------ > Date: Tue, 17 Aug 2010 11:29:46 +0200 > From: miconda(a)gmail.com > To: kevin.jzh(a)hotmail.com > CC: sr-users(a)lists.sip-router.org > Subject: Re: [SR-Users] Kamailio 3.0 cann't access the RTPProxy > > Hello, > > please send full log at startup, your snippets include just few lines > per process, being mixed from different processes. > > Cheers, > Daniel > > > On 8/14/10 3:54 AM, KevinJin wrote: > > Hello, > > ------------------------------------------------------------------------ > Date: Thu, 12 Aug 2010 22:16:18 +0200 > From: miconda(a)gmail.com <mailto:miconda@gmail.com> > To: kevin.jzh(a)hotmail.com <mailto:kevin.jzh@hotmail.com> > CC: sr-users(a)lists.sip-router.org > <mailto:sr-users@lists.sip-router.org> > Subject: Re: [SR-Users] Kamailio 3.0 cann't access the RTPProxy > > Hello, > > On 8/12/10 8:34 PM, KevinJin wrote: > > Hello, > > ------------------------------------------------------------------------ > Date: Thu, 12 Aug 2010 18:46:19 +0200 > From: miconda(a)gmail.com <mailto:miconda@gmail.com> > To: kevin.jzh(a)hotmail.com <mailto:kevin.jzh@hotmail.com> > CC: sr-users(a)lists.sip-router.org > <mailto:sr-users@lists.sip-router.org> > Subject: Re: [SR-Users] Kamailio 3.0 cann't access the RTPProxy > > Hello, > > On 8/12/10 4:47 PM, KevinJin wrote: > > Hi Daniel, > > What does the log below means? Does it mean nathelper has > issue to send the request to RTP proxy first or nathelper > doesn't receive a response after sending a request to the > rtp proxy? > 0(27429) ERROR: nathelper [nathelper.c:2457]: can't send > command to a RTP proxy > > this error is printed when write to socket fails. Do you have > any firewall running on the system? Is the user under which > kamailio runs allowed to write to sockets? > > > There's no firewall on the system, and I run the kamailio > as root, > root 26310 1 0 02:24:19 ? 0:00 > /usr/local/kamailio-3.0.2/sbin/kamailio -f > /usr/local/kamailio-3.0.2/etc/kamail > > You can edit module_k/nathelper/nathelper.c and replace > the line 2457 with: > > LM_ERR("can't send command to a RTP proxy (%s/%d)\n", > strerror(errno), errno); > > Recompile and reinstall. Hopefully will get more hints > about what happens. > > > Here is the error message after the change: > 2(26312) ERROR: nathelper [nathelper.c:2457]: can't send > command to a RTP proxy(Invalid argument/22) > 2(26312) ERROR: nathelper [nathelper.c:2492]: proxy > <udp:210.13.124.15:7722> does not respond, disable it > 2(26312) ERROR: nathelper [nathelper.c:3144]: no available proxies > what could be the cause? > > hmm, invalid argurment ... try with this line: > > LM_ERR("can't send command to a RTP proxy (%s/%d) [sock %d (%d), > vcnt %d]\n", > strerror(errno), errno, rtpp_socks[node->idx], node->idx, vcnt); > > maybe will give some hints about which value is invalid. > > Here's the log after the change: > 4(14415) ERROR: nathelper [nathelper.c:2457]: can't send command > to a RTP proxy (Invalid argument/22) [sock 7 (0), vcnt 18] > 4(14415) ERROR: nathelper [nathelper.c:2492]: proxy > <udp:210.13.x.y:7722> does not respond, disable it > 4(14415) ERROR: nathelper [nathelper.c:3144]: no available proxies > > > Can you try as well with an unix file socket: > > modparam("nathelper", "rtpproxy_sock", "unix:/tmp/rtpproxy.sock") > > then start rtpproxy with -s unix:/tmp/rtpproxy.sock > > > 4(17530) INFO: nathelper [nathelper.c:2369]: rtp proxy > <unix:/tmp/rtpproxy.sock> found, support for it re-enabled > 3(17529) ERROR: nathelper [nathelper.c:2429]: can't send command > to a RTP proxy > 3(17529) ERROR: nathelper [nathelper.c:2492]: proxy > <unix:/tmp/rtpproxy.sock> does not respond, disable it > 3(17529) ERROR: nathelper [nathelper.c:3144]: no available proxies > > Thanks, > Kevin > > I have no solaris (sparc) to try myself... > > Cheers, > Daniel > > > > Test env: > UA1 (Behind NAT) --------> Kamailio & RTPproxy (Public IP) > --------->UA2 (Public IP) > > Thanks, > Kevin > Cheers, > Daniel > > > > 0(27429) ERROR: nathelper [nathelper.c:2492]: proxy > <udp:210.13.124.15:7722> does not respond, disable it > > There's no problem for the resource(CPU, mem etc.) on the > server, the load is very low. > > Thanks in advance! > ---------- > 0(27429) DEBUG: nathelper [nhelpr_funcs.c:148]: type > <application/sdp> found valid > 0(27429) ERROR: nathelper [nathelper.c:3144]: no available > proxies > 0(27429) ERROR: nathelper [nathelper.c:2627]: no available > proxies > 0(27429) DEBUG: nathelper [nhelpr_funcs.c:148]: type > <application/sdp> found valid > 0(27429) INFO: nathelper [nathelper.c:2369]: rtp proxy > <udp:210.13.124.15:7722> found, support for it re-enabled > 0(27429) DEBUG: nathelper [nathelper.c:3196]: proxy reply: > 42040 210.13.124.14 > 0(27429) DEBUG: nathelper [nhelpr_funcs.c:148]: type > <application/sdp> found valid > 0(27429) ERROR: nathelper [nathelper.c:2457]: can't send > command to a RTP proxy > 0(27429) ERROR: nathelper [nathelper.c:2492]: proxy > <udp:210.13.124.15:7722> does not respond, disable it > 0(27429) ERROR: nathelper [nathelper.c:3144]: no available > proxies > 0(27429) ERROR: nathelper [nathelper.c:2627]: no available > proxies > > Thanks, > Kevin > ------------------------------------------------------------------------ > > > _______________________________________________ > SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list > sr-users(a)lists.sip-router.org <mailto:sr-users@lists.sip-router.org> > http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users > > > -- > Daniel-Constantin Mierla > http://www.asipto.com/ > > > -- > Daniel-Constantin Mierla > http://www.asipto.com/ > > > -- > Daniel-Constantin Mierla > http://www.asipto.com/ -- Daniel-Constantin Mierla http://www.asipto.com/

2 5

mtree memory comsumption question
by anthony thomas 13 Oct '10

13 Oct '10

Hello list, I have been testing the new mtree module but I am a little bit confused about the results. On my tests, I randomly generated 500K, 1M and 2M entries in a table in several trees. The size of the db (on disk) ranges from 120 megs to 270 megs and when Kamailio loads it in memory, it jumps from 1.0Gb to 2.8Gb. Is there any way to pre-calculate the total amount of memory that a tree will need? Thanks, A

2 1

Problem with ser - INVITE size problem tcp->udp?
by Simone Felici 11 Oct '10

11 Oct '10

Hello to all! I need a little help with our ser installation (ser-2.0.0-rc1). The continuous groving up of our infrastructure and using even more codecs, causes the INVITE (udp) to be over 1500bytes. An external->incoming call to our proxy sip comes in with a size of ~1300 and will be forwarded to the end device (sua) over 1500. Ser is adding more than 200bytes in the udp packet. I can see 'INVITE' from ser to customer, but the INVITE is not answerred due the size. I'm sure about that, because in certain situations, deleting codec list the packet-size goes under the 1500bytes and all works. To main issue is from external calls to ser server to our customers. Calls started from customers to ser and then out are all ok. Now the question: Could the passage from UDP to TCP solve the issue? Could someone give me an example and how implement it into our ser configuration? The atteched configuration, ser on a mysql basis, is working well in expect the issue described. Thank's a lot for your help! Simon

2 5

Evaluate Perl Return Value in Routing Logic
by "Nicolas Rüger" 08 Oct '10

08 Oct '10

Hello, is there any way to use or evaluate the return-statements of a perl-script in kamailio.cfg? I tried the following in the Routing Logic in kamailio.cfg: if (is_method("INVITE")) { if (perl_exec("my_perl_subroutine") == -1){ xlog("PERL returns -1 \n"); } } Doesn't work. The bad thing is that the return-values of the - perl_exec("XXX") - call are not the same that the perl subroutine "XXX" returns. That's at least what I strongly believe after testing. I do need to read/evaluate the return-value of the perl-subroutine in the Routing Logic to define different routes depending on what the perl-subroutine returns. Is there any way to do that??? Thank you for your help in advance. Regards, Nicolas -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

2 5

kamailio 3.0.3 tls problems
by Rouskol Andrey 07 Oct '10

07 Oct '10

Hello, I have a problem running kamailio with tls support. I can successfully register only for the first time, all further registration fails with the following message in the log: Sep 28 11:53:55 siptest /usr/sbin/kamailio[16963]: ERROR: tls [tls_server.c:392]: SSL error:error:07064041:memory buffer routines:BUF_MEM_grow:malloc failure The system is a default kamailio installation on a Debian 5.0.6 system. Does somebody know what could cause the problem? Regards, Andrey.

5 17

Problem with debug memory: kill -SIGUSR1 doesn't work fine
by César Pinto Magán 06 Oct '10

06 Oct '10

Hello, We had been experiencing memory leaks issues with our Kamailio deployment. Some of the process started to use all their assigned memory and arises allocation memory errors. Using the "kill -SIGUSR1" as explained in the Kamailio wiki and found the problem: Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: <core> [main.c:788]: INFO: signal 15 received Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: <core> [main.c:799]: Memory status (pkg): Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: qm_status: (0x885a60): Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: qm_status: heap size= 67108864 Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: qm_status: used= 60641440, used+overhead=67096424, free=12440 Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: qm_status: max used (+overhead)= 67102896 Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: qm_status: dumping all alloc'ed. fragments: Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: qm_status: 0. N address=0x8baf78 frag=0x8baf48 size=16 used=1 Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: qm_status: alloc'd from <core>: rvalue.c: mk_rval_expr_v(2452) Sep 8 11:34:04 localhost /sbin/kamailio[17275]: INFO: qm_status: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed ... Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: 1618. N address=0x95e920 frag=0x95e8f0 size=936 used=1 Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: alloc'd from <core>: rvalue.c: rval_new_empty(233) Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: 1633. N address=0x95f528 frag=0x95f4f8 size=936 used=1 Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: alloc'd from <core>: rvalue.c: rval_new_empty(233) Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: 1634. N address=0x95f930 frag=0x95f900 size=936 used=1 Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: alloc'd from <core>: rvalue.c: rval_new_empty(233) Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: 1696. N address=0x962298 frag=0x962268 size=944 used=1 Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: alloc'd from <core>: rvalue.c: rval_new_empty(233) Sep 8 11:34:06 localhost /sbin/kamailio[17275]: INFO: qm_status: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed . . (the rvalue.c repeats all the time) . Sep 8 11:34:23 localhost /sbin/kamailio[17275]: INFO: qm_status: 64963. N address=0x4885118 frag=0x48850e8 size=944 used=1 Sep 8 11:34:23 localhost /sbin/kamailio[17275]: INFO: qm_status: alloc'd from <core>: rvalue.c: rval_new_empty(233) Sep 8 11:34:23 localhost /sbin/kamailio[17275]: INFO: qm_status: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed Sep 8 11:34:23 localhost /sbin/kamailio[17275]: INFO: qm_status: 64964. N address=0x4885528 frag=0x48854f8 size=1288 used=1 Sep 8 11:34:23 localhost /sbin/kamailio[17275]: INFO: qm_status: alloc'd from <core>: rvalue.c: rval_new_empty(233) Sep 8 11:34:23 localhost /sbin/kamailio[17275]: INFO: qm_status: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed We saw there was several core memory leaks resolved in the 3.0.3 version (we had the 3.0.2), so we decided to upgrade to that version. Now I was trying to check the memory status of the process (in order to see if the problem is arising again) with "kill -SIGUSR1" but now only show the memory status of the shm and the memory of the attendant process (the one who launch the other ones). I had tried to send the signal to each of the son process but I see nothing in the log. Is this a new bug or is that there is other new way to see the memory status of the processes? Thanks in advance, http://www.alhambra-eidos.es/CO/1.gif<http://www.alhambra-eidos.es/CO/1.gif> César Pinto. ICM Team +34 91 787 23 00 http://www.alhambra-eidos.es/CO/3.gif <http://www.alhambra-eidos.es/>

2 2

Tutorial: SIP SIMPLE Presence Made Simple with Kamailio 3.1
by Daniel-Constantin Mierla 05 Oct '10

05 Oct '10

Hello, I published a tutorial of how to implement a SIP SIMPLE Presence & XCAP server with latest Kamailio/SER version. You can find it at: http://bit.ly/btrJij Last build of SIP Communicator softphone was used to exemplify some use cases. xcap_server is a new module in upcoming v3.1.0, I have tested it with several SIP clients, but I have to say is not easy to find one that implements many presence & xcap extensions (filled already couple of bugs so far). So consider it a young component by now, however, with it inside our SIP server, deploying a SIP presence server becomes trivial. Hope is helpful, Daniel -- Daniel-Constantin Mierla http://www.asipto.com

4 14

"Create Certificates to be used with Kamailio" changes
by Juha Heinanen 04 Oct '10

04 Oct '10

now that 3.1 has async tls support, i decided (first time ever) to try to test tls. things went quite smoothly when i followed "Create Certificates to be used with Kamailio" document http://kamailio.org/dokuwiki/doku.php/tls:create-certificates#using_the_cer… during the process, i fixed a typo in the doc, added two comments to cfg part: enable_tls=1 tcp_async=no # do not include in 3.1 listen=udp:0.0.0.0:5060 listen=tcp:0.0.0.0:5060 listen=tls:0.0.0.0:5061 # not needed in 3.1 and fixed wrong file references in client configurations: eyebeam: copy the CA certificate (/etc/certs/demoCA/cert.pem) to the Windows PC and add it to the Windows certificate store (Start→Control Panel→Internet) QjSimple: copy the CA certificate (/etc/certs/demoCA/cert.pem) to the client PC and configure QjSimple to use this CA (“TLS CA file” and “verify TLS server certificate) earlier the paths pointed to certs/sip.mydomain.com files, which i think were wrong. at least i was not able to get them working. perhaps someone who is more familiar with tsl stuff could verify the above changes. -- juha

4 14

XCAP 3.1 configuration !
by X- x -X 01 Oct '10

01 Oct '10

Hi Daniel, Im a kamailio 3.1 (testing noobie) Im trying to setup a simple buddy list supporting presence server. (I gather xcap is the way to go) The simple presence thingy works nicely & instantly (thanks to those #!defines ) But I haven't been able to get this configuration going http://sip-router.org/docbook/sip-router/branch/master/modules_k/xcap_serve… I mean loading the modules & setting the modparams is a snap but this routing logic always gets to me. (i.e. those filing off .......... lines in the the routing logic section. Did I mention I was a noobie especially of routing logic section ?) Anyway you have also added this declarative #!ifdef WITH_XHTTPAUTH with in that section, where as its missing in the top section of the kamailio.cfg file. Pasting just about anywhere (or in the end before the } doesn't work for me. Could u be kind enough to elaborate a little more on that or come up with a fuller kamailo.cfg sample file. Thanx & Regards --

4 10