sr-users March 2011

sr-users@lists.kamailio.org

83 participants
123 discussions

Kamailio auth_radius: duplicate User-Name attribute
by Kosilov Fedor 06 Mar '11

06 Mar '11

Hello List! I'm trying to set up authorization with our billing proprietary radius server, using Freeradius as a proxy. Currently I'm experiencing the following problem: The Access-Request packet, sent by Kamailio, contains two User-Name attribute records Here is a log from the Freeradius server: rad_recv: Access-Request packet from host 127.0.0.1 port 59294, id=112, length=298 User-Name = "2219001(a)example.com" Digest-Attributes = 0x0a0932323139303031 Digest-Attributes = 0x01106c696e6b2d726567696f6e2e7275 Digest-Attributes = 0x022254584452634531773045524b7368796f30684a70544f4f6a69424d386b32534a Digest-Attributes = 0x04147369703a6c696e6b2d726567696f6e2e7275 Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x050661757468 Digest-Attributes = 0x090a3030303030303031 Digest-Attributes = 0x080c32383034636535373032 Digest-Response = "e79b47955c02401fe52d05f7956609aa" Service-Type = Sip-Session Sip-Uri-User = "2219001" * User-Name = "call-id=domcmqmnychbwlp@koffe-work"* NAS-Identifier = "kamserv.example.com" NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [digest] Checking for correctly formatted Digest-Attributes [digest] Digest-Attributes look OK. Converting them to something more usful. Digest-User-Name = "2219001" Digest-Realm = "example.com" Digest-Nonce = "TXDRcE1w0ERKshyo0hJpTOOjiBM8k2SJ" Digest-URI = "sip:example.com" Digest-Method = "REGISTER" Digest-QOP = "auth" Digest-Nonce-Count = "00000001" Digest-CNonce = "2804ce5702" [digest] Adding Auth-Type = DIGEST ++[digest] returns ok [suffix] Looking up realm "example.com" for User-Name = "2219001(a)example.com " [suffix] Found realm "example.com" [suffix] Adding Realm = "example.com" [suffix] Proxying request from user 2219001 to realm example.com [suffix] Preparing to proxy authentication request to realm "example.com" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 250 to 127.0.0.1 port 1822 User-Name = "2219001(a)example.com" Digest-Attributes = 0x0a0932323139303031 Digest-Attributes = 0x01106c696e6b2d726567696f6e2e7275 Digest-Attributes = 0x022254584452634531773045524b7368796f30684a70544f4f6a69424d386b32534a Digest-Attributes = 0x04147369703a6c696e6b2d726567696f6e2e7275 Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x050661757468 Digest-Attributes = 0x090a3030303030303031 Digest-Attributes = 0x080c32383034636535373032 Digest-Response = "e79b47955c02401fe52d05f7956609aa" Service-Type = Sip-Session Sip-Uri-User = "2219001" * User-Name = "call-id=domcmqmnychbwlp@koffe-work"* NAS-Identifier = "kamserv.example.com" NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 Proxy-State = 0x313132 Proxying request 1 to home server 127.0.0.1 port 1822 As I understand, this second User-Name attribute has to be a call-id attribute.

3 5

Calls are killed during kamailio restart
by Efelin Novak 04 Mar '11

04 Mar '11

Hi, I'd like to ask whether my situation is normal. During kamailio restart calls are dropped from mediaproxy. Those two programs are connected using kamailio.sock. Why RTP strem is dropped when SIP proxy is restarted? I would expect just undelivered BYE or something. Thanks for answer, Efelin

4 3

WARNING: <core> [db_id.c:281]: identical DB URLs, but different DB connection pid [30123/30107]
by Klaus Darilion 04 Mar '11

04 Mar '11

Any idea what does it mean? Where does it come from? Do I have to change my config? How? WARNING: <core> [db_id.c:281]: identical DB URLs, but different DB connection pid [30123/30107] Thanks Klaus

5 7

re-SUBSCRIBE and Record-Route
by marius zbihlei 04 Mar '11

04 Mar '11

Hello list, An UAC sends a resubscribe in the form SUBSCRIBE sip:Alice@example.com SIP/2.0 Route: <sip:sip.example.com;lr=on> Route:<sip:sip.next-hop.example.com;lr=on> .... The request has a to tag, from tag... Basic resubscribe(R-URI is the same as original SUBSCRIBE) The proxy that handles it is a Kamailio (1.5 but this refers to 3.1 as well). The problem is that loose_route() treats this request as coming from a strict routing router, not from the UAC, so it applies the strict-to-loose rules and rewrites the request as: SUBSCRIBE sip:sip.next-hop.example.com;lr=on SIP/2.0 Route: <sip:sip.example.com;lr=on> .... The segment that handles this is pretty standard: if (loose_route()) { # sequential request withing a dialog should take the path # determined by record-routing if(has_totag()) { forward(); exit; } It sees that message has Route set, it finds the to tag (so the routes were not a preset), and then , the important thing, sees that the domain from the RURI matches itself (kamailio has aliases configured for example.com), thus considering the request as coming from a strict router. Then it takes the bottom Route header and overwrites the RURI. What is the best way to ensure that loose routing is applied to the resubscribe as described above? Cheers, Marius

3 5

Re: [SR-Users] set_dlg_profile() in failure_route
by Timo Reimann 04 Mar '11

04 Mar '11

Hey 侯旭光, please keep SR-Users in CC so others can share in some assistance and benefit from a solution. On 04.03.2011 08:29, 侯旭光 wrote: > I did trace the dialog in the initial REQUEST > > my script: > ... > modparam("dialog","dlg_flag","4") > ... > route{ > > if (is_method("INVITE")){ > dlg_setflag("2"); > dlg_manage(); > ... > if(avp_db_load("$ruri/username","$avp(s:busyforward)")) > { > setflag(26); > t_on_failure(FAIL_ONE); > } > ... > } > failure_route[FAIL_ONE]{ > ... > if(isflagset(26)&&t_check_status("486")) > { > $ru=$avp(s:busyforward); > append_branch(); > dlg_setflag("2"); > avp_delete("$avp(s:busyforward)"); > resetflag("26"); > lookup("location"); > route(RELAY); > } > ... > } > route[RELAY]{ > if(!t_relay()){ > sl_reply_error(); > } > } > #----------------------------------------------------------------------# > > Is anything wrong? You set flag 2 but showed flag 4 to be modparam'ed to the dialog flag. Is that intentional? Anyways, since you are doing dlg_manage() in the INVITE transaction, you should still be fine. Just for the sake of debugging, can you set flag 4 in your 'is_method("INVITE")' block and see if it makes a difference? I have no in-depth experience with on demand dialog tracking as we use the dialog flag exclusively. By the way, I see no calls to set_dlg_profile() in your route logic. Is this really an excerpt of the configuration you are having trouble with? Cheers, --Timo > > 2011/3/3 Timo Reimann <timo.reimann(a)1und1.de>: >> Hi, >> >> >> On 03.03.2011 14:47, 侯旭光 wrote: >>> set_dlg_profile() function carshed in failure_route when I need do the >>> call-forwarding. >>> >>> When in busy-call-forward or no-answer-forward mode ,it'll run into >>> the failure_route.But at the time , the route_type of the dialog is >>> FAILURE_ROUTE and the get_current_dialog() return NULL, >>> >>> then the set_dlg_profile() function won't work. >>> >>> How can I set dialog profile in the busy or no-answer call-forwarding ? >>> >>> CRITIAL dialog [dlg_profile.c]: BUG - dialog not found in non > REQUEST route >>> ERROR dialog [dialog.c] : failed to set profile >> >> I think you did not track the dialog in the first place, i.e., when the >> initial request associated to the dialog you seek to profile was > processed. >> >> Are you using dlg_flag, and if so, have you enabled it in REQUEST_ROUTE? >> If you want to track dialogs on demand instead, try calling dlg_manage() >> prior to calling set_dlg_profile(). I'm not sure if this is the most >> elegant approach for your use case but it might at least work. >> >> >> Cheers, >> >> --Timo

1 1

set_dlg_profile() in failure_route
by 侯旭光 04 Mar '11

04 Mar '11

Hello set_dlg_profile() function carshed in failure_route when I need do the call-forwarding. When in busy-call-forward or no-answer-forward mode ,it'll run into the failure_route.But at the time , the route_type of the dialog is FAILURE_ROUTE and the get_current_dialog() return NULL, then the set_dlg_profile() function won't work. How can I set dialog profile in the busy or no-answer call-forwarding ? LOG file CRITIAL dialog [dlg_profile.c]: BUG - dialog not found in non REQUEST route ERROR dialog [dialog.c] : failed to set profile thanks

2 2

Re: [SR-Users] About RPM of Kamailio
by Ovidiu Sas 02 Mar '11

02 Mar '11

Please post your questions to the mailing list. If you want to build an rpm, the location of the spec file is available in the source tree: ./pkg/kamailio/rpm/kamailio.spec.CenOS If you prefer a link: http://git.sip-router.org/cgi-bin/gitweb.cgi?p=sip-router;a=blob;f=pkg/kama… Regards, Ovidiu Sas On Wed, Mar 2, 2011 at 5:56 AM, Suresh Bhandari <bring2sb(a)yahoo.com> wrote: > Hello Ovidiu, > > I searched through the kamailio.org/pub but can't find what you said. > > Can you verify the exact location of package that you've downloaded. > > Thanks. > Suresh > >

1 0

how to combine alias_db_lookup() with lookup()
by x-kamailio＠sidell.org 02 Mar '11

02 Mar '11

I'm trying to use the db_alias module as a way to define "generic" addresses that map to a set of actual phones. For example, I'd like the alias "home(a)foo.bar" to map to "kitchen(a)foo.bar" and "office(a)foo.bar", so that both phones ring when a call comes in to "home". I have set the append_branches param to 1: modparam("alias_db", "append_branches", 1) I also modified the dbaliases database table so that key "alias_idx" isn't unique, thereby allow me to add multiple rows for the same alias. The relevant script section is taken verbatim from 3.1 kamailio.cfg: # USER location service route[LOCATION] { #!ifdef WITH_ALIASDB # search in DB-based aliases alias_db_lookup("dbaliases"); #!endif if (!lookup("location")) { switch ($rc) { case -1: case -3: xlog( "L_WARN", "XXX $ru $fu\n"); t_newtran(); t_reply("404", "Not Found"); exit; case -2: sl_send_reply("405", "Method Not Allowed"); exit; } } # when routing via usrloc, log the missed calls also if (is_method("INVITE")) { setflag(FLT_ACCMISSED); } } When I place a call to an alias, the kamailio debug log shows that alias_db_lookup() is correctly setting the ruri to the first entry found in the table, and using append_branch() to add the others. But only the first matching phone gets an INVITE, not the others. I suspect that the lookup() call is blowing away the branches set up by alias_db_lookup() and replacing them with the single phone that matches the ruri for the first alias entry. Is there a way to get alias_db_lookup() and lookup() to play together, so that the first function can set up a list of branches, and the second function can resolve all of the branches to the actual device locations? -- Mark Sidell Partner Forte, Inc. 919-942-7068 fax 919-969-2844 www.forteinc.com

2 1

Radius authentication
by Pablo Ros 02 Mar '11

02 Mar '11

I am trying to authenticate through radius (info in LDAP database). I am using kamailio 3.1 First of all I would like to clear up an issue: As shown the way to do the authentication is done with: *Code:* if (! radius_www_authorize("uu.net")) { www_challenge("uu.net", "0"); return; } Ok, when I installed openser I did it with kamailio "flavour" so it was using the auth_radius module belonging to it. Does anyone know which would be the correct way to do the challenge to the user cause is was not working at all. The radius client does not even send it. I got stuck some time till I just decided to load the module from ser modules folder and then freeradius server started to get correctly my requests. Actually I can even see it authenticates them correctly. However Openser/Kamailio doesn't seem to see the same and it doesn't saves location. *Code:* route[AUTH] { #!ifdef WITH_AUTH # Primeramente comprobamos si pertenece a nuestro dominio; si no ya no hace falta comprobar credenciales. if (uri==myself) { if (is_method("REGISTER")) { xlog("L_NOTICE","KAM-INFO: r[AUTH] - REGISTER - User info: ($fu):($si)>\n"); if (!radius_www_authorize("i2cat.net")){ route(RADIUS); #www_challenge("i2cat.net","0"); exit; } } if ($au!=$tU) { sl_send_reply("403","Forbidden auth ID"); exit; } } else { #!ifdef WITH_IPAUTH if(allow_source_address()) { # source IP allowed return; } #!endif # authenticate if from local subscriber if (from_uri==myself) { if (!proxy_authorize("$fd", "subscriber")) { proxy_challenge("$fd", "0"); exit; } if (is_method("PUBLISH")) { if ($au!=$tU) { sl_send_reply("403","Forbidden auth ID"); exit; } } else { if ($au!=$fU) { sl_send_reply("403","Forbidden auth ID"); exit; } } consume_credentials(); # caller authenticated } else { # caller is not local subscriber, then check if it calls # a local destination, otherwise deny, not an open relay here if (!uri==myself) { sl_send_reply("403","Not relaying"); exit; } } } #!endif return; } Before doing the challenge then it just goes throught: *Code:* route[RADIUS] { sl_send_reply("100", "Trying"); append_to_reply("Expires: 600\r\n"); append_to_reply("Min-Expires: 240\r\n"); xlog("L_NOTICE","KAM-INFO: RADIUS AUTHENTICATION - AUTHORIZING USER $fU - <$fu>:<$si>\n"); xlog("L_NOTICE","KAM-INFO: CHALLENGING. - RETCODE-> $rc \n"); www_challenge("i2cat.net", "0"); switch($rc){ case -5: xlog("L_INFO", "-> 500: internal server error"); sl_send_reply("500", "Internal Server Error"); case -4: xlog("L_INFO", "-> 404: credentials not found"); sl_send_reply("404", "Credentials Not Found"); case -3: xlog("L_INFO", "-> 400: bad request - stale nonce"); sl_send_reply("400", "Bad Request"); case -2: xlog("L_INFO", "-> 401: invalid password"); sl_send_reply("401", "Invalid Password"); case -1: xlog("L_INFO", "-> 401: invalid user"); sl_send_reply("401", "Invalid User"); default: xlog("L_INFO", "-> 401: unauthorized"); sl_send_reply("401", "Unauthorized"); } } Buuuuuuuuuuuuut... I got that in the debug of Kamailio: *Code:* 4(31099) DEBUG: auth [api.c:95]: auth: digest-algo: MD5 parsed value: 1 4(31099) DEBUG: auth_radius [sterman.c:271]: radius_authorize_sterman(): Success 4(31099) WARNING: auth_radius [authorize.c:89]: RADIUS server did not send SER-UID attribute in digest authentication reply 4(31099) DEBUG: auth [challenge.c:102]: build_challenge_hf: realm=' i2cat.net' 4(31099) DEBUG: auth [challenge.c:113]: build_challenge_hf: qop='auth' 4(31099) DEBUG: auth [challenge.c:236]: auth: 'WWW-Authenticate: Digest realm="i2cat.net", nonce="TWZJLk1mSAKFVzL0b+dVPzkuyyAnZHQs", qop="auth" I guess it has something to do with this SER-UID attribute and thus something about the dictonary? It is weird seeing that the radius server says 'ok' but then openser is not authenticating it. I need some clues! Thank you!. -- Pablo Ros

2 1

rtpproxy and connection information field
by Dominguez Jover, Ricardo 01 Mar '11

01 Mar '11

Hi all, I'm using rtpproxy 1.2.1 and kamailio. RTPproxy is working fine in almost every case. However I have a problem with some call. When softphone A using sip2sip.info account calls softphone B using my Kamailio server account, the Kamilio receives SIP packets from IP1 (81.23.228.129). The invite packet has IP2 (81.23.228.150) in the conecction information field (c=IN IP4 81.23.228.150): INVITE sip:12345@xxxxxxxx.xxx;transport=udp SIP/2.0 Record-Route: <sip:81.23.228.129;lr;ftag=d9e99adf;did=e81.3538c317> Via: SIP/2.0/UDP 81.23.228.129;branch=z9hG4bKd14b.12802794.0 Via: SIP/2.0/UDP 192.168.xx.xx:7964;received=88.xx.xx.xx;branch=z9hG4bK-d8754z-8ba1b4b47e37bb89-1---d8754z-;rport=7964 Max-Forwards: 69 Contact: <sip:54321@88.xxx.xxx.xxx:7964;transport=udp> To: "2205"<sip:12345@xxxxxxxx.xxx> From: "R sip2sip"<sip:54321@sip2sip.info>;tag=d9e99adf Call-ID: OGE5MTFiMzljZjE0NTYxN2M0N2VkZjgzNDRhMzE2ZTA. CSeq: 2 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent:xxxxxxxxxxxxxxxxxxxxxxxxx Content-Length: 279 v=0 o=- 12943454020854250 1 IN IP4 192.168.xxx.xx s=xxxxxxxxxxxxxxxxxxxx c=IN IP4 81.23.228.150 t=0 0 m=audio 52854 RTP/AVP 107 0 8 18 101 a=rtpmap:107 BV32/16000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=yes a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=sendrecv Then Kamilio translates "c=" IP address to my RTPproxy IPaddress and sends the INVITE to softphone B. After the OK softphone B sends RTP packets to the RTPproxy as specified in the "c=" field, however the RTPproxy sends RTP packets to IP1 instead of send packets to IP2. How can I tell the RTPproxy to send packets to IP2 (the one in the c= field?) Thanks, Ricardo Dominguez

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users March 2011