sr-users May 2015

sr-users@lists.kamailio.org

80 participants
114 discussions

Strange behavior for TCP and UDP SIP Routing

by Grant Bagdasarian

Hello, I have a Kamailio machine configured with two interfaces. One public, one private. Public Address: 10.10.10.10 Private Address: 192.168.1.10 Kamailio forwards the SIP packet to another local endpoint: 192.168.1.20 When a client sends a SIP packet using TCP to the public address of Kamailio, Kamailio relays the packet using its private interface (private address) to the other endpoint. TCP: Client -> 10.10.10.10 -> 192.168.1.10 -> 192.18.1.20 When a client sends a SIP packet using UDP to the public address of Kamailio, Kamailio (or the OS) relays the packet using its public interface (public address) to the other endpoint. UDP: Client -> 10.10.10.10 -> 10.10.10.10 -> 192.18.1.20 In the case of TCP, the source address is 192.168.1.10. In the case of UDP, the source address is 10.10.10.10. Everything is the same in the routing script for both UDP and TCP, except in route[relay] (see below) Is this normal? What is causing this, the OS or Kamailio? Route[RELAY] { ... if($pr =~ "TCP") { if (!t_relay_to_tcp()) { sl_reply_error(); } } else { if (!t_relay_to_udp()) { sl_reply_error(); } } }

8 years, 12 months

rtpengine, turn fallback

by Isuru Wijesinghe

Hi All I'm using rtpengine to in my implementation of webrtc. In my client side browser I have used following code snippet to configure stun/turn servers to identify ice candidates and turn fall back. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> var pcConfig = {"iceServers": [ {'url': 'turn:52.6.57.126:3478?transport=tcp'}]}; peerConn = new PeerConnection(pcConfig); >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Am using rfc 5766 turn server http://code.google.com/p/rfc5766-turn-server/ As long as stun is working my webrtc flow works fine. I wanted to know how rtpengine support the turn fallback, is there any configuration required in this case. Regards Isuru

8 years, 12 months

Double record routes

by Mickael Marrache

Hi, We are adding TCP support to our load balancer and for some reason it adds two record route headers. The instance have two IP addresses on which it binds: one if the VIP address and the second is the non-VIP address. I explicitly set the tcp_source_ipv4 parameter with the VIP address so that it is used as source address for outbound TCP connection. So, we get the following INVITE going from the load balancer to a proxy: T 2015/05/05 12:08:49.715822 VIP:54667 -> PROXY:5060 [AP] INVITE sip:123@mycompany.com SIP/2.0. Record-Route: <sip:NONVIP;transport=tcp;r2=on;lr>. Record-Route: <sip:VIP;transport=tcp;r2=on;lr>. Via: SIP/2.0/TCP NONVIP;branch=z9hG4bK6f4.688efa90a17e02181ef7a11fecf8bb72.0;i=3. Via: SIP/2.0/TCP 1.1.1.1:4598;received=2.2.2.2;branch=z9hG4bKmqFaCxNo6m3f5LW4;rport=40020. You can see the INVITE is sent from the VIP address (as specified using the tcp_source_ipv4 parameter). However, the added Via corresponds to the non-VIP address. Also, you can see the two record route headers added for both addresses. Any idea? Thanks, Mickael

8 years, 12 months

sht_rm_name_re() question

by Yufei Tao

Hi I've hit a problem with sht_rm_name_re() in htable module. I was calling it like this: sht_rm_name_re("Dlg=>$var(callid)::tenant"); But when I used sipp to generate 600 concurrent calls for example, I called this function when receiving BYE. But it removed more entries than it should. Seems when removing removing some entry with callid 1-3798(a)192.168.60.80, it also removed entries for [1-9]1-3798(a)192.168.60.80. How do I add '^' in front and '$' at the end of the regexp string when calling this function please? Here I don't really need regexp in fact, just want to do an exact match. But I didn't find any other functions for deleting entries. Thank you! Yufei

8 years, 12 months

UAC not answer with new register after 401 reply from porvider

by Yuriy Gorlichenko

Hello. We have an issue with REGISTER to Provider. When Provider answers 401 Kamailio don't send any REGISTER with digest auth IP ourservice.com.5068 > provider.dev.5060: UDP, length 468 E...U...@.3' ..............AREGISTER sip:provider.dev SIP/2.0 Via: SIP/2.0/UDP ourservice.com:5068 ;branch=z9hG4bK4238.45a4a626000000000000000000000000.0 To: <sip:login@provider.dev> From: <sip:login@provider.dev>;tag=6a39af2190f8b2c99cc63bfeb3a3959c-1ff8 CSeq: 10 REGISTER Call-ID: 1b3f9f5d5822eca2-16804(a)ourservice.com Max-Forwards: 70 Content-Length: 0 User-Agent: kamailio (4.3.0-dev5 (x86_64/linux)) Contact: <sip:login@ourservice.com:5068> Expires: 360 IP provider.dev.5060 > ourservice.com.5068: UDP, length 572 E..XC...-.W..... ........DkJSIP/2.0 401 Unauthorized Via: SIP/2.0/UDP ourservice.com:5068 ;branch=z9hG4bK4238.45a4a626000000000000000000000000.0;received=23.100.24.250 From: <sip:login@provider.dev>;tag=6a39af2190f8b2c99cc63bfeb3a3959c-1ff8 To: <sip:login@provider.dev>;tag=as6ad61d4a Call-ID: 1b3f9f5d5822eca2-16804(a)ourservice.com CSeq: 10 REGISTER Server: FastTel SoftSwitch Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH Supported: replaces WWW-Authenticate: Digest algorithm=MD5, realm="provider.dev", nonce="63fc6951" Content-Length: 0

8 years, 12 months

Kamailio proxy for far-end nat traversal

by rahul.ultimate

Hello I need a small guidance on creating a light weight proxy which only forwards the msgs to my sip server and also does supports symmetrical nated clients. The way I have created the configuration is a slight modification of : https://github.com/xlab1/sipfe_kamailio/blob/master/kamailio.cfg Problem is unless the sip clients use STUN media packets are not routed. And sometimes even the signalling does not pass through. Should i not use fix_nated_register and switch to fix _ nated_contact always ? Because in all those cases where signalling does not pass through, I see RTO. My best guess is kamailio trying to communicate with private ip. Anything which I can try that you could suggest from the top of yourmind woyld be muc appreciated. Thanks Rahul Sent from Samsung Mobile

8 years, 12 months

Re: [SR-Users] issue with TLS and 2 NIC interfaces

by Slava Bendersky

Hello Vik, I have similar setup, try define you server configuration in tls.cfg [server:ip address of alias interface:port of alias interface] method = TLSv1 verify_certificate = no require_certificate = no private_key = certificate = ca_list = crl = Slava From: "Vik Killa" <vipkilla(a)gmail.com> To: "sr-users" <sr-users(a)lists.sip-router.org> Sent: Wednesday, April 29, 2015 4:32:21 PM Subject: [SR-Users] issue with TLS and 2 NIC interfaces Hello, if i have two interfaces (eth0 and eth0:0) I set kamailio to listen to the IP on eth0:0 This works great except when I try using TLS, kamailio routes traffic from eth0:0 to eth0 then to correct destination It should be just doing eth0:0 -> correct destination If I use UDP/TCP I am not seeing this behavior. If I set kamailio to listen to eth0 and remove eth0;0, TLS works fine. I'm running kamailio compiled from source git master a few days ago. Is anyone else having this problem? I'm wondering if it's a bug. Thanks, V _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users(a)lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

9 years

kamcli - kamailio command line control tool

by Daniel-Constantin Mierla

Hello, we just published a new command line tool for Kamailio management, named now kamcli, available at: * https://github.com/asipto/kamcli It is written in Python and adapted from a tool provided originally by a subcontractor for a specific deployment. While not being Python developers here, the benefits and flexibility proved extremely good. At this stage it is more an attempt to see if the community finds it useful and worth to get it developed further as part of Kamailio project. Short about the benefits/flexibility: - python is by default installed on OSes (including Mac OS X) (as opposite to Lua, for example) - became rather fast since Google invested in it - lot more knowledge base and developers out there (as opposite to Lua or Perl), along with tons of extensions - implementation is based on a CLI framework (Click) that makes it extremely easy to add new commands in a plugin-like fashion, therefore is easy to have custom commands when having specific needs (e.g., managing a custom database table used in kamailio.cfg via sqlops => add a new cmd_xyz.py in commands subfolder, without touching other files, not even the config) - help message is embedded in the command code file, making it easier to document commands - easy to validate parameters as well as format the output - handling kamcli configuration file options is also easy (ini format) One of my reasons of pushing this out was in the perspective of deprecating MI and working with JSONRPC fifo from command line -- I couldn't find easy ways to manage json docs with shell and common tools (e.g., cat, echo, grep, awk) only. Kamcli has implemented the JSONRPC over fifo command (see also jsonrpc-s kamailio module). Still, given the old initial implementation, at this moment, kamcli is relying on MI via fifo (mi_fifo) for some of the commands (e.g., dumping usrloc records from memory) -- (Just as side note: perhaps here we need to do a mapping, because name of commands are different, if we want to make a 'ctl transport agnostic' tool.) Here are few things to decide: - does it sound useful and are people finding it worth to develop it further? - what about the name, is it ok? Another one? If worth developing and deciding on the name, then the plan is to host the project on kamailio organization on github so each kamailio developer can code on it (it won't be inside kamailio source code tree, but a separate project inside same organization). So far, couple of commands were implemented when comparing with kamctl: - subscriber management (kamctl add/rm/passwd...) - user location management (kamctl ul ...) - database querying (kamctl db ...) - statistics (kamctl stats ...) - mi commands (kamctl mi ...) - jsonrpc commands (not in kamctl) While cross posted for the sake of getting the info to everyone in the community, let's have further discussions on sr-dev. Cheers, Daniel -- Daniel-Constantin Mierla http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda Kamailio World Conference, May 27-29, 2015 Berlin, Germany - http://www.kamailioworld.com

9 years

TLSv1.2 and weak ciphers

by Attila Megyeri

Hi Daniel, Kamailio folks, We are trying to make our server more secure, but we have some issues. Right now, we have set the TLS method to method = TLSv1+ and cipher_list = HIGH The problem is, that there are still cipher suites offered which are not secure. E.g. If I check with the SSLLabs analizer, I see: This server supports anonymous (insecure) suites (see below for details). Grade set to F. Cipher Suites (SSL 3+ suites in server-preferred order; deprecated and SSL 2 suites always at the end) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH 256 bits (eq. 3072 bits RSA) FS 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH 256 bits (eq. 3072 bits RSA) FS 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH 256 bits (eq. 3072 bits RSA) FS 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x6b) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (0x88) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 256 TLS_ECDH_anon_WITH_AES_256_CBC_SHA (0xc019) INSECURE 256 TLS_DH_anon_WITH_AES_256_GCM_SHA384 (0xa7) INSECURE 256 TLS_DH_anon_WITH_AES_256_CBC_SHA256 (0x6d) INSECURE 256 TLS_DH_anon_WITH_AES_256_CBC_SHA (0x3a) INSECURE 256 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA (0x89) INSECURE 256 TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d) 256 TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) 256 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x84) 256 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) ECDH 256 bits (eq. 3072 bits RSA) FS 112 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x16) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 112 TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA (0xc017) INSECURE 112 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA (0x1b) INSECURE 112 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH 256 bits (eq. 3072 bits RSA) FS 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH 256 bits (eq. 3072 bits RSA) FS 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH 256 bits (eq. 3072 bits RSA) FS 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x67) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (0x45) DH 3072 bits (p: 384, g: 1, Ys: 384) FS 128 TLS_ECDH_anon_WITH_AES_128_CBC_SHA (0xc018) INSECURE 128 TLS_DH_anon_WITH_AES_128_GCM_SHA256 (0xa6) INSECURE 128 TLS_DH_anon_WITH_AES_128_CBC_SHA256 (0x6c) INSECURE 128 TLS_DH_anon_WITH_AES_128_CBC_SHA (0x34) INSECURE 128 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA (0x46) INSECURE 128 TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) 128 TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) 128 TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x41) 128 How can we get rid of these _anon_ cipher suites? Thanks Attila

9 years

Auth User & is_subscriber

by jay binks

Hey, from the examples it looks like the typical usage of is_subscriber is with $fu ( From User ), however im not 100% sure I want this. in-fact, I want it to be the Auth User that is used. After all if a call was Authed, then we authoritatively know what user it is, and I think this should be used over and above the from user ( which could even be set to caller Id in some cases ). Im having some trouble getting is_subscriber to work with the Auth user, does anyone have an example of this working somewhere ? -- Sincerely Jay

9 years

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users May 2015