January 2020 - sr-users

Parallel forking and rtpengine handling
by Sebastian Damm 24 Jan '20

24 Jan '20

Hi, our scenario is the following: We have two clients registered to our Kamailio server, one with a TLS capable phone, one via websocket. Now, when a call comes in, the call is forked and is sent out to both clients. rtpengine handling is done in the branch route, so there are two offers, and we use the "via-branch" parameter. Now, when one branch answers the call, what happens to the other branch? I there a way to delete the other branch? How and in which route? Or does Kamailio do this automatically? I'm happy for a hint. Regards, Sebastian -- Sebastian Damm Voice Engineer __________________________________________ sipgate GmbH

5 8

Re: [SR-Users] TLS verification error LetsEncrypt
by Social Boh 24 Jan '20

24 Jan '20

I'm not sure but with let's encrypt you can create only server certificate, not client certificate so you can't require and verify client certificate. Regards --- I'm SoCIaL, MayBe El 24/01/2020 a las 09:01, Bugaian A. Vitalie escribió: > Ok, thanks. > > But my question is still about why verification fails/or what should > be chked to make it work. Not how to disable it. > > Thanks. > > Vitalie. > > On Fri, Jan 24, 2020 at 2:54 PM Social Boh <social(a)bohboh.info > <mailto:social@bohboh.info>> wrote: > > Hello, > > changing: > > [client:default] > #method = TLSv1.2+ > verify_certificate = yes > > require_certificate = yes > > with > > [client:default] > #method = TLSv1.2+ > verify_certificate = no > require_certificate = no > > --- > I'm SoCIaL, MayBe > > El 24/01/2020 a las 08:46, Bugaian A. Vitalie escribió: >> Hello list, >> >> I have tried to setup my tls config tish LetsEncrypt following >> this post: >> >> https://www.fredposner.com/1836/kamailio-tls-and-letsencrypt/ >> >> My tls config looks like this: >> >> >> [server:default] >> method = TLSv1.2+ >> verify_certificate = no >> require_certificate = no >> private_key = /etc/letsencrypt/live/sbc.example.net-0001/privkey.pem >> certificate = >> /etc/letsencrypt/live/sbc.example.net-0001/fullchain.pem >> ca_list = /etc/letsencrypt/live/sbc.example.net-0001/ca_list.pem >> #ca_list = /usr/local/etc/kamailio/tls/cacert.pem >> #crl = /usr/local/etc/kamailio/tls/crl.pem >> server_name = sbc.example.net <http://sbc.example.net> >> server_id = sbc.example.net <http://sbc.example.net> >> >> #ca_list = /usr/local/etc/fullchain.pem >> #ca_list = /usr/local/etc/kamailio/tls/cacert.pem >> #crl = /usr/local/etc/kamailio/tls/crl.pem >> >> >> # --- >> # This is the default client domain profile. >> # Settings in this domain will be used for all outgoing >> # TLS connections that do not match any other >> # client domain in this configuration file. >> # We require that servers present valid certificate. >> # >> [client:default] >> #method = TLSv1.2+ >> verify_certificate = yes >> require_certificate = yes >> >> =================================== >> My ca_list has all certificates from >> cat /etc/ssl/certs/ca-certificates.crt >> >> /etc/letsencrypt/live/sbcc.example.net/ca_list.pem >> <http://sbcc.example.net/ca_list.pem> >> >> I keep getting certificate validation failed see bellow: >> >> an 24 08:39:56 sbc.example.net <http://sbc.example.net> >> /usr/local/sbin/kamailio[6371]: ERROR: tls [tls_util.h:42]: >> tls_err_ret(): TLS write:error:1416F086:SSL >> routines:tls_process_server_certificate:certificate verify failed >> Jan 24 08:39:56 sbc.example.net <http://sbc.example.net> >> /usr/local/sbin/kamailio[6371]: ERROR: <core> >> [core/tcp_read.c:1505]: tcp_read_req(): ERROR: tcp_read_req: >> error reading - c: 0x7f0474421f68 r: 0x7f0474422028 (-1) >> Jan 24 08:39:56 sbc.example.net <http://sbc.example.net> >> /usr/local/sbin/kamailio[6370]: ERROR: tls [tls_util.h:42]: >> tls_err_ret(): TLS write:error:1416F086:SSL >> routines:tls_process_server_certificate:certificate verify failed >> Jan 24 08:39:56 sbc.example.net <http://sbc.example.net> >> /usr/local/sbin/kamailio[6370]: ERROR: <core> >> [core/tcp_read.c:1505]: tcp_read_req(): ERROR: tcp_read_req: >> error reading - c: 0x7f0474401cb8 r: 0x7f0474401d78 (-1) >> >> ===================== >> >> What params should I change or where to look for a solution on >> this one? >> >> Thanks. >> >> Vitalie A. Bugaian. >> >> _______________________________________________ >> Kamailio (SER) - Users Mailing List >> sr-users(a)lists.kamailio.org <mailto:sr-users@lists.kamailio.org> >> https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users >

2 1

TLS verification error LetsEncrypt
by Bugaian A. Vitalie 24 Jan '20

24 Jan '20

Hello list, I have tried to setup my tls config tish LetsEncrypt following this post: https://www.fredposner.com/1836/kamailio-tls-and-letsencrypt/ My tls config looks like this: [server:default] method = TLSv1.2+ verify_certificate = no require_certificate = no private_key = /etc/letsencrypt/live/sbc.example.net-0001/privkey.pem certificate = /etc/letsencrypt/live/sbc.example.net-0001/fullchain.pem ca_list = /etc/letsencrypt/live/sbc.example.net-0001/ca_list.pem #ca_list = /usr/local/etc/kamailio/tls/cacert.pem #crl = /usr/local/etc/kamailio/tls/crl.pem server_name = sbc.example.net server_id = sbc.example.net #ca_list = /usr/local/etc/fullchain.pem #ca_list = /usr/local/etc/kamailio/tls/cacert.pem #crl = /usr/local/etc/kamailio/tls/crl.pem # --- # This is the default client domain profile. # Settings in this domain will be used for all outgoing # TLS connections that do not match any other # client domain in this configuration file. # We require that servers present valid certificate. # [client:default] #method = TLSv1.2+ verify_certificate = yes require_certificate = yes =================================== My ca_list has all certificates from cat /etc/ssl/certs/ca-certificates.crt >> /etc/letsencrypt/live/ sbcc.example.net/ca_list.pem I keep getting certificate validation failed see bellow: an 24 08:39:56 sbc.example.net /usr/local/sbin/kamailio[6371]: ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS write:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed Jan 24 08:39:56 sbc.example.net /usr/local/sbin/kamailio[6371]: ERROR: <core> [core/tcp_read.c:1505]: tcp_read_req(): ERROR: tcp_read_req: error reading - c: 0x7f0474421f68 r: 0x7f0474422028 (-1) Jan 24 08:39:56 sbc.example.net /usr/local/sbin/kamailio[6370]: ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS write:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed Jan 24 08:39:56 sbc.example.net /usr/local/sbin/kamailio[6370]: ERROR: <core> [core/tcp_read.c:1505]: tcp_read_req(): ERROR: tcp_read_req: error reading - c: 0x7f0474401cb8 r: 0x7f0474401d78 (-1) ===================== What params should I change or where to look for a solution on this one? Thanks. Vitalie A. Bugaian.

1 0

Releasing Kamailio v5.2.6
by Henning Westerholt 24 Jan '20

24 Jan '20

Hello, after the release of Kamailio 5.3.2 it is time to also release another minor version for the branch 5.2. I plan to release Kamailio 5.2.6 next Friday, 24th January 2020, if there are no new reports of relevant issues that make us to reconsider and postpone. Cheers, Henning -- Henning Westerholt - https://skalatan.de/blog/ Kamailio services - https://gilawa.com<https://gilawa.com/>

1 1

Ideas to reject a call due to RTPEngine failure when handling the 200Ok
by Patrick Wakano 23 Jan '20

23 Jan '20

Hello list, Hope you all doing well! I have a setup of Kamailio + RTPEngine (so no B2BUA), and I've come to a situation which I can't really figure out the best decision..... The case is a late SDP negotiation that the 200Ok with the SDP offer fails to engage the RTPEngine (for example no RTPEngine available). Also, the same problem can happen with a normal SDP negotiation, in case the INVITE goes through normally but then when engaging the SDP answer for the 200Ok, the RTPengine answer request fails for any reason... In these cases, I can't generate a proper SDP for the 200OOk so the call will connect normally, but the media path will be broken... So for such cases, I am thinking it is reasonable to fail the call. However, failing a call during the 200Ok stage is tricky, at this point we can't convert the 200Ok to a 50X. I tried and Kamailio doesn't allow and also RFC wise this is a no no for a SIP proxy.... I could completely remove the SDP body and forward the 200Ok. This will force a failed SDP negotiation and leave it for the endpoints the task to terminate the call. Is that acceptable? Has anyone faced such situation? Any idea is much appreciated! Kind regards, Patrick Wakano

2 2

uac_replace_from and uac_auth fails to authenticate.
by Kjeld Flarup 23 Jan '20

23 Jan '20

I have a setup where I have a fallback to a GSM number I look up the GSM number and provider information in a database and sets the headers. dlg_manage(); $du = "sip:" + $dbr(ra=>[0,0]); $tu = "sip:"+$rU+"@"+$dbr(ra=>[0,0]); $ru = "sip:"+$rU+"@"+$dbr(ra=>[0,0]); uac_replace_from("sip:"+$dbr(ra=>[0,1])+"@EXTERNALIP"); After this the call goes to a failure_route to do uac_auth() Now my problem is that this works with the providers Asterisk server. But if the call is send to the providers Kamailio server, authentication is rejected. Removing uac_replace_from makes the call accepted on the Kamailio server The only possible problem I can see is that the first INVITE without authentication, has correct From header. But the second with the nonce and auth, uses the wrong From header. Thus two different From headers in the same SIP dialog. Unfortunately uac_replace_from is not allowed in failure_route, so I could test if this is the problem. Is the two different From headers a problem, and how could that be fixed. -- -------------------- Med Liberalistiske Hilsner ---------------------- Civilingeniør, Kjeld Flarup - Mit sind er mere åbent end min tegnebog Sofienlundvej 6B, 7560 Hjerm, Tlf: 40 29 41 49 Den ikke akademiske hjemmeside for liberalismen - www.liberalismen.dk

5 6

ims_ipsec_pcscf mandatory for ims_registrar_pcscf ?
by Hamid Hashmi 23 Jan '20

23 Jan '20

According to Module documentation ims_ipsec_pcscf is not mandatory [cid:9c92ff73-4978-4837-b541-a38e15525140] but mod: ims_registrar_pcscf is giving error on ims_ipsec_pcscf. Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: ims_registrar_pcscf [ims_registrar_pcscf_mod.c:253]: mod_init(): Successfully bound to TM module Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: <core> [core/sr_module.c:632]: find_mod_export_record(): found export of <ul_bind_ims_usrloc_pcscf> in module ims_usrloc_pcscf [/opt/lib64/kamailio/modules/ims_usrloc_pcscf.so] Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: ims_registrar_pcscf [ims_registrar_pcscf_mod.c:264]: mod_init(): Successfully bound to PCSCF Usrloc module Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: <core> [core/sr_module.c:638]: find_mod_export_record(): export of <bind_ims_ipsec_pcscf> not found (flags 0) Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: ERROR: ims_registrar_pcscf [ims_registrar_pcscf_mod.c:268]: mod_init(): can't bind ims_ipsec_pcscf Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: ERROR: <core> [core/sr_module.c:849]: init_mod(): Error while initializing module ims_registrar_pcscf (/opt/lib64/kamailio/modules/ims_registrar_pcscf.so) Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: cdp_avp [cdp_avp_mod.c:225]: cdp_avp_destroy(): Destroying module cdp_avp Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: WARNING: <core> [core/mem/q_malloc.c:487]: qm_free(): WARNING: free(0) called from cdp_avp: cdp_avp_mod.c: cdp_avp_destroy(226) Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: INFO: cdp [cdp_mod.c:255]: cdp_exit(): CDiameterPeer child stopping ... Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: INFO: cdp [cdp_mod.c:257]: cdp_exit(): ... CDiameterPeer child stopped Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: tcpops [tcpops_mod.c:156]: mod_destroy(): TCP keepalive module unloaded. Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: tm [t_funcs.c:84]: tm_shutdown(): start Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: tm [t_funcs.c:87]: tm_shutdown(): emptying hash table Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: tm [t_funcs.c:89]: tm_shutdown(): removing semaphores Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: tm [t_funcs.c:91]: tm_shutdown(): destroying tmcb lists Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: tm [t_funcs.c:94]: tm_shutdown(): done Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: INFO: <core> [core/sctp_core.c:53]: sctp_core_destroy(): SCTP API not initialized Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: <core> [core/mem/shm.c:288]: shm_destroy_manager(): destroying memory manager: q_malloc Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: <core> [core/mem/q_malloc.c:1185]: qm_shm_lock_destroy(): destroying the shared memory lock Jan 3 02:19:09 CSCFNode2 [Proxy-CSCF][833]: DEBUG: <core> [core/mem/pkg.c:97]: pkg_destroy_manager(): destroying memory manager: q_malloc There is no option to use ims_registrar_pcscf without ims_ipsec_pcscf. [cid:ec21fdae-7d7e-437c-a7ea-6345f36a1428] Regards Hamid R. Hashmi

2 3

rtpengine relay ip and port in avp
by Pafel 23 Jan '20

23 Jan '20

Hello, I am using kamailio 5.3, rtproxy module and sipwise rtpengine. Is there any way I can get the rewritten / relay address and port by the rtpproxy/rtpengine. In avp or some other variable? Regards, Pavel Siderov

2 2

Param.valueat not returning special chars
by Duarte Rocha 21 Jan '20

21 Jan '20

Hello, I've run into a problem while using parameters parsing tools from Kamailio. When i request the value of a parameter it discards some characters like "" for example. Here is an example : $var(Parameters) = "kamailio=\"version5\";sip=hey"; xerr("String Parameter = $var(Parameters)"); xerr("Parameter on position 1 = $(var(Parameters){param.name,0}) and has value = $(var(Parameters){param.valueat,0})"); This code returns : ERROR: <script>: String Parameter = kamailio="version5";sip=hey ERROR: <script>: Parameter on position 0 = kamailio and has value = version5 Is there anything i can do to get the original string? I'm running Kamailio 5.2.0. Best Regards, Duarte Rocha

1 0

Printing xavp
by Ovidiu Sas 21 Jan '20

21 Jan '20

What's the best way to print the entire content of an xavp? The xavp_params_implode() doesn't print the entire stack of an xavp, only the top layer: The following code produces "c=d;e=f;" $xavp(x=>e) = "f"; $xavp(x[0]=>c) = "d"; $xavp(x[1]=>e) = "z"; $xavp(x[1]=>c) = "y"; xavp_params_implode("x", "$var(out)"); Is there a way to print everything inside $xavp(x)? Thanks, Ovidiu

3 10