sr-users March 2021

sr-users@lists.kamailio.org

61 participants
67 discussions

Kamailio how to make UAC challenge on Dispatcher failure route

by Antonio Couto

I have one Kamailio that makes an outbound register on two Asterisk. I have a dispatcher with that same two Asterisk destinations, on INVITE message I call replace_from("", ) in order to call a internal extension and on failure route I receive 401 and call the process of authorization is OK. The problem is that if the first Asterisk fail and I get 500 on failure route I can not call replace_from() because is not valid on the block. Is there any way to make this type of authorization process after receiving a 500 on failure route of dispatcher ? Below my cfg file. Thanks in advance. Antonio Couto #!KAMAILIO#!ifdef WITH_DEBUG#!define DBGLEVEL 3#!else#!define DBGLEVEL 2#!endif # - flags# FLT_ - per transaction (message) flags# FLB_ - per branch flags#!define FLT_ACC 1#!define FLT_ACCMISSED 2#!define FLT_ACCFAILED 3#!define FLT_NATS 5 #!define FLB_NATB 6#!define FLB_NATSIPPING 7 ####### Global Parameters ######### /* LOG Levels: 3=DBG, 2=INFO, 1=NOTICE, 0=WARN, -1=ERR, ... */ debug=DBGLEVEL /* set to 'yes' to print log messages to terminal or use '-E' cli option */log_stderror=no memdbg=5 memlog=5 log_facility=LOG_LOCAL0log_prefix="{$mt $hdr(CSeq) $ci} " children=8 auto_aliases=noenable_tls=noenable_sctp=no tcp_accept_no_cl=yes # SIP port listen=udp:192.168.0.201:5060# xhttp port listen=tcp:127.0.0.1:8181 loadmodule "xhttp.so" loadmodule "jsonrpcs.so" loadmodule "kex.so" loadmodule "corex.so" loadmodule "tm.so" loadmodule "tmx.so" loadmodule "sl.so" loadmodule "rr.so" loadmodule "pv.so" loadmodule "maxfwd.so" loadmodule "textops.so" loadmodule "siputils.so" loadmodule "xlog.so" loadmodule "sanity.so" loadmodule "ctl.so" loadmodule "acc.so" loadmodule "dispatcher.so" loadmodule "htable.so" loadmodule "db_text.so" loadmodule "dialog.so" loadmodule "uac.so" # ----------------- setting module-specific parameters --------------- # ----- jsonrpcs params ----- modparam("jsonrpcs", "pretty_format", 1) modparam("jsonrpcs", "transport", 1) # ----- sanity params ----- modparam("sanity", "autodrop", 0) # ----- tm params -----# default retransmission timeout: 2sec modparam("tm", "fr_timer", 1500)# default invite retransmission timeout after 1xx: 40sec modparam("tm", "fr_inv_timer", 40000) # ----- rr params -----# set next param to 1 to add value to ;lr param (helps with some UAs) modparam("rr", "enable_full_lr", 0) modparam("rr", "append_fromtag", 1) # account triggers (flags) modparam("acc", "log_flag", FLT_ACC) modparam("acc", "failed_transaction_flag", FLT_ACCFAILED) modparam("acc", "log_extra", "src_user=$fU;src_domain=$fd;src_ip=$si;" "dst_ouser=$tU;dst_user=$rU;dst_domain=$rd") # ----- dispatcher params ----- modparam("dispatcher", "list_file", "/etc/kamailio/dispatcher.list") modparam("dispatcher", "flags", 2) modparam("dispatcher", "xavp_dst", "_dsdst_") modparam("dispatcher", "xavp_ctx", "_dsctx_") modparam("dispatcher", "ds_ping_method", "OPTIONS") modparam("dispatcher", "ds_ping_from", "sip:proxy@kamailio.org") modparam("dispatcher", "ds_ping_interval", 1) modparam("dispatcher", "ds_probing_mode", 1) modparam("dispatcher", "ds_probing_threshold", 1) modparam("dispatcher", "ds_inactive_threshold", 1) modparam("dispatcher", "ds_timer_mode", 1) modparam("db_text", "db_mode", 1) modparam("db_text", "emptystring", 1) modparam("dialog", "dlg_flag", 4) modparam("dialog", "track_cseq_updates", 1) modparam("uac", "restore_dlg", 1) modparam("uac", "reg_db_url", "text:///etc/kamailio/dbtext") modparam("uac", "reg_db_table", "uacreg") modparam("uac", "reg_timer_interval", 60) modparam("uac", "reg_retry_interval", 60) modparam("uac", "reg_contact_addr", "192.168.0.201:5060") modparam("uac","auth_username_avp","$avp(auser)") modparam("uac","auth_password_avp","$avp(apass)") modparam("uac","auth_realm_avp","$avp(arealm)") ####### Routing Logic ######## # main request routing logic request_route { # per request initial checks route(REQINIT); # CANCEL processing if (is_method("CANCEL")) { if (t_check_trans()) { route(RELAY); } exit; } # handle retransmissions if (!is_method("ACK")) { if(t_precheck_trans()) { t_check_trans(); exit; } t_check_trans(); } # handle requests within SIP dialogs route(WITHINDLG); # record routing for dialog forming requests (in case they are routed) # - remove preloaded route headers remove_hf("Route"); if (is_method("INVITE|SUBSCRIBE")) { record_route(); } # account only INVITEs if (is_method("INVITE")) { setflag(FLT_ACC); # do accounting } if ($rU==$null) { # request with no Username in RURI sl_send_reply("484","Address Incomplete"); exit; } # dispatch destinations if (is_method("INVITE")) { route(DISPATCH); } else { sl_send_reply("501","Not Implemented"); exit; } } # Dispatch requests route[DISPATCH] { if ($si == "192.168.0.44" and $sp == 5060) { xlog("L_ALERT","from switch $si:$sp)\n"); $var(groupid) = "2"; } else{ xlog("L_ALERT","from others $si:$sp)\n"); $var(groupid) = "1"; } if(!ds_select_dst($var(groupid), "11")) { send_reply("503", "Service Unavailable"); exit; } if ($du =~ "192.168.0.210") { xlog("L_ALERT", "SCRIPT: uac_replace_from\n"); uac_replace_from("", "sip:4000@192.168.0.201:5060"); } xlog("L_ALERT", "SCRIPT: going to <$ru> via <$du> (attrs: $xavp(_dsdst_=>attrs))\n"); t_on_failure("RTF_DISPATCH"); route(RELAY); exit; } failure_route[RTF_DISPATCH] { $var(ts) = t_get_status_code(); xlog("L_ALERT","ALERT: failure_route[RTF_DISPATCH]] from $si:$rp status:$var(ts)\n"); if (t_is_canceled()) { exit; } if(t_check_status("401|407")) { $avp(auser) = "4000"; $avp(apass) = "1234"; $avp(arealm) = "asterisk"; if (uac_auth()) { route(RELAY); } exit; } if (t_check_status("500") or (t_branch_timeout() and !t_branch_replied())) { if (ds_next_dst()) { xlog("L_ALERT", "retrying to <$ru> via <$du> (attrs: $xavp(_dsdst_=>attrs))\n"); t_on_failure("RTF_DISPATCH"); route(RELAY); exit; } } } # Per SIP request initial checks route[REQINIT] { if($ua =~ "friendly|scanner|sipcli|sipvicious|VaxSIPUserAgent") { # silent drop for scanners - uncomment next line if want to reply # sl_send_reply("200", "OK"); exit; } if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); exit; } if(is_method("OPTIONS") && uri==myself && $rU==$null) { sl_send_reply("200","Keepalive"); exit; } if(!sanity_check("17895", "7")) { xlog("Malformed SIP request from $si:$sp\n"); exit; } } # Handle requests within SIP dialogs route[WITHINDLG] { if (!has_totag()) { return; } # sequential request withing a dialog should # take the path determined by record-routing if (loose_route()) { if (is_method("BYE")) { setflag(FLT_ACC); # do accounting ... setflag(FLT_ACCFAILED); # ... even if the transaction fails } route(RELAY); exit; } if (is_method("ACK")) { if (t_check_trans()) { # no loose-route, but stateful ACK; # must be an ACK after a 487 # or e.g. 404 from upstream server route(RELAY); exit; } else { # ACK without matching transaction ... ignore and discard exit; } } sl_send_reply("500","Server Internal Error"); exit; } # Wrapper for relaying requests route[RELAY] { # enable additional event routes for forwarded requests # - serial forking, RTP relaying handling, a.s.o. if (is_method("INVITE|BYE|SUBSCRIBE|UPDATE")) { if(!t_is_set("branch_route")) t_on_branch("MANAGE_BRANCH"); } if (is_method("INVITE|SUBSCRIBE|UPDATE")) { if(!t_is_set("onreply_route")) t_on_reply("MANAGE_REPLY"); } if (is_method("INVITE")) { if(!t_is_set("failure_route")) t_on_failure("MANAGE_FAILURE"); } if (!t_relay()) { sl_reply_error(); } exit; } # jsonrpc dispatch event_route[xhttp:request] { if ($hu =~ "^/RPC") { jsonrpc_dispatch(); } else { xhttp_reply("200", "OK", "text/html", "<html><body>Wrong URL $hu</body></html>"); } }

3 years, 8 months

limits in hashtable

by Fabian Borot

Hi I have a hashtable with about 2500 elements in it. Some of the key_names are the same and in the config file and I traverse them using the index. The problem that I am having is that not all the values are loaded into memory. Lets say I have 5 entries with key_name and key_values like this: 1.2.34:5060:10.10.10 --> 0001232555690 1.2.34:5060:10.10.10 --> 0004562555691 1.2.34:5060:10.10.10 --> 0007892555692 1.2.34:5060:10.10.10 --> 0003212555693 1.2.34:5060:10.10.10 --> 0006542555694 when I do this kamcmd htable.get mytable 1.2.34:5060:10.10.10[0] kamcmd htable.get mytable 1.2.34:5060:10.10.10[1] kamcmd htable.get mytable 1.2.34:5060:10.10.10[2] kamcmd htable.get mytable 1.2.34:5060:10.10.10[3] kamcmd htable.get mytable 1.2.34:5060:10.10.10[4] I am supposed to get their values on the console but sometimes I can not get the 3rd or 4th value , instead I receive this error error: 500 - Key name doesn't exist in htable. What I have been doing so far is to delete extra/old keys from the physical hashtable and load the values again and then it works for a few days. But there is a process that adds entries to the hashtable and at some point it breaks again and I have to delete again old/unused ones. I can not use 'expire' here because the time it takes to become "old" is unknown/variable. This is how the table is defined..2^16 is more than enough to hold 2500 values. What am I missing here? modparam("htable", "htable", "a=>size=16;autoexpire=0;dbtable=htable;") I have taken pcap captures between the kamailio server and the db and I see all the values being transferred over the network when the kamailio is loading/refreshing the values from the db. Is there another limit somewhere? Also when I try to dump the values I get 'reply too big'. modparam("ctl", "binrpc_max_body_size", 10240) modparam("ctl", "binrpc_struct_max_body_size",10240) ./kamcmd htable.dump a ERROR: reply too big any assistance is highly appreciated fborot

3 years, 8 months

Can't show single location via kamctl

by Jon Bonilla (Manwe)

Hi all Using version 5.4.x here. I save the registrations with use_domain 0 but I do use the domain module to do some checks. If I execute "kamctl ul" show I can see the registrations but if I execute "kamctl ul show username" I get "ERROR: domain unknown: use usernames with domain or set default domain in SIP_DOMAIN" I understand I should use domain in case I was using it in the usrloc module but I'm not. How can I tell kamctl not to ask for domain? cheers, Jonm -- PekePBX, the multitenant PBX solution https://pekepbx.com

3 years, 8 months

Route - loose_route

by Ilie Soltanici

Hello, I have a strange issue here with the Route header not been respected by the Kamailio server. I'm getting the INVITE from the SBC-1, adding my own RR header (SBC-2), and send it to the SBC-3 This is the Invite I'm sending outside to the SBC-3 Proxy. ``` INVITE sip:+123456789@192.168.1.1:5060 SIP/2.0 Record-Route: <sip:SBC-2:5067;transport=tls;r2=on;ftag=as2b53df6f;lr> Record-Route: <sip:SBC-1;ftag=as2b53df6f;lr> ``` I'm getting back 200OK with mirrored RR, the call is established successfully. But, the problem is with the BYE message coming from the SBC-3: ``` BYE sip:+123456789@192.168.1.2:5060 SIP/2.0 ROUTE: <sip:SBC-2:5067;transport=tls;r2=on;ftag=as2b53df6f;lr>,<sip:SBC-1;ftag=as2b53df6f;lr> ``` There are 2 routes within a single header. Afaik, loose_function should remove his own Route header (SBC-2) and forward the message to the next Route (SBC-1), or to the URI if there are not other Routes. But, in my case, for some reason Kamailio on SBC-2 is sending the request directly to the URI, bypassing the SBC-1. In the logs I'm getting the following errors: *rr_do_force_send_socket(): no socket found to match second RR (sip:SBC-1)* *rr_do_force_send_socket(): second RR uri is not myself (sip:SBC-1)* To enforce the socket I was trying to use 'sn=interface', then I'm not getting anymore this error - but still, Kamailio sends the message directly to the URI, instead of SBC-1. Is there anything wrong with my config, or I am missing something with the Route headers? Kamailio Version: version: kamailio 5.4.4 (x86_64/linux) bdf4e0 Thank you.

3 years, 8 months

Lookup issue with websockets contacts

by moisesynfante

I have configured Kamailio for websockets support and I'm having issues whenever I try to lookup a WS registered uac on the location table, it never finds the contact even though the contact is present when I dump the list via kamcmd. This issue only happens with WS, I tested using another user agent with a different protocol and it works fine, not sure if this is related to the fact that WS RURI doesn't really contain the AoR username. The AoR is something like 104-p4f578, but the contact's address stored is something like: sip:f0ck9vph@sjm8i3la4i7n.invalid;transport=ws; -- Sent from: http://sip-router.1086192.n5.nabble.com/Users-f3.html

3 years, 8 months

TLS certificate unknown

by Daniel Hermann N'don

Hi guys, I am a beginner in kamailio technology. I want to use kamailio in secure mode with TLS. But when I try to connect via TLS, I get this error in terminal: Mar 08 12:29:36 KAMAILIO5 /usr/sbin/kamailio[1627]: ERROR: <core> [core/tcp_read.c:1512]: tcp_read_req(): ERROR: tcp_read_req: error reading - c: 0x7f6d71a82800 r: 0x7f6d71a828e8 (-1) Mar 08 12:29:44 KAMAILIO5 /usr/sbin/kamailio[1629]: ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS accept:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown tls.cfg : [server:default] method = TLSv1.2+ verify_certificate = no require_certificate = no private_key = /etc/certs/kamailio/kamailio-key.pem certificate = /etc/certs/kamailio/kamailio-cert.pem ca_list = /etc/certs/demoCA/kamailio-cert.pem I followed this tutorial to generate the ssl keys: http://www.kamailio.net/dokuwiki/doku.php/tls:create-certificates Can someone please help me?

3 years, 8 months

client TLS session reuse problem

by Rupesh Kumar

Hi, I am running kamailio 5.2.6 on centos 8 and openssl 1.1.1c and connecting and using it as a proxy sip endpoints to a legacy PBX over TLS. The connection to the backend PBX is over TLS 1.2 . Whenever kamailio initiates a TLS connection to the PBX, it uses session ID and a random session id . The server side has a bug and cannot handle the TLS session resuse apparently because of some bug/issue in caching the TLS sessions. The renegotiation and session_cache is by default turned off and I also explicitly set to 0 via modparam but kamailio would always send the session ID in the initial client hello and this is causing us trouble. Any help would be greatly appreciated. https://kamailio.org/docs/modules/5.2.x/modules/tls.html#tls.p.renegotiation Regards, RK

3 years, 8 months

Core dumps/crash handlers

by Alex Balashov

For memory bugs like this ... [mem/f_malloc.c:599]: fm_free(): BUG: fm_free: bad pointer 0x1 (out of memory block!), called from tm: h_table.c: free_cell_helper(185) - aborting ... I'd love to see a core dump, but unfortunately the SIGCHLD from the SIGABRT-terminated child is intercepted and leads to a graceful shutdown: [main.c:743]: handle_sigs(): child process 16037 exited by a signal 6 Is there any way Kamailio can be set to dump core when this happens? -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/

3 years, 8 months

monitor uac registration status

by Davide Zanichelli

Hello is there a way to monitor (write to db) uacreg status ? Thanks You Davide

3 years, 8 months

Kamailio and Asterisk in K8s

by H Yavari

Hi to all, I am going to run multiple Asterisk instances (Pods) in my Kubernetes cluster. I have a stateless Kamailio sip proxy also. We know that K8s can't handle port range for its services, So we have to use host network for Asterisk deployment. But in this mode, Asterisk pods can't connect to other pods through local IPs and you have to add a second network interface to your pods. One solution is using something like Multus that provides multi-home pods. But it has some issue in host-mode! Also, Using media proxy like RTPEngine in front of Asterisk instances doesn't make a change. You have to run RTPEngine in the host mode or just run it on a VM with multiple NIC.What is the practical solution for this scenario? Thank you. BRHossein

3 years, 8 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users March 2021