Hello,
I use DNS failover feature for routing some calls, and I wonder about its limitations.
I noticed that INVITE and ReINVITE requests are correctly routed based on SRV priority/weight in case of failure, but ACK requests do not use them.
Let’s say I have Kamailio A relaying requests to a pool of Kamailios B1 and B2 in TLS.
DNS records are the below ones.
kamailiob.net. 60 NAPTR 20 100 S SIPS+D2T _sips._tcp.kamailiob.net.
_sips._tcp.kamailiob.net. 60 SRV 1 10 5061 kamailiob-1.net.
_sips._tcp.kamailiob.net. 60 SRV 2 10 5061 kamailiob-2.net.
If B1 is down, I expect requests being relayed to B2 (because of priority 2 in the SRV record).
* For initial INVITEs: R-URI is sip:kamailiob.net
* If B1 is down, the request is retried to B2 => OK
* For in-dialog requests: Route header in incoming request is sip:kamailiob.net so it is set as next destination with loose_route function
* If B1 is down, the request is retried to B2 for ReINVITE => OK
* But once the ACK comes in, with the same Route header (sip:kamailiob.net), Kamailio tries to send it to B1 only (no retries to B2, and even no retransmissions to B1 either).
* When B1 is back UP again a few seconds later, Kamailio does not try to relay the ACK again. The ACK request is attempted to be retransmitted only once to B1. It fails and no more retries after that.
Is it the expected behavior? Or is it something misconfigured on Kamailio A? Or is it a TLS connection issue?
Here is the DNS configuration on Kamailio A (TM module is enabled):
dns_try_naptr=yes
use_dns_failover=yes
use_dns_cache=yes
dns_srv_lb=yes
enable_tls=yes
tcp_max_connections=4096
tls_max_connections=4096
tcp_reuse_port=yes
tcp_connect_timeout=10
tcp_send_timeout=10
tcp_connection_lifetime=3600
I had a look into the DNS tutorial (https://github.com/kamailio/kamailio/blob/master/doc/tutorials/dns.txt) without finding any hint about this.
If anyone has already played with SIP DNS failover in Kamailio, your help would be appreciated, thanks!
Julien
Hi all,
I'm switching my kamailio to use Let's Encrypt certificates.
Do I need to force a restart of kamailio when the certificate
is renewed or will this be automatic?
The doc indicates that reload is possible (but not advised)
but it looks to be for a "configuration change" (tls.cfg file change)
and not for certificate change.
Maybe certificates are automatically reloaded?
Regards
Aymeric
--
Antisip - http://www.antisip.com
Hello,
My problem: our provider opens a TLS connection to us. They want us to
use this channel for outgoing calls, instead of opening a new SIP
connection to their server.
Is there a way to teach Kamailio to do that?
--
-- Matthias Urlichs
Hello guys,
We're dispatching with hash over user, if i execute dispatcher.reload
<http://www.kamailio.net/docs/modules/5.0.x/modules/dispatcher.html#dispatch…>
does the dispatcher list gets calculated? i.e. user A is always dispatched
to box3, if i reload, is the hash recalculated and will probably be
dispatched differently?
Regards,
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
Hello,
I would like to do a load balance between Asterisk SIP trunks. You can see
a diagram from this link:
https://drive.google.com/file/d/1Qy66L5rQCfxysYQpSd2-ek_8-by0T8PR/view?usp=…
SIP Packets capture log:
https://drive.google.com/file/d/1CHGUOwoRDAC93MMBtyfa8gBISKIVC-ng/view?usp=…
Details
1. Asterisk1 makes SIP trunk connection with Kamailio.
2. Kamailio makes SIP trunk connection with Asterisk2 and Asterisk3
3. Caller register SIP phone with Asterisk1
Caller extension = 8002
4. Asterisk2 makes a blind transfer to Kamailio. (Call to 8009 then
transfer to ARI APP)
exten = 8009,1,Transfer(SIP/3802@<kamailio public IP>)
5. ARI app extension is 3802
My problem is that Kamailio LB only works when I try to connect
with Asterisk1 and Asterisk2 or Asterisk1 and Asterisk3. If I have two
Asterisks in dispatcher.list, it doesn't work and it appears *SIP/2.0 401
Unauthorized* in sip packets capture log.
Kamailio version: 5.5.2
Kamailio.cfg
modparam("dispatcher", "list_file", "/etc/kamailio/dispatcher.list")
modparam("dispatcher", "flags", 3)
modparam("dispatcher", "xavp_dst", "_dsdst_")
modparam("dispatcher", "xavp_ctx", "_dsctx_")
# Dispatch requests
route[DISPATCH] {
# round robin dispatching on gateways group '1'
if(!ds_select_dst("1", "4")) {
send_reply("404", "No destination");
exit;
}
xdbg("--- SCRIPT: going to <$ru> via <$du> (attrs:
$xavp(_dsdst_=>attrs))\n");
t_on_failure("RTF_DISPATCH");
route(RELAY);
exit;
}
# Try next destionations in failure route
failure_route[RTF_DISPATCH] {
if (t_is_canceled()) {
exit;
}
# next DST - only for 500 or local timeout
if (t_check_status("500")
or (t_branch_timeout() and !t_branch_replied())) {
if(ds_next_dst()) {
xdbg("--- SCRIPT: retrying to <$ru> via <$du>
(attrs: $xavp(_dsdst_=>attrs))\n");
t_on_failure("RTF_DISPATCH");
route(RELAY);
exit;
}
}
}
dispatcher.list
# setid(int) destination(sip uri) flags(int,opt) priority(int,opt)
attrs(str,opt)
1 sip:10.148.0.31:5123
1 sip:10.148.0.44:5123
Thanks,
Warawich
I'm not sure if this is by design or not. I have things I want to log to a SQL DB, but it's not nearly as important as call handling, so the sql_query_async() function looked ideal, but in testing, if the DB is not responsive, the call processing gets blocked. In the example below, I'm using just a short hostname which isn't resolvable, but if I have an IP address there that isn't really assigned (for example if the DB server is down), the same blocking behavior is exhibited, but the error is slightly different (can't connect instead of unknown host).
Here's my config. This specific simple config was tested on Kamailio 5.5, but I observe similar behavior (in a more complicated config) in the dev branch as well.
- - - -
#!KAMAILIO
async_workers=2
loadmodule "db_mysql"
loadmodule "sqlops"
loadmodule "sl"
loadmodule "xlog"
loadmodule "pv"
force_rport=yes
## Host sql does not resolve.
modparam("sqlops","sqlcon","cb=>mysql://kamailio:kamailiorw@sql/kamailio")
## But start anyways.
modparam("sqlops", "connect_mode", 1)
request_route {
sl_send_reply("100", "Trying"); ## Prevent re-transmissions from the UAC
xlog("L_NOTICE", "Time before sql_query_async(): [$TV(Sn)]\n");
sql_query_async("cb", "INSERT INTO table1 (col) VALUES ('val')");
xlog("L_NOTICE", "Time before sl_send_reply(): [$TV(Sn)]\n");
sl_send_reply("404", "Not found");
}
Here's the log if I send a simple INVITE with SIPp. Note the timestamps
9(16) NOTICE: <script>: Time before sql_query_async(): [1645574694.546165]
9(16) ERROR: db_mysql [km_my_con.c:163]: db_mysql_new_connection(): driver error: Unknown MySQL server host 'sql' (-3)
9(16) ERROR: <core> [db.c:319]: db_do_init2(): could not add connection to the pool
9(16) ERROR: sqlops [sql_api.c:190]: sql_reconnect(): failed to connect to the database [cb]
9(16) ERROR: sqlops [sqlops.c:232]: sql_check_connection(): failed to connect to database
9(16) ERROR: sqlops [sqlops.c:264]: sql_query_async(): invalid connection to database 9(16) NOTICE: <script>: Time before sl_send_reply(): [1645574699.552440]
Ben Kaufman
Sr. VoIP Engineer - BCM One
+1.612.735.9309
bkaufman(a)bcmone.com<mailto:bkaufman@bcmone.com>
24 hour client support: +1.855.639.6300
[https://www.bcmone.com/files/bcmone-logo.png]<https://www.bcmone.com/> [https://www.bcmone.com/files/twitter-icon-circle.png] <https://www.facebook.com/bcmonenyc/> [https://www.bcmone.com/files/twitter-icon-circle.png] <https://twitter.com/bcm_one/> [https://www.bcmone.com/files/linkedin-icon-circle.png] <https://www.linkedin.com/company/business-communications-management/>
NOTE: This e-mail and any attachments are from BCM One, Inc. and are intended
solely for the use and review of the individual(s) to whom it is addressed.
If you believe you received this e-mail in error, please notify the sender
immediately, delete the e-mail (and any attachments) from your computer and do
not copy or disclose it to anyone else.
Dear,
I enabled two softphone with ADDRESS.
- codec1 : ip 192.168.30.241/32 5060
- codec2 : ip 192.168.30.242/32 5060
I enable one softphone with SUBSCRIBER
- codec3 : is registered (login/passwd)
codec4 is not part of the domain, is not subriber and address.
Kamailio proxy
- kamailio : ip 192.168.30.240/32 5060
In the kamailio.cfg
ROUTE[AUTH]# IP authorization and user authenticationroute[AUTH] {#!ifdef WITH_AUTH #!ifdef WITH_IPAUTH if((!is_method("REGISTER")) && allow_source_address()) { # source IP allowed return; }#!endif if (is_method("REGISTER") || from_uri==myself) { # authenticate requests if (!auth_check("$fd", "subscriber", "1")) { auth_challenge("$fd", "0"); exit; } # user authenticated - remove auth header if(!is_method("REGISTER|PUBLISH")) consume_credentials(); } # if caller is not local subscriber, then check if it calls # a local destination, otherwise deny, not an open relay here if (from_uri!=myself && uri!=myself) { sl_send_reply("403","Not relaying"); exit; } #!else # authentication not enabled - do not relay at all to foreign networks if(uri!=myself) { sl_send_reply("403","Not relaying"); exit; } #!endif return;}
Regarding the condition
#!ifdef WITH_IPAUTH if((!is_method("REGISTER")) && allow_source_address()) { # source IP allowed return; }#!endif
USE CASE :
If codec4 (not registered or same domain) tries to INVITE codec3 (in subscriber) the codec, an INVITE MESSAGE is sent and the codec3 could ACK.
- But I don't want to allow the INVITE, I 'd like to not allow the codec4 to reach codec3.
- But if codec1 or codec2 tries to reach codec3, kamailio will allow the INVITE.
Best Regards,
--
Youssef BOUJRAF
