sr-users April 2023

sr-users@lists.kamailio.org

44 participants
43 discussions

Route Header based routing for initial INVITE

by harneet singh

Hi Experts, I believe the loose_route() in kamailio can be used for initial Out of the dialog INVITE processing as well. Is that the correct understanding? If so, the request will be forwarded ahead to the destination corresponding to the Route Header remaining (if any) after Kamailio has stripped off it's own Address(es) from the Route Header(s). Is that correct? Regards, Harneet Singh -- "Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth" - Sir Arthur Conan Doyle

11 months, 3 weeks

Strange RTCP issue

by Kiss Zoltán

Hello, We have a transparent proxy in front of Asterisk boxes. The media is handled by rtpengine, and the "manage" work is done by Kamailio in the route[NATMANAGE] section like this: if(nat_uac_test("8")) { # Packet from backend server if(ds_is_from_list()){ if (rtpengine_manage("replace-origin replace-session-connection direction=internal direction=pub")) { xdbg("NATMANAGE --- Success rtpengine_manage() RTP from INTERNAL to EXTERNAL $ru"); } } else { if (rtpengine_manage("replace-origin replace-session-connection direction=pub direction=internal")) { xdbg("NATMANAGE --- Success rtpengine_manage() RTP from EXTERNAL to INTERNAL $ru"); } } } else { # Packet from backend server if(ds_is_from_list()){ if (rtpengine_manage("replace-origin replace-session-connection trust-address direction=internal direction=pub")) { xdbg("NATMANAGE --- Success rtpengine_manage() RTP from INTERNAL to EXTERNAL $ru"); } } else { if (rtpengine_manage("replace-origin replace-session-connection trust-address direction=pub direction=internal")) { xdbg("NATMANAGE --- Success rtpengine_manage() RTP from EXTERNAL to INTERNAL $ru"); } } } Everything is working fine, but with some clients (like Grandstream phone) the RTCP session wants to go tot he private address of the phone. Here is the log of one of these strange calls: Apr 27 16:54:38 rtp1 rtpengine[2273]: INFO: [312ed76c31f21b71452e91e5184ad25b@172.16.2.210:5060]: [core] --------- Port 178.238.213.14:11088 <> 81.183.216.3:5068 , SSRC 77c19488, 625 p, 107500 b, 0 e, 29 ts Apr 27 16:54:38 rtp1 rtpengine[2273]: INFO: [312ed76c31f21b71452e91e5184ad25b@172.16.2.210:5060]: [core] --------- Port 178.238.213.14:11089 <> 10.0.5.192:5069 (RTCP), SSRC 0, 0 p, 0 b, 0 e, 43 ts As you can see the RTP itself is okay, but the RTCP will somehow go to the private address. If we tracing the sdp messages in sngrep, then we can see that Kamailio transforming IP addresses for the backend servers to the public (and the private address of the rtpengine) addresses. We are missing something? Thank you! With kind regards, Zoltan

11 months, 4 weeks

Sensible values for pike mudule?

by Benoit Panizzon

Hi Before I go too deep into try and error, I guess others have been there too. What are sensible value you use for the pike module to detect / mitigate abusive behavior, especially dictionary attacks? Are there better solutions that the pike module? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

11 months, 4 weeks

Fwd: Sensible values for pike mudule?

by Stefan

Hi Benoît We use pike in combination with fail2ban. Log a message -> create a fail2ban rule to block the ip for xxx time. example: if ($ua =~ "(friendly-scanner|sipvicious)") { sl_send_reply("488", "Go away."); xlog("L_INFO","$ci Blocking traffic from $si\n"); exit; } Cool thing is, you can write a log entry from every part in your kamailio-config, and then fail2ban does the rest. Regards Stefan Am 27.04.23 um 16:07 schrieb Benoit Panizzon: > Hi > > Before I go too deep into try and error, I guess others have been there > too. > > What are sensible value you use for the pike module to detect / > mitigate abusive behavior, especially dictionary attacks? > > Are there better solutions that the pike module? > > Mit freundlichen Grüssen > > -Benoît Panizzon-

11 months, 4 weeks

hooking mechanism for routing blocks

by Valentin Christoph

Dear all, I am looking for some hooking mechanism for user defined routing blocks. Is something like this already available? 1) a common part of the routing configuration shall not (or only slightly) be changed, after some hooks have been implemented Something like a function "engage_hooks()" of some "hook_module"? : Routing config that should not be changed by application developers engage_hooks(HOOK_TYPE); Routing config that should not be changed by application developers : 2) one application developer may "hook" new parts of the routing configuration into this, by modparam("hook_module", "hook", "name=MY_RB;type=HOOK_TYPE;prio=50); : : Route [MY_RB] { Do something at hook HOOK_TYPE; } : : 3) another application developer might want to "hook" into the same HOOK_TYPE with a higher priority modparam("hook_module", "hook", "name=ANOTHER_RB;type=HOOK_TYPE;prio=20); : : Route [ANOTHER_RB] { Do another thing with higher priority at hook HOOK_TYPE } : : Kr, Christoph

11 months, 4 weeks

Kamailio use case

by jdprsaga＠gmail.com

Hello All, new subscriber here. I've been reading kamailio documentation to check if kamailio has a use case on the architecture for the solution for my company's software, here an small architecture diagram of our solution. sipclient <----> [ Middleware ] <-----> SBC Our middle ware is both a sip proxy and media proxy. we have a large number of sip clients but a small calling number, our current bottleneck is that the middleware can't handle a high number of registration, i would like to deploy Kamailio as a load balancer for registrations, making sure it is statefull so registrations and calls are hashed into the same middleware server. sipclients < ----> [ kamailio ] <------> [ middleware1, middleware2,...,middleware N] <-----> SBC Any thoughts or pointers?

12 months

rtpengine module: Actions caused by rtpengine_manage() on reply-codes?

by Benoît Panizzon

Hi all I wonder, if there is a documentation on what action is performed by rtpengine_manage() on which kind reply. Am I right, that rtpengine_manage(), on any 4XX reply causes a delete? So if there is a re-invite (for example to switch to T.38) and the other party replies with 488 which in turn is passed through rtpengine_manage() the existing RTP stream is deleted from rtpengine instead of being left running with the previously agreed codec? Has anyone already figured out a list of what reply codes should be exempt from calling rtpengine_manage()? -- Mit freundlichen Grüssen -Benoît Panizzon- @ HomeOffice und normal erreichbar -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

12 months

Configuring dynamic Destination identification for Kamailio Routing

by harneet singh

Hi Experts, We have been using Kamailio as a sip proxy for a fair bit of time now(version 5.3.2 though) and do understand the native routing mechanism that can be instrumented through the kamailio cfg scripts. We initially had only two sides, where the traffic could come from into Kamailio and it just passed through to the other side(ie Traffic from A was routed to B and that from B was routed to A). Off late, a few more sip elements have been introduced in the deployment and now there is a need for a more formal/robust mechanism to select the intended destination to forward an initial SIP INVITE to. I believe that we could still keep all the logic in the native kamailio script and do the routing(for example, an incoming call where the *From URI* contains *sip.elementA.com <http://sip.elementA.com>* should be routed to destination *sip.elementB.com <http://sip.elementB.com>*, where as if the* To URI *contains *sip.elementC.com <http://sip.elementC.com>*, the request should be routed to *sip.elementC.com <http://sip.elementC.com>)**. *Since we have many sip elements like A,B.C,D,E etc where the requests might have to be routed to, based on certain different criteria, this logic would become cumbersome. *What would be the best way to accommodate this?* *Would it be possible to rewire this routing logic at runtime(*like in some csv file that can be reloaded*) without a Kamailio restart? * Regards, Harneet Singh -- "Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth" - Sir Arthur Conan Doyle

12 months

sips to sip with TLS proxy

by Kiss Zoltán

Hi all, We have a working Kamailio setup, lets call it a transparent proxy for Asterisk boxes. Its based on domain and dispatcher modules and everything is working as expected with the test clients (more or less microsip, softphone for ios, etc). We are tried to register with a Grandstream deskphone today, and we see that the phone sending sips:xxx in the Reg Contact field for example. Because the sips schema, the register is working, but we cannot initiate calls from this phone. If we are turning SIP scheme to sip from sips in the phone, then everything is working as expected. I think we can transform those requests from sips to sip with Kamailio, but currently we dont know where can we start. Has anybody a suggestion about this issue? I know that we can transform ruri, contact, etc with textops, nathelper and a lot of other modules, but what is the best for this sips->sip translation? Thanks for your help. With kind regards, Zoltan

12 months

TCP/TLS connection (id: 0) for WebSocket could not be found

by Joey Golan

Hello, I have 2 clients. 1 using websocket and 1 mobile using TLS. Both can call each other perfectly. After 24-48 hours calls from mobile to websocket failed with an error message: TCP/TLS connection (id: 0) for WebSocket could not be found. At the same time I can make calls from the websocket client to the mobile. I know that the search of the connection is done by target address so I printed the addresses + ports and they are matched to the ones that appear on the ul.dump and ws.dump. *kamcmd ul.dump output:* Info: { AoR: usrmt63ly_1040 HashID: 1830036546 Contacts: { Contact: { Address: sip:usrmt63ly_1040@example.com;transport=ws Expires: 283 Q: -1 Call-ID: tvne1pskgkm2a01pnqm677 CSeq: 1060 User-Agent: JsSIP 3.9.0 Received: sip:*10.218.51.86:24061 <http://10.218.51.86:24061>*;transport=ws Path: <sip:10.218.154.228:50443;transport=ws;received=sip:*10.218.51.86:24061 <http://10.218.51.86:24061>*;transport=ws;lr> State: CS_NEW Flags: 0 CFlags: 64 Socket: tls:10.218.154.228:50443 Methods: 7071 Ruid: uloc-61ebba84-64242101-89ba-1 Instance: <urn:uuid:7573726d-7436-116c-915f-313034304077> Reg-Id: 1 Server-Id: 1642838660 Tcpconn-Id: 100420 Keepalive: 1 Last-Keepalive: 1680417282 KA-Roundtrip: 0 Last-Modified: 1680417282 } } } *kamcmd ws.dump* { connections: { 100420: wss:*10.218.51.86:24061 <http://10.218.51.86:24061>* -> wss: 10.218.154.228:50443 (state: OPEN, last used 14s ago, sub-protocol: sip) } info: { wscounter: 1 truncated: no } } *Call from mobile (TLS) to websocket: Failed with error message: TCP/TLS connection (id: 0) for WebSocket could not be found* 30(35263) INFO: {1 2563 INVITE 4248c155-cd92-49b8-b68a-eef5f2cb3e88} <script>: request_route: method [INVITE] from [ sip:usrrcv4o4_1040@example.com] socket [sip:10.218.51.86:50909;transport=tls] to [sip:usrmt63ly_1040@example.com] 30(35263) INFO: {1 2563 INVITE 4248c155-cd92-49b8-b68a-eef5f2cb3e88} <script>: [RELAY]: method [INVITE] from [sip:usrrcv4o4_1040@example.com] socket [sip:10.218.51.86:50909;transport=tls] to [ sip:usrmt63ly_1040@example.com] socket [sip:*10.218.51.86:24061 <http://10.218.51.86:24061>*;transport=ws] 30(35263) WARNING: {1 2563 INVITE 4248c155-cd92-49b8-b68a-eef5f2cb3e88} <core> [core/msg_translator.c:2863]: *via_builder(): TCP/TLS connection (id: 0) for WebSocket could not be found* 30(35263) ERROR: {1 2563 INVITE 4248c155-cd92-49b8-b68a-eef5f2cb3e88} <core> [core/msg_translator.c:2040]: build_req_buf_from_sip_req(): could not create Via header 30(35263) ERROR: {1 2563 INVITE 4248c155-cd92-49b8-b68a-eef5f2cb3e88} tm [t_fwd.c:479]: prepare_new_uac(): could not build request 30(35263) ERROR: {1 2563 INVITE 4248c155-cd92-49b8-b68a-eef5f2cb3e88} tm [t_fwd.c:1759]: t_forward_nonack(): failure to add branches 30(35263) ERROR: {1 2563 INVITE 4248c155-cd92-49b8-b68a-eef5f2cb3e88} sl [sl_funcs.c:418]: sl_reply_error(): stateless error reply used: No error (2/SL) 30(35263) NOTICE: {1 2563 INVITE 4248c155-cd92-49b8-b68a-eef5f2cb3e88} acc [acc.c:287]: acc_log_request(): ACC: call missed: timestamp=1680417920;method=INVITE;from_tag=e168ffa6-e577-48ec-b9c9-a73f5be318e8;to_tag=0c3e625e9f223a7ee2b093e8e31b2526-b7165bcb;call_id=4248c155-cd92-49b8-b68a-eef5f2cb3e88;code=500;reason=Server Internal Error;src_user=usrrcv4o4_1040;src_domain=example.com ;src_ip=10.218.51.86;dst_ouser=usrmt63ly_1040;dst_user=usrmt63ly_1040;dst_domain= example.com *Call from websocket to mobile (TLS):* 38(35271) INFO: {1 7488 INVITE urcnete8r71dpkhmngd8} <script>: request_route: method [INVITE] from [sip:usrmt63ly_1040@example.com] socket [sip:*10.218.51.86:24061 <http://10.218.51.86:24061>*;transport=ws] to [ sip:usrrcv4o4_1040@example.com] 38(35271) INFO: {1 7488 INVITE urcnete8r71dpkhmngd8} <script>: [RELAY]: method [INVITE] from [sip:usrmt63ly_1040@example.com] socket [sip:*10.218.51.86:24061 <http://10.218.51.86:24061>*;transport=ws] to [ sip:usrrcv4o4_1040@example.com] socket [sip:10.218.51.86:20674 ;transport=tls] 39(35272) INFO: {2 7488 INVITE urcnete8r71dpkhmngd8} <script>: onreply_route[MANAGE_REPLY] method [INVITE] code [100] from [ sip:usrmt63ly_1040@example.com] to [sip:usrrcv4o4_1040@example.com] 39(35272) INFO: {2 7488 INVITE urcnete8r71dpkhmngd8} <script>: onreply_route[MANAGE_REPLY] method [INVITE] code [200] from [ sip:usrmt63ly_1040@example.com] to [sip:usrrcv4o4_1040@example.com] 39(35272) NOTICE: {2 7488 INVITE urcnete8r71dpkhmngd8} acc [acc.c:287]: acc_log_request(): ACC: transaction answered: timestamp=1680417926;method=INVITE;from_tag=18q0p37nfo;to_tag=a88272a0-25ca-43c2-8ce9-8615831b7e9a;call_id=urcnete8r71dpkhmngd8;code=200;reason=OK;src_user=usrmt63ly_1040;src_domain= example.com ;src_ip=10.218.51.86;dst_ouser=usrrcv4o4_1040;dst_user=usrrcv4o4_1040;dst_domain=10.218.51.86 38(35271) INFO: {1 7488 ACK urcnete8r71dpkhmngd8} <script>: request_route: method [ACK] from [sip:usrmt63ly_1040@example.com] socket [sip:*10.218.51.86:24061 <http://10.218.51.86:24061>*;transport=ws] to [ sip:usrrcv4o4_1040@example.com] 38(35271) INFO: {1 7488 ACK urcnete8r71dpkhmngd8} <script>: [RELAY]: method [ACK] from [sip:usrmt63ly_1040@example.com] socket [sip:*10.218.51.86:24061 <http://10.218.51.86:24061>*;transport=ws] to [ sip:usrrcv4o4_1040@example.com] socket [sip:10.218.51.86:20674 ;transport=tls] *Version: kamailio 5.6.2 (x86_64/linux)* What could be the reason for that? Your help would be much appreciated. Thanks, Joey.

12 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users April 2023