sr-users February 2025

sr-users@lists.kamailio.org

34 participants
31 discussions

dynamic selection of authentication algorithm
by Juha Heinanen 28 Oct '25

28 Oct '25

How about this new function that sets the algorithm? -- Juha iff --git a/src/modules/auth/auth_mod.c b/src/modules/auth/auth_mod.c index 534ad9e20f..4e3a584d22 100644 --- a/src/modules/auth/auth_mod.c +++ b/src/modules/auth/auth_mod.c @@ -74,6 +74,10 @@ int w_consume_credentials(struct sip_msg *msg, char *s1, char *s2); * Check for credentials with given realm */ int w_has_credentials(struct sip_msg *msg, char *s1, char *s2); +/* + * Set authentication algorithm + */ +int w_auth_algorithm(struct sip_msg *msg, char *alg, char* s2); static int pv_proxy_authenticate( struct sip_msg *msg, char *realm, char *passwd, char *flags); @@ -170,6 +174,8 @@ static cmd_export_t cmds[] = { REQUEST_ROUTE}, {"pv_auth_check", (cmd_function)w_pv_auth_check, 4, fixup_pv_auth_check, 0, REQUEST_ROUTE}, + {"auth_algorithm", w_auth_algorithm, 1, fixup_spve_null, 0, + REQUEST_ROUTE}, {"bind_auth_s", (cmd_function)bind_auth_s, 0, 0, 0}, {0, 0, 0, 0, 0, 0} @@ -475,6 +481,35 @@ int w_has_credentials(sip_msg_t *msg, char *realm, char *s2) return -1; } return ki_has_credentials(msg, &srealm); + +} +/** + * + */ +int w_auth_algorithm(sip_msg_t *msg, char* alg, char* s2) +{ + if (fixup_get_svalue(msg, (gparam_t*)alg, &auth_algorithm) < 0) { + LM_ERR("failed to get algorithm value\n"); + return -1; + } + + if (strcmp(auth_algorithm.s, "MD5") == 0) { + hash_hex_len = HASHHEXLEN; + calc_HA1 = calc_HA1_md5; + calc_response = calc_response_md5; + } + else if (strcmp(auth_algorithm.s, "SHA-256") == 0) { + hash_hex_len = HASHHEXLEN_SHA256; + calc_HA1 = calc_HA1_sha256; + calc_response = calc_response_sha256; + } + else { + LM_ERR("Invalid algorithm provided." + " Possible values are \"\", \"MD5\" or \"SHA-256\"\n"); + return -1; + } + + return 1; } #ifdef USE_NC

5 13

SIP Trunk registration In Kamailio
by tanmoykarmakar10＠gmail.com 14 Oct '25

14 Oct '25

I want to register SIP Trunk directly in Kamailio. How can I register the SIP trunk in Kamailio. Please find the below sample SIP trunk details. Network IP 10.2.2.2 Subnet Mask 255.255.255.252 Customer IP 10.3.3.3 Gateway IP 10.1.1.1 SBCIP 10.4.4.4 Username 12345678 Password 1234 Please help me with configuration to register SIP trunk in kamailio.

4 4

Support for TLS server_name extension (aka SNI=server name indication)
by Barry Flanagan 04 Sep '25

04 Sep '25

Hi, Back in Kamailio 1.5, the release notes state: "support for TLS server_name extension (aka SNI=server name indication)" However, I cannot find any indication of this in the current TLS docs, and trying to set tls_server_name or server_name in tls.cfg fails with "unsupported option". Is this actually supported? Thanks. -Barry Flanagan

5 7

[4.2] how to send out BYE successfully to close a TCP/TLS connection which misses the connection ID?
by Jack Wang 02 Sep '25

02 Sep '25

For some reasons, My settings will cause kamailio to be restarted even if there were connections connected to it. And when one SIP client in a connection wanted to hangup the call with a WebRTC Client (SIP over websocket) after the proxy-restarting, local client was closed, however , the other side was not. >From the log below it seems that the connection missed. Jan 30 18:19:31 ./kamailio[27857]: WARNING: <core> [msg_translator.c:2777]: via_builder(): TCP/TLS connection (id: 0) for WebSocket could not be found Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [t_msgbuilder.c:1365]: assemble_via(): assemble_via: via building failed Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [t_msgbuilder.c:1545]: build_uac_req(): build_uac_req(): Error while assembling Via Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [uac.c:379]: t_uac_prepare(): t_uac: Error while building message So, Is it equivalent to connection ID missing? And is there any way to make Websocket found the connection? Btw, after proxy-restarting for seconds , I typed `sh kamctl stats` : websocket:ws_current_connections = 1 It showed that the WebRTC Client will re-connect automatically, So I think this connection could be found by proxy, Any suggestion? Thanks :)

2 3

[Serusers] Digest Authentication with Tenor DX
by Ashutosh Kumar 29 Apr '25

29 Apr '25

Hi, Does someone have any idea/experience with Quintum DX radius server's support for digest mode authentication. The Access-Request packets sent by SER are getting an error back. Guide. Regards, Ashutosh Kumar Chetu, Inc. Ph : 1(305) 402 6724 - Witin US Ph : 91 120 5323340 - Outside US Fax:1 (305) 832 5987 For more information, please visit http://www.chetu.com

2 1

Best practices for proxy protocol and TLS offloading
by Alex Balashov 04 Mar '25

04 Mar '25

Hello, I am converting a Kamailio WSS/TLS gateway to pure TCP, with an external HAProxy handling TLS termination and emitting the proxied connection as plain TCP. I am using the PROXYv2 protocol, with `tcp_accept_haproxy=yes`, to convey the upstream network and transport-layer reachability info into Kamailio. I am trying to figure out best practices for mapping the contacts on those connections to the proxied connections themselves. For registrations, tcp_force_alias() (with `tcp_accept_aliases=yes`) works well, and inbound calls go to the right place. However, I'm not quite sure what to do with other flows, such as, for example, in-dialog requests on inbound calls going to the TLS endpoints. There are obviously a lot of possibilities, all or most of which I've tinkered with. These generally involve either {s.replace}-ing `;transport=tls` with `;transport=tcp` in the contacts received from the client, or using the traditional `nathelper` contact alias / RURI alias bag of tricks. However, I don't like the former solution because it leads to a non-compliant R-URI going to the endpoint (it's not the ;transport it sent in its contact), and I don't like the latter because it seems like there are too many moving parts. When tcp_force_alias() works so well for registrations, there must be some small linchpin I'm missing for normal request-reply flows. What is it? Thanks in advance! -- Alex -- Alex Balashov Principal Consultant Evariste Systems LLC Web: https://evaristesys.com Tel: +1-706-510-6800

2 4

Topos Module Questions
by David Tek 04 Mar '25

04 Mar '25

Hello, I am trying to configure the Topos module and have some questions. # topos:msg-outgoing vs topos:msg-sending https://www.kamailio.org/docs/modules/5.8.x/modules/topos.html#topos.e.msg_… I am trying to understand the difference between these two event routes(beyond the content of the SIP message ). I notice that both are invoked when OPTIONS are generated by the local Kamailio server but only msg-sending is invoked for messages transiting the Kamailio( ie proxied, not locally generated). Is there some difference in how these event_routers are invoked beyond the content of the SIP message? # tops -> requests/replies When I am in event_route[topos:msg-sending] { and invoke 'drop', does this apply to the current message or does it apply to the transaction? I have a Kamailio node with devices on either side. Let's call side A untrusted and side B trusted. I want TOPOS happening against the untrusted device but not the trusted device. I have found that when I invoke 'drop' on a request coming from A to B, it disables TOPOS not only on that packet, but also the reply comes from B back to A, TOPOS isn't applied when the reply exits Kamailio towards A. So if I call 'drop' on the request coming from A to B, the reply coming from B to A has no TOPOS applied. How do I get TOPOS applied to all traffic facing a particular device while leaving that traffic un-stripped when the same traffic is interacting with other devices that are trusted? Thanks, David

2 2

Torso Sex Toy for Men & Women
by feifeiwangf＠uusextoy.com 04 Mar '25

04 Mar '25

The sex doll torso is a very light mini sex doll. Usually, its weight is 4kg to 20kg. These sex doll torsos are made of TPE or silicone. Of course, they are all very safe materials. https://www.sextorso.com/

3 2

KEMI logging function name output
by Dmitry Sytchev 28 Feb '25

28 Feb '25

Hi all! By default logging from KEMI with KSR.log() is prefixed with something like this: <core> [core/kemi.c:152]: sr_kemi_core_log(): Can we somehow disable this not to print it every time with every message? Thanks! [image: image.png] -- Best regards, Dmitry Sytchev

2 2

SNMP thresholds
by Sergio Charrua 27 Feb '25

27 Feb '25

Hi all! we have set SNMP stats on our production server. The server is only receiving 1% of the calls, less than 1 CAPS, but we are receiving some SNMP alarms that are a bit weird to us. [image: image.png] This is an example. As we were unsure about the thresholds to be set for Msg Queue, we set Minor to 20 and Major to 100, which resulted in some alarms when we exceeded the Major threshold. From our understanding, the Max Major MSG Queue threshold was 2176, which obviously generated an alarm. But we can't understand why when a Msg Queue depth of 1280 generated an Minor Threshold alarm when the threshold is 20!! Why not generate a Major Threshold alarm instead, as it did reach the Major Threshold ? Also, does anyone have a clue on how to estimate Major and Minor thresholds? How does this Msg Queue handler work? Is it Kamailio's level or on OS/Kernel level that it gets the statistics from? Apart from the official Kamailio SNMPStats docs, any doc or article one would share? greatly appreciated. ( I so much hate SNMP!!! :) ) Atenciosamente / Kind Regards / Cordialement / Un saludo, *Sérgio Charrua*

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users February 2025