April 2025 - sr-users - kamailio.org

Kamailio & Asterisk SIP Registration Forwarding - Asterisk replies 401 Unauthorized
by Ben Fitzgerald 17 Apr '26

17 Apr '26

Hi, I've been following this integration tutorial http://kb.asipto.com/asterisk:realtime:kamailio-4.0.x-asterisk-11.3.0-astdb and have a successful registration and I can even make calls through my asterisk box. However what is unusual to me is that every time a phone registers with Kamailio, that is forwarded to Asterisk (as expected), yet Asterisk replies with 401 Unauthorized. Oddly enough the phone registers and can still make calls. What worries me is that as we scale to 100's of cps, this seemingly erroneous message may slow down Asterisk because it's trying to handle authentication for users which have already been authenticated by Kamailio. If this behavior is expected, then that would be good to know as well. This is the sip debug from ASTERISK (I have replaced IP's with the names of the servers): <--- SIP read from TCP:kamailio:41205 ---> REGISTER sip:asteriskIP:5060;transport=tcp SIP/2.0 Via: SIP/2.0/TCP kamailio;branch=z9hG4bK998f.2846e405000000000000000000000000.0 To: <sip:40081@asteriskIP> From: <sip:40081@asteriskIP>;tag=32fda68bf54efeeb04e3edc67b53c63d-cfb0 CSeq: 10 REGISTER Call-ID: 0005ce130bcee5c4-26538@kamailio Max-Forwards: 70 Content-Length: 0 User-Agent: kamailio (4.3.0 (x86_64/linux)) Contact: <sip:40081@kamailio:5060> Expires: 3600 <-------------> --- (11 headers 0 lines) --- Sending to kamailio:5060 (no NAT) Sending to kamailio:5060 (no NAT) <--- Transmitting (no NAT) to kamailio:5060 ---> SIP/2.0 401 Unauthorized Via: SIP/2.0/TCP kamailio;branch=z9hG4bK998f.2846e405000000000000000000000000.0;received= kamailio From: <sip:40081@asteriskIP>;tag=32fda68bf54efeeb04e3edc67b53c63d-cfb0 To: <sip:40081@asteriskIP>;tag=as404bac9a Call-ID: 0005ce130bcee5c4-26538@ kamailio CSeq: 10 REGISTER Server: Asterisk PBX 11.6-cert2 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH Supported: replaces, timer WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="262b338e" Content-Length: 0 <------------> Scheduling destruction of SIP dialog '0005ce130bcee5c4-26538@ kamailio' in 32000 ms (Method: REGISTER) Scheduling destruction of SIP dialog '0005ce130bcee5c4-26538@ kamailio' in 32000 ms (Method: REGISTER) Really destroying SIP dialog '0005ce130bcee5c1-26536@ kamailio' Method: REGISTER ========================= sip.conf for kamailio trunk: [kamailio-inbound] type=friend dtmfmode=auto host=kamailioIP allow=all context=sipout insecure=port,invite canreinvite=no ======================== Asterisk version: 11.6-cert2 Kamailio version: 4.3 Benjamin Fitzgerald LETS Corporation (925) 235-1154 ben(a)letscorp.us *******Confidential Notice: This message is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this message in error, please delete this message from all computers and contact Orion Systems/LETS Corp immediately by return e-mail and/or telephone at (925) 566-5600

4 8

dynamic selection of authentication algorithm
by Juha Heinanen 28 Oct '25

28 Oct '25

How about this new function that sets the algorithm? -- Juha iff --git a/src/modules/auth/auth_mod.c b/src/modules/auth/auth_mod.c index 534ad9e20f..4e3a584d22 100644 --- a/src/modules/auth/auth_mod.c +++ b/src/modules/auth/auth_mod.c @@ -74,6 +74,10 @@ int w_consume_credentials(struct sip_msg *msg, char *s1, char *s2); * Check for credentials with given realm */ int w_has_credentials(struct sip_msg *msg, char *s1, char *s2); +/* + * Set authentication algorithm + */ +int w_auth_algorithm(struct sip_msg *msg, char *alg, char* s2); static int pv_proxy_authenticate( struct sip_msg *msg, char *realm, char *passwd, char *flags); @@ -170,6 +174,8 @@ static cmd_export_t cmds[] = { REQUEST_ROUTE}, {"pv_auth_check", (cmd_function)w_pv_auth_check, 4, fixup_pv_auth_check, 0, REQUEST_ROUTE}, + {"auth_algorithm", w_auth_algorithm, 1, fixup_spve_null, 0, + REQUEST_ROUTE}, {"bind_auth_s", (cmd_function)bind_auth_s, 0, 0, 0}, {0, 0, 0, 0, 0, 0} @@ -475,6 +481,35 @@ int w_has_credentials(sip_msg_t *msg, char *realm, char *s2) return -1; } return ki_has_credentials(msg, &srealm); + +} +/** + * + */ +int w_auth_algorithm(sip_msg_t *msg, char* alg, char* s2) +{ + if (fixup_get_svalue(msg, (gparam_t*)alg, &auth_algorithm) < 0) { + LM_ERR("failed to get algorithm value\n"); + return -1; + } + + if (strcmp(auth_algorithm.s, "MD5") == 0) { + hash_hex_len = HASHHEXLEN; + calc_HA1 = calc_HA1_md5; + calc_response = calc_response_md5; + } + else if (strcmp(auth_algorithm.s, "SHA-256") == 0) { + hash_hex_len = HASHHEXLEN_SHA256; + calc_HA1 = calc_HA1_sha256; + calc_response = calc_response_sha256; + } + else { + LM_ERR("Invalid algorithm provided." + " Possible values are \"\", \"MD5\" or \"SHA-256\"\n"); + return -1; + } + + return 1; } #ifdef USE_NC

5 13

SIP Trunk registration In Kamailio
by tanmoykarmakar10＠gmail.com 14 Oct '25

14 Oct '25

I want to register SIP Trunk directly in Kamailio. How can I register the SIP trunk in Kamailio. Please find the below sample SIP trunk details. Network IP 10.2.2.2 Subnet Mask 255.255.255.252 Customer IP 10.3.3.3 Gateway IP 10.1.1.1 SBCIP 10.4.4.4 Username 12345678 Password 1234 Please help me with configuration to register SIP trunk in kamailio.

4 4

Support for TLS server_name extension (aka SNI=server name indication)
by Barry Flanagan 04 Sep '25

04 Sep '25

Hi, Back in Kamailio 1.5, the release notes state: "support for TLS server_name extension (aka SNI=server name indication)" However, I cannot find any indication of this in the current TLS docs, and trying to set tls_server_name or server_name in tls.cfg fails with "unsupported option". Is this actually supported? Thanks. -Barry Flanagan

5 7

[4.2] how to send out BYE successfully to close a TCP/TLS connection which misses the connection ID?
by Jack Wang 02 Sep '25

02 Sep '25

For some reasons, My settings will cause kamailio to be restarted even if there were connections connected to it. And when one SIP client in a connection wanted to hangup the call with a WebRTC Client (SIP over websocket) after the proxy-restarting, local client was closed, however , the other side was not. >From the log below it seems that the connection missed. Jan 30 18:19:31 ./kamailio[27857]: WARNING: <core> [msg_translator.c:2777]: via_builder(): TCP/TLS connection (id: 0) for WebSocket could not be found Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [t_msgbuilder.c:1365]: assemble_via(): assemble_via: via building failed Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [t_msgbuilder.c:1545]: build_uac_req(): build_uac_req(): Error while assembling Via Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [uac.c:379]: t_uac_prepare(): t_uac: Error while building message So, Is it equivalent to connection ID missing? And is there any way to make Websocket found the connection? Btw, after proxy-restarting for seconds , I typed `sh kamctl stats` : websocket:ws_current_connections = 1 It showed that the WebRTC Client will re-connect automatically, So I think this connection could be found by proxy, Any suggestion? Thanks :)

2 3

WebRTC error NS_ERROR_NET_TIMEOUT
by David Cunningham 01 May '25

01 May '25

Hello, Does anyone know of a reason (besides the obvious like network down) why users might experience a NS_ERROR_NET_TIMEOUT error in their browser when connecting to WebRTC port 8443 on Kamailio (version 5.2.7)? This only happens intermittently, so debugging it is tricky. The number of connections to Kamailio port 8443 peaks at around 4150 daily. The max open files ulimit in Linux is 65535, and in the Kamailio configuration we have "tcp_max_connections=32768" and "tls_max_connections=32000". Would anyone have any suggestions on where the problem might be? Thanks in advance! -- David Cunningham, Voisonics Limited http://voisonics.com/ USA: +1 213 221 1092 New Zealand: +64 (0)28 2558 3782

2 2

Looking for Documentation/Guidance to Setup Kamailio and RTPProxy to Terminate Encryption for Asterisk
by Joshua Ruehlig 30 Apr '25

30 Apr '25

Hello, I am fairly new to SIP and just recently setup Asterisk for a few purposes. 1) To have my Hikvision doorbell videocall my phone when someone presses it 2) Videocalling between me and my families' phones/tablets 3) Eventually have a home phone setup for POTS calling. I currently have an ObiHai202 that is still working with GoogleVoice, so this not a priority at the moment. I wanted to have encryption for SIP and RTP outside of my network, but wanted this to all be terminated on my OPNsense router. I can install Kamailio and RTPProxy on OPNsense since they are available for FreeBSD, but it looks like Rtpengine is currently not ported. Ideally I wanted most logic to be handled on my Asterisk server, and have Kamailio/RTPProxy do the bare minimum of encrypting/decryption and rewriting headers as needed. ## Diagram of my Targeted Setup ## * Android Phones / Tablets running Linphone || SIPS(TLS) / SRTP || * OPNsense Router ~ WAN_IP(dynamic)=DOMAIN.com / LAN_IP=10.0.1.1 - Kamailio / RTPProxy || SIP(UDP) / RTP || * FreeBSD Application Server ~ LAN_IP=10.0.1.17 / Internal_IP=192.168.10.17 - Asterisk || SIP(UDP) / RTP || * Hikvision Doorbell ~ Internal_IP=192.168.10.100 #### From my reading so far I have a few questions... * To setup Kamailio > Asterisk it looks like I need to setup the dispatcher module; I also I may need to write some routing code. Am I correct, that I will need to use the dispatcher module? Will I need to modify the routing code/logic or is the default usually sufficient? * I read RTPProxy does support SRTP, but I don't see any configuration options related to encryption. I assume this is just enabled in Asterisk/Kamailio? * For Asterisk configuration I believe I just need to define the outbound_proxy. But now I am not sure how I can require SRTP between my Linphone clients and RTPProxy, while the leg between RTPProxy and Asterisk is unencrypted RTP? Thanks for any help that is provided!

1 2

Kamailio TLS Listener Not Binding to Port (5061 or 10061)
by steven.muchwe 29 Apr '25

29 Apr '25

Hello Kamailio Community, I’ve been troubleshooting an issue with Kamailio where the TLS listener fails to bind to any specified ports (5061, 10061, etc.), despite valid configurations and certificates. Here’s a summary of my setup and steps taken: 1. *Environment Details*: - Kamailio version: 5.7.4 - OpenSSL version: 3.0.13 - Operating System: Ubuntu (Noble Release) - TLS module (tls.so) is installed and loaded. 2. *Issue Details*: - Configurations validate successfully (config file ok). - OpenSSL works perfectly when testing certificates and keys with s_server, binding to ports (5061 and others). - Kamailio fails to bind TLS listeners (ss -tulnp shows no activity on the specified ports). 3. *Steps Already Taken*: - Simplified TLS configuration (minimal_tls.cfg) with: plaintext listen=tls:10.14.202.39:5061 loadmodule "tls.so" modparam("tls", "certificate", "/home/localtech/vicissl/868a963bc33d5eae.crt") modparam("tls", "private_key", "/home/localtech/vicissl/private.key") - Tested multiple ports (5061, 10061, 15061). - Checked firewall settings (iptables) and confirmed no restrictions. - Rebuilt Kamailio from source and ensured TLS modules are linked to OpenSSL. - Ran Kamailio with maximum debugging (-ddd) to examine logs—no binding-related errors appeared. 4. *Log Excerpts*: (Attach relevant logs showing TLS initialization or lack of binding activity.) 5. *Question*: What additional steps or configurations should I explore to resolve this issue? Could this be a compatibility problem between Kamailio 5.7.4 and OpenSSL 3.0.13? Any guidance or insights would be greatly appreciated! Best regards, Steven Muchwe Njoroge

4 8

Re: SIP Call Drops After 0.32 Seconds – Asterisk on Kubernetes with Kamailio + RTPengine
by airsay＠duck.com 29 Apr '25

29 Apr '25

I will let the more experienced Kamailio folks comment on the technical/Kamailio/RTP modifications that you need to make. The SIP standard requires an ACK to a 200 OK to be sent within that 32 second window. If an ACK is not received, the session is torn down. You would need to do a packet capture to review the Contact header in the SIP and the c: in the SDP. I'm just getting bedded in with SIP, reading Alan B Johnston's "SIP: Understanding the Session Initiation Protocol". Excellent introduction to understanding SIP. Best regards Sent from my iPhone > On 23 Apr 2025, at 16:35, Fernando Lopes via sr-users <sr-users_at_lists.kamailio.org_airsay(a)duck.com> wrote: > > Hello everyone, > I'm running into an issue with SIP calls in my current setup and would really appreciate some help. > > Setup: > I have a machine named sip00 (IP: 192.168.1.75) running Kamailio + RTPengine. > Kamailio is dispatching calls to sip:192.168.1.190:32210;transport=tcp. This IP points to another machine running Asterisk inside a Kubernetes cluster. > RTPengine is configured with an RTP port range of 10000–20000, and my router is set to allow that same range. > > Asterisk Kubernetes Service Configuration: > yaml > Copy > Edit > spec: > ports: > - name: tcp-port > protocol: TCP > port: 5060 > targetPort: 5060 > nodePort: 32210 > - name: udp-port > protocol: UDP > port: 5060 > targetPort: 5060 > nodePort: 32210 > > Problem: > When I initiate a SIP call, the router forwards traffic to Kamailio + RTPengine, which then sends it to the Asterisk server on 192.168.1.190. > Everything seems fine initially, but at exactly 0.32 seconds into the call, Asterisk sends a BYE and no longer responds with 200 OK to the SIP dialog — even though I'm still receiving and sending audio. Then, at around 01:04, I get a 408 Request Timeout. > > Questions: > Do I need to explicitly expose the RTP port range (10000–20000) in the Asterisk Kubernetes service as well? > Why is Asterisk sending a BYE so early if audio is still flowing? > Could it be a signaling timeout or an issue with SIP dialog tracking? > Any help or pointers would be greatly appreciated! > > Thanks in advance! > __________________________________________________________ > Kamailio - Users Mailing List - Non Commercial Discussions -- sr-users(a)lists.kamailio.org > To unsubscribe send an email to sr-users-leave(a)lists.kamailio.org > Important: keep the mailing list in the recipients, do not reply only to the sender!

7 7

[Serusers] Digest Authentication with Tenor DX
by Ashutosh Kumar 29 Apr '25

29 Apr '25

Hi, Does someone have any idea/experience with Quintum DX radius server's support for digest mode authentication. The Access-Request packets sent by SER are getting an error back. Guide. Regards, Ashutosh Kumar Chetu, Inc. Ph : 1(305) 402 6724 - Witin US Ph : 91 120 5323340 - Outside US Fax:1 (305) 832 5987 For more information, please visit http://www.chetu.com

2 1