August 2025 - sr-users - kamailio.org

Postgres connections optimization #4342
by Stephane Savonitto 17 Jun '26

17 Jun '26

Hello, On P-CSCF when running we have 200+ permanent connection to postgres db, even if there is no traffic. Is there a way to manage connections dynamically using a pool like using PgBouncer ? Regards, Stéphane

6 10

Kamailio & Asterisk SIP Registration Forwarding - Asterisk replies 401 Unauthorized
by Ben Fitzgerald 17 Apr '26

17 Apr '26

Hi, I've been following this integration tutorial http://kb.asipto.com/asterisk:realtime:kamailio-4.0.x-asterisk-11.3.0-astdb and have a successful registration and I can even make calls through my asterisk box. However what is unusual to me is that every time a phone registers with Kamailio, that is forwarded to Asterisk (as expected), yet Asterisk replies with 401 Unauthorized. Oddly enough the phone registers and can still make calls. What worries me is that as we scale to 100's of cps, this seemingly erroneous message may slow down Asterisk because it's trying to handle authentication for users which have already been authenticated by Kamailio. If this behavior is expected, then that would be good to know as well. This is the sip debug from ASTERISK (I have replaced IP's with the names of the servers): <--- SIP read from TCP:kamailio:41205 ---> REGISTER sip:asteriskIP:5060;transport=tcp SIP/2.0 Via: SIP/2.0/TCP kamailio;branch=z9hG4bK998f.2846e405000000000000000000000000.0 To: <sip:40081@asteriskIP> From: <sip:40081@asteriskIP>;tag=32fda68bf54efeeb04e3edc67b53c63d-cfb0 CSeq: 10 REGISTER Call-ID: 0005ce130bcee5c4-26538@kamailio Max-Forwards: 70 Content-Length: 0 User-Agent: kamailio (4.3.0 (x86_64/linux)) Contact: <sip:40081@kamailio:5060> Expires: 3600 <-------------> --- (11 headers 0 lines) --- Sending to kamailio:5060 (no NAT) Sending to kamailio:5060 (no NAT) <--- Transmitting (no NAT) to kamailio:5060 ---> SIP/2.0 401 Unauthorized Via: SIP/2.0/TCP kamailio;branch=z9hG4bK998f.2846e405000000000000000000000000.0;received= kamailio From: <sip:40081@asteriskIP>;tag=32fda68bf54efeeb04e3edc67b53c63d-cfb0 To: <sip:40081@asteriskIP>;tag=as404bac9a Call-ID: 0005ce130bcee5c4-26538@ kamailio CSeq: 10 REGISTER Server: Asterisk PBX 11.6-cert2 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH Supported: replaces, timer WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="262b338e" Content-Length: 0 <------------> Scheduling destruction of SIP dialog '0005ce130bcee5c4-26538@ kamailio' in 32000 ms (Method: REGISTER) Scheduling destruction of SIP dialog '0005ce130bcee5c4-26538@ kamailio' in 32000 ms (Method: REGISTER) Really destroying SIP dialog '0005ce130bcee5c1-26536@ kamailio' Method: REGISTER ========================= sip.conf for kamailio trunk: [kamailio-inbound] type=friend dtmfmode=auto host=kamailioIP allow=all context=sipout insecure=port,invite canreinvite=no ======================== Asterisk version: 11.6-cert2 Kamailio version: 4.3 Benjamin Fitzgerald LETS Corporation (925) 235-1154 ben(a)letscorp.us *******Confidential Notice: This message is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this message in error, please delete this message from all computers and contact Orion Systems/LETS Corp immediately by return e-mail and/or telephone at (925) 566-5600

4 8

problems using kamailio
by Peter Walber 17 Apr '26

17 Apr '26

Hello, I try to use kamailio as webrtc-sip-gateway between my openhab smart home system and my doorbird doorbell with phone and camera. I try to use the product of "https://github.com/florian-h05/webrtc-sip-gw". Which integrates kamailio together with rtpengine to the gateway. I want to use openhab as SIP Client and have a Telekom Speedport Smart 4 Router on the other side. The webrtc-sip-gw from florian-h05 shall be the software between Openhab and the speedport smart 4. On the speedport smart router the SIP Server is enabled and configured. I can sucessfully call with zoiper extern phone numbers. The doorbird als is configured correctly. I can call the doorbird with my zioper softphone using the SIP interface of the doorbird. The runtime system is a docker container on debian 12. I want to call the doorbird by SIP from my openhab SIP client. I can initiate the call, but it doesn't establish Here is the log from the docker container. --------------------------------------------------------------------------------------------------- 2025-08-07T07:46:57.384687165Z 9(52) INFO: <script>: HTTP Request Received 2025-08-07T07:46:57.391479050Z 9(52) INFO: <script>: START: REGISTER from sip:**73@speedport.ip (IP:192.168.2.185:39510) 2025-08-07T07:46:57.391516534Z 9(52) INFO: <script>: Current Contact header: <sip:v0fds0hl@fe8ojuo7pnkl.invalid;transport=ws>;+sip.ice;reg-id=1;+sip.instance="<urn:uuid:243e461d-f0cb-4c09-9a63-f57c9bba8d6b>";expires=600 2025-08-07T07:46:57.391526535Z 9(52) INFO: <script>: Setting new Contact header: <sip:**73@192.168.2.209:5060> 2025-08-07T07:47:00.195739350Z 9(52) INFO: <script>: START: INVITE from sip:**73@speedport.ip (IP:192.168.2.185:39510) 2025-08-07T07:47:00.195800424Z 9(52) INFO: <script>: Current Contact header: <sip:v0fds0hl@fe8ojuo7pnkl.invalid;transport=ws;ob> 2025-08-07T07:47:00.195811886Z 9(52) INFO: <script>: Setting new Contact header: <sip:v0fds0hl@fe8ojuo7pnkl.invalid;transport=ws;ob;alias=192.168.2.185~39510~6;alias=192.168.2.185~39510~6> 2025-08-07T07:47:00.196163528Z 9(52) INFO: <script>: MANAGE_BRANCH: New branch [0] to sip:**72@speedport.ip 2025-08-07T07:47:00.196181228Z 9(52) INFO: <script>: NATMANAGE branch_id:0 ruri: sip:**72@speedport.ip, method:INVITE, status:<null>, extra_id: z9hG4bK44082210, rtpengine_manage: replace-origin replace-session-connection via-branch=extra rtcp-mux-demux SDES-off ICE=remove RTP/AVP 2025-08-07T07:47:00.196608235Z INFO: [penvq8f06ehafutk9ivf]: [control] Received command 'offer' from 127.0.0.1:50790 2025-08-07T07:47:00.196625247Z NOTICE: [penvq8f06ehafutk9ivf]: [core] Creating new call 2025-08-07T07:47:00.198519843Z INFO: [penvq8f06ehafutk9ivf]: [control] Replying to 'offer' from 127.0.0.1:50790 (elapsed time 0.001979 sec) 2025-08-07T07:47:01.927528447Z 9(52) INFO: <script>: START: CANCEL from sip:**73@speedport.ip (IP:192.168.2.185:39510) 2025-08-07T07:47:01.927577111Z 9(52) INFO: <script>: Current Contact header: <null> 2025-08-07T07:47:01.927586439Z 9(52) INFO: <script>: Setting new Contact header: <null> 2025-08-07T07:47:09.169489716Z 7(50) INFO: <script>: WebSocket connection from 192.168.2.185:39510 has closed *2025-08-07T07:47:27.355185671Z 2(45) WARNING: tm [../../core/forward.h:203]: msg_send_buffer(): TCP/TLS connection for WebSocket could not be found* 2025-08-07T07:47:27.914769340Z 9(52) INFO: <script>: HTTP Request Received 2025-08-07T07:47:27.951608347Z 9(52) INFO: <script>: START: REGISTER from sip:**73@speedport.ip (IP:192.168.2.185:44816) 2025-08-07T07:47:27.951663073Z 9(52) INFO: <script>: Current Contact header: <sip:lebth4eq@fe8ojuo7pnkl.invalid;transport=ws>;+sip.ice;reg-id=1;+sip.instance="<urn:uuid:39eac0ca-0aea-4526-a5c7-0516bc8a2d71>";expires=600 2025-08-07T07:47:27.951915520Z 9(52) INFO: <script>: Setting new Contact header: <sip:**73@192.168.2.209:5060> 2025-08-07T07:47:30.168546446Z 2(45) INFO: <script>: BRANCH FAILED: z9hG4bK4408221 + 0INFO: [penvq8f06ehafutk9ivf]: [control] Received command 'delete' from 127.0.0.1:36296 2025-08-07T07:47:30.168587880Z INFO: [penvq8f06ehafutk9ivf]: [core] Deleting call branch '' (via-branch 'z9hG4bK44082210') 2025-08-07T07:47:30.168597011Z INFO: [penvq8f06ehafutk9ivf]: [core] Call branch '' (via-branch 'z9hG4bK44082210') deleted, no more branches remaining 2025-08-07T07:47:30.168605215Z INFO: [penvq8f06ehafutk9ivf]: [core] Deleting entire call 2025-08-07T07:47:30.168612883Z INFO: [penvq8f06ehafutk9ivf]: [core] Final packet stats: 2025-08-07T07:47:30.168620604Z INFO: [penvq8f06ehafutk9ivf]: [core] --- Tag 'utenlull77', created 0:30 ago for branch '' 2025-08-07T07:47:30.168628359Z INFO: [penvq8f06ehafutk9ivf]: [core] --- subscribed to '' 2025-08-07T07:47:30.168636445Z INFO: [penvq8f06ehafutk9ivf]: [core] --- subscription for '' 2025-08-07T07:47:30.168645446Z INFO: [penvq8f06ehafutk9ivf]: [core] ------ Media #1 (audio over UDP/TLS/RTP/SAVPF) using unknown codec 2025-08-07T07:47:30.168653691Z INFO: [penvq8f06ehafutk9ivf]: [core] --------- Port 192.168.2.209:23484 <> 192.168.2.185:60650, SSRC 0, 0 p, 0 b, 0 e, 30 ts 2025-08-07T07:47:30.168661939Z INFO: [penvq8f06ehafutk9ivf]: [core] --- Tag '', created 0:30 ago for branch 'z9hG4bK44082210' 2025-08-07T07:47:30.168669844Z INFO: [penvq8f06ehafutk9ivf]: [core] --- subscribed to 'utenlull77' 2025-08-07T07:47:30.168677713Z INFO: [penvq8f06ehafutk9ivf]: [core] --- subscription for 'utenlull77' 2025-08-07T07:47:30.168685661Z INFO: [penvq8f06ehafutk9ivf]: [core] ------ Media #1 (audio over RTP/AVP) using unknown codec 2025-08-07T07:47:30.168693705Z INFO: [penvq8f06ehafutk9ivf]: [core] --------- Port 192.168.2.209:23472 <> :0 , SSRC 0, 0 p, 0 b, 0 e, 30 ts 2025-08-07T07:47:30.168718608Z INFO: [penvq8f06ehafutk9ivf]: [core] --------- Port 192.168.2.209:23473 <> :0 (RTCP), SSRC 0, 0 p, 0 b, 0 e, 30 ts 2025-08-07T07:47:30.168728065Z INFO: [penvq8f06ehafutk9ivf]: [control] Replying to 'delete' from 127.0.0.1:36296 (elapsed time 0.000505 sec) *2025-08-07T07:47:30.169042099Z 2(45) INFO: <script>: Failure: <null> 2(45) WARNING: tm [../../core/forward.h:203]: msg_send_buffer(): TCP/TLS connection for WebSocket could not be found* 2025-08-07T07:47:30.265075785Z 9(52) INFO: <script>: START: INVITE from sip:**73@speedport.ip (IP:192.168.2.185:44816) 2025-08-07T07:47:30.265125134Z 9(52) INFO: <script>: Current Contact header: <sip:lebth4eq@fe8ojuo7pnkl.invalid;transport=ws;ob> 2025-08-07T07:47:30.265135557Z 9(52) INFO: <script>: Setting new Contact header: <sip:lebth4eq@fe8ojuo7pnkl.invalid;transport=ws;ob;alias=192.168.2.185~44816~6;alias=192.168.2.185~44816~6> 2025-08-07T07:47:30.265484502Z 9(52) INFO: <script>: MANAGE_BRANCH: New branch [0] to sip:**72@speedport.ip 2025-08-07T07:47:30.265664116Z 9(52) INFO: <script>: NATMANAGE branch_id:0 ruri: sip:**72@speedport.ip, method:INVITE, status:<null>, extra_id: z9hG4bK16860370, rtpengine_manage: replace-origin replace-session-connection via-branch=extra rtcp-mux-demux SDES-off ICE=remove RTP/AVP 2025-08-07T07:47:30.265819591Z INFO: [412n0o8dedgair81t70p]: [control] Received command 'offer' from 127.0.0.1:50790 2025-08-07T07:47:30.265979425Z NOTICE: [412n0o8dedgair81t70p]: [core] Creating new call 2025-08-07T07:47:30.267497852Z INFO: [412n0o8dedgair81t70p]: [control] Replying to 'offer' from 127.0.0.1:50790 (elapsed time 0.001599 sec) 2025-08-07T07:47:30.469565385Z 9(52) INFO: <script>: START: CANCEL from sip:**73@speedport.ip (IP:192.168.2.185:44816) 2025-08-07T07:47:30.469629711Z 9(52) INFO: <script>: Current Contact header: <null> 2025-08-07T07:47:30.469645116Z 9(52) INFO: <script>: Setting new Contact header: <null> 2025-08-07T07:47:41.207672567Z 7(50) INFO: <script>: WebSocket connection from 192.168.2.185:44816 has closed 2025-08-07T07:47:57.917754216Z 2(45) WARNING: tm [../../core/forward.h:203]: msg_send_buffer(): TCP/TLS connection for WebSocket could not be found 2025-08-07T07:48:00.230412646Z 2(45) INFO: <script>: BRANCH FAILED: z9hG4bK1686037 + 0INFO: [412n0o8dedgair81t70p]: [control] Received command 'delete' from 127.0.0.1:36296 2025-08-07T07:48:00.230457143Z INFO: [412n0o8dedgair81t70p]: [core] Deleting call branch '' (via-branch 'z9hG4bK16860370') 2025-08-07T07:48:00.230466718Z INFO: [412n0o8dedgair81t70p]: [core] Call branch '' (via-branch 'z9hG4bK16860370') deleted, no more branches remaining 2025-08-07T07:48:00.230475640Z INFO: [412n0o8dedgair81t70p]: [core] Deleting entire call 2025-08-07T07:48:00.230483968Z INFO: [412n0o8dedgair81t70p]: [core] Final packet stats: 2025-08-07T07:48:00.230491909Z INFO: [412n0o8dedgair81t70p]: [core] --- Tag 'hc7h5imu96', created 0:30 ago for branch '' 2025-08-07T07:48:00.230518917Z INFO: [412n0o8dedgair81t70p]: [core] --- subscribed to '' 2025-08-07T07:48:00.230528302Z INFO: [412n0o8dedgair81t70p]: [core] --- subscription for '' 2025-08-07T07:48:00.230537387Z INFO: [412n0o8dedgair81t70p]: [core] ------ Media #1 (audio over UDP/TLS/RTP/SAVPF) using unknown codec 2025-08-07T07:48:00.230545867Z INFO: [412n0o8dedgair81t70p]: [core] --------- Port 192.168.2.209:23400 <> 192.168.2.185:46431, SSRC 0, 0 p, 0 b, 0 e, 30 ts 2025-08-07T07:48:00.230554949Z INFO: [412n0o8dedgair81t70p]: [core] --- Tag '', created 0:30 ago for branch 'z9hG4bK16860370' 2025-08-07T07:48:00.230563124Z INFO: [412n0o8dedgair81t70p]: [core] --- subscribed to 'hc7h5imu96' 2025-08-07T07:48:00.230570851Z INFO: [412n0o8dedgair81t70p]: [core] --- subscription for 'hc7h5imu96' 2025-08-07T07:48:00.230578827Z INFO: [412n0o8dedgair81t70p]: [core] ------ Media #1 (audio over RTP/AVP) using unknown codec 2025-08-07T07:48:00.230587091Z INFO: [412n0o8dedgair81t70p]: [core] --------- Port 192.168.2.209:23494 <> :0 , SSRC 0, 0 p, 0 b, 0 e, 30 ts 2025-08-07T07:48:00.230595631Z INFO: [412n0o8dedgair81t70p]: [core] --------- Port 192.168.2.209:23495 <> :0 (RTCP), SSRC 0, 0 p, 0 b, 0 e, 30 ts 2025-08-07T07:48:00.230603868Z INFO: [412n0o8dedgair81t70p]: [control] Replying to 'delete' from 127.0.0.1:36296 (elapsed time 0.000253 sec) *2025-08-07T07:48:00.230753116Z 2(45) INFO: <script>: Failure: <null> 2(45) WARNING: tm [../../core/forward.h:203]: msg_send_buffer(): TCP/TLS connection for WebSocket could not be found* --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- especially the bold lines confuse me. Why is the TCP/TLS closed and can not be found ? Could that be the problem ?* * * * Thanks for some help and best regards Peter* *

7 15

topoh breaks SIPS with PJSIP if PJMEDIA_SRTP_MANDATORY is set
by Mathias Schneuwly 01 Dec '25

01 Dec '25

Hi I have a question related to topoh. We are running Kamailio in version 6.0.2 with topoh enabled. The PJSIP based softphone is unable to establish a call with SIPS and SRTP if we use "PJMEDIA_SRTP_MANDATORY" in PJSIP. PJSIP complains about "Secure dialog requires SIPS scheme in Contact and Record-Route headers, ending the session". The other side is sending "Contact: <sips:620150@10.165.44.117:59686;transport=tls>", but topoh modifies the contact header to "Contact: <sip:127.0.0.8;line=sr-avdFaQDvhUxGrqtxhqxThq-ZnUy6nUzGrQDZmqa1rUf6a0JTaLt4aoyV2EGQ>" without sips scheme and without transport=tls. PJSIP then refuses to establish the call and sends immediately a BYE. If topoh is disabled, the call is successfully established. Is it somehow possible to tell topoh to keep the scheme or transport=tls if the other side provided it? Thanks for your help Best regards Mathias

3 3

dynamic selection of authentication algorithm
by Juha Heinanen 28 Oct '25

28 Oct '25

How about this new function that sets the algorithm? -- Juha iff --git a/src/modules/auth/auth_mod.c b/src/modules/auth/auth_mod.c index 534ad9e20f..4e3a584d22 100644 --- a/src/modules/auth/auth_mod.c +++ b/src/modules/auth/auth_mod.c @@ -74,6 +74,10 @@ int w_consume_credentials(struct sip_msg *msg, char *s1, char *s2); * Check for credentials with given realm */ int w_has_credentials(struct sip_msg *msg, char *s1, char *s2); +/* + * Set authentication algorithm + */ +int w_auth_algorithm(struct sip_msg *msg, char *alg, char* s2); static int pv_proxy_authenticate( struct sip_msg *msg, char *realm, char *passwd, char *flags); @@ -170,6 +174,8 @@ static cmd_export_t cmds[] = { REQUEST_ROUTE}, {"pv_auth_check", (cmd_function)w_pv_auth_check, 4, fixup_pv_auth_check, 0, REQUEST_ROUTE}, + {"auth_algorithm", w_auth_algorithm, 1, fixup_spve_null, 0, + REQUEST_ROUTE}, {"bind_auth_s", (cmd_function)bind_auth_s, 0, 0, 0}, {0, 0, 0, 0, 0, 0} @@ -475,6 +481,35 @@ int w_has_credentials(sip_msg_t *msg, char *realm, char *s2) return -1; } return ki_has_credentials(msg, &srealm); + +} +/** + * + */ +int w_auth_algorithm(sip_msg_t *msg, char* alg, char* s2) +{ + if (fixup_get_svalue(msg, (gparam_t*)alg, &auth_algorithm) < 0) { + LM_ERR("failed to get algorithm value\n"); + return -1; + } + + if (strcmp(auth_algorithm.s, "MD5") == 0) { + hash_hex_len = HASHHEXLEN; + calc_HA1 = calc_HA1_md5; + calc_response = calc_response_md5; + } + else if (strcmp(auth_algorithm.s, "SHA-256") == 0) { + hash_hex_len = HASHHEXLEN_SHA256; + calc_HA1 = calc_HA1_sha256; + calc_response = calc_response_sha256; + } + else { + LM_ERR("Invalid algorithm provided." + " Possible values are \"\", \"MD5\" or \"SHA-256\"\n"); + return -1; + } + + return 1; } #ifdef USE_NC

5 13

SIP Trunk registration In Kamailio
by tanmoykarmakar10＠gmail.com 14 Oct '25

14 Oct '25

I want to register SIP Trunk directly in Kamailio. How can I register the SIP trunk in Kamailio. Please find the below sample SIP trunk details. Network IP 10.2.2.2 Subnet Mask 255.255.255.252 Customer IP 10.3.3.3 Gateway IP 10.1.1.1 SBCIP 10.4.4.4 Username 12345678 Password 1234 Please help me with configuration to register SIP trunk in kamailio.

4 4

Support for TLS server_name extension (aka SNI=server name indication)
by Barry Flanagan 04 Sep '25

04 Sep '25

Hi, Back in Kamailio 1.5, the release notes state: "support for TLS server_name extension (aka SNI=server name indication)" However, I cannot find any indication of this in the current TLS docs, and trying to set tls_server_name or server_name in tls.cfg fails with "unsupported option". Is this actually supported? Thanks. -Barry Flanagan

5 7

SDP Issue on NAT environment
by Nathan C 02 Sep '25

02 Sep '25

Hello, I have a kamailio on SITE A using a public IP. I'm trying to setup another kamailio on SITE B with NAT. When I try to make a call from SITE B to SITE A, the call is initiated but when comes the SDP my equipment on SITE B does not reply to SDP sent by kamailio on SITE A. I made some test and use only Public IP between the 2 sites and it works properly. So I think that I have a problem on my NAT configuration or maybe I'm missing something. Can someone help me one this problem ? Do you have an idea on what could be blocking. Thank in advance for your help. Regards, Nathan

3 6

Is a kamailio integer signed or unsigned?
by Benoit Panizzon 02 Sep '25

02 Sep '25

Hi I'm chasing an issue where I have a mysql column of type int NOT NULL In MySQL this is a signed integer. In some cases this column can be negative for example -1 I read this column with sql_xquery I end up with 18446744073709551615 That is the unsigned equivalent of 2^64-1 - so kamailio uses SIGNED int? Is there a way to change this to unsigned or to read have sql_xquery convert the value to a string? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

2 2

[4.2] how to send out BYE successfully to close a TCP/TLS connection which misses the connection ID?
by Jack Wang 02 Sep '25

02 Sep '25

For some reasons, My settings will cause kamailio to be restarted even if there were connections connected to it. And when one SIP client in a connection wanted to hangup the call with a WebRTC Client (SIP over websocket) after the proxy-restarting, local client was closed, however , the other side was not. >From the log below it seems that the connection missed. Jan 30 18:19:31 ./kamailio[27857]: WARNING: <core> [msg_translator.c:2777]: via_builder(): TCP/TLS connection (id: 0) for WebSocket could not be found Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [t_msgbuilder.c:1365]: assemble_via(): assemble_via: via building failed Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [t_msgbuilder.c:1545]: build_uac_req(): build_uac_req(): Error while assembling Via Jan 30 18:19:31 ./kamailio[27857]: ERROR: tm [uac.c:379]: t_uac_prepare(): t_uac: Error while building message So, Is it equivalent to connection ID missing? And is there any way to make Websocket found the connection? Btw, after proxy-restarting for seconds , I typed `sh kamctl stats` : websocket:ws_current_connections = 1 It showed that the WebRTC Client will re-connect automatically, So I think this connection could be found by proxy, Any suggestion? Thanks :)

2 3