topoh breaks SIPS with PJSIP if PJMEDIA_SRTP_MANDATORY is set
Hi I have a question related to topoh. We are running Kamailio in version 6.0.2 with topoh enabled. The PJSIP based softphone is unable to establish a call with SIPS and SRTP if we use "PJMEDIA_SRTP_MANDATORY" in PJSIP. PJSIP complains about "Secure dialog requires SIPS scheme in Contact and Record-Route headers, ending the session". The other side is sending "Contact: <sips:620150@10.165.44.117:59686;transport=tls>", but topoh modifies the contact header to "Contact: <sip:127.0.0.8;line=sr-avdFaQDvhUxGrqtxhqxThq-ZnUy6nUzGrQDZmqa1rUf6a0JTaLt4aoyV2EGQ>" without sips scheme and without transport=tls. PJSIP then refuses to establish the call and sends immediately a BYE. If topoh is disabled, the call is successfully established. Is it somehow possible to tell topoh to keep the scheme or transport=tls if the other side provided it? Thanks for your help Best regards Mathias
Hello! I just faced the same behavior. I have modparam("topoh", "mask_ip", "") so Kamailio uses the address it sends packets from. Inside event_route[topoh:msg-outgoing] it rewrites the Contact header but skips adding transport value for TCP or TLS. Is there a way of including transport value or adding parameter to mask_mode setting to exclure processing Contact header for all responses? Thanks! пт, 22 серп. 2025 р. о 17:09 Mathias Schneuwly via sr-users < sr-users@lists.kamailio.org> пише:
Hi
I have a question related to topoh. We are running Kamailio in version 6.0.2 with topoh enabled. The PJSIP based softphone is unable to establish a call with SIPS and SRTP if we use "PJMEDIA_SRTP_MANDATORY" in PJSIP.
PJSIP complains about "Secure dialog requires SIPS scheme in Contact and Record-Route headers, ending the session". The other side is sending "Contact: <sips:620150@10.165.44.117:59686;transport=tls>", but topoh modifies the contact header to "Contact: <sip:127.0.0.8;line=sr-avdFaQDvhUxGrqtxhqxThq-ZnUy6nUzGrQDZmqa1rUf6a0JTaLt4aoyV2EGQ>" without sips scheme and without transport=tls. PJSIP then refuses to establish the call and sends immediately a BYE.
If topoh is disabled, the call is successfully established.
Is it somehow possible to tell topoh to keep the scheme or transport=tls if the other side provided it?
Thanks for your help Best regards Mathias __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions -- sr-users@lists.kamailio.org To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender!
Hello, On 01.12.25 13:10, Володимир Іванець via sr-users wrote:
Hello!
I just faced the same behavior.
I have modparam("topoh", "mask_ip", "") so Kamailio uses the address it sends packets from. Inside event_route[topoh:msg-outgoing] it rewrites the Contact header but skips adding transport value for TCP or TLS. Is there a way of including transport value or adding parameter to mask_mode setting to exclure processing Contact header for all responses?
Thanks!
пт, 22 серп. 2025 р. о 17:09 Mathias Schneuwly via sr-users <sr-users@lists.kamailio.org> пише:
Hi
I have a question related to topoh. We are running Kamailio in version 6.0.2 with topoh enabled. The PJSIP based softphone is unable to establish a call with SIPS and SRTP if we use "PJMEDIA_SRTP_MANDATORY" in PJSIP.
PJSIP complains about "Secure dialog requires SIPS scheme in Contact and Record-Route headers, ending the session". The other side is sending "Contact: <sips:620150@10.165.44.117:59686;transport=tls>", but topoh modifies the contact header to "Contact: <sip:127.0.0.8;line=sr-avdFaQDvhUxGrqtxhqxThq-ZnUy6nUzGrQDZmqa1rUf6a0JTaLt4aoyV2EGQ>" without sips scheme and without transport=tls. PJSIP then refuses to establish the call and sends immediately a BYE.
If topoh is disabled, the call is successfully established.
Is it somehow possible to tell topoh to keep the scheme or transport=tls if the other side provided it?
the UA does not route using Contact, it has to use the Record-/Route header(s) set by Kamailio, which should have the transport=tls, if that side of the call is over TLS. Also, sips does not mean transport=tls, but that the traffic goes over "secure" channel, which can be ipsec/vpn, private networks, ... Cheers, Daniel -- Daniel-Constantin Mierla (@ asipto.com) twitter.com/miconda -- linkedin.com/in/miconda Kamailio Consultancy, Training and Development Services -- asipto.com Kamailio World Conference, May 7-8, 2026 - Berlin, Germany -- kamailioworld.com
Hello Daniel! Thank you for your reply. This answers the question, as the Kamailio configuration I'm currently working on does not add Record-Route headers. Just in case anyone will be wondering, I managed to locate and skip required packages using event_route[topoh:msg-sending] instead. Thank you. пн, 1 груд. 2025 р. о 15:11 Daniel-Constantin Mierla <miconda@gmail.com> пише:
Hello, On 01.12.25 13:10, Володимир Іванець via sr-users wrote:
Hello!
I just faced the same behavior.
I have modparam("topoh", "mask_ip", "") so Kamailio uses the address it sends packets from. Inside event_route[topoh:msg-outgoing] it rewrites the Contact header but skips adding transport value for TCP or TLS. Is there a way of including transport value or adding parameter to mask_mode setting to exclure processing Contact header for all responses?
Thanks!
пт, 22 серп. 2025 р. о 17:09 Mathias Schneuwly via sr-users < sr-users@lists.kamailio.org> пише:
Hi
I have a question related to topoh. We are running Kamailio in version 6.0.2 with topoh enabled. The PJSIP based softphone is unable to establish a call with SIPS and SRTP if we use "PJMEDIA_SRTP_MANDATORY" in PJSIP.
PJSIP complains about "Secure dialog requires SIPS scheme in Contact and Record-Route headers, ending the session". The other side is sending "Contact: <sips:620150@10.165.44.117:59686;transport=tls> <sips:620150@10.165.44.117:59686;transport=tls>", but topoh modifies the contact header to "Contact: <sip:127.0.0.8;line=sr-avdFaQDvhUxGrqtxhqxThq-ZnUy6nUzGrQDZmqa1rUf6a0JTaLt4aoyV2EGQ>" without sips scheme and without transport=tls. PJSIP then refuses to establish the call and sends immediately a BYE.
If topoh is disabled, the call is successfully established.
Is it somehow possible to tell topoh to keep the scheme or transport=tls if the other side provided it?
the UA does not route using Contact, it has to use the Record-/Route header(s) set by Kamailio, which should have the transport=tls, if that side of the call is over TLS. Also, sips does not mean transport=tls, but that the traffic goes over "secure" channel, which can be ipsec/vpn, private networks, ...
Cheers, Daniel
-- Daniel-Constantin Mierla (@ asipto.com)twitter.com/miconda -- linkedin.com/in/miconda Kamailio Consultancy, Training and Development Services -- asipto.com Kamailio World Conference, May 7-8, 2026 - Berlin, Germany -- kamailioworld.com
participants (3)
-
Daniel-Constantin Mierla -
Mathias Schneuwly -
Володимир Іванець