sr-dev December 2018

sr-dev@lists.kamailio.org

23 participants
314 discussions

[kamailio/kamailio] Proxy Protocol support (#1757)
by Sebastian Lauwers 19 Dec '18

19 Dec '18

### Description I would like to implement support for the Proxy Protocol as implemented by HAProxy and AWS ELBs. The main advantage this brings is better connection information, even behind multiple layers of NAT or LBs. This feature was already discussed a couple of years ago, and it appears the project was not against receiving a patch that adds support for this protocol: https://lists.kamailio.org/pipermail/sr-users/2016-June/093497.html For example, at the moment, my Kamailio deployment is "blind" when it comes to the origin of inbound TCP connections, because it is only able to report the internal IP address of our ELBs, rather than the actual IP address of the client, and IP address of the LB the connection was received on. Dixa is offering to sponsor work (my own hours) to implement this, and we would also be a production user of this feature. The Proxy Protocol is fairly well documented here: https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt As far as I know, AWS ELBs only implement version 1 of the protocol, but I believe there is value in implementing both (while we're at it), and the second version of the protocol is a lot easier to parse, anyway. I'm opening this feature request to a/ track progress, b/ discuss implementation details. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/1757

3 11

git:master:10be01a4: core: Add PROXY protocol implementation (#1765)
by Henning Westerholt 19 Dec '18

19 Dec '18

Module: kamailio Branch: master Commit: 10be01a41430335f27a557a58a8f0e72bbd5d2c7 URL: https://github.com/kamailio/kamailio/commit/10be01a41430335f27a557a58a8f0e7… Author: Sebastian Lauwers <sebastian.lauwers(a)gmail.com> Committer: Henning Westerholt <henningw(a)users.noreply.github.com> Date: 2018-12-19T09:05:14+01:00 core: Add PROXY protocol implementation (#1765) - introduce new global variable `ksr_tcp_accept_haproxy`. - this variable can be modified by using the `tcp_accept_haproxy=yes` core configuration parameter. - when active, inbound TCP connections are expected to behave according to the PROXY protocol[1]. - Both the v1 (human-readable) and v2 (binary) versions of the protocol are supported. - [1]: https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt --- Modified: src/core/cfg.lex Modified: src/core/cfg.y Modified: src/core/globals.h Modified: src/core/tcp_main.c Modified: src/core/tcp_read.c --- Diff: https://github.com/kamailio/kamailio/commit/10be01a41430335f27a557a58a8f0e7… Patch: https://github.com/kamailio/kamailio/commit/10be01a41430335f27a557a58a8f0e7…

1 0

git:master:b5253b62: websocket: use the list with ids for ws connections to do ping-pong
by Daniel-Constantin Mierla 18 Dec '18

18 Dec '18

Module: kamailio Branch: master Commit: b5253b62090feb70f08885fb530d894d0bd6ad90 URL: https://github.com/kamailio/kamailio/commit/b5253b62090feb70f08885fb530d894… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2018-12-18T13:20:51+01:00 websocket: use the list with ids for ws connections to do ping-pong - avoid using pointers to ws connections, they can get closed --- Modified: src/modules/websocket/ws_conn.c Modified: src/modules/websocket/ws_conn.h Modified: src/modules/websocket/ws_frame.c --- Diff: https://github.com/kamailio/kamailio/commit/b5253b62090feb70f08885fb530d894… Patch: https://github.com/kamailio/kamailio/commit/b5253b62090feb70f08885fb530d894…

1 0

[kamailio/kamailio] Module: security to prevent different types of attacks (#1755)
by Pepelux 18 Dec '18

18 Dec '18

#### Pre-Submission Checklist    - [x] Commit message has the format required by CONTRIBUTING guide - [x] Commits are split per component (core, individual modules, libs, utils, ...) - [x] Each component has a single commit (if not, squash them into one commit) - [x] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated) #### Type Of Change - [ ] Small bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality) #### Checklist:  - [x] PR should be backported to stable branches - [x] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number) #### Description  This module has been designed to offer an additional layer of security over our communications. To achieve this, the following features are available: Blacklist to filter user agents, IP addresses, countries, domains and users. Whitelist to filter user agents, IP addresses, countries, domains and users. Blacklist of destinations where calling is not allowed. SQL injection attacks prevention. You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/1755 -- Commit Summary -- * Module security: create database SQL * Module security: database schema * Module security: new module * Change dst_exact_match from string to integer * fix Makefile description * update descriptions * Now it is possible to define the names of the columns in as parameters of the module * Update description * Update description * Fix sqli checks for some headers -- File Changes -- A src/lib/srdb1/schema/security.xml (65) A src/modules/security/Makefile (14) A src/modules/security/README (461) A src/modules/security/doc/Makefile (3) A src/modules/security/doc/security.xml (33) A src/modules/security/doc/security_admin.xml (601) A src/modules/security/security.c (376) A src/modules/security/security.h (64) A src/modules/security/security_db.c (408) A src/modules/security/security_hdr.c (294) A src/modules/security/security_rpc.c (212) A utils/kamctl/db_sqlite/security-create.sql (11) A utils/kamctl/mysql/security-create.sql (11) A utils/kamctl/oracle/security-create.sql (19) A utils/kamctl/postgres/security-create.sql (11) -- Patch Links -- https://github.com/kamailio/kamailio/pull/1755.patch https://github.com/kamailio/kamailio/pull/1755.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/1755

3 16

git:master:8467ef01: src/Makefile.groups: added secfilter module
by Daniel-Constantin Mierla 18 Dec '18

18 Dec '18

Module: kamailio Branch: master Commit: 8467ef01181e43d3664501862bb698f4963c6e3e URL: https://github.com/kamailio/kamailio/commit/8467ef01181e43d3664501862bb698f… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2018-12-18T10:27:26+01:00 src/Makefile.groups: added secfilter module --- Modified: src/Makefile.groups --- Diff: https://github.com/kamailio/kamailio/commit/8467ef01181e43d3664501862bb698f… Patch: https://github.com/kamailio/kamailio/commit/8467ef01181e43d3664501862bb698f… --- diff --git a/src/Makefile.groups b/src/Makefile.groups index 9729cdd1b5..90f62e0127 100644 --- a/src/Makefile.groups +++ b/src/Makefile.groups @@ -29,7 +29,7 @@ mod_list_db=acc alias_db auth_db avpops cfg_db db_text db_flatstore \ db_cluster dialog dispatcher domain drouting group \ htable imc matrix mohqueue msilo mtree p_usrloc pdt permissions \ pipelimit prefix_route registrar sipcapture siptrace speeddial \ - sqlops uac uri_db userblacklist usrloc + sqlops uac uri_db userblacklist usrloc secfilter # - common modules depending on database, using UID db schema

1 0

git:master:e5067d45: kamctl: generated sql creation scripts for secfilter module
by Daniel-Constantin Mierla 18 Dec '18

18 Dec '18

Module: kamailio Branch: master Commit: e5067d45614abbc89710493f7f0916aa4f33432a URL: https://github.com/kamailio/kamailio/commit/e5067d45614abbc89710493f7f0916a… Author: Jose Luis Verdeguer <pepeluxx(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2018-12-18T10:23:10+01:00 kamctl: generated sql creation scripts for secfilter module --- Added: utils/kamctl/db_sqlite/secfilter-create.sql Added: utils/kamctl/mysql/secfilter-create.sql Added: utils/kamctl/oracle/secfilter-create.sql Added: utils/kamctl/postgres/secfilter-create.sql --- Diff: https://github.com/kamailio/kamailio/commit/e5067d45614abbc89710493f7f0916a… Patch: https://github.com/kamailio/kamailio/commit/e5067d45614abbc89710493f7f0916a… --- diff --git a/utils/kamctl/db_sqlite/secfilter-create.sql b/utils/kamctl/db_sqlite/secfilter-create.sql new file mode 100644 index 0000000000..6f8af6d5a9 --- /dev/null +++ b/utils/kamctl/db_sqlite/secfilter-create.sql @@ -0,0 +1,11 @@ +CREATE TABLE secfilter ( + id INTEGER PRIMARY KEY NOT NULL, + action SMALLINT DEFAULT 0 NOT NULL, + type SMALLINT DEFAULT 0 NOT NULL, + data VARCHAR(64) DEFAULT '' NOT NULL +); + +CREATE INDEX secfilter_idx ON secfilter (action, type, data); + +INSERT INTO version (table_name, table_version) values ('secfilter', '1'); + diff --git a/utils/kamctl/mysql/secfilter-create.sql b/utils/kamctl/mysql/secfilter-create.sql new file mode 100644 index 0000000000..9e6eab745f --- /dev/null +++ b/utils/kamctl/mysql/secfilter-create.sql @@ -0,0 +1,11 @@ +CREATE TABLE `secfilter` ( + `id` INT(10) UNSIGNED AUTO_INCREMENT PRIMARY KEY NOT NULL, + `action` TINYINT(1) DEFAULT 0 NOT NULL, + `type` TINYINT(1) DEFAULT 0 NOT NULL, + `data` VARCHAR(64) DEFAULT '' NOT NULL +); + +CREATE INDEX secfilter_idx ON secfilter (`action`, `type`, `data`); + +INSERT INTO version (`table_name`, `table_version`) values ('secfilter', '1'); + diff --git a/utils/kamctl/oracle/secfilter-create.sql b/utils/kamctl/oracle/secfilter-create.sql new file mode 100644 index 0000000000..539be00a5d --- /dev/null +++ b/utils/kamctl/oracle/secfilter-create.sql @@ -0,0 +1,19 @@ +CREATE TABLE secfilter ( + id NUMBER(10) PRIMARY KEY, + action NUMBER(1) DEFAULT 0 NOT NULL, + type NUMBER(1) DEFAULT 0 NOT NULL, + data VARCHAR2(64) DEFAULT '' NOT NULL +); + +CREATE OR REPLACE TRIGGER secfilter_tr +before insert on secfilter FOR EACH ROW +BEGIN + auto_id(:NEW.id); +END secfilter_tr; +/ +BEGIN map2users('secfilter'); END; +/ +CREATE INDEX ORA_secfilter_idx ON secfilter (action, type, data); + +INSERT INTO version (table_name, table_version) values ('secfilter', '1'); + diff --git a/utils/kamctl/postgres/secfilter-create.sql b/utils/kamctl/postgres/secfilter-create.sql new file mode 100644 index 0000000000..fc44a806a9 --- /dev/null +++ b/utils/kamctl/postgres/secfilter-create.sql @@ -0,0 +1,11 @@ +CREATE TABLE secfilter ( + id SERIAL PRIMARY KEY NOT NULL, + action SMALLINT DEFAULT 0 NOT NULL, + type SMALLINT DEFAULT 0 NOT NULL, + data VARCHAR(64) DEFAULT '' NOT NULL +); + +CREATE INDEX secfilter_idx ON secfilter (action, type, data); + +INSERT INTO version (table_name, table_version) values ('secfilter', '1'); +

1 0

git:master:ff943c68: lib/srdb1: added db schema for secfilter module
by Daniel-Constantin Mierla 18 Dec '18

18 Dec '18

Module: kamailio Branch: master Commit: ff943c681f1888bb106e85a170df371136410341 URL: https://github.com/kamailio/kamailio/commit/ff943c681f1888bb106e85a170df371… Author: Jose Luis Verdeguer <pepeluxx(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2018-12-18T10:22:18+01:00 lib/srdb1: added db schema for secfilter module --- Added: src/lib/srdb1/schema/secfilter.xml --- Diff: https://github.com/kamailio/kamailio/commit/ff943c681f1888bb106e85a170df371… Patch: https://github.com/kamailio/kamailio/commit/ff943c681f1888bb106e85a170df371… --- diff --git a/src/lib/srdb1/schema/secfilter.xml b/src/lib/srdb1/schema/secfilter.xml new file mode 100644 index 0000000000..3e0037da5a --- /dev/null +++ b/src/lib/srdb1/schema/secfilter.xml @@ -0,0 +1,65 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE table PUBLIC "-//kamailio.org//DTD DBSchema V1.1//EN" + "http://kamailio.org/pub/kamailio/dbschema/dtd/1.1/dbschema.dtd" [ + +<!ENTITY % entities SYSTEM "entities.xml"> +%entities; + +]> + +<table id="secfilter" xmlns:db="http://docbook.org/ns/docbook"> + <name>secfilter</name> + <version>1</version> + <type db="mysql">&MYSQL_TABLE_TYPE;</type> + <description> + <db:para> + This table is used by the secfilter module. It contains the sets of + values used to block or allow messages. More information about the + secfilter module can be found at: + <itemizedlist> + <listitem> + <ulink url="&KAMAILIO_MOD_DOC;secfilter.html">&KAMAILIO_MOD_DOC;secfilter.html</ulink>. + </listitem> + </itemizedlist> + </db:para> + </description> + + <column id="id"> + <name>id</name> + <type>unsigned int</type> + <size>&table_id_len;</size> + <autoincrement/> + <primary/> + <type db="dbtext">int,auto</type> + <description>unique ID</description> + </column> + + <column id="action"> + <name>action</name> + <type>tinyint</type> + <default/> + <description>Action to do (0=blacklisted data, 1=whitelisted data, 2=blacklisted destination).</description> + </column> + + <column id="type"> + <name>type</name> + <type>tinyint</type> + <default/> + <description>Type of data (0=user-agent, 1=country, 2=domain, 3=IP address, 4=user).</description> + </column> + + <column id="data"> + <name>data</name> + <type>string</type> + <size>64</size> + <default/> + <description>Data value.</description> + </column> + + <index> + <name>secfilter_idx</name> + <colref linkend="action"/> + <colref linkend="type"/> + <colref linkend="data"/> + </index> +</table>

1 0

git:master:4e9558e1: secfilter: new module for defining security filters
by Daniel-Constantin Mierla 18 Dec '18

18 Dec '18

Module: kamailio Branch: master Commit: 4e9558e1cb142612fa6053a790d29814a8b1e623 URL: https://github.com/kamailio/kamailio/commit/4e9558e1cb142612fa6053a790d2981… Author: Jose Luis Verdeguer <pepeluxx(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2018-12-18T10:18:07+01:00 secfilter: new module for defining security filters - the following features are available: * blacklist to filter user agents, IP addresses, countries, domains and users * whitelist to filter user agents, IP addresses, countries, domains and users * blacklist of destinations where calling is not allowed * SQL injection attacks prevention --- Added: src/modules/secfilter/Makefile Added: src/modules/secfilter/README Added: src/modules/secfilter/doc/Makefile Added: src/modules/secfilter/doc/secfilter.xml Added: src/modules/secfilter/doc/secfilter_admin.xml Added: src/modules/secfilter/secfilter.c Added: src/modules/secfilter/secfilter.h Added: src/modules/secfilter/secfilter_db.c Added: src/modules/secfilter/secfilter_hdr.c Added: src/modules/secfilter/secfilter_rpc.c --- Diff: https://github.com/kamailio/kamailio/commit/4e9558e1cb142612fa6053a790d2981… Patch: https://github.com/kamailio/kamailio/commit/4e9558e1cb142612fa6053a790d2981…

1 0

[kamailio/kamailio] pipelimit module documentation error? (#1671)
by Rogelio Perez 17 Dec '18

17 Dec '18

As reported by Juan Priotti [here](https://lists.kamailio.org/pipermail/sr-users/2017-December/099727.ht… the way pipelimit actually works is: > limit * timer_interval = max req/sec However the [module documentation](https://www.kamailio.org/docs/modules/5.1.x/modules/pipelimi… can be interpreted as: > limit / timer_interval = max req/sec Is this just a documentation error or are we doing something wrong? Thanks. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/1671

3 12

[kamailio/kamailio] Same warnings durring build (#1712)
by sergey-safarov 17 Dec '18

17 Dec '18

### Description This in not important and may be closed at any time. Some info about build warnings on Alpine dist ### Troubleshooting #### Reproduction start a build process on Alpine dist #### Debugging Data NA #### Log Messages ``` CC (gcc) [M regex.so] regex_mod.o regex_mod.c: In function 'w_pcre_match_group': regex_mod.c:663:9: warning: 'num_pcre' may be used uninitialized in this function [-Wmaybe-uninitialized] return ki_pcre_match_group(_msg, &string, (int)num_pcre); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ LD (gcc) [M regex.so] regex.so CC (gcc) [M db_berkeley.so] bdb_fld.o ``` Next ``` CC (gcc) [M cplc.so] cpl_parser.o In file included from ../../core/mem/mem.h:41:0, from cpl_run.c:37: cpl_run.c: In function 'run_remove_location': ../../core/mem/../dprint.h:302:8: warning: 'url.len' may be used uninitialized in this function [-Wmaybe-uninitialized] fprintf(stderr, "%2d(%d) %s: %.*s%s" fmt, \ ^~~~~~~ cpl_run.c:416:6: note: 'url.len' was declared here str url; ^~~ CC (gcc) [M cplc.so] sub_list.o make[3]: 'libsrdb1.so.1.0' is up to date. ``` Next ``` CC (gcc) [M db2_ldap.so] ld_fld.o ld_fld.c: In function 'ldap_gentime2db_datetime': ld_fld.c:273:10: warning: implicit declaration of function 'timelocal' [-Wimplicit-function-declaration] *dst = timelocal(&time); ^~~~~~~~~ CC (gcc) [M db2_ldap.so] ld_cmd.o ``` Next ``` CC (gcc) [M auth_identity.so] auth_dynstr.o CC (gcc) [M auth_identity.so] auth_crypt.o auth_crypt.c:29:0: warning: "_GNU_SOURCE" redefined #define _GNU_SOURCE <command-line>:0:0: note: this is the location of the previous definition ``` Next ``` CC (gcc) [M tls.so] tls_init.o tls_init.c:320:13: warning: 'ser_free' defined but not used [-Wunused-function] static void ser_free(void *ptr, const char *fname, int fline) ^~~~~~~~ CC (gcc) [M tls.so] tls_dump_vf.o CC (gcc) [M tls.so] tls_select.o CC (gcc) [M tls.so] tls_cfg.o CC (gcc) [M tls.so] tls_map.o CC (gcc) [M tls.so] tls_server.o CC (gcc) [M tls.so] tls_locking.o tls_locking.c:85:13: warning: 'dyn_destroy_f' defined but not used [-Wunused-function] static void dyn_destroy_f(struct CRYPTO_dynlock_value *l, ^~~~~~~~~~~~~ tls_locking.c:67:13: warning: 'dyn_lock_f' defined but not used [-Wunused-function] static void dyn_lock_f(int mode, struct CRYPTO_dynlock_value* l, ^~~~~~~~~~ tls_locking.c:45:37: warning: 'dyn_create_f' defined but not used [-Wunused-function] static struct CRYPTO_dynlock_value* dyn_create_f(const char* file, int line) ^~~~~~~~~~~~ CC (gcc) [M tls.so] tls_domain.o tls_domain.c:872:12: warning: 'tls_ssl_ctx_set_freelist' defined but not used [-Wunused-function] static int tls_ssl_ctx_set_freelist(SSL_CTX* ctx, long val, void* unused) ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from tls_domain.c:33:0: tls_domain.c: In function 'load_engine_private_key': tls_map.h:46:14: warning: 'pkey' may be used uninitialized in this function [-Wmaybe-uninitialized] ( (m)->tmp = (value),\ ^ tls_domain.c:1183:12: note: 'pkey' was declared here EVP_PKEY *pkey; ^~~~ CC (gcc) [M tls.so] tls_util.o ``` Next ``` CC (gcc) [M ims_usrloc_pcscf.so] dlist.o In file included from usrloc_db.c:10:0: usrloc_db.c: In function 'db_update_pcontact': usrloc_db.h:46:25: warning: 'service_routes.len' may be used uninitialized in this function [-Wmaybe-uninitialized] VAL_STR((_val)).len = (_str).len;\ ^ usrloc_db.c:122:13: note: 'service_routes.len' was declared here str impus, service_routes; ^~~~~~~~~~~~~~ In file included from usrloc_db.c:10:0: usrloc_db.h:45:24: warning: 'service_routes.s' may be used uninitialized in this function [-Wmaybe-uninitialized] VAL_STR((_val)).s = (_str).s;\ ^ usrloc_db.c:122:13: note: 'service_routes.s' was declared here str impus, service_routes; ^~~~~~~~~~~~~~ CC (gcc) [M ims_usrloc_pcscf.so] pcontact.o ``` Next ``` CC (gcc) [M evapi.so] evapi_mod.o evapi_dispatch.c: In function 'evapi_run_dispatcher': evapi_dispatch.c:699:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] ev_io_init(&io_server, evapi_accept_client, evapi_srv_sock, EV_READ); ^~~~~~~~~~ evapi_dispatch.c:699:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] evapi_dispatch.c:699:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] evapi_dispatch.c:699:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] evapi_dispatch.c:701:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] ev_io_init(&io_notify, evapi_recv_notify, _evapi_notify_sockets[0], EV_READ); ^~~~~~~~~~ evapi_dispatch.c:701:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] evapi_dispatch.c:701:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] evapi_dispatch.c:701:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] make[3]: 'libsrutils.so.1.0' is up to date. LD (gcc) [M evapi.so] evapi.so ``` #### SIP Traffic NA ### Possible Solutions ### Additional Information Compiled master on Alpine 3.8 dist If this is fixed, then i can provide more warnings. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/1712

4 5

← Newer
1
...
17
18
19
20
21
22
23
...
32
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev December 2018