sergey-safarov created an issue (kamailio/kamailio#4180)
### Description
I have installed two `rtpengine` instances and want to use them as an `active backup`. I want to use `backup` only when `active` is unavailable.
Closest settings for this rtpengine node `weight` and want to use settings like
```
MariaDB [kamailio]> select * from rtpengine;
+----+-------+---------------------------------+--------+----------+---------------------+
| id | setid | url | weight | disabled | stamp |
+----+-------+---------------------------------+--------+----------+---------------------+
| 1 | 0 | udp6:[2005:84c0:bf:11::20]:2223 | 1 | 0 | 1900-01-01 00:00:01 |
| 2 | 0 | udp6:[2005:84c0:bf:11::21]:2223 | 0 | 0 | 1900-01-01 00:00:01 |
+----+-------+---------------------------------+--------+----------+---------------------+
```
But in case `weight=0` node is not selected and handled as disabled.
It will be fine do not use rtpengine nodes with `weight=0` when other rtpengine with `weight!=0` are available. But if no other nodes are available, use `weight=0` nodes as last resort.
### Expected behavior
Do not use rtpengine nodes with `weight=0` when other rtpengine with `weight!=0` are available. But if no other nodes are available, use `weight=0` nodes as last resort.
#### Actual observed behavior
The node is not selected and handled as disabled when `weight=0`.
#### Log Messages
```
rtpengine [rtpengine.c:3430]: rtpp_test(): rtpengine instance <udp6:[2005:84c0:bf:11::21]:2223> found, support for it enabled
rtpengine [rtpengine.c:3883]: select_rtpp_node(): rtpengine failed to select new for calllen=27 callid=1-10824@2005:84c0:bf:11::22
rtpengine [rtpengine.c:3183]: rtpp_function_call(): no available proxies
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/4180
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/4180(a)github.com>
ChristianBergerSipgate created an issue (kamailio/kamailio#4167)
Hi,
we have found a potential bug. The pseudo variables return null for WSS connections.
Example config:
`xlog("L_INFO", "<mainLogic> REGISTER: TLS or WSS detected: fU=$fU tls_version=$tls_version tls_cipher_info=$tls_cipher_info ua=$ua\n");`
Log output:
`Mar 7 08:37:28 sip-tcploadbalancer01 /usr/sbin/kamailio[1268940]: { "level": "ERROR", "module": "tls", "file": "tls_select.c", "line": 131, "function": "get_cur_connection", "message": "Transport protocol is not TLS (bug in config)\n" }
Mar 7 08:37:28 sip-tcploadbalancer01 /usr/sbin/kamailio[1268940]: { "level": "INFO", "module": "tls", "file": "tls_select.c", "line": 310, "function": "get_version", "message": "TLS connection not found in select_version\n" }
Mar 7 08:37:28 sip-tcploadbalancer01 /usr/sbin/kamailio[1268940]: { "level": "ERROR", "module": "tls", "file": "tls_select.c", "line": 131, "function": "get_cur_connection", "message": "Transport protocol is not TLS (bug in config)\n" }
Mar 7 08:37:28 sip-tcploadbalancer01 /usr/sbin/kamailio[1268940]: { "level": "INFO", "module": "tls", "file": "tls_select.c", "line": 201, "function": "get_cipher", "message": "TLS connection not found in select_cipher\n" }
Mar 7 08:37:28 sip-tcploadbalancer01 /usr/sbin/kamailio[1268940]: { "level": "INFO", "module": "xlog", "file": "xlog.c", "line": 278, "function": "", "message": "<mainLogic> REGISTER: TLS or WSS detected: fU=1125411e0 tls_version=<null> tls_cipher_info=<null> ua=webphone\n" }`
As you can see both tls_version and tls_cipher_info return <null> even though the underlying connection is via WSS.
We have looked into it, and it seems like `get_cur_connection` in `modules/tls/tls_select.c` only checks for TLS, but not WSS.
```
struct tcp_connection *get_cur_connection(struct sip_msg *msg)
{
struct tcp_connection *c;
if(_tls_pv_con != 0)
return _tls_pv_con;
if(msg->rcv.proto != PROTO_TLS) {
ERR("Transport protocol is not TLS (bug in config)\n");
return 0;
}
c = tcpconn_get(msg->rcv.proto_reserved1, 0, 0, 0,
cfg_get(tls, tls_cfg, con_lifetime));
if(c && c->type != PROTO_TLS) {
ERR("Connection found but is not TLS\n");
tcpconn_put(c);
return 0;
}
return c;
}
```
We think that checking for `PROTO_WSS` might solve the issue.
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/4167
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/4167(a)github.com>
Opening this generic issue to track issues when trying to switch deb package generation to cmake:
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/4053
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/4053(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
We've been running the ims_charging module in production for quite some time, without any issues.
A couple of days ago the whole instance freezed, but I was able to get a dump before the stuck processes before restarting. The traffic volume has gradually increased over time, so it's likely related to that.
I then did a summary of the different types of stuck processes. Which locks they're holding, and what they're waiting for:
```
holding lock:
AAASessionsLock
waiting for lock:
lock_get(peer_list_lock);
#1 0x00007fe70eba8cde in futex_get (lock=0x7fe6e4a5c680) at ../../core/futexlock.h:108
#2 0x00007fe70ebaaca2 in get_peer_by_fqdn (fqdn=0x7fe6e4a5ba30) at peermanager.c:259
#3 0x00007fe70ebb64b7 in get_first_connected_route (cdp_session=0x7fe6e5cc5350, r=0x7fe6e4a5ba30, app_id=4, vendor_id=10415) at routing.c:115
#4 0x00007fe70ebb9a37 in get_routing_peer (cdp_session=0x7fe6e5cc5350, m=0x7fe6e5447ab0) at routing.c:293
#5 0x00007fe70ebcaf8c in AAASendMessage (message=0x7fe6e5447ab0, callback_f=0x7fe707a9e323 <resume_on_initial_ccr>, callback_param=0x7fe6e5297110) at diameter_comm.c:139
#6 0x00007fe707a9d3e0 in Ro_Send_CCR (msg=0x7fe70f011100, dlg=0x7fe6e5c571f0, dir=0, reservation_units=30, incoming_trunk_id=0x7ffe50efb060, outgoing_trunk_id=0x7ffe50efb050, pani=0x7ffe50efaee0, action=0x7fe70efa4730, tindex=10484, tlabel=677172593) at ims_ro.c:1511
#7 0x00007fe707a8285d in ki_ro_ccr (msg=0x7fe70f011100, s_route_name=0x7ffe50efb080, s_direction=0x7ffe50efb070, reservation_units=30, s_incoming_trunk_id=0x7ffe50efb060, s_outgoing_trunk_id=0x7ffe50efb050) at ims_charging_mod.c:742
#8 0x00007fe707a7bf01 in w_ro_ccr (msg=0x7fe70f011100, c_route_name=0x7fe70ef8b8d0 "\220\311\371\016\347\177", c_direction=0x7fe70ef8b980 "p\240\371\016\347\177", reservation_units=30, c_incoming_trunk_id=0x7fe70ef8ba30 "p\241\371\016\347\177", c_outgoing_trunk_id=0x7fe70ef8bae0 "\360\241\371\016\347\177") at ims_charging_mod.c:507
#9 0x00000000004858d8 in do_action (h=0x7ffe50efb970, a=0x7fe70ef99e20, msg=0x7fe70f011100) at core/action.c:1144
#10 0x00000000004928d6 in run_actions (h=0x7ffe50efb970, a=0x7fe70ef99e20, msg=0x7fe70f011100) at core/action.c:1618
#11 0x0000000000492f52 in run_actions_safe (h=0x7ffe50eff1e0, a=0x7fe70ef99e20, msg=0x7fe70f011100) at core/action.c:1681
#12 0x0000000000450156 in rval_get_long (h=0x7ffe50eff1e0, msg=0x7fe70f011100, i=0x7ffe50efbec8, rv=0x7fe70ef9c1d8, cache=0x0) at core/rvalue.c:973
#13 0x0000000000454d24 in rval_expr_eval_long (h=0x7ffe50eff1e0, msg=0x7fe70f011100, res=0x7ffe50efbec8, rve=0x7fe70ef9c1d0) at core/rvalue.c:1854
#14 0x0000000000454d52 in rval_expr_eval_long (h=0x7ffe50eff1e0, msg=0x7fe70f011100, res=0x7ffe50efc448, rve=0x7fe70ef9b920) at core/rvalue.c:1864
#15 0x00000000004850ce in do_action (h=0x7ffe50eff1e0, a=0x7fe70ef9b070, msg=0x7fe70f011100) at core/action.c:1097
--
holding lock:
AAASessionsLock
waiting for lock:
lock_get(peer_list_lock);
#1 0x00007fe70eba8d4f in futex_get (lock=0x7fe6e4a5c680) at ../../core/futexlock.h:121
#2 0x00007fe70ebaaca2 in get_peer_by_fqdn (fqdn=0x7ffe50efab90) at peermanager.c:259
#3 0x00007fe70ebb8e89 in get_routing_peer (cdp_session=0x7fe6e5ab6910, m=0x7fe6e5435be0) at routing.c:252
#4 0x00007fe70ebcaf8c in AAASendMessage (message=0x7fe6e5435be0, callback_f=0x7fe707a95edc <resume_on_termination_ccr>, callback_param=0x0) at diameter_comm.c:139
#5 0x00007fe707a95b02 in send_ccr_stop_with_param (ro_session=0x7fe6e5ab65e0, code=0, reason=0x7ffe50efb060) at ims_ro.c:1181
#6 0x00007fe707a72ff7 in dlg_terminated (dlg=0x7fe6e623d7a0, type=64, termcode=0, reason=0x7fe707ab72b3 "normal call clearing", _params=0x7fe707f67280 <params>) at dialog.c:249
#7 0x00007fe707a6a729 in dlg_callback_received (dlg=0x7fe6e623d7a0, type=64, _params=0x7fe707f67280 <params>) at dialog.c:25
#8 0x00007fe707d341b9 in run_dlg_callbacks (type=64, dlg=0x7fe6e623d7a0, req=0x7fe70f011100, rpl=0x0, dir=1, dlg_data=0x0) at dlg_cb.c:271
#9 0x00007fe707cf4db4 in dlg_terminated (req=0x7fe70f011100, dlg=0x7fe6e623d7a0, dir=1) at dlg_handlers.c:413
#10 0x00007fe707cfddeb in dlg_onroute (req=0x7fe70f011100, route_params=0x7ffe50efb6d0, param=0x0) at dlg_handlers.c:1097
#11 0x00007fe70ad285f6 in run_rr_callbacks (req=0x7fe70f011100, rr_param=0x7ffe50efb7c0) at rr_cb.c:96
#12 0x00007fe70ad3ae92 in after_loose (_m=0x7fe70f011100, preloaded=0) at loose.c:1021
#13 0x00007fe70ad3b5ce in loose_route_mode (_m=0x7fe70f011100, _mode=0) at loose.c:1056
#14 0x00007fe70ad3f74f in w_loose_route (msg=0x7fe70f011100, p1=0x0, p2=0x0) at rr_mod.c:273
#15 0x00000000004855ff in do_action (h=0x7ffe50efc390, a=0x7fe70efe0d40, msg=0x7fe70f011100) at core/action.c:1121
--
holding lock:
lock_get(peer_list_lock);
waiting for lock:
lock_get(p->lock);
#1 0x00007fe70eba8d4f in futex_get (lock=0x7fe6e4a5cbd0) at ../../core/futexlock.h:121
#2 0x00007fe70ebab0ae in peer_timer (now=1742807320, ptr=0x0) at peermanager.c:286
#3 0x00007fe70ebd0f39 in timer_loop () at timer.c:116
#4 0x00007fe70ebd21b2 in timer_process (returns=0) at timer.c:216
#5 0x00007fe70eb8ccf8 in diameter_peer_start (blocking=0) at diameter_peer.c:350
#6 0x00007fe70eb7cbb2 in cdp_child_init (rank=0) at cdp_mod.c:272
--
holding lock:
lock_get(p->lock)
waiting for lock:
AAASessionsLock
#1 0x00007fe70ebf2597 in futex_get (lock=0x7fe6e4a5d490) at ../../core/futexlock.h:108
#2 0x00007fe70ebf26f1 in AAASessionsLock (hash=0) at session.c:79
#3 0x00007fe70ebf5e6e in cdp_get_session (id=...) at session.c:316
#4 0x00007fe70eba6892 in Snd_Message (p=0x7fe6e4a5c880, msg=0x7fe6e63998d0) at peerstatemachine.c:1237
#5 0x00007fe70eba003e in sm_process (p=0x7fe6e4a5c880, event=Send_Message, msg=0x7fe6e63998d0, peer_locked=0, sock=0) at peerstatemachine.c:429
#6 0x00007fe70ebcbdc6 in AAASendMessage (message=0x7fe6e63998d0, callback_f=0x7fe707a8f208 <resume_on_interim_ccr>, callback_param=0x7fe6e6190a90) at diameter_comm.c:166
#7 0x00007fe707a8edb3 in send_ccr_interim (ro_session=0x7fe6e5399160, used=60, reserve=30) at ims_ro.c:847
#8 0x00007fe707a68bd6 in ro_session_ontimeout (tl=0x7fe6e5399200) at ro_timer.c:513
#9 0x00007fe707a63078 in ro_timer_routine (ticks=114862426, attr=0x0) at ro_timer.c:279
#10 0x00000000004fd33e in compat_old_handler (ti=1837798827, tl=0x7fe6e4cf6260, data=0x7fe6e4cf6260) at core/timer.c:980
#11 0x00000000004fde7a in slow_timer_main () at core/timer.c:1103
#12 0x000000000042e4e7 in main_loop () at main.c:1911
#13 0x000000000043876c in main (argc=10, argv=0x7ffe50f001c8) at main.c:3236
```
In `get_first_connected_route()` in `routing.c` of the cdp module there are two places `get_peer_by_fqdn()` are called. One of them has an unlock/relock of the session list before and after (and a comment about holding two locks at a time), while the other doesn't.
I'm currently testing two version of this. The first by just doing the some relock for the other `get_peer_by_fqdn()`, but this PR got an approach for maybe fixing more latent issues. `sm_process()` also got some strange handling by `Rcv_Process()` after the peer lock is released, which seems to be about the same thing. My deadlock is for the `Snd_Message()` equivalent.
I've now removed this queueing behaviour, and instead doing a re-lock of the peer to (hopefully) have the same locking order as the other operations.
The problem with this thing is how rare it occurs. Just wanted to share my findings for others with more knowledge to the cdp module for comments, suggestions and hopefully some extra testing.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4191
-- Commit Summary --
* cdp: restructure locking order to prevent rare deadlock
-- File Changes --
M src/modules/cdp/peerstatemachine.c (25)
M src/modules/cdp/routing.c (6)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4191.patchhttps://github.com/kamailio/kamailio/pull/4191.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4191
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4191(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
Currently `stirshaken` module performs x509 certificate path check twice (when enabled):
- first by calling `stir_shaken_verify_cert_path` directly from the [`stirshaken_mod.c`](https://github.com/kamailio/kamailio/blob/330543f46cbb6bf815ebf77c98378314091197ce/src/modules/stirshaken/stirshaken_mod.c#L626)
- second time from the [`libstirshaken`](https://github.com/signalwire/libstirshaken/blame/cb6ede40b3ce12ab76e370186a14dc141839ef07/src/stir_shaken_verify.c#L445)
`libstirshaken` had the path check built in since approx 2020 ([last commit mentioning it as TODO](https://github.com/signalwire/libstirshaken/blame/552650e31e3dc668069… before the `stir_shaken_verify_cert_path` function was introduced). This shouldn't be an issue since `stirshaken` module was added to Kamailio in 2021.
This PR removes the x509 certificate path check from the `stirshaken_mod.c` by passing the responsibility to perform certificate path check to the `libstirshaken`.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4202
-- Commit Summary --
* stirshaken: removed repeated x509 certification path check
-- File Changes --
M src/modules/stirshaken/doc/stirshaken_admin.xml (4)
M src/modules/stirshaken/stirshaken_mod.c (17)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4202.patchhttps://github.com/kamailio/kamailio/pull/4202.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4202
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4202(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [X] Commit message has the format required by CONTRIBUTING guide
- [X] Commits are split per component (core, individual modules, libs, utils, ...)
- [X] Each component has a single commit (if not, squash them into one commit)
- [X] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [X] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
<!-- Describe your changes in detail -->
- The code that loaded a JavaScript file used a fix buffer length of 128K on the stack. This has been changed so that the file size is determined and an attempt to allocate an appropriate buffer size temporarily is made. The file contents are then loaded into that buffer before being passed to the duktape engine.
- In addition a new module param 'loaddir' has been added that allows you to specify a directory containing .js files rather than specifying a single .js file to load with the existing 'load' param. If loaddir is set it will take a higher priority than load. All .js files in the directory are loaded into a temporary buffer and combined before passing to the duktape engine. This allows you to split logic/routes into separate .js files but load them all into the JavaScript engine.
- Updated documentation
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4221
-- Commit Summary --
* app_jstd: Added dynamic buffer sizing to load bigger .js files and Added ability to load all JavaScript files from a specified directory
-- File Changes --
M src/modules/app_jsdt/app_jsdt_api.c (175)
M src/modules/app_jsdt/app_jsdt_mod.c (2)
M src/modules/app_jsdt/doc/app_jsdt_admin.xml (31)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4221.patchhttps://github.com/kamailio/kamailio/pull/4221.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4221
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4221(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
PR adds new core option `tls_connection_match_domain` with the default value 0 (old behavior)
to solve the problem when we need to have multiple TLS connections with different SNI to the same host:port endpoint.
for example: multiple customers (authorized by cert) for MS Teams on the single kamailio instance.
originally, functions `_tcpconn_find` and `_tcpconn_add_alias_unsafe` use only endpoint and protocol to match connections.
setting `tls_connection_match_domain` to `1` will match additionaly with `tls_domain_str()` output for matched TLS domain.
as a result, we will be able to establish new TLS connections if TLS domain is changed instead of reusing of the existent one with the wrong SNI.
i'm not considering this PR as the final version but we need something to start with. looking forward for any input.
FIXME: not found the right place where new core option should be documented.
#### Behavior difference example
* /etc/kamailio/kamailio.cfg
(relays all requests to 127.0.0.1:5081 using TLS domain matched by server_id retreived from RURI-User):
```
#!KAMAILIO
listen=udp:127.0.0.1:5060
listen=tls:127.0.0.1:5061
enable_tls = yes
tls_connection_match_domain = 1
debug = 3
loadmodule "tls.so"
modparam("tls", "config", "/etc/kamailio/tls.cfg")
modparam("tls", "xavp_cfg", "tls")
loadmodule "ctl.so"
loadmodule "pv.so"
loadmodule "tm.so"
route {
$xavp(tls=>server_id) = $rU;
t_relay_to_tls("127.0.0.1", 5081);
}
```
* /etc/kamailio/tls.cfg:
```
[server:default]
certificate = /etc/ssl/certs/ssl-cert-snakeoil.pem
private_key = /etc/ssl/private/ssl-cert-snakeoil.key
[client:any]
server_name = server_name_1.invalid
server_id = 1
[client:any]
server_name = server_name_2.invalid
server_id = 2
```
* run tls server:
```bash
$ openssl s_server -port 5081 -cert /etc/ssl/certs/ssl-cert-snakeoil.pem -key /etc/ssl/private/ssl-cert-snakeoil.key
```
* send `INVITE sip:1@127.0.0.1:5060` and `INVITE sip:2@127.0.0.1:5060` using sipp:
```bash
$ for u in 1 2; do sipp -sn uac -m 1 -nd -recv_timeout 1 -bg -s $u 127.0.0.1:5060; done
```
* resulting `tls.list` for kamailio instance WITHOUT `tls_connection_match_domain = 1` (old behavior):
```bash
# kamcmd tls.list
{
id: 1
dom: TLSc<any:server_name_1.invalid>
sni: N/A
timestamp: 2025-04-24 14:07:20
timeout: 118
src_ip: 127.0.0.1
src_port: 5081
dst_ip: 127.0.0.1
dst_port: 58808
cipher: unknown
ct_wq_size: 1162
enc_rd_buf: 0
flags: 1
state: tls_connect
}
```
* `tls.list` for kamailio instance WITH `tls_connection_match_domain = 1` (new behavior):
```bash
# kamcmd tls.list
{
id: 1
dom: TLSc<any:server_name_1.invalid>
sni: N/A
timestamp: 2025-04-24 14:09:10
timeout: 117
src_ip: 127.0.0.1
src_port: 5081
dst_ip: 127.0.0.1
dst_port: 55480
cipher: unknown
ct_wq_size: 581
enc_rd_buf: 0
flags: 1
state: tls_connect
}
{
id: 2
dom: TLSc<any:server_name_2.invalid>
sni: N/A
timestamp: 2025-04-24 14:09:10
timeout: 117
src_ip: 127.0.0.1
src_port: 5081
dst_ip: 127.0.0.1
dst_port: 55488
cipher: unknown
ct_wq_size: 581
enc_rd_buf: 0
flags: 1
state: tls_connect
}
```
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4222
-- Commit Summary --
* core: support tls connection domain matching
* tls: implement match_domain,match_connections_domain hooks
* tls_wolfssl: implement match_domain,match_connections_domain hooks
-- File Changes --
M src/core/cfg.lex (3)
M src/core/cfg.y (9)
M src/core/globals.h (1)
M src/core/tcp_main.c (14)
M src/core/tls_hooks.h (9)
M src/main.c (4)
M src/modules/tls/tls_mod.c (2)
M src/modules/tls/tls_rpc.c (12)
M src/modules/tls/tls_server.c (97)
M src/modules/tls/tls_server.h (8)
M src/modules/tls_wolfssl/tls_rpc.c (12)
M src/modules/tls_wolfssl/tls_server.c (94)
M src/modules/tls_wolfssl/tls_server.h (7)
M src/modules/tls_wolfssl/tls_wolfssl_mod.c (2)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4222.patchhttps://github.com/kamailio/kamailio/pull/4222.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4222
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4222(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [x] PR should be backported to stable branches
- [x] Tested changes locally
- [x] Related to issue #4226
#### Description
<!-- Describe your changes in detail -->
- Improve and add missing function documentation `list_peers`.
- Use correct identifier in `struct_add` rpc function and cast `time_t` for time_t field.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/4227
-- Commit Summary --
* cdp: Cast time_t and use 'L' (long long) identifier in rpc function.
* cdp/docs: Add missing list_peers function
-- File Changes --
M src/modules/cdp/cdp_rpc.c (4)
M src/modules/cdp/doc/cdp_admin.xml (29)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/4227.patchhttps://github.com/kamailio/kamailio/pull/4227.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4227
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4227(a)github.com>