sr-dev

sr-dev@lists.kamailio.org

11 participants
44792 discussions

[kamailio/kamailio] Feature/tcp/tls domain matching (PR #4222)
by Michael Furmur 24 Apr '25

24 Apr '25

#### Pre-Submission Checklist    - [x] Commit message has the format required by CONTRIBUTING guide - [x] Commits are split per component (core, individual modules, libs, utils, ...) - [x] Each component has a single commit (if not, squash them into one commit) - [x] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated) #### Type Of Change - [ ] Small bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality) #### Checklist:  - [ ] PR should be backported to stable branches - [x] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number) #### Description PR adds new core option `tls_connection_match_domain` with the default value 0 (old behavior) to solve the problem when we need to have multiple TLS connections with different SNI to the same host:port endpoint. for example: multiple customers (authorized by cert) for MS Teams on the single kamailio instance. originally, functions `_tcpconn_find` and `_tcpconn_add_alias_unsafe` use only endpoint and protocol to match connections. setting `tls_connection_match_domain` to `1` will match additionaly with `tls_domain_str()` output for matched TLS domain. as a result, we will be able to establish new TLS connections if TLS domain is changed instead of reusing of the existent one with the wrong SNI. i'm not considering this PR as the final version but we need something to start with. looking forward for any input. FIXME: not found the right place where new core option should be documented. #### Behavior difference example * /etc/kamailio/kamailio.cfg (relays all requests to 127.0.0.1:5081 using TLS domain matched by server_id retreived from RURI-User): ``` #!KAMAILIO listen=udp:127.0.0.1:5060 listen=tls:127.0.0.1:5061 enable_tls = yes tls_connection_match_domain = 1 debug = 3 loadmodule "tls.so" modparam("tls", "config", "/etc/kamailio/tls.cfg") modparam("tls", "xavp_cfg", "tls") loadmodule "ctl.so" loadmodule "pv.so" loadmodule "tm.so" route { $xavp(tls=>server_id) = $rU; t_relay_to_tls("127.0.0.1", 5081); } ``` * /etc/kamailio/tls.cfg: ``` [server:default] certificate = /etc/ssl/certs/ssl-cert-snakeoil.pem private_key = /etc/ssl/private/ssl-cert-snakeoil.key [client:any] server_name = server_name_1.invalid server_id = 1 [client:any] server_name = server_name_2.invalid server_id = 2 ``` * run tls server: ```bash $ openssl s_server -port 5081 -cert /etc/ssl/certs/ssl-cert-snakeoil.pem -key /etc/ssl/private/ssl-cert-snakeoil.key ``` * send `INVITE sip:1@127.0.0.1:5060` and `INVITE sip:2@127.0.0.1:5060` using sipp: ```bash $ for u in 1 2; do sipp -sn uac -m 1 -nd -recv_timeout 1 -bg -s $u 127.0.0.1:5060; done ``` * resulting `tls.list` for kamailio instance WITHOUT `tls_connection_match_domain = 1` (old behavior): ```bash # kamcmd tls.list { id: 1 dom: TLSc<any:server_name_1.invalid> sni: N/A timestamp: 2025-04-24 14:07:20 timeout: 118 src_ip: 127.0.0.1 src_port: 5081 dst_ip: 127.0.0.1 dst_port: 58808 cipher: unknown ct_wq_size: 1162 enc_rd_buf: 0 flags: 1 state: tls_connect } ``` * `tls.list` for kamailio instance WITH `tls_connection_match_domain = 1` (new behavior): ```bash # kamcmd tls.list { id: 1 dom: TLSc<any:server_name_1.invalid> sni: N/A timestamp: 2025-04-24 14:09:10 timeout: 117 src_ip: 127.0.0.1 src_port: 5081 dst_ip: 127.0.0.1 dst_port: 55480 cipher: unknown ct_wq_size: 581 enc_rd_buf: 0 flags: 1 state: tls_connect } { id: 2 dom: TLSc<any:server_name_2.invalid> sni: N/A timestamp: 2025-04-24 14:09:10 timeout: 117 src_ip: 127.0.0.1 src_port: 5081 dst_ip: 127.0.0.1 dst_port: 55488 cipher: unknown ct_wq_size: 581 enc_rd_buf: 0 flags: 1 state: tls_connect } ``` You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/4222 -- Commit Summary -- * core: support tls connection domain matching * tls: implement match_domain,match_connections_domain hooks * tls_wolfssl: implement match_domain,match_connections_domain hooks -- File Changes -- M src/core/cfg.lex (3) M src/core/cfg.y (9) M src/core/globals.h (1) M src/core/tcp_main.c (14) M src/core/tls_hooks.h (9) M src/main.c (4) M src/modules/tls/tls_mod.c (2) M src/modules/tls/tls_rpc.c (12) M src/modules/tls/tls_server.c (97) M src/modules/tls/tls_server.h (8) M src/modules/tls_wolfssl/tls_rpc.c (12) M src/modules/tls_wolfssl/tls_server.c (94) M src/modules/tls_wolfssl/tls_server.h (7) M src/modules/tls_wolfssl/tls_wolfssl_mod.c (2) -- Patch Links -- https://github.com/kamailio/kamailio/pull/4222.patch https://github.com/kamailio/kamailio/pull/4222.diff -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/4222 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/pull/4222(a)github.com>

1 0

Kamailio Redis Integration
by Timothy Delin 24 Apr '25

24 Apr '25

Hey team, I have a question related to the Kamailio - Redis integration. I am currently using a VM with RHEL 9 OS, and I have created two separated docker files in my VM for the Kamailio and Redis. Both docker files are up and running as individual applications. However, when I tried to integrate the two containers, I keep facing issue where it doesn't want to connect between one and the other. Can you please help to advise on what I should do next? Thanks Best regards, Timothy

2 2

git:master:d965b924: jsonrpcs: reworked closing tcp socket
by Daniel-Constantin Mierla 23 Apr '25

23 Apr '25

Module: kamailio Branch: master Commit: d965b9242b313cb19f75baac12786d202a9987eb URL: https://github.com/kamailio/kamailio/commit/d965b9242b313cb19f75baac12786d2… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2025-04-23T21:04:08+02:00 jsonrpcs: reworked closing tcp socket --- Modified: src/modules/jsonrpcs/jsonrpcs_sock.c --- Diff: https://github.com/kamailio/kamailio/commit/d965b9242b313cb19f75baac12786d2… Patch: https://github.com/kamailio/kamailio/commit/d965b9242b313cb19f75baac12786d2… --- diff --git a/src/modules/jsonrpcs/jsonrpcs_sock.c b/src/modules/jsonrpcs/jsonrpcs_sock.c index 366569ea3d9..ebd040e6509 100644 --- a/src/modules/jsonrpcs/jsonrpcs_sock.c +++ b/src/modules/jsonrpcs/jsonrpcs_sock.c @@ -830,6 +830,9 @@ int jsonrpc_tcp_process(void) LM_DBG("waiting for client connections\n"); while(1) { cfg_update(); + if(csock >= 0) { + close(csock); + } csock = accept( _jsonrpc_tcp_address.tsock, (struct sockaddr *)&caddr, &clen); @@ -845,12 +848,10 @@ int jsonrpc_tcp_process(void) n = read(csock, jsonrpc_tcp_buf, JSONRPC_DGRAM_BUF_SIZE - 1); if(n < 0) { LM_ERR("failed reading from tcp socket\n"); - close(csock); continue; } if(n == 0) { LM_DBG("no data received\n"); - close(csock); continue; } LM_DBG("data received - size: %d\n", n); @@ -892,7 +893,6 @@ int jsonrpc_tcp_process(void) if(n < 0) { LM_ERR("failed to send the response\n"); } - close(csock); continue; } @@ -900,7 +900,6 @@ int jsonrpc_tcp_process(void) if(n < 0) { LM_ERR("failed to send the response\n"); } - close(csock); } return 0;

1 0

[kamailio/kamailio] secfilter‌: support remove rule in Whitelist and Blacklist (PR #4089)
by AsedMorteza 23 Apr '25

23 Apr '25

5 8

[kamailio/kamailio] app_jstd: Added dynamic buffer sizing to load bigger .js files and Added ability to load all JavaScript files from a specified directory (PR #4221)
by nickgashcc 23 Apr '25

23 Apr '25

1 2

[kamailio/kamailio] rtpengine does not detect new nodes in table (Issue #4220)
by David Cunningham 23 Apr '25

23 Apr '25

davidvoisonics created an issue (kamailio/kamailio#4220) We are using Kamailio 5.8.2 with the rtpengine module on Ubuntu 22.04. The "rtpengine" table is used to define nodes, with a configuration like this: modparam( "rtpengine", "db_url", DB_URL ) modparam( "rtpengine", "table_name", "rtpengine" ) modparam( "rtpengine", "setid_default", 1 ) It works fine if Kamailio is restarted after entries in the "rtpengine" table are inserted or deleted, but this isn't suitable for production use. I can't see anywhere in the module documentation where it says that a Kamailio restart is required, so not using entries in the "rtpengine" table appears to be a bug. Perhaps it can periodically check the table for changes? Thank you. -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/4220 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/issues/4220(a)github.com>

3 3

[kamailio/kamailio] topoh: fix bug in hiding record routes in reply messages (PR #4170)
by Farzaneh Soltanzadeh 23 Apr '25

23 Apr '25

2 10

[kamailio/kamailio] ims_diameter_server not freeing shared memory (Issue #4116)
by MGrimby 23 Apr '25

23 Apr '25

### Description I have run in to an issue when sending diameter requests using the ims_diameter_server module. Shared memory keeps increasing and are not being freed until restart of kamailio. This leads to all shared memory is being used and no more are able to be allocated. This only happens when the request is sent synchronously. When sent asynchronously shared memory is being freed as far as I can see. Following functions have been used for sending requests. diameter_request([peer], appid, commandcode, message) diameter_request_async([peer], appid, commandcode, message) ### Troubleshooting Sent a bunch of diameter requests and verified that shared memory for the following functions are not freed. do_receive(600): AAATranslateMessage(500): AAACreateAVP(137): #### Reproduction It's possible to reproduce by sending sync diameter request and verify shared memory. Example of diameter request block ``` route[CHECK_LOCATION] { diameter_request("hss.ims.test.local", "16777217", "306", "[ " + "{ \"avpCode\":260, \"vendorId\":0, \"Flags\":64, \"list\":[ { \"avpCode\":266, \"vendorId\":0, \"Flags\":64, \"int32\":10415 }, { \"avpCode\":258, \"vendorId\":0, \"Flags\":64, \"int32\":16777217 } ] }, " + "{ \"avpCode\":277, \"vendorId\":0, \"Flags\":64, \"int32\":1 }, " + "{ \"avpCode\":283, \"vendorId\":0, \"Flags\":64, \"string\":\"ims.test.local\"}, " + "{ \"avpCode\":706, \"vendorId\":10415, \"Flags\":192, \"int32\":0 }, " + "{ \"avpCode\":700, \"vendorId\":10415, \"Flags\":192, \"list\": [ { \"avpCode\":601, \"vendorId\":10415, \"Flags\":192, \"string\":\"tel:" + $fU + "\" }]}, " + "{ \"avpCode\":707, \"vendorId\":10415, \"Flags\":192, \"int32\":0 }, " + "{ \"avpCode\":703, \"vendorId\":10415, \"Flags\":192, \"int32\":14 } ]"); xlog("L_INFO", "Sent Diameter request"); } ``` Stats cdp:replies_received = 343310 shmem:fragments = 142 shmem:free_size = 1221489992 shmem:max_used_size = 948242168 shmem:real_used_size = 925993656 shmem:total_size = 2147483648 shmem:used_size = 558205656 kamcmd mod.stats cdp shm do_receive(600): 256245808 AAATranslateMessage(500): 64420712 AAACreateAVP(137): 218100320 Total: 538774000 #### Debugging Data  ``` (paste your debugging data here) ``` #### Log Messages  ``` (paste your log messages here) ``` #### SIP Traffic  ``` (paste your sip traffic here) ``` ### Possible Solutions  ### Additional Information * **Kamailio Version** - output of `kamailio -v` ``` version: kamailio 5.7.4 (x86_64/linux) dc393e flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, MEM_JOIN_FREE, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB poll method support: poll, epoll_lt, epoll_et, sigio_rt, select. id: dc393e compiled on 13:56:27 Feb 27 2024 with gcc 8.5.0 ``` * **Operating System**:  ``` Linux bmatkamas1 4.18.0-553.16.1.el8_10.x86_64 #1 SMP Thu Aug 1 04:16:12 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux Red Hat Enterprise Linux release 8.10 (Ootpa) ``` -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/4116 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/issues/4116(a)github.com>

3 3

git:master:76a72a00: ims_isc: free allocated route in case of error
by Daniel-Constantin Mierla 22 Apr '25

22 Apr '25

Module: kamailio Branch: master Commit: 76a72a0092272d0f0ca7cf3df22ad6d05a79e782 URL: https://github.com/kamailio/kamailio/commit/76a72a0092272d0f0ca7cf3df22ad6d… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2025-04-22T22:16:44+02:00 ims_isc: free allocated route in case of error --- Modified: src/modules/ims_isc/mark.c --- Diff: https://github.com/kamailio/kamailio/commit/76a72a0092272d0f0ca7cf3df22ad6d… Patch: https://github.com/kamailio/kamailio/commit/76a72a0092272d0f0ca7cf3df22ad6d… --- diff --git a/src/modules/ims_isc/mark.c b/src/modules/ims_isc/mark.c index cbd0c17e3cd..9e417e29d3f 100644 --- a/src/modules/ims_isc/mark.c +++ b/src/modules/ims_isc/mark.c @@ -348,7 +348,7 @@ int isc_mark_write_route(struct sip_msg *msg, str *as, str *iscmark) { struct hdr_field *first; struct lump *anchor; - str route; + str route = STR_NULL; parse_headers(msg, HDR_EOH_F, 0); first = msg->headers; @@ -367,6 +367,7 @@ int isc_mark_write_route(struct sip_msg *msg, str *as, str *iscmark) anchor = anchor_lump(msg, first->name.s - msg->buf, 0, HDR_ROUTE_T); if(anchor == NULL) { LM_ERR("isc_mark_write_route: anchor_lump failed\n"); + pkg_free(route.s); return 0; }

1 0

[kamailio/kamailio] Why can't set_body_multipart and append_body_part* functions be used from ONREPLY_ROUTE? (Issue #4149)
by rodrigodc 22 Apr '25

22 Apr '25

rodrigodc created an issue (kamailio/kamailio#4149) Hello, Is there a strong reason why the following functions from [textops](https://www.kamailio.org/docs/modules/5.4.x/modules/textops.html) can't be used from `ONREPLY_ROUTE`? - [set_body_multipart](https://www.kamailio.org/docs/modules/5.4.x/modules/tex… - [append_body_part_hex](https://www.kamailio.org/docs/modules/5.4.x/modules/t… I need to add ISUP to outgoing `SIP/18x` replies which already have an SDP body and would like to use those functions for that. However, they cannot be used from `ONREPLY_ROUTE`, just as they can from `REQUEST_ROUTE` (which I use to add ISUP to `SIP/INVITE`). So I am considering sending a pull request allowing them to be used from `ONREPLY_ROUTE`, but first I would like to know if it makes sense. Thank you. -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/4149 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/issues/4149(a)github.com>

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev