Module: kamailio
Branch: master
Commit: 9b3b8ec968c6f7bda0d10a0d4fe593a92560ee7d
URL: https://github.com/kamailio/kamailio/commit/9b3b8ec968c6f7bda0d10a0d4fe593a…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-04-06T08:35:19+02:00
corex: docs for dns_file parameter
---
Modified: src/modules/corex/doc/corex_admin.xml
---
Diff: https://github.com/kamailio/kamailio/commit/9b3b8ec968c6f7bda0d10a0d4fe593a…
Patch: https://github.com/kamailio/kamailio/commit/9b3b8ec968c6f7bda0d10a0d4fe593a…
---
diff --git a/src/modules/corex/doc/corex_admin.xml b/src/modules/corex/doc/corex_admin.xml
index d5cfe1db477..3cdad0aa2a5 100644
--- a/src/modules/corex/doc/corex_admin.xml
+++ b/src/modules/corex/doc/corex_admin.xml
@@ -162,6 +162,41 @@ modparam("corex", "alias_subdomains", "udp:sip-router.org:5060")
modparam("corex", "dns_cache", "type=A;name=kamailio.org;addr=193.22.119.66;ttl=3600000;flags=0")
modparam("corex", "dns_cache", "type=AAAA;name=kamailio.org;addr=2a00:d60:0:400::2;ttl=3600000;flags=0")
...
+</programlisting>
+ </example>
+ </section>
+ <section id="corex.p.dns_file">
+ <title><varname>dns_file</varname> (string)</title>
+ <para>
+ Path to the file from where to load dns_cache records. It can be set
+ many times to add more than one file.
+ </para>
+ <para>
+ Inside the file, the dns_cache record has to be in a single line, with
+ the format of the dns_cache module parameter (see above). Empty lines
+ or lines with whitespaces only are ignored. Comment lines have to start
+ with '#'. Comments are not accepted after dns_cache records, only on
+ separate lines.
+ </para>
+ <para>
+ <emphasis>
+ Default value is <quote>NULL</quote>.
+ </emphasis>
+ </para>
+ <example>
+ <title>Set <varname>dns_file</varname> parameter</title>
+ <programlisting format="linespecific">
+...
+# content of /etc/kamailio/kamailio-cache.dns
+
+# IPv4 record
+type=A;name=kamailio.org;addr=193.22.119.66;ttl=3600000;flags=0
+# IPv6 record
+type=AAAA;name=kamailio.org;addr=2a00:d60:0:400::2;ttl=3600000;flags=0
+...
+...
+modparam("corex", "dns_file", "/etc/kamailio/kamailio-cache.dns")
+...
</programlisting>
</example>
</section>
@@ -1291,4 +1326,3 @@ sub do_uncompress() {
</example>
</section>
</chapter>
-
<!--
Kamailio Project uses GitHub Issues only for bugs in the code or feature requests. Please use this template only for bug reports.
If you have questions about using Kamailio or related to its configuration file, ask on sr-users mailing list:
* https://lists.kamailio.org/mailman3/postorius/lists/sr-users.lists.kamailio…
If you have questions about developing extensions to Kamailio or its existing C code, ask on sr-dev mailing list:
* https://lists.kamailio.org/mailman3/postorius/lists/sr-dev.lists.kamailio.o…
Please try to fill this template as much as possible for any issue. It helps the developers to troubleshoot the issue.
Note that an issue report may be closed automatically after about 2 months
if there is no interest from developers or community users on pursuing it, being
considered expired. In such case, it can be reopened by writing a comment that includes
the token `/notexpired`. About two weeks before considered expired, the issue is
marked with the label `stale`, trying to notify the submitter and everyone else
that might be interested in it. To remove the label `stale`, write a comment that
includes the token `/notstale`. Also, any comment postpone the `expire` timeline,
being considered that there is interest in pursuing the issue.
If there is no content to be filled in a section, the entire section can be removed.
You can delete the comments from the template sections when filling.
You can delete next line and everything above before submitting (it is a comment).
-->
### Description
<!--
Explain what you did, what you expected to happen, and what actually happened.
-->
### Troubleshooting
#### Reproduction
<!--
If the issue can be reproduced, describe how it can be done.
-->
#### Debugging Data
<!--
If you got a core dump, use gdb to extract troubleshooting data - full backtrace,
local variables and the list of the code at the issue location.
gdb /path/to/kamailio /path/to/corefile
bt full
info locals
list
If you are familiar with gdb, feel free to attach more of what you consider to
be relevant.
-->
```
I want to read params from environment, so define
#!defenv MYSQL_IP
#!trydef DBURL "mysql://kamailio:kamailio@MYSQL_IP/kamailio"
but It can't read this ”MYSQL_IP“。
root@d2e1fcc3f89e:/# env |grep MYSQL*
MYSQL_URL=172.16.4.111
MYSQL_IP=172.16.4.111
```
#### Log Messages
<!--
Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
0(34) ERROR: db_mysql [km_my_con.c:166]: db_mysql_new_connection(): driver error: Unknown server host 'MYSQL_IP' (-2)
0(34) ERROR: <core> [db.c:324]: db_do_init2(): could not add connection to the pool
0(34) ERROR: dispatcher [dispatch.c:955]: ds_connect_db(): cannot initialize db connection
0(34) ERROR: dispatcher [dispatch.c:989]: ds_init_db(): unable to connect to the database
0(34) ERROR: dispatcher [dispatcher.c:439]: mod_init(): could not initiate a connect to the database
0(34) ERROR: <core> [core/sr_module.c:1030]: init_mod(): Error while initializing module dispatcher (/usr/lib/x86_64-linux-gnu/kamailio/modules/dispatcher.so)
```
#### SIP Traffic
<!--
If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
(paste your sip traffic here)
```
### Possible Solutions
<!--
If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix.
-->
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
```
version: kamailio 5.7.4 (x86_64/linux)
flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, MEM_JOIN_FREE, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED
ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown
compiled with gcc 12.2.0
```
* **Operating System**:
<!--
Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...;
Kernel details (output of `lsb_release -a` and `uname -a`)
-->
```
cat /proc/version
Linux version 3.10.0-1160.105.1.el7.x86_64 (mockbuild(a)kbuilder.bsys.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) ) #1 SMP Thu Dec 7 15:39:45 UTC 2023
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3800
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3800(a)github.com>
### Description
All kamailio versions on the 5.7.x train and additionally point release 5.6.5 break early dialog transactions, at least when the following conditions are (cumulatively) met:
* topos-redis is enabled (haven't tested other storage backends yet, let me know if needed)
* kamailio is multihomed
* enable_double_rr is enabled (the default)
### Troubleshooting
#### SIP Traffic
Here's an exchange demonstrating the problem:
```
kamailio instance
──────────┬──────────────────┬─────────
internal external peer
172.30.154.1:5060 185.73.43.241:5060 195.167.21.66:5060
──────────┬──────────────────┬───────── ──────────┬─────────
│ │ │
│ │ │
│ │ │
│ │ │
│ │ │
│ │ │
│ │ │
│ │ │
│ │ INVITE (SDP) │
│ │ ──────────────────────────> │
│ │ 100 Trying │
│ │ <────────────────────────── │
│ │ 183 Session Progress (SDP) │
│ │ <────────────────────────── │
│ │ PRACK │
│ │ ──────────────────────────> │
│ │ 200 OK │
│ │ <────────────────────────── │
│ │ UPDATE (SDP) │
UPDATE (SDP) │ │
<─────────────────────────── │ │
```
Whereas the expected behaviour should be:
```
│ │ UPDATE (SDP) │
| <────────────────────────── │
UPDATE (SDP)│ │ │
<───────── │ │ │
```
This is also exemplified by examining the Via headers as rewritten by kamailio.
Not working (>= 5.6.5, 5.7.x):
* Inbound Via: `Via: SIP/2.0/UDP 195.167.21.66:5060;branch=z9hG4bKtjlwcpvfh03epe0thhtjhq3qg;Role=3;Hpt=8e58_16`
* Oubound Via: `Via: SIP/2.0/UDP 185.73.43.241;branch=z9hG4bK66c4.3453dd9a219858819d528b9da671e39e.0`
Working (5.6.4):
* Inbound Via: `Via: SIP/2.0/UDP 195.167.21.66:5060;branch=z9hG4bK8lj1ahz6npz65khd8jkzl1ohh;Role=3;Hpt=8e68_16`
* Oubound Via: `Via: SIP/2.0/UDP 172.30.154.1;branch=z9hG4bK4dce.4f5448efd64465fa5dbaf5eef0dc35b7.0`
### Possible Solutions
Only solution I have found so far is to downgrade to kamailio 5.6.4
<!--
If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix.
-->
### Additional Information
```
version: kamailio 5.7.4 (x86_64/linux)
flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, MEM_JOIN_FREE, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLOCKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED
ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown
compiled with gcc 10.2.1
```
But I have also tested all 5.7.x versions, which are all affected, as well 5.6.5.
* **Operating System**:
<!--
Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...;
Kernel details (output of `lsb_release -a` and `uname -a`)
-->
```
Linux host 5.10.0-27-amd64 #1 SMP Debian 5.10.205-2 (2023-12-31) x86_64 GNU/Linux
```
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3757
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3757(a)github.com>
I'm trying to build current git sources on ArchLinux.
`modules/app_python/Makefile` still asks for python2:
```
which: no python2 in ($PATH)
which: no python2.7 in ($PATH)
File "<string>", line 1
import distutils.sysconfig;print distutils.sysconfig.get_config_var('LIBDIR')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?
```
Is this intended?
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/3805
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/issues/3805(a)github.com>
Module: kamailio
Branch: master
Commit: 368661cc15251af4cbf295d1f5fad5a42d1b647b
URL: https://github.com/kamailio/kamailio/commit/368661cc15251af4cbf295d1f5fad5a…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-04-05T08:10:11+02:00
core: parser/sdp - function to find sdp line with start EoL check option
---
Modified: src/core/parser/sdp/sdp_helpr_funcs.c
Modified: src/core/parser/sdp/sdp_helpr_funcs.h
---
Diff: https://github.com/kamailio/kamailio/commit/368661cc15251af4cbf295d1f5fad5a…
Patch: https://github.com/kamailio/kamailio/commit/368661cc15251af4cbf295d1f5fad5a…
---
diff --git a/src/core/parser/sdp/sdp_helpr_funcs.c b/src/core/parser/sdp/sdp_helpr_funcs.c
index d5cb359b40f..a5dffd9c398 100644
--- a/src/core/parser/sdp/sdp_helpr_funcs.c
+++ b/src/core/parser/sdp/sdp_helpr_funcs.c
@@ -733,9 +733,10 @@ int extract_sess_version(str *oline, str *sess_version)
/*
* Auxiliary for some functions.
+ * - smode: if 1, pstart is pointing inside msg body
* Returns pointer to first character of found line, or NULL if no such line.
*/
-char *find_sdp_line(char *pstart, char *plimit, char linechar)
+char *find_sdp_line_start(char *pstart, char *plimit, char linechar, int smode)
{
static char linehead[3] = "x=";
char *cp, *cp1;
@@ -749,11 +750,14 @@ char *find_sdp_line(char *pstart, char *plimit, char linechar)
if(cp1 == NULL)
return NULL;
/*
- * As it is body, we assume it has previous line and we can
- * lookup previous character.
+ * smode==1 means it is msg body, thus it has previous line and it can
+ * lookup previous character even when cp1==pstart.
*/
- if(cp1[-1] == '\n' || cp1[-1] == '\r')
- return cp1;
+ if(cp1 > pstart || smode == 1) {
+ if(cp1[-1] == '\n' || cp1[-1] == '\r') {
+ return cp1;
+ }
+ }
/*
* Having such data, but not at line beginning.
* Skip them and reiterate. ser_memmem() will find next
@@ -765,6 +769,14 @@ char *find_sdp_line(char *pstart, char *plimit, char linechar)
}
}
+/*
+ * Auxiliary for some functions - expect pstart to point inside SIP message body.
+ * Returns pointer to first character of found line, or NULL if no such line.
+ */
+char *find_sdp_line(char *pstart, char *plimit, char linechar)
+{
+ return find_sdp_line_start(pstart, plimit, linechar, 1);
+}
/* This function assumes pstart points to a line of requested type. */
char *find_next_sdp_line(
diff --git a/src/core/parser/sdp/sdp_helpr_funcs.h b/src/core/parser/sdp/sdp_helpr_funcs.h
index e8ce6f7e60a..20d3ebd882d 100644
--- a/src/core/parser/sdp/sdp_helpr_funcs.h
+++ b/src/core/parser/sdp/sdp_helpr_funcs.h
@@ -65,6 +65,7 @@ int extract_accept_wrapped_types(str *body, str *accept_wrapped_types);
int extract_max_size(str *body, str *max_size);
int extract_path(str *body, str *path);
+char *find_sdp_line_start(char *pstart, char *plimit, char linechar, int smode);
char *find_sdp_line(char *p, char *plimit, char linechar);
char *find_next_sdp_line(char *p, char *plimit, char linechar, char *defptr);
#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
This patch introduces a new "time" field for JSON logging to stderr. The CEE format already includes this field, but the Kamailio-specific format doesn't. If you need timestamps in your structured logs, but don't want to use the CEE format due to its limitations, this patch'd give you the best of both worlds.
I know this comes a little out of the blue, so any feedback is welcome.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3795
-- Commit Summary --
* core: dprint - include time in stderr json log
-- File Changes --
M src/core/dprint.c (44)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3795.patchhttps://github.com/kamailio/kamailio/pull/3795.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3795
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3795(a)github.com>
Module: kamailio
Branch: master
Commit: 3c16c13acdf95924636c4d938abe13dcb3707b73
URL: https://github.com/kamailio/kamailio/commit/3c16c13acdf95924636c4d938abe13d…
Author: Kamailio Dev <kamailio.dev(a)kamailio.org>
Committer: Kamailio Dev <kamailio.dev(a)kamailio.org>
Date: 2024-04-04T13:01:21+02:00
modules: readme files regenerated - db_redis ... [skip ci]
---
Modified: src/modules/db_redis/README
Modified: src/modules/ndb_redis/README
---
Diff: https://github.com/kamailio/kamailio/commit/3c16c13acdf95924636c4d938abe13d…
Patch: https://github.com/kamailio/kamailio/commit/3c16c13acdf95924636c4d938abe13d…
---
diff --git a/src/modules/db_redis/README b/src/modules/db_redis/README
index d2baa50e72d..4cfdcaa5b4f 100644
--- a/src/modules/db_redis/README
+++ b/src/modules/db_redis/README
@@ -39,7 +39,7 @@ Joel Centelles Martin
4.3. verbosity (int)
4.4. opt_tls (int)
4.5. db_pass (string)
- 4.6. ac_path (string)
+ 4.6. ca_path (string)
5. Usage
6. Module Specific Considerations
@@ -75,7 +75,7 @@ Chapter 1. Admin Guide
4.3. verbosity (int)
4.4. opt_tls (int)
4.5. db_pass (string)
- 4.6. ac_path (string)
+ 4.6. ca_path (string)
5. Usage
6. Module Specific Considerations
@@ -203,7 +203,7 @@ allid,time_hires&cid:callid
4.3. verbosity (int)
4.4. opt_tls (int)
4.5. db_pass (string)
- 4.6. ac_path (string)
+ 4.6. ca_path (string)
4.1. schema_path (string)
@@ -247,6 +247,12 @@ modparam("db_redis", "verbosity", 0)
Controls TLS usage while connecting to a remote DB. If set to 1, TLS is
used to connect to the DB.
+ If TLS is enabled, the module will validate the Redis server
+ certificate against the ca_path. There is currently no way to connect
+ with a specified client certificate, the corresponding configuration to
+ check client certificates in the Redis server must therefore be turned
+ off.
+
Default value: 0.
Example 1.4. Enabling TLS connection
@@ -265,9 +271,10 @@ modparam("db_redis", "opt_tls", 1)
modparam("db_redis", "db_pass", "r3d1sPass")
...
-4.6. ac_path (string)
+4.6. ca_path (string)
- Sets the path where Certificates Authorities certs are stored.
+ Sets the path where Certificates Authorities certs for the Redis server
+ certificate are stored.
Default value: "" (empty).
diff --git a/src/modules/ndb_redis/README b/src/modules/ndb_redis/README
index 1cdfc842db3..90071f5e3f0 100644
--- a/src/modules/ndb_redis/README
+++ b/src/modules/ndb_redis/README
@@ -55,7 +55,7 @@ Joel Centelles Martin
3.8. flush_on_reconnect (integer)
3.9. allow_dynamic_nodes (integer)
3.10. debug (integer)
- 3.11. ac_path (string)
+ 3.11. ca_path (string)
4. Functions
@@ -103,7 +103,7 @@ Chapter 1. Admin Guide
3.8. flush_on_reconnect (integer)
3.9. allow_dynamic_nodes (integer)
3.10. debug (integer)
- 3.11. ac_path (string)
+ 3.11. ca_path (string)
4. Functions
@@ -149,7 +149,7 @@ Chapter 1. Admin Guide
3.8. flush_on_reconnect (integer)
3.9. allow_dynamic_nodes (integer)
3.10. debug (integer)
- 3.11. ac_path (string)
+ 3.11. ca_path (string)
3.1. server (str)
@@ -168,6 +168,12 @@ Chapter 1. Admin Guide
many REDIS servers, just give different attributes and use the specific
server name when querying the REDIS instance.
+ If tls is enabled, the module will validate the REDIS server
+ certificate against the ca_path. There is currently no way to connect
+ with a specified client certificate, the corresponding configuration to
+ check client certificates in the REDIS server must therefore be turned
+ off.
+
Default value is NULL.
Example 1.1. Set server parameter
@@ -346,9 +352,10 @@ modparam("ndb_redis", "allow_dynamic_nodes", 1)
modparam("ndb_redis", "debug", 1)
...
-3.11. ac_path (string)
+3.11. ca_path (string)
- Sets the path where Certificates Authorities certs are stored.
+ Sets the path where Certificates Authorities certs for the REDIS server
+ certificate are stored.
Default value: "" (empty).
#### Type Of Change
- [ ] Small bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
Enhance xhttp_prom module to export pkgmem stats.
The new stats can be enabled via a new module parameter: `xhttp_prom_pkgmem_stats_enabled`.
Default value for the new module parameter: 0 (no pkg mem stats are generated).
Any value different then 0 will export the pkg mem statistics.
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3793
-- Commit Summary --
* kex: expose access to pkg mem stats
* xhttp_prom: export pkg mem stats
-- File Changes --
A src/modules/kex/api.c (54)
A src/modules/kex/api.h (69)
M src/modules/kex/kex_mod.c (2)
M src/modules/kex/pkg_stats.c (24)
M src/modules/kex/pkg_stats.h (17)
M src/modules/xhttp_prom/prom.c (66)
M src/modules/xhttp_prom/xhttp_prom.c (44)
M src/modules/xhttp_prom/xhttp_prom.h (16)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3793.patchhttps://github.com/kamailio/kamailio/pull/3793.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3793
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3793(a)github.com>
<!-- Kamailio Pull Request Template -->
<!--
IMPORTANT:
- for detailed contributing guidelines, read:
https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md
- pull requests must be done to master branch, unless they are backports
of fixes from master branch to a stable branch
- backports to stable branches must be done with 'git cherry-pick -x ...'
- code is contributed under BSD for core and main components (tm, sl, auth, tls)
- code is contributed GPLv2 or a compatible license for the other components
- GPL code is contributed with OpenSSL licensing exception
-->
#### Pre-Submission Checklist
<!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply -->
<!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above-->
<!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list -->
- [x] Commit message has the format required by CONTRIBUTING guide
- [x] Commits are split per component (core, individual modules, libs, utils, ...)
- [x] Each component has a single commit (if not, squash them into one commit)
- [x] No commits to README files for modules (changes must be done to docbook files
in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change
- [x] Small bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds new functionality)
- [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist:
<!-- Go over all points below, and after creating the PR, tick the checkboxes that apply -->
- [ ] PR should be backported to stable branches
- [x] Tested changes locally
- [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description
The created ssl context in the `db_redis` and `ndb_redis` modules does not use client certificates [1], [2] which is against the default in current Redis configurations [3]. The used Redis server therefore needs to be configured to not use tls-auth-clients [3]. Without setting this configuration in Redis, no TLS connection to the Redis server can be established, since Redis will not accept unsigned/not-validated client certificates.
There is also a small typo in "ac_path" in both docs which was fixed to "ca_path", added with some more specification to _which_ certificate is validated.
[1]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[2]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[3]: https://redis.io/docs/management/security/encryption/#client-certificate-au…
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3804
-- Commit Summary --
* db_redis: docs - refine docs regarding client certificates [skip ci]
* ndb_redis: docs - refine docs regarding client certificates [skip ci]
-- File Changes --
M src/modules/db_redis/doc/db_redis_admin.xml (10)
M src/modules/ndb_redis/doc/ndb_redis_admin.xml (10)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3804.patchhttps://github.com/kamailio/kamailio/pull/3804.diff
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/3804
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/3804(a)github.com>
Module: kamailio
Branch: master
Commit: 6faa180661e799187eff3a498f8b13e96719fa92
URL: https://github.com/kamailio/kamailio/commit/6faa180661e799187eff3a498f8b13e…
Author: Jannik Volkland <volkland(a)sipgate.de>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-04-04T12:55:38+02:00
ndb_redis: docs - refine docs regarding client certificates [skip ci]
The created ssl context does not use client certificates [1,2] which is against the default in current Redis configurations [3]. The used Redis server therefore needs to be configured to not use tls-auth-clients [3].
There is also a small typo in "ac_path" which was fixed to "ca_path".
[1]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[2]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[3]: https://redis.io/docs/management/security/encryption/#client-certificate-au…
---
Modified: src/modules/ndb_redis/doc/ndb_redis_admin.xml
---
Diff: https://github.com/kamailio/kamailio/commit/6faa180661e799187eff3a498f8b13e…
Patch: https://github.com/kamailio/kamailio/commit/6faa180661e799187eff3a498f8b13e…
---
diff --git a/src/modules/ndb_redis/doc/ndb_redis_admin.xml b/src/modules/ndb_redis/doc/ndb_redis_admin.xml
index 74d35c75cc9..024b01315ac 100644
--- a/src/modules/ndb_redis/doc/ndb_redis_admin.xml
+++ b/src/modules/ndb_redis/doc/ndb_redis_admin.xml
@@ -75,6 +75,12 @@
many REDIS servers, just give different attributes and use the specific
server name when querying the REDIS instance.
</para>
+ <para>
+ If tls is enabled, the module will validate the REDIS server certificate against the
+ ca_path. There is currently no way to connect with a specified client certificate, the
+ <ulink url="https://redis.io/docs/management/security/encryption/#client-certificate-au…">corresponding configuration</ulink>
+ to check client certificates in the REDIS server must therefore be turned off.
+ </para>
<para>
<emphasis>
Default value is NULL.
@@ -330,9 +336,9 @@ modparam("ndb_redis", "debug", 1)
</example>
</section>
<section id="ndb_redis.p.ca_path">
- <title><varname>ac_path</varname> (string)</title>
+ <title><varname>ca_path</varname> (string)</title>
<para>
- Sets the path where Certificates Authorities certs are stored.
+ Sets the path where Certificates Authorities certs for the REDIS server certificate are stored.
</para>
<para>
Default value: "" (empty).
Module: kamailio
Branch: master
Commit: 40a50243f0bae782b7acd97cf0a9b1138185068b
URL: https://github.com/kamailio/kamailio/commit/40a50243f0bae782b7acd97cf0a9b11…
Author: Jannik Volkland <volkland(a)sipgate.de>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2024-04-04T12:55:38+02:00
db_redis: docs - refine docs regarding client certificates [skip ci]
The created ssl context does not use client certificates [1,2] which is against the default in current Redis configurations [3]. The used Redis server therefore needs to be configured to not use tls-auth-clients [3].
There is also a small typo in "ac_path" which was fixed to "ca_path".
[1]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[2]: https://github.com/kamailio/kamailio/blob/8047c958b42ea5af2e8f9ede0152f892a…
[3]: https://redis.io/docs/management/security/encryption/#client-certificate-au…
---
Modified: src/modules/db_redis/doc/db_redis_admin.xml
---
Diff: https://github.com/kamailio/kamailio/commit/40a50243f0bae782b7acd97cf0a9b11…
Patch: https://github.com/kamailio/kamailio/commit/40a50243f0bae782b7acd97cf0a9b11…
---
diff --git a/src/modules/db_redis/doc/db_redis_admin.xml b/src/modules/db_redis/doc/db_redis_admin.xml
index a7e7c3bb3a9..15ed0ca61e2 100644
--- a/src/modules/db_redis/doc/db_redis_admin.xml
+++ b/src/modules/db_redis/doc/db_redis_admin.xml
@@ -224,6 +224,12 @@ modparam("db_redis", "verbosity", 0)
Controls TLS usage while connecting to a remote DB.
If set to 1, TLS is used to connect to the DB.
</para>
+ <para>
+ If TLS is enabled, the module will validate the Redis server certificate against the
+ ca_path. There is currently no way to connect with a specified client certificate, the
+ <ulink url="https://redis.io/docs/management/security/encryption/#client-certificate-au…">corresponding configuration</ulink>
+ to check client certificates in the Redis server must therefore be turned off.
+ </para>
<para>
Default value: 0.
</para>
@@ -256,9 +262,9 @@ modparam("db_redis", "db_pass", "r3d1sPass")
</section>
<section id="db_redis.p.ca_path">
- <title><varname>ac_path</varname> (string)</title>
+ <title><varname>ca_path</varname> (string)</title>
<para>
- Sets the path where Certificates Authorities certs are stored.
+ Sets the path where Certificates Authorities certs for the Redis server certificate are stored.
</para>
<para>
Default value: "" (empty).
Hello,
Kamailio SIP Server v5.8.1 stable release is out.
This is a maintenance release of the latest stable branch, 5.8, that
includes fixes since the release of v5.8.0. There is no change to
database schema or configuration language structure that you have to do
on previous installations of v5.8.x. Deployments running previous v5.8.x
versions are strongly recommended to be upgraded to v5.8.1.
For more details about version 5.8.1 (including links and guidelines to
download the tarball or from GIT repository), visit:
* https://www.kamailio.org/w/2024/04/kamailio-v5-8-1-released/
RPM, Debian/Ubuntu packages will be available soon as well.
Many thanks to all contributing and using Kamailio!
Cheers,
Daniel
--
Daniel-Constantin Mierla (@ asipto.com)
twitter.com/miconda -- linkedin.com/in/miconda
Kamailio Consultancy, Training and Development Services -- asipto.com
Kamailio World Conference, April 18-19, 2024, Berlin -- kamailioworld.com