sr-users May 2022

sr-users@lists.kamailio.org

49 participants
59 discussions

unable to get local issuer certificate
by Володимир Іванець 12 May '22

12 May '22

Hello all! I'm trying to establish TLS connection but getting the following error. Can anyone point me in the right direction, please? tls_dump_verification_failure(): verification failure: unable to get local issuer certificate Kamailio version is 5.5.1. System runs on CentOS 7. At the moment tls.cfg configuration file looks like this: [server:default] method = TLSv1+ require_certificate = no verify_certificate = no private_key = /var/kamailio/certificates/default/server/key.pem certificate = /var/kamailio/certificates/default/server/cert.pem ca_list = /var/kamailio/certificates/default/CA/cert.pem [client:default] method = TLSv1+ require_certificate = no verify_certificate = no private_key = /var/kamailio/certificates/default/server/key.pem certificate = /var/kamailio/certificates/default/server/cert.pem ca_list = /var/kamailio/certificates/default/CA/cert.pem ca_list file contains root and intermediate certificates. Certificate was issued by Sectigo. It can be successfully verified with OpenSSL tool: # openssl verify -verbose -CAfile /var/kamailio/certificates/default/CA/cert.pem /var/kamailio/certificates/default/server/cert.pem /var/kamailio/certificates/default/server/cert.pem: OK Here is a fragment of Kamailio debug output: May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: <core> [core/tcp_main.c:1993]: tcp_send(): no open tcp connection found, opening new one May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: <core> [core/ip_addr.c:577]: print_ip(): tcpconn_new: new tcp connection: 52.114.132.46 May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: <core> [core/tcp_main.c:1175]: tcpconn_new(): on port 5061, type 3, socket -1 May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: <core> [core/tcp_main.c:1498]: tcpconn_add(): hashes: 3678:784:0, 230 May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: tls [tls_server.c:244]: tls_complete_init(): completing tls connection initialization May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: tls [tls_server.c:207]: tls_get_connect_server_name(): xavp with outbound server name not found May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: tls [tls_server.c:180]: tls_get_connect_server_id(): xavp with outbound server id not found May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: tls [tls_server.c:187]: tls_get_connect_server_id(): outbound server id not set May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: tls [tls_server.c:274]: tls_complete_init(): Using initial TLS domain TLSc<default> (dom 0x7f1cca178720 ctx 0x7f1cca29dbd0 sn []) May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: tls [tls_domain.c:1208]: tls_lookup_private_key(): Private key lookup for SSL_CTX-0x7f1cca29dbd0: (nil) May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: tls [tls_domain.c:778]: sr_ssl_ctx_info_callback(): SSL handshake started May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: <core> [core/tcp_main.c:2888]: tcpconn_1st_send(): pending write on new connection 0x7f1cca41fe18 sock 11 (-1/517 bytes written) (err: 11 - Resource temporarily unavailable) May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: tm [uac.c:686]: send_prepared_request_impl(): uac: 0x7f1cca40bd50 branch: 0 to 52.114.132.46:5061 May 5 06:51:03 server kamailio[3834]: 5(3844) DEBUG: <core> [core/onsend.c:50]: run_onsend(): required parameters are not available - ignoring May 5 06:51:03 server kamailio[3834]: 14(3853) DEBUG: <core> [core/tcp_main.c:3793]: handle_ser_child(): read response= 7f1cca41fe18, 5, fd 26 from 5 (3844) May 5 06:51:03 server kamailio[3834]: 14(3853) DEBUG: <core> [core/io_wait.h:375]: io_watch_add(): DBG: io_watch_add(0xae4760, 26, 2, 0x7f1cca41fe18), fd_no=20 May 5 06:51:03 server kamailio[3834]: 14(3853) DEBUG: <core> [core/io_wait.h:782]: io_watch_chg(): DBG: io_watch_chg (0xae4760, 26, 0x1, 0xffffffff) fd_no=21 called May 5 06:51:03 server kamailio[3834]: 14(3853) DEBUG: <core> [core/io_wait.h:782]: io_watch_chg(): DBG: io_watch_chg (0xae4760, 24, 0x1, 0xffffffff) fd_no=21 called May 5 06:51:03 server kamailio[3834]: 14(3853) DEBUG: <core> [core/io_wait.h:600]: io_watch_del(): DBG: io_watch_del (0xae4760, 26, -1, 0x0) fd_no=21 called May 5 06:51:03 server kamailio[3834]: 14(3853) DEBUG: <core> [core/tcp_main.c:4457]: handle_tcpconn_ev(): sending to child, events 1 May 5 06:51:03 server kamailio[3834]: 14(3853) DEBUG: <core> [core/tcp_main.c:4130]: send2child(): selected tcp worker idx:3 proc:13 pid:3852 for activity on [tls:X.X.X.X:5062], 0x7f1cca41fe18 May 5 06:51:03 server kamailio[3834]: 13(3852) DEBUG: <core> [core/tcp_read.c:1737]: handle_io(): received n=8 con=0x7f1cca41fe18, fd=6 May 5 06:51:03 server kamailio[3834]: 13(3852) DEBUG: tls [tls_domain.c:1208]: tls_lookup_private_key(): Private key lookup for SSL_CTX-0x7f1cca29dbd0: (nil) May 5 06:51:03 server kamailio[3834]: 14(3853) DEBUG: <core> [core/io_wait.h:782]: io_watch_chg(): DBG: io_watch_chg (0xae4760, 25, 0x1, 0xffffffff) fd_no=20 called May 5 06:51:03 server kamailio[3834]: 13(3852) DEBUG: <core> [core/tcp_main.c:2706]: tcpconn_do_send(): sending... May 5 06:51:03 server kamailio[3834]: 13(3852) DEBUG: <core> [core/tcp_main.c:2739]: tcpconn_do_send(): after real write: c= 0x7f1cca41fe18 n=5103 fd=6 May 5 06:51:03 server kamailio[3834]: 13(3852) DEBUG: <core> [core/tcp_main.c:2740]: tcpconn_do_send(): buf= May 5 06:51:03 server kamailio[3834]: ? May 5 06:51:03 server kamailio[3834]: 13(3852) DEBUG: <core> [core/io_wait.h:375]: io_watch_add(): DBG: io_watch_add(0xb50560, 6, 2, 0x7f1cca41fe18), fd_no=1 May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_domain.c:1208]: tls_lookup_private_key(): Private key lookup for SSL_CTX-0x7f1cca29dbd0: (nil) May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_domain.c:790]: sr_ssl_ctx_info_callback(): SSL handshake done May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_domain.c:794]: sr_ssl_ctx_info_callback(): SSL disable renegotiation May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_server.c:542]: tls_connect(): TLS connect successful May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_server.c:549]: tls_connect(): tls_connect: new connection to 52.114.132.46:5061 using TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384 256 May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_server.c:552]: tls_connect(): tls_connect: sending socket: X.X.X.X:0 May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_server.c:418]: tls_dump_cert_info(): tls_connect: server certificate subject:/CN=sip.pstnhub.microsoft.com May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_server.c:422]: tls_dump_cert_info(): tls_connect: server certificate issuer:/C=US/O=Microsoft Corporation/CN=Microsoft RSA TLS CA 01 May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_server.c:558]: tls_connect(): WARNING: tls_connect: server certificate verification failed!!! May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: tls [tls_dump_vf.c:104]: tls_dump_verification_failure(): verification failure: unable to get local issuer certificate May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: <core> [core/tcp_main.c:2706]: tcpconn_do_send(): sending... May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: <core> [core/tcp_main.c:2739]: tcpconn_do_send(): after real write: c= 0x7f1cca41fe18 n=513 fd=6 May 5 06:51:04 server kamailio[3834]: 13(3852) DEBUG: <core> [core/tcp_main.c:2740]: tcpconn_do_send(): buf= Thank you very much!

2 4

Using TLS in Kamailio behind AWS NLB
by Aditya Uppuluri 12 May '22

12 May '22

Hello Team, I want to understand if there is any recommendation on installing kamailio behind AWS NLB. I want to enable TLS at the NLB (using the certificate generated via Aws Certificate Manager) but still use the TLS module functionalities in kamailio (like listening on 443 port/updating the correct via header and all). Because NLB by default doesn't understand sips/TLS, I need a way to differentiate whether the request came on a secure line or on a plain UDP line. How do I configure this? Do I need to generate new certificates for kamailio ? Thanks in advance Regards, Aditya

1 0

Detect RTP stream end (Kamailio + rtpengine)
by Rawad Kassir 11 May '22

11 May '22

Hello, I am trying to play early media purely relaying on kamailio and i have accomplished that using the below: rtpengine_manage(); append_to_reply("Content-Type: application/sdp\r\n"); $var(body)= $(rb{re.subst,/(IP4.).*/\127.0.0.1/g}); set_reply_body($var(body), "application/sdp"); send_reply("100","Trying"); send_reply("183","Session In Progress"); play_media("totag=$ft file=/home/rawad/test.wav"); My problem is that once the RTP stream starts the call is kept open so my question is is there a way for kamailio to detect the end of rtp stream so that i can send BYE or can kamailio do that automatically.

1 0

Proxy for ACK
by Rick van Rein 09 May '22

09 May '22

Hello, RFC 3261 gives (by way of example) an ACK that is sent directly to a remote phone via its Contact: header address. Is this the _only_ way of doing this, or may ACK also be passed through a SIP proxy? I found that my Kamailio setup does not forward ACK, and I wonder why; whether that is a common refusal, or my fault in modifying the proxy script. I am working on an IPv4-only to IPv6-only translation proxy, and would like to leave the DNS-related work to a more advanced SIP proxy. The translator is supposed to be small/simple, so it can be integrated into home routers. I would like to avoid DNS resolution (and its delays) for Contact: URIs. Proxy script, https://gitlab.com/arpa2/mkroot/-/blob/master/contrib/sip-trunk/etc/kamaili… SIPproxy64 translator, https://gitlab.com/0cpm/sipproxy64 Thanks, -Rick

2 4

dns_query container no found
by David Villasmil 06 May '22

06 May '22

Hello guys, I'm trying to use: if(dns_query("$du", "xyz")) And all I get is dns_update_pv(): container not found: xyz Any ideas? I'm not really sure what that means. I know there's supposed to be a $dns(xyz) but it looks like it's not there? I'm using 5.0 BTW. Thanks all & Regards, David Villasmil email: david.villasmil.work(a)gmail.com phone: +34669448337

2 2

calling failure_route
by David Villasmil 06 May '22

06 May '22

Hello guys, Is it possible to call a failure_route like a normal route? i.e.: { t_on_failure("myroute"); } ... route("myroute"); failure_route[myroute] { ... } Let me explain: I have this scenario where a DNS name may get deleted and a dns resolution will fail. There's no pinging to that gateway so i need to: - skip that gateway when dispatching to the setid - detect whether the domain is up and available And failover to the next gateway. I don't know of any other way so on the DISPATCH route, I'm doing: route[DISPATCH] { # round robin dispatching on gateways group '1' if(!ds_select_dst("1", "4")) { send_reply("404", "No destination"); exit; } xlog("L_DBG", "--- SCRIPT: going to <$ru> via <$du>\n"); if(dns_query("$du", "xyz")) { t_on_failure("RTF_DISPATCH"); route(RELAY); } else { route(RTF_DISPATCH); } exit; } to try to resolve and if it fails, it will just go to the failover route. makes sense? Regards, David Villasmil email: david.villasmil.work(a)gmail.com phone: +34669448337

3 4

BYE is being sent using the Dialog ID (did)
by mack＠dopensource.com 06 May '22

06 May '22

I configured the dialog module to match routing based on SIP elements versus the (Dialog ID) did. It looks like it’s using the callid SIP element, but it’s still looking it up using the dialog module. I was hoping it would route on the RURI of the BYE. But, it looks like it’s using the dialog lookup table, which has the wrong RURI because that was the original server we sent the request to. How can I get Kamailio to route based on the RURI within the BYE. May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: rr [rr_cb.c:94]: run_rr_callbacks(): callback id 0 entered with <lr> May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:887]: internal_get_dlg(): ref dlg 0x7f6d97faf200 with 1 -> 3 May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:891]: internal_get_dlg(): dialog callid='oeIojv5OA59S9FYCCu7BcQ..' found on entry 777, dir=2 to-tag='sip+3+f36a00a5+44b60208' May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_profile.c:536]: set_current_dialog(): setting current dialog [777:1428] May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:1290]: next_state_dlg(): dialog 0x7f6d97faf200 changed from state 4 to state 5, due event 7 (ref 3) May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:1071]: dlg_ref_helper(): ref op on 0x7f6d97faf200 with 1 from dlg_handlers.c:1441 May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:1075]: dlg_ref_helper(): ref dlg 0x7f6d97faf200 with 1 -> 4 May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_handlers.c:1452]: dlg_onroute(): BYE successfully processed May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:1091]: dlg_unref_helper(): unref op on 0x7f6d97faf200 with 2 from dlg_handlers.c:1476 May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:1095]: dlg_unref_helper(): unref dlg 0x7f6d97faf200 with 2 -> 2 May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:1091]: dlg_unref_helper(): unref op on 0x7f6d97faf200 with 1 from dlg_hash.c:1109 May 5 06:28:13 sbc-atlanta /usr/sbin/kamailio[27066]: DEBUG: dialog [dlg_hash.c:1095]: dlg_unref_helper(): unref dlg 0x7f6d97faf200 with 1 -> 1 Thanks in advance

2 1

Tips on picking random element from a list
by Joel Serrano 05 May '22

05 May '22

Hi Everyone, I have to implement a flow where outbound calls get their caller-id set with a random number from a pool. I've been looking around and, as most of the time, there are tons of ways to implement something like this... This is a simple implementation, the number pool is fixed and will not change (so I could have it hard-coded in the config if required). My initial approach was: 1- Try to keep it simple, with no dependencies, and all done in the config script. 2- If #1 is "ugly", then I'd probably go with some inline code using python/lua/etc 3- If #2 is "ugly", then I'd go with having the info in a DB and just run a query I think #2 and #3 might be overkill for something so "simple" but I haven't had to work too much with randomness in Kamailio, so any tips/suggestions on where to store the number list and how to pick one randomly would be awesome! Thanks!! Joel.

5 7

failover on dns resolve error
by David Villasmil 05 May '22

05 May '22

Hello guys, I have a scenario where a dns name I've added as a dispatcher endpoint may get removed completely, i.e.: dns resolution fails completely. How would you recommend implementing failover in this case? Regards, David Villasmil email: david.villasmil.work(a)gmail.com phone: +34669448337

1 0

iterating over htable with lua
by David Villasmil 05 May '22

05 May '22

Hello guys, I'm trying to iterate over an htable in lus, this is what i have: =================================== loadmodule "app_lua.so" modparam("app_lua", "load", "/etc/kamailio/myscript.lua") modparam("htable", "htable", "mydata=>size=16;autoexpire=0;dbtable=mydata;dbmode=0;") route { lua_run("match_mydata"); } ... function match_mydata() KSR.htable.sht_iterator_start("i1", "mydata") while KSR.htable.sht_iterator_next("i1") do KSR.log("err","WHILE: iterating on: " .. KSR.htable.sht_get("mydata", "i1")) end KSR.htable.sht_iterator_end("i1"); end But i keep getting: 0(1255) DEBUG: app_lua [app_lua_api.c:666]: app_lua_run_ex(): executing Lua function: [[match_mydata]] 0(1255) DEBUG: app_lua [app_lua_api.c:668]: app_lua_run_ex(): lua top index is: 12 0(1255) ERROR: app_lua [app_lua_api.c:719]: app_lua_run_ex(): error from Lua: /etc/kamailio/myscript.lua:11: attempt to call field 'sht_iterator_start' (a nil value) 0(1255) ERROR: app_lua [app_lua_api.c:734]: app_lua_run_ex(): error executing: match_mydata (err: 2) This almost exact same thing works on the cfg: sht_iterator_start("i1", "msrn"); while(sht_iterator_next("i1")) { xlog("data: $shtitkey(i1)\n"); } sht_iterator_end("i1"); Anyone know what I could be doing wrong? Regards, David Villasmil email: david.villasmil.work(a)gmail.com phone: +34669448337

1 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users May 2022