- sr-users - kamailio.org

TLS issue
by M Arqum CH 22 Aug '22

22 Aug '22

Dear All, Thank you in advance . Facing issue is setting up tls with kamailio 5.5.4 on ec2 Amazon linux server. Getting this error. Aug 18 20:36:33 abc.domain /usr/local/mykamailio/sbin/kamailio[10772]: ERROR: tls [tls_server.c:1329]: tls_h_read_f(): protocol level error Aug 18 20:36:33 abc.domain /usr/local/mykamailio/sbin/kamailio[10772]: ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS accept:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca Aug 18 20:36:33 abc.domain /usr/local/mykamailio/sbin/kamailio[10772]: ERROR: tls [tls_server.c:1333]: tls_h_read_f(): src addr: 143.198.11.1:62033 ///client ip Aug 18 20:36:33 abc.domain /usr/local/mykamailio/sbin/kamailio[10772]: ERROR: tls [tls_server.c:1336]: tls_h_read_f(): dst addr: 172.36.53.1:5061 ///ec2 local ip Aug 18 20:36:33 abc.domain /usr/local/mykamailio/sbin/kamailio[10772]: ERROR: <core> [core/tcp_read.c:1481]: tcp_read_req(): ERROR: tcp_read_req: error reading - c: 0xffff80d78a10 r: 0xffff80d78b38 (-1) TLS Config [server:default] method = TLSv1+ verify_certificate = no require_certificate = nocertificate=/usr/local/ssl/certs/cert.pem private_key=/usr/local/ssl/certs/fullkey.pem server_name = abc.domain Also tried this conf [server:default] method = TLSv1+ ///tries all version options verify_certificate = no require_certificate = no certificate=/usr/local/ssl/certs/ abc.domain.crt private_key=/usr/local/ssl/certs/ abc.domain.key server_name = abc.domain.link openssl version OpenSSL 1.0.2k-fips 26 Jan 2017 please guide. -- Regards Arqum

3 3

remove header from reply?
by Brett Nemeroff 19 Aug '22

19 Aug '22

Hello, I'm receiving calls which I forward to a server I KNOW will reply with a 302. When I get that 302, I parse some information and then t_reply(302) the originator. The 302 I create needs to have it's own contact header which I am adding with append_to_reply(). That works great. BUT the contact header from the original 302 is hanging around. Now I have two contact headers :( How can I get rid of the original 302's contact header? remove_hf() doesn't work in this context since it's a reply. So I need a kind of "remove_header_from_reply()". Thanks, Brett

2 3

Processing Async HTTP Requests in Real-time
by Brett Nemeroff 19 Aug '22

19 Aug '22

Hello Kamailio Team! I've tried following the documentation for http_async_query() with suspend=1 and not getting results I'm expecting. Perhaps I'm misunderstanding the documentation. Basically I'm performing a http_async_query() with suspend set to 1 and a "route_name" set to HTTP_REPLY. When my query executes, it appears that Kamailio stops processing in that route block, suspends, and then when a reply is available, it continues in HTTP_REPLY. That makes sense. I pull the return value and set some $var and $avp. When I get to the end of the HTTP_REPLY block, I'm EXPECTING it to RESUME FROM the suspended location from the original route block, which it does NOT seem to do. Is that expected? For what it's worth, I did test just continuing my route logic in HTTP_REPLY and just forgetting about the original route block (moved all the remaining processing logic into HTTP_REPLY) However, existing $avp and $vars that were already set within the transaction were not set. So that's not possible either. I'm pretty sure there is a right way to do this without getting hacky. Can someone help me out? And yes, I know what I'm trying to do sounds like sync, but I want async to handle high volume and the potential for my external URL to lightly block. I believe the right way to do this is with async+suspending. Thank you, Brett

2 4

packets exceeding MTU size
by Ali Taher 18 Aug '22

18 Aug '22

Hello all, Lately I faced an issue that Kamailio is not responding to some invite packets coming from SBC. When investigating I found that these packets exceeds MTU size. Could this be the issue? Knowing that in Kamailio configuration I have a condition on is_method("INVITE"). Could be that in case of packet exceeding MTU size it's not considered as invite packet by Kamailio? I have Kamailio 5.2.5. Regards, Ali Taher

4 6

How to enforce max_contacts at registration?
by Benoit Panizzon 18 Aug '22

18 Aug '22

Hi List # ----- registrar params ----- modparam("registrar", "method_filtering", 1) # modparam("registrar", "append_branches", 0) modparam("registrar", "max_contacts", 10) modparam("registrar", "max_expires", 3600) modparam("registrar", "gruu_enabled", 0) modparam("registrar", "retry_after", 30) modparam("registrar", "xavp_cfg", "reg") == snipp == # Handle SIP registrations route[REGISTRAR] { # We are authenticated. # Create an AOR based on the auth_username for the location service. $var(saveuri) = "sip:" + $aU + "@" + $rd; # Set max_contacts limit via registration module reg xavp. if ($avp(debug) > 0) { xlog("L_INFO", "$cfg(route): Setting max_contacts to $avp(max_contacts) for $var(saveuri)\n"); } $xavp(reg=>max_contacts) = $avp(max_contacts); # Save Location! $var(result) = save("location","0x00","$var(saveuri)"); if ($var(result) == -2) { xlog("L_ERR", "$cfg(route): Too many contacts for $var(saveuri)\n"); sl_reply_error(); } if ($var(result) == -1) { xlog("L_ERR", "$cfg(route): Error saving location $var(saveuri)\n"); sl_reply_error(); } if ($var(result) == 1) { xlog("L_INFO", "$cfg(route): Contact $var(saveuri) inserted\n"); } if ($var(result) == 2) { xlog("L_INFO", "$cfg(route): Contact $var(saveuri) updated\n"); } if ($var(result) == 3) { xlog("L_INFO", "$cfg(route): Contact $var(saveuri) deleted\n"); } if ($var(result) == 4) { xlog("L_INFO", "$cfg(route): Contact $var(saveuri) returend\n"); } exit; } == snapp == $avp(max_contacts) is set to 1 Still, multiple registrations are possible for the $aU in question. What am I doing wrong? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

4 8

Re: [SR-Users] TLSv1.3 support
by Henning Westerholt 17 Aug '22

17 Aug '22

Hello, Please keep the list in CC. Regarding opening new TLS 1.3 connection, this should work, but did not tested it right now. If not, open an issue on our tracker. Regarding the option to restrict to only TSLv1.3 connection - I have added support for configuring this to git master version in commit 105600b3. Maybe you can give it a try, the patch should probably apply to 5.6.x branch. Cheers, Henning From: Helio <hok.sh10(a)gmail.com> Sent: Wednesday, August 17, 2022 2:52 PM To: Henning Westerholt <hw(a)gilawa.com> Subject: Re: [SR-Users] TLSv1.3 support Regarding the full support, I would like to know if Kamailio can start a TLSv1.3 connection as a client. Another point is if we can restrict to accept only TLS v1.3 and not TLSv1.2 for instance. Thanks, Helio Em ter., 16 de ago. de 2022 às 11:45, Henning Westerholt <hw(a)gilawa.com<mailto:hw@gilawa.com>> escreveu: Hello, not sure about the question about “full support”, maybe you can add details. Kamailio supports connection with TLSv1.3: $ openssl s_client -connect kam04.tst.domain.net:5061<http://kam04.tst.domain.net:5061> -tls1_3 2>&1 | tail -n 10 New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 4096 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) Cheers, Henning From: sr-users <sr-users-bounces(a)lists.kamailio.org<mailto:sr-users-bounces@lists.kamailio.org>> On Behalf Of Helio Sent: Monday, August 15, 2022 8:01 PM To: sr-users(a)lists.kamailio.org<mailto:sr-users@lists.kamailio.org> Subject: [SR-Users] TLSv1.3 support Hello, I noticed that Kamailio has option TLSv1.2+. Does the Kamailio support full TLSv1.3? Or does it have any restrictions? BR,

1 1

Kamailio not responding in heavy load
by Ali Taher 17 Aug '22

17 Aug '22

Hello all, I'm using sqlops module to connect to postgres and get the routing of calls from postgresql database. In order to troubleshoot issues in case they happened, I added each call details to Kamailio log. In some cases, when there is heavy traffic load (around 100 cps), I don't find some calls in Kamailio log, knowing that I can find them on the switch log (switch sending the invite packets to Kamailio). When checking the traces on these calls taken by the switch, it's clear that Kamailio is not responding to the invite packets sent by the switch. It could be because there are no available process to handle the call at this moment (I have set fork=14) Is it possible to check if there are calls pending in the queue? Regards,

2 1

Request rpms for 5.6.1
by Richard Chan 17 Aug '22

17 Aug '22

Hi kamailio team, I'd like to request that 5.6.1 be added to rpm.kamailio.org. Thanks! S-P Chan

3 3

TLSv1.3 support
by Helio 16 Aug '22

16 Aug '22

Hello, I noticed that Kamailio has option TLSv1.2+. Does the Kamailio support full TLSv1.3? Or does it have any restrictions? BR,

2 1

proper way for infinite loop in event_route for evrexec module
by Patrick Karton 16 Aug '22

16 Aug '22

Hello i would like to use the evrexec module to execute background jobs over exec module mainly because i want to be able to trigger that route manually via rpc from time to time. in the documentation its is stated we should use tasks that run forever and except using while loop i dont see another way. and i dont to want to disable max_while_loops. but if i disable it i will get error message like runaway while (1091, 9): more then 100 loops. so is there another way to do it properly ? Thanks.

4 5

Remove and Re add FROM in 200 OK sl reply
by Lewis Hutchinson 16 Aug '22

16 Aug '22

Hello All kamailio 5.5.3 KEMI Python Lab environemnt Is there a reason why this does not work? Lines 2 and 3 work but the removal of the initial From is not working on Line 1 1. KSR.hdr.remove("From") 2. KSR.hdr.append_to_reply("From: " +KSR.pv.gete("$fn") + " <"+KSR.pv.gete("$fu") + ">" + ";tag=" +KSR.pv.gete("$ft") + "--1234" + "\r\n") 3. KSR.sl.sl_send_reply(200, "OK") In a SUBSCRIBE/NOTIFY scenario I am trying to control the From Tag returned in the 200OK so I can use the same one in subsequent NOTIFY messages generated outside of Kamailio, my theory is use the From tag in the Subscribe and append it on the reply with -1234 for example (this is only in a Lab at this stage, any other options please let me know) Whenever I do this I end up with 2 From headers (see below) SIP/2.0 200 OK Via: SIP/2.0/UDP 192.168.1.67:5060;branch=z9hG4bK-f710a11a;rport=46404;received=xx.yy.xx.yy From: " testuser" sip:limeant30@sip.viazeta.com;tag=bf8745def06c7b12 To: <sip: testuser(a)sip.viazeta.com>;tag=47969b75f14e6954812863912d1cf21c.b5f3318f Call-ID: b21ba770-9b5836aa(a)192.168.1.67 CSeq: 18137 SUBSCRIBE Contact: "testuser" <sip:testuser@ xx.yy.xx.yy:46404> Expires: 3600 From: "testuser" sip:testuser@testbed.com;tag=bf8745def06c7b12--1234 Content-Length: 0 I have tried many many variations but the original From header always persists I have checked the debug logs and it says it has been removed Anyone know what I am missing? And how to get KSR.hdr.remove("From") to work. Looking in a debug log the header is removed. Lewis

2 3

Need help with multi mtree
by Benoît Panizzon 16 Aug '22

16 Aug '22

Heya I try to use mutli tree mtree to define multiple 'named' prefixes. id(int,auto) tname(string) tprefix(string) tvalue(string) 0:tech:+1:1 0:tech:+9:1 0:cust:+1:1 0:cust:+9:0 Kamailio is not complaining while loading this file, but mtree.summary shows no entries. Any hint on what I may be do wrong? -- Mit freundlichen Grüssen -Benoît Panizzon- @ HomeOffice und normal erreichbar -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

2 2

Kamailio Configuration Help
by P. White 16 Aug '22

16 Aug '22

Hi All, Really sorry to bother everyone, but if possible, can I ask for a little help? I've been attempting to get Kamailio configured and working for some considerable time now (read: Years of occasional tinkering, and weeks of recent dedicated evening work) -- all without success. I have a sip trunk from sipgate, with two PSTN numbers assigned. My local network has a static external IP, with an internal private network. Currently I have Kamailio running within the intenal network along with two physical sip telephones (gigaset and an old grandstream), although I do have the option to put kamailio within a DMZ if necessary. Would anyone have a working config file that they could share please, permitting incoming and outgoing calls? With grateful thanks, Phil

2 1

Where to find DMQ protocol specification
by Илья Болмосов 15 Aug '22

15 Aug '22

Hello, we use DMQ module and we need to handle some events: 1) when peer joins cluster 2) when peer leaves cluster It will be helpful to know which content will be in KDMQ message in different cases. Tried to find any specification of KDMQ protocol, but didn't find it. Can you, please, help me with this?

2 1

Change reply code reason other than using change_reply_status
by Patrick Karton 12 Aug '22

12 Aug '22

hello is there a way to change reply code reason other than using () function. because the first parameterc of change_reply_status needs to be a constant so i can not use pseudo var for first argument of that function. so i use change_reply_status_code to change to code with a pseudo. but i would also to change the code reason.

3 3

remove_hf() does not remove the complete line
by Bernd Krueger-Knauber 11 Aug '22

11 Aug '22

Hi, I tried to remove a Via header line with: remove_hf("Via"); Original I have this 2 lines: Via: SIP/2.0/TCP xxx.xxx.xxx.xxx;branch=z9hG4bK370b.21720bb33c4f8264fde4e7994d288a57.0;i Via: SIP/2.0/TCP yyy.yyy.yyy.yyy:53967;received=yyy.yyy.yyy.yyy;rport=53967;branch=z9hG4bKPjxb0bdb2c9624076815f12937cc9e51d;alias If I insert remove_hf("Via"); in the cfg, I get: Via: SIP/2.0/TCP xxx.xxx.xxx.xxx;branch=z9hG4bK370b.21720bb33c4f8264fde4e7994d288a57.0;i ;received=yyy.yyy.yyy.yyy;rport=53967;branch=z9hG4bKPjxb0bdb2c9624076815f12937cc9e51d;alias Doesn't mattter if the command make sense or not, the result, in my opinion, is wrong. The INVITE packet has now an invalid header line. Any ideas? version: kamailio 5.6.1 (x86_64/linux) Best regards, Bernd

4 8

Kamailio has unconfined processes
by HimaBindu G 11 Aug '22

11 Aug '22

Hi, Problem Description: Customer security scan returned unconfined services on Kamailio. Unconfined processes run in unconfined domains Rationale: For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules - it does not replace them Solution Investigate any unconfined processes found during the audit action. They may need to have an existing security context assigned to them or a policy built for them. Notes: Occasionally certain daemons such as backup or centralized management software may require running unconfined. Any such software should be carefully analyzed and documented before such an exception is made. See Also https://workbench.cisecurity.org/files/2485 For Kamailio ====== The command returned : 00 kamailio 00 kamailio 00 kamailio 00 kamailio 00 kamailio 10 kamailio 10 kamailio 10 kamailio 10 kamailio 00 kamailio 00 kamailio 00 kamailio 00 kamailio 33 kamailio 33 kamailio 33 kamailio 32 kamailio 17 kamailio 16 kamailio 33 kamailio 00 kamailio 00 kamailio 03 kamailio 05 kamailio 18 kamailio 17 kamailio 18 kamailio 18 kamailio 07 kamailio 00 sleep is any security context available to assign kamailio processes ? theses services can be run as confined services ? Please suggest us with resolution, thanks in advance. Thanks & Regards, Hima Bindu.

2 1

Kamailio World Conference - Sep 7-8, 2022 - Online
by Daniel-Constantin Mierla 10 Aug '22

10 Aug '22

For the 3rd year, we are planning an online version of Kamailio World Conference! At the beginning of 2022, the situation was not clear in terms of whether pandemic would decrease enough in intensity and we would be allowed to organize an on-site event late spring/beginner of summer, when the usual Kamailio Conference took place in Berlin, therefore we chose the safety path. But we hope that next year we will return in-person to the beautiful Berlin city center! The event this year, to happen in 4 weeks from now (Sep 7-8, 2022), follows the structure from previous edition, being two afternoons with presentations about Kamailio, sharing technical solutions and open discussions, allowing the community to interact and reconnect. The website of the event: - https://kamailioworld.com/k10-online/ There is no registration required, the event will happen on live video conferencing, also streamed to youtube. A text chatting channel will be made available as well. If you want to present, just send me the title and a short description -- we encourage community members to step forward and share their knowledge. It has to be related to Kamailio and fit within a 30min slot (including the questions). The agenda will be released in the near future. The event will be used also to celebrate 21 years of Kamailio project development, first commit being done on Sep 3, 2001. Two other major celebrations for 2022 to make the party bigger: - 20 years of open source for the project -- after one year of internal development, GPL was added on Sep 19, 2002 and source code was released to public - the 10th edition of Kamailio World Conference Book the dates in your agenda! I am looking forward to a very interesting event and (re-)connecting with many of you! Daniel -- Daniel-Constantin Mierla -- www.asipto.com www.twitter.com/miconda -- www.linkedin.com/in/miconda

1 0

set source port of TCP socket in Contact header
by Maarten Ureel 09 Aug '22

09 Aug '22

Hello I want to set the correct source port in an outgoing message over TCP. Is it possible? I can't find a pseudo-variable for this. Currently we have no port number in the contact header, and the other party is sending their BYE to port 5060 instead of to the source port from which the outgoing TCP connection was made. Regards Maarten

2 5

Syncing Registration Database across Kamailio Pairs
by harneet singh 09 Aug '22

09 Aug '22

Hi Experts, We have been using Kamailio in an Active/Standby Pair(with Keepalived under the rugs moving the single Virtual IP to access the Active Kamailio) for sometime now. *Kamailio also acts as a Registrar for our webrtc endpoints. * It has been serving the purpose pretty well and now we have a requirement where we need to be syncing the Registration DB between Two Pairs of Kamailios. Kamailio-Active(*Pair 1*) -------- Kamailio-Standby(*Pair 1*) || Kamailio-Active(*Pair 2*) -------- Kamailio-Standby(*Pair 2*) We generally keep the counterpart in the same Pair as a notifier( *modparam("dmq", "notification_address", "sip:PEER1_IP:5060")* ) so as to sync the dialogs and the userloc data too( *modparam("dmq_usrloc", "enable", 1) * ). In order to achieve the said requirement with the other Pair, we added another "*notification_address*" in the kamailio cfg. At this point, we ran into weird issues. *1. *With Kamailio ver *5.3.2, *the subsequent *notification_address *line in the cfg file, seemed to be overriding the previous one. Hence we see only the latter peer in the dmq list nodes. Example: modparam("dmq", "notification_address", "sip:*172.27.45.77* :5090") modparam("dmq", "notification_address", "sip:*172.27.45.200* :5090") In this case, the "*kamcmd dmq.list_nodes*" would show the local Machine and 172.27.45.200 as the only nodes in the output, ie *172.27.45.77 is not showing up at all,* which is problematic, since the local machine(172.27.45.243 in our case) would not been able to send any dmq sync info to its peer(172.27.45.77) in the same Pair. To see if the above issue might have been addressed in later release, we upgraded to the latest Kamailio ver *5.6.0* *To our respite, the above issue no longer exists in the new version*(though not sure which immediate release after v 5.3.2 it would have been initially fixed.) This is where we have a new issue explained below: *2. *The registration data does get synced to the peer Kamailio in the same Pair, and also to the Kamailio instances in the other Pair. However, the *Socket* Parameter in "*kamctl ul show*" output shows *[not set] *even on the side where the websocket connection actually exists. [root@localhost ~]# *kamctl ul show * { "jsonrpc": "2.0", "result": { "Domains": [{ "Domain": { "Domain": "location", "Size": 1024, "AoRs": [{ "Info": { "AoR": "9008077221", "HashID": 1952082106, "Contacts": [{ "Contact": { "Address": "sip:Harneet_qifir@172.24.58.210", "Expires": 159, "Q": -1, "Call-ID": "vfli2uv8du3ppda73q5ppe", "CSeq": 106, "User-Agent": "EngageDigital", "Received": "sip:172.27.44.252:60070;transport=ws", "Path": "[not set]", "State": "CS_NEW", "Flags": 0, "CFlags": 0, * "Socket": "[not set]", <<<<<<<<<<<<<<<<<<<<<<* "Methods": 7071, "Ruid": "uloc-62f26e3b-2677-1", "Instance": "<urn:uuid:4fbd3e96-b4de-497b-886d-1ca8ffa016a4>", "Reg-Id": 1, "Server-Id": 0, "Tcpconn-Id": -1, "Keepalive": 0, "Last-Keepalive": 1660063892, "KA-Roundtrip": 0, "Last-Modified": 1660063892 } }] } } ], In order to confirm that the socket actually exists on this Kamailio instance, I am pasting the below outputs from the same machine, where ws dump and even the native netstat confirms that. [root@localhost ~]# *netstat -tunelap | grep 60070* tcp 0 0 172.27.45.199:8080 172.27.44.252:*60070* *ESTABLISHED* 994 17322355 16230/kamailio [root@localhost ~]# *kamcmd ws.dump* { connections: { 1: ws:172.27.44.252:*60070* -> ws:172.27.45.199:8080 (state: *OPEN*, last used 24s ago, sub-protocol: sip) } info: { wscounter: 1 truncated: no } } We do need to distinguish the actual Kamailio instance where the websocket connection actually exists, so as to route the call ahead from the same instance, or if it does not exist(and it's merely a sync'ed registration data received over DMQ Channel), then the Kamailio should route the call ahead to the Kamailio instance in the other Pair, which can then route it ahead to the Registered webrtc endpoint. We were hoping to use the Socket Parameter output, but for the said problem, unable to use the same as an indicator. *So what would be the best way to identify which Kamailio has the websocket connection with the Actual endpoint*? Should we rely on the output of netstat or ws.dump to infer that? I mean this needs to be done in kamailio.cfg for each call, so want to know the best way, or if there is completely different approach that can be suggested? Apologies for the long email, but any pointers will be much helpful. Thanks & Regards, Harneet Singh -- "Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth" - Sir Arthur Conan Doyle

2 1

recompute distribution list
by David Villasmil 08 Aug '22

08 Aug '22

Hello guys, Is it possible to have dispatcher recompute the distribution list? i.e. one server goes down, all traffic for that server goes to the next one, doubling traffic on that one. Is there a way of, when a host becomes unreachable, recompute the whole list? Regards, David Villasmil email: david.villasmil.work(a)gmail.com phone: +34669448337

3 7

Contact header modification - Kamailio
by Ankit Jayswal 04 Aug '22

04 Aug '22

Hello Team, I am in need to modify the contact header in Kamailio before sending an INVITE request to the SIP trunk provider. Basically the IP address I need to modify in the contact header. Please suggest a better way to do this. Below is an example. *OLD (Existing):* Contact: <sip:009169240xxx@*45.118.162.x:5080*;alias=10.52.26.102~5080~1> *NEW (Needed):* Contact: <sip:00912269240xxx@*10.52.26.98:5060 <http://10.52.26.98:5060>*> I tried various functions from the textops module but no hope. I am looking for a function that can replace the contact header's value. Please help me with this. -- Thanks & Regards, *Ankit Jayswal* | Specialist - Software Development

4 13

Support of ECDHE cipher suites for tls connection in kamailio
by Илья Болмосов 03 Aug '22

03 Aug '22

Hello. I have a question about support of ECDHE cipher suites in kamailio-5.6.0 in centos7 with installed OpenSSL 1.0.2k-fips. We received kamailio with its modules from https://rpm.kamailio.org/. Our client can use only cipher suites: TLS_AES_256_GCM_SHA384 (0x1302) TLS_CHACHA20_POLY1305_SHA256 (0x1303) TLS_AES_128_GCM_SHA256 (0x1301) TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) And some of them are supported by our openssl: $ openssl cipher -V ... 0xC0,0x14 - ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 0xC0,0x0A - ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ... 0xC0,0x13 - ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 0xC0,0x09 - ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ... But when trying to connect with, for example, cipher suite ECDHE-RSA-AES256-SHA (the same with other 3 cipher suites), we receive, that it is not allowed: $ openssl s_client -connect ${kamailio-serper-ip}:${kamailio-server-port} -cipher ECDHE-RSA-AES256-SHA ... SSL handshake has read 7 bytes and written 121 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 ... To exclude the influence of other factors, I installed nginx on the same machine with usage of the same tls certificate and it can use cipher suites ECDHE-RSA-AES256-SHA and ECDHE-RSA-AES128-SHA. $ openssl s_client -connect ${nginx-serper-ip}:${nginx-server-port} -cipher ECDHE-RSA-AES256-SHA ... SSL handshake has read 3271 bytes and written 406 bytes Verification: OK --- New, TLSv1.0, Cipher is ECDHE-RSA-AES256-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA ... So, the reason of failed handshake is, probably, kamailio. Tried to add cipher_list modparam: modparam("tls", "cipher_list", "ECDHE-RSA-AES256-SHA") but result is the same: $ openssl s_client -connect ${kamailio-serper-ip}:${kamailio-server-port} -cipher ECDHE-RSA-AES256-SHA ... SSL handshake has read 7 bytes and written 121 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 ... Can you, please, help me to add support of cipher suites ECDHE-RSA-AES256-SHA and ECDHE-RSA-AES128-SHA to kamailio?

2 1

Newbie - Installation Issue - ERROR: could not load the script in /usr/lib/kamailio//kamctl/kamdbctl.mysql for database engine MYSQL
by p.t.crossley＠gmail.com 02 Aug '22

02 Aug '22

I suspect this must have been addressed before but I couldn't find a way of searching Archives. I'm using Alpine Linux. Used "apk add kamailio" to install Kamailio 5.5.4-r1 Following the Instructions on https://kamailio.org/docs/tutorials/5.5.x/kamailio-install-guide-git/ At the section for "Creating MySQL database" I modify the file and then run kamdbctl create ERROR: could not load the script in /usr/lib/kamailio//kamctl/kamdbctl.mysql for database engine MYSQL ERROR: database engine not loaded - tried 'MYSQL' I checked the /usr/lib/kamailio//kamctl/ directory and the file wasn't there I suspect I'm missing a module but there aren't any other packages listed for Kamailio at pkgs.alpinelinux.org Thanks for your help P Crossley

3 2

Limit cps per destination gw
by Jon Bonilla (Manwe) 02 Aug '22

02 Aug '22

Hi I'm thinking on having a cps preference for each pstn gw that I can check. I've started thinking in the pike module but it won't allow me to set custom cps per peer. seems that the threshold is global. Ratelimit module needs the queues to be set as modparam, not dynamic AFAICS. Any hints? cheers, Jon -- PekePBX, the multitenant PBX solution https://pekepbx.com

6 8

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users