sr-users

sr-users@lists.kamailio.org

32 participants
37387 discussions

Support of ECDHE cipher suites for tls connection in kamailio
by Илья Болмосов 03 Aug '22

03 Aug '22

Hello. I have a question about support of ECDHE cipher suites in kamailio-5.6.0 in centos7 with installed OpenSSL 1.0.2k-fips. We received kamailio with its modules from https://rpm.kamailio.org/. Our client can use only cipher suites: TLS_AES_256_GCM_SHA384 (0x1302) TLS_CHACHA20_POLY1305_SHA256 (0x1303) TLS_AES_128_GCM_SHA256 (0x1301) TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) And some of them are supported by our openssl: $ openssl cipher -V ... 0xC0,0x14 - ECDHE-RSA-AES256-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 0xC0,0x0A - ECDHE-ECDSA-AES256-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ... 0xC0,0x13 - ECDHE-RSA-AES128-SHA SSLv3 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 0xC0,0x09 - ECDHE-ECDSA-AES128-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ... But when trying to connect with, for example, cipher suite ECDHE-RSA-AES256-SHA (the same with other 3 cipher suites), we receive, that it is not allowed: $ openssl s_client -connect ${kamailio-serper-ip}:${kamailio-server-port} -cipher ECDHE-RSA-AES256-SHA ... SSL handshake has read 7 bytes and written 121 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 ... To exclude the influence of other factors, I installed nginx on the same machine with usage of the same tls certificate and it can use cipher suites ECDHE-RSA-AES256-SHA and ECDHE-RSA-AES128-SHA. $ openssl s_client -connect ${nginx-serper-ip}:${nginx-server-port} -cipher ECDHE-RSA-AES256-SHA ... SSL handshake has read 3271 bytes and written 406 bytes Verification: OK --- New, TLSv1.0, Cipher is ECDHE-RSA-AES256-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA ... So, the reason of failed handshake is, probably, kamailio. Tried to add cipher_list modparam: modparam("tls", "cipher_list", "ECDHE-RSA-AES256-SHA") but result is the same: $ openssl s_client -connect ${kamailio-serper-ip}:${kamailio-server-port} -cipher ECDHE-RSA-AES256-SHA ... SSL handshake has read 7 bytes and written 121 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 ... Can you, please, help me to add support of cipher suites ECDHE-RSA-AES256-SHA and ECDHE-RSA-AES128-SHA to kamailio?

2 1

Newbie - Installation Issue - ERROR: could not load the script in /usr/lib/kamailio//kamctl/kamdbctl.mysql for database engine MYSQL
by p.t.crossley＠gmail.com 02 Aug '22

02 Aug '22

I suspect this must have been addressed before but I couldn't find a way of searching Archives. I'm using Alpine Linux. Used "apk add kamailio" to install Kamailio 5.5.4-r1 Following the Instructions on https://kamailio.org/docs/tutorials/5.5.x/kamailio-install-guide-git/ At the section for "Creating MySQL database" I modify the file and then run kamdbctl create ERROR: could not load the script in /usr/lib/kamailio//kamctl/kamdbctl.mysql for database engine MYSQL ERROR: database engine not loaded - tried 'MYSQL' I checked the /usr/lib/kamailio//kamctl/ directory and the file wasn't there I suspect I'm missing a module but there aren't any other packages listed for Kamailio at pkgs.alpinelinux.org Thanks for your help P Crossley

3 2

Limit cps per destination gw
by Jon Bonilla (Manwe) 02 Aug '22

02 Aug '22

Hi I'm thinking on having a cps preference for each pstn gw that I can check. I've started thinking in the pike module but it won't allow me to set custom cps per peer. seems that the threshold is global. Ratelimit module needs the queues to be set as modparam, not dynamic AFAICS. Any hints? cheers, Jon -- PekePBX, the multitenant PBX solution https://pekepbx.com

6 8

Sharing Database between three kamailios
by Waqar 40 01 Aug '22

01 Aug '22

I have three Kamailios in three different servers which are dispatching calls to 9 asterisks in three different servers using load balancing. All these Kamailios are using databases installed on that servers. As the entries of the dispatcher table are the same for all the Kamailio, so I want that these Kamailio use a single database installed on one of the servers. All these Kamailios instances should use the same database which is common between them. And also I want these Kamailios to write into the database by creating a table that stores all the active calls in three Kamailios. Is it possible? How can I do it? Please guide me with somewhat explanation as I am not this much expert in Kamailio. Waiting for a quick response. Regards VoIP Engineer Vicky

3 3

Kamailio behind NAT
by Алексей Якимкин 29 Jul '22

29 Jul '22

Hello, I have kamailio in local network behind NAT. Kamailio have one interface eth1 with ip 10.130.0.23 UserAgent - (internet) - (178.0.0.169)router_with_NAT - (LAN) - kamailio+rtpproxy - pbx I made two listeners: listen=udp:10.130.0.23:5070 #to pbx in lan (I don`t want to put via header with 178.0.0.169) listen=udp:10.130.0.23:5060 advertise 178.0.0.169:5060 #to internet (UserAgent need to get via header with 178.0.0.169 ) mhomed = 1 # I think It not useful for my case UserAgent send Register and Invite to 178.0.0.169:5060, Kamailio get it on udp:10.130.0.23:5060 Kamailio Relay it to udp:10.130.0.23:5070 My pbx get requests from udp:10.130.0.23:5070 with via header 10.130.0.23 Responses to UserAgent go from udp:10.130.0.23:5060 with via 178.0.0.169 In RELAY block: if ($Ru == «udp:10.130.0.23:5070») { #set_send_socket(«udp:10.130.0.23:5060»); $fs = «udp:10.130.0.23:5060»; #force_send_socket(«udp:10.130.0.23:5060»); } else { #set_send_socket(«udp:10.130.0.23:5070»); $fs = «udp:10.130.0.23:5070»; } #$fs = «udp:10.130.0.23:5070»; if (!t_relay()) { sl_reply_error(); } route[REGISTRAR] { if ($rd == "mydomain.ru" || $rd == "mydomain2.ru") { set_send_socket("udp:10.130.0.23:5070"); } } It works for requests from UserAgent to PBX. But INVITE from my pbx to UserAgent goes only through udp:10.130.0.23:5070 , Kamailio realy it to internet from udp:10.130.0.23:5070 I get error in syslog: (pv [pv_branch.c:62]: pv_get_branchx_helper(): error accessing branch [0]) I tried set_send_socket(«udp:10.130.0.23:5070»); and $fs = «udp:10.130.0.23:5070»; Why I can`t relay outgoing requests to internet through another socket? -- Best regards, Alex

3 6

[REGISTRAR] Registered. How to match $sut to usrloc received ?
by Richard Edmands 29 Jul '22

29 Jul '22

Hey Kamailio Users, So the scenario is we get the registers. Load them, slightly oddly as we also fill in the received section, not something I usually do. Then when they send an invite, the To and From headers are real phone numbers and for some reason the contact header isn't their username. So to compensate for that I'm trying to match their connection ($sut) using registered, but after a couple of hours I haven't been able to get it to match up. Not sure what I'm missing. ul.dump gets me Received: sip:sipclientpublicip:2353;transport=udp so we know that part is loading $sut correctly into the user location data. modparam("usrloc", "matching_mode", 2) modparam("registrar", "xavp_rcd", "ulrcd") modparam("registrar", "received_avp", "$avp(i:42)") $xavp(regcfg=>match_received) = $sut; if (registered("location","$sut", 2, 1)) { After that block of code $sut is sip: sipclientpublicip:2353;transport=udp which is what's in usrloc for received, but it's not match. There's probably a much smarter way of doing this that I've completely missed, if so then that'd be excellent. But if I'm on the right path somewhat then it would be great to get this working.

2 3

[UAC] How to get the outbound registration status of uac.reg_active?
by Denys Pozniak 28 Jul '22

28 Jul '22

Hello! I have several Kamailio sharing a common uacreg table and use the RPC interface to enable and disable outgoing registration on nodes depending on the cluster status: *kamcmd uac.reg_active 0kamcmd uac.reg_active 1* https://kamailio.org/docs/modules/stable/modules/uac.html#uac.r.uac.reg_act… How can I get the current status of uac outbound registration (to get 0 or 1)? -- BR, Denys Pozniak

2 3

Re: [SR-Users] TLS connection failure. Not sure if system behavior is correct.
by Ahmed Fouad 27 Jul '22

27 Jul '22

Hi, You are currently using TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384 256 Teams stopped TLSv1/ TLSv1.1 and only allowing TLS1.2+ So change your TLS settings to enforce it only method = TLSv1.2+ after restarting kamailio your teams connections should be good.

1 0

ACC CDR accounting
by Oleg Podguyko 27 Jul '22

27 Jul '22

HI I’m trying to get CDR function. I would like to have one CDR for whole call at the syslog. I use: …… loadmodule "db_text.so" loadmodule "dialog.so" loadmodule "acc.so" …….. # -----Dialog module ----- modparam("dialog", "db_mode", 0) # -----ACCounting module ----- modparam("acc", "early_media", 0) modparam("acc", "report_cancels", 1) modparam("acc", "log_facility", "LOG_LOCAL1") modparam("acc", "detect_direction", 0) modparam("acc", "log_level", ACC_LOG_LEVEL) modparam("acc", "log_flag", FLAG_ACC_LOG) modparam("acc", "log_missed_flag", FLAG_ACC_LOG_MISSED) modparam("acc", "failed_transaction_flag", FLAG_ACC_LOG_FAILED) modparam("acc", "log_extra", "ip_src=$si;ip_dst=$avp(ip_dst);sip_from=$fU;sip_to=$tU;ruri_user=$rU;spx_rs=$avp(spx_http_rs)") ## TODO modparam("acc", "cdr_enable", 1) modparam("acc", "cdr_enable_log", 1) modparam("acc", "cdr_facility", "LOG_LOCAL1") request_route { if (is_method("INVITE")) { setflag(FLAG_ACC_LOG); setflag(FLAG_ACC_LOG_MISSED); setflag(FLAG_ACC_LOG_FAILED); } At the kamailio.log I see only transaction for INVITE, but I wait for some CDR for all dialog. Whats wrong in my config? -- -- Олег Подгуйко

3 9

Cannot load usrloc table at startup using DMQ_USRLOC sync feature
by Benedito Marques 25 Jul '22

25 Jul '22

I have an scenario with two kamailios, and no databases. At the first, I authenticate one subscriber successfully and save in memory usrloc: /etc/kamailio # kamailio --version version: kamailio 5.4.4 (x86_64/linux) flags: USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES, TLS_PTHREAD_MUTEX_SHARED ADAPTIVE_WAIT_LOOPS 1024, MAX_RECV_BUFFER_SIZE 262144, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB poll method support: poll, epoll_lt, epoll_et, sigio_rt, select. id: unknown compiled on 16:13:18 Feb 15 2021 with gcc 9.3.0 /etc/kamailio # /etc/kamailio # --- /etc/kamailio # cat /etc/os-release NAME="Alpine Linux" ID=alpine VERSION_ID=3.12.3 PRETTY_NAME="Alpine Linux v3.12" HOME_URL="https://alpinelinux.org/" BUG_REPORT_URL="https://bugs.alpinelinux.org/" --- # Handle SIP registrations route[REGISTRAR] { if (!is_method("REGISTER")) return; if (!save("location","0x05")) { sl_reply_error(); } exit; } -- /etc/kamailio # kamcmd ul.dump { Domains: { Domain: { Domain: location Size: 1024 AoRs: { Info: { AoR: 1014(a)my.domain HashID: -1989102610 Contacts: { Contact: { Address: sip:1014@10.0.0.2:7071;ob Expires: 299 Q: -1.000000 Call-ID: d5cf6d5f293647a59ba64ba996a793b0 CSeq: 43689 User-Agent: MicroSIP/3.20.7 Received: sip: 10.0.0.2:7071 Path: [not set] State: CS_NEW Flags: 1 CFlags: 0 Socket: [not set] Methods: 8159 Ruid: uloc-62d95ca2-3c-1 Instance: [not set] Reg-Id: 0 Server-Id: 0 Tcpconn-Id: -1 Keepalive: 0 Last-Keepalive: 1658412252 KA-Roundtrip: 0 Last-Modified: 1658412252 } } } } Stats: { Records: 1 Max-Slots: 1 } } } } /etc/kamailio # *The problem is*: when I start the second kamailio server, the current usrloc users are not replicated to it, so in the second server the usrloc is empty: /etc/kamailio # kamcmd ul.dump { Domains: { Domain: { Domain: location Size: 1024 AoRs: { } Stats: { Records: 0 Max-Slots: 0 } } } } *The modules loaded:* - dmq.so - dmq_usrloc.so *Params (sync enabled):* modparam("dmq_usrloc", "enable", 1) modparam("dmq_usrloc", "sync", 1) modparam("dmq_usrloc", "usrloc_domain", "location") modparam("dmq_usrloc", "usrloc_delete", 1) modparam("dmq_usrloc", "replicate_socket_info", 0) *Obs*: The DMQ replication is working perfectly. So, if I register another user in server 1, server 2 receives the KDMQ message and the new user appears on usrloc. The real problem is to load pre registered users at startup. *Log messages from second server at startup:* 0(51) DEBUG: <core> [core/sr_module.c:873]: init_mod(): dmq_usrloc 0(51) INFO: dmq_usrloc [dmq_usrloc.c:81]: mod_init(): dmq usrloc replication mode = 1 0(51) DEBUG: <core> [core/sr_module.c:652]: find_mod_export_record(): found export of <ul_bind_usrloc> in module usrloc [/usr/lib/kamailio/modules/usrloc.so] 0(51) DEBUG: <core> [core/sr_module.c:652]: find_mod_export_record(): found export of <bind_dmq> in module dmq [/usr/lib/kamailio/modules/dmq.so] 0(51) DEBUG: dmq_usrloc [usrloc_sync.c:286]: usrloc_dmq_initialize(): loaded dmq api 0(51) DEBUG: dmq_usrloc [usrloc_sync.c:299]: usrloc_dmq_initialize(): dmq peer registered 0(51) DEBUG: dmq_usrloc [dmq_usrloc.c:111]: mod_init(): dmq_usrloc initialized 0(51) DEBUG: <core> [core/sr_module.c:804]: init_mod_child(): idx 0 rank -127: dmq_usrloc [main] 0(51) DEBUG: dmq_usrloc [dmq_usrloc.c:127]: child_init(): child_init PROC_INIT 7(62) DEBUG: dmq_usrloc [usrloc_sync.c:552]: usrloc_dmq_request_sync(): requesting sync from dmq peers 0(51) DEBUG: <core> [core/sr_module.c:804]: init_mod_child(): idx 0 rank 0: dialog [main] 7(62) DEBUG: dmq_usrloc [usrloc_sync.c:568]: usrloc_dmq_request_sync(): sending serialized data {"action":3} 7(62) DEBUG: dmq_usrloc [usrloc_sync.c:317]: usrloc_dmq_send(): sending dmq broadcast... 7(62) DEBUG: dmq [dmq_funcs.c:166]: bcast_dmq_message1(): skipping node sip:10.0.2.38:5090 7(62) DEBUG: dmq [dmq_funcs.c:166]: bcast_dmq_message1(): skipping node sip:10.0.2.30:5090 7(62) DEBUG: dmq [dmq_funcs.c:166]: bcast_dmq_message1(): skipping node sip:0.0.0.0:5090 *List nodes at SERVER 1:* /etc/kamailio # kamcmd dmq.list_nodes { host: 10.0.1.36 port: 5090 resolved_ip: 10.0.1.36 status: active last_notification: 0 local: 0 } { host: 10.0.1.35 port: 5090 resolved_ip: 10.0.1.35 status: active last_notification: 0 local: 0 } { host: 0.0.0.0 port: 5090 resolved_ip: 0.0.0.0 status: active last_notification: 0 local: 1 } *List nodes at SERVER 2:* /etc/kamailio # kamcmd dmq.list_nodes { host: 10.0.1.35 port: 5090 resolved_ip: 10.0.1.35 status: active last_notification: 0 local: 0 } { host: 10.0.1.36 port: 5090 resolved_ip: 10.0.1.36 status: active last_notification: 0 local: 0 } { host: 0.0.0.0 port: 5090 resolved_ip: 0.0.0.0 status: active last_notification: 0 local: 1 } -- Att, Benedito Marques

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users