Hello guys,
We're seeing corner cases where the following happens:
On proxy-ws - IP1:PORT1 connects via websocket from Client1 - Registration happens on an upstream kamailio - for any reason, the TCP socket closes or times out. - IP1:PORT1 (same IP:PORT combination) connects via websocket from Client2 - Registration happens on an upstream kamailio
Now a call comes in to Client1. Because the first connection was never cleaned up, it is sent to the proxy-ws and the proxy will send it to the IP1:PORT1 where Client2 is connected.
Short story, proxy-ws doesn't check the IP1:PORT1 where it is sending the INVITE is the actual client it is supposed to be sending...
It seems that when a socket is closed, the mapping IP:PORT to Address (i.e.: sip:d4f27e34@994f31243be9.invalid;transport=ws) doesn't seem to be cleared... is this by design?
Thanks!
Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Hello Alex,
Thanks for replying. Yeah that’s exactly our concern.
David
On Wed, 1 Mar 2023 at 01:33, Alex Balashov abalashov@evaristesys.com wrote:
Hi,
The proxy-ws has no way of knowing which client is registered; all it can do is consume the RURI as received, and map it to an existing connection from IP1:PORT1.
I think it's vital to get to the bottom of why the first connection was never "cleaned up". When the socket closes, it should be cleaned up, and rather immediately. What's going on there?
-- Alex
— Sent from mobile, apologies for brevity and errors.
On Feb 28, 2023, at 5:40 PM, David Villasmil < david.villasmil.work@gmail.com> wrote:
Hello guys,
We're seeing corner cases where the following happens:
On proxy-ws
- IP1:PORT1 connects via websocket from Client1
- Registration happens on an upstream kamailio
- for any reason, the TCP socket closes or times out.
- IP1:PORT1 (same IP:PORT combination) connects via websocket from Client2
- Registration happens on an upstream kamailio
Now a call comes in to Client1. Because the first connection was never cleaned up, it is sent to the proxy-ws and the proxy will send it to the IP1:PORT1 where Client2 is connected.
Short story, proxy-ws doesn't check the IP1:PORT1 where it is sending the INVITE is the actual client it is supposed to be sending...
It seems that when a socket is closed, the mapping IP:PORT to Address (i.e.: sip:d4f27e34@994f31243be9.invalid;transport=ws) doesn't seem to be cleared... is this by design?
Thanks!
Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
Hello,
are the endpoints connecting directly to Kamailio, or is there a http proxy/tcp loadbalancer in front?
It is pretty unlikely another endpoint to get same source ip and port, unless is a middle proxy that reuses the connection. I met the latter case in the past, but not the former.
Cheers, Daniel
On 01.03.23 09:49, David Villasmil wrote:
Hello Alex,
Thanks for replying. Yeah that’s exactly our concern.
David
On Wed, 1 Mar 2023 at 01:33, Alex Balashov abalashov@evaristesys.com wrote:
Hi, The proxy-ws has no way of knowing which client is registered; all it can do is consume the RURI as received, and map it to an existing connection from IP1:PORT1. I think it's vital to get to the bottom of why the first connection was never "cleaned up". When the socket closes, it should be cleaned up, and rather immediately. What's going on there? -- Alex — Sent from mobile, apologies for brevity and errors.On Feb 28, 2023, at 5:40 PM, David Villasmil <david.villasmil.work@gmail.com> wrote: Hello guys, We're seeing corner cases where the following happens: On proxy-ws - IP1:PORT1 connects via websocket from Client1 - Registration happens on an upstream kamailio - for any reason, the TCP socket closes or times out. - IP1:PORT1 (same IP:PORT combination) connects via websocket from Client2 - Registration happens on an upstream kamailio Now a call comes in to Client1. Because the first connection was never cleaned up, it is sent to the proxy-ws and the proxy will send it to the IP1:PORT1 where Client2 is connected. Short story, proxy-ws doesn't check the IP1:PORT1 where it is sending the INVITE is the actual client it is supposed to be sending... It seems that when a socket is closed, the mapping IP:PORT to Address (i.e.: sip:d4f27e34@994f31243be9.invalid;transport=ws) doesn't seem to be cleared... is this by design? Thanks! Regards, David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:__________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:-- Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
Hello Daniel,
Yep sir; there an AWS load-balancer. But regardless, shouldn’t the mapping get cleared immediately?
Thanks
David
On Wed, 1 Mar 2023 at 11:28, Daniel-Constantin Mierla miconda@gmail.com wrote:
Hello,
are the endpoints connecting directly to Kamailio, or is there a http proxy/tcp loadbalancer in front?
It is pretty unlikely another endpoint to get same source ip and port, unless is a middle proxy that reuses the connection. I met the latter case in the past, but not the former.
Cheers, Daniel On 01.03.23 09:49, David Villasmil wrote:
Hello Alex,
Thanks for replying. Yeah that’s exactly our concern.
David
On Wed, 1 Mar 2023 at 01:33, Alex Balashov abalashov@evaristesys.com wrote:
Hi,
The proxy-ws has no way of knowing which client is registered; all it can do is consume the RURI as received, and map it to an existing connection from IP1:PORT1.
I think it's vital to get to the bottom of why the first connection was never "cleaned up". When the socket closes, it should be cleaned up, and rather immediately. What's going on there?
-- Alex
— Sent from mobile, apologies for brevity and errors.
On Feb 28, 2023, at 5:40 PM, David Villasmil < david.villasmil.work@gmail.com> wrote:
Hello guys,
We're seeing corner cases where the following happens:
On proxy-ws
- IP1:PORT1 connects via websocket from Client1
- Registration happens on an upstream kamailio
- for any reason, the TCP socket closes or times out.
- IP1:PORT1 (same IP:PORT combination) connects via websocket from Client2
- Registration happens on an upstream kamailio
Now a call comes in to Client1. Because the first connection was never cleaned up, it is sent to the proxy-ws and the proxy will send it to the IP1:PORT1 where Client2 is connected.
Short story, proxy-ws doesn't check the IP1:PORT1 where it is sending the INVITE is the actual client it is supposed to be sending...
It seems that when a socket is closed, the mapping IP:PORT to Address (i.e.: sip:d4f27e34@994f31243be9.invalid;transport=ws) doesn't seem to be cleared... is this by design?
Thanks!
Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
-- Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
-- Daniel-Constantin Mierla -- www.asipto.comwww.twitter.com/miconda -- www.linkedin.com/in/miconda Kamailio World Conference - June 5-7, 2023 - www.kamailioworld.com Kamailio Advanced Training - Online - March 27-30, 2023 - www.asipto.com
--
Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
That’s exactly what’s happening, AWS reuses the ip:port source.
I understand it was very unlikely the ip:port would be reused, but nowadays kamailio is more and more used on the cloud with a load balancer in front.
Regards
David
On Wed, 1 Mar 2023 at 14:40, David Villasmil david.villasmil.work@gmail.com wrote:
Hello Daniel,
Yep sir; there an AWS load-balancer. But regardless, shouldn’t the mapping get cleared immediately?
Thanks
David
On Wed, 1 Mar 2023 at 11:28, Daniel-Constantin Mierla miconda@gmail.com wrote:
Hello,
are the endpoints connecting directly to Kamailio, or is there a http proxy/tcp loadbalancer in front?
It is pretty unlikely another endpoint to get same source ip and port, unless is a middle proxy that reuses the connection. I met the latter case in the past, but not the former.
Cheers, Daniel On 01.03.23 09:49, David Villasmil wrote:
Hello Alex,
Thanks for replying. Yeah that’s exactly our concern.
David
On Wed, 1 Mar 2023 at 01:33, Alex Balashov abalashov@evaristesys.com wrote:
Hi,
The proxy-ws has no way of knowing which client is registered; all it can do is consume the RURI as received, and map it to an existing connection from IP1:PORT1.
I think it's vital to get to the bottom of why the first connection was never "cleaned up". When the socket closes, it should be cleaned up, and rather immediately. What's going on there?
-- Alex
— Sent from mobile, apologies for brevity and errors.
On Feb 28, 2023, at 5:40 PM, David Villasmil < david.villasmil.work@gmail.com> wrote:
Hello guys,
We're seeing corner cases where the following happens:
On proxy-ws
- IP1:PORT1 connects via websocket from Client1
- Registration happens on an upstream kamailio
- for any reason, the TCP socket closes or times out.
- IP1:PORT1 (same IP:PORT combination) connects via websocket from
Client2
- Registration happens on an upstream kamailio
Now a call comes in to Client1. Because the first connection was never cleaned up, it is sent to the proxy-ws and the proxy will send it to the IP1:PORT1 where Client2 is connected.
Short story, proxy-ws doesn't check the IP1:PORT1 where it is sending the INVITE is the actual client it is supposed to be sending...
It seems that when a socket is closed, the mapping IP:PORT to Address (i.e.: sip:d4f27e34@994f31243be9.invalid;transport=ws) doesn't seem to be cleared... is this by design?
Thanks!
Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
-- Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
-- Daniel-Constantin Mierla -- www.asipto.comwww.twitter.com/miconda -- www.linkedin.com/in/miconda Kamailio World Conference - June 5-7, 2023 - www.kamailioworld.com Kamailio Advanced Training - Online - March 27-30, 2023 - www.asipto.com
--
Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Hello,
I could smell it from Mars :-) !
SIP endpoint is bound to contact address, not to a transport layer connection. For example, if you have a SIP edge proxy (SBC) in front of SIP registrar server, between edge proxy and registrar is usually one (trunk) connection and all registrations coming to edge proxy and forwarded (with Path header) on that connection. If the connection is closed (eg, registrar restarted), there is no problem for registrar to connect back to edge proxy when it needs and all works fine, contacts do not have to be erased.
As a matter of fact, even the end point can register, close the connection, then wait for server to connect to the address provided in the registration contact address. This is what SIP specify, which obviously doesn't really work in the case of NAT'ed endpoint.
Anyhow, look at the modparams of usrloc/registrar -- some of them can help deal better with such cases.
Cheers, Daniel
On 01.03.23 14:40, David Villasmil wrote:
Hello Daniel,
Yep sir; there an AWS load-balancer. But regardless, shouldn’t the mapping get cleared immediately?
Thanks
David
On Wed, 1 Mar 2023 at 11:28, Daniel-Constantin Mierla miconda@gmail.com wrote:
Hello, are the endpoints connecting directly to Kamailio, or is there a http proxy/tcp loadbalancer in front? It is pretty unlikely another endpoint to get same source ip and port, unless is a middle proxy that reuses the connection. I met the latter case in the past, but not the former. Cheers, Daniel On 01.03.23 09:49, David Villasmil wrote:Hello Alex, Thanks for replying. Yeah that’s exactly our concern. David On Wed, 1 Mar 2023 at 01:33, Alex Balashov <abalashov@evaristesys.com> wrote: Hi, The proxy-ws has no way of knowing which client is registered; all it can do is consume the RURI as received, and map it to an existing connection from IP1:PORT1. I think it's vital to get to the bottom of why the first connection was never "cleaned up". When the socket closes, it should be cleaned up, and rather immediately. What's going on there? -- Alex — Sent from mobile, apologies for brevity and errors.On Feb 28, 2023, at 5:40 PM, David Villasmil <david.villasmil.work@gmail.com> wrote: Hello guys, We're seeing corner cases where the following happens: On proxy-ws - IP1:PORT1 connects via websocket from Client1 - Registration happens on an upstream kamailio - for any reason, the TCP socket closes or times out. - IP1:PORT1 (same IP:PORT combination) connects via websocket from Client2 - Registration happens on an upstream kamailio Now a call comes in to Client1. Because the first connection was never cleaned up, it is sent to the proxy-ws and the proxy will send it to the IP1:PORT1 where Client2 is connected. Short story, proxy-ws doesn't check the IP1:PORT1 where it is sending the INVITE is the actual client it is supposed to be sending... It seems that when a socket is closed, the mapping IP:PORT to Address (i.e.: sip:d4f27e34@994f31243be9.invalid;transport=ws) doesn't seem to be cleared... is this by design? Thanks! Regards, David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:__________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe: -- Regards, David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337 __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:-- Daniel-Constantin Mierla -- www.asipto.com <http://www.asipto.com> www.twitter.com/miconda <http://www.twitter.com/miconda> -- www.linkedin.com/in/miconda <http://www.linkedin.com/in/miconda> Kamailio World Conference - June 5-7, 2023 - www.kamailioworld.com <http://www.kamailioworld.com> Kamailio Advanced Training - Online - March 27-30, 2023 - www.asipto.com <http://www.asipto.com>-- Regards,
David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
-
Alex Balashov -
Daniel-Constantin Mierla -
David Villasmil