As part of a project, I have installed a CentOS 6 test system (a virtual machine) with Asterisk 11.7.0 and Kamailio 4.1.1 downloaded from http://download.opensuse.org/repositories/home:/kamailio:/telephony/CentOS_CentOS-6/x86_64/. I am trying to setup a
combination of Kamailio and Asterisk that will route SIP calls between all the configured networks in the test setup, in addition to being capable of using Asterisk in order to handle PSTN and IAX2 calls.
I am using the following online guide to modify my kamailio.cfg:
http://kb.asipto.com/asterisk:realtime:kamailio-4.0.x-asterisk-11.3.0-astdb .
Based on this, I generated the attached patch for my Kamailio configuration
My test setup has the following network interfaces:
eth0: 10.1.0.3, on network 10.1.0.0/24
eth1: 192.168.5.18, on network 192.168.0.0/16
eth2: 10.0.0.2, on network 10.0.0.0/24
lo: 127.0.0.1, on network 127.0.0.0/8
I first configured Asterisk with SIP realtime support (with no Kamailio), and tested that all configured accounts could register from all interfaces, and that Asterisk could properly route media between any two disjoint networks. After installing Kamailio,
the guide called for disabling Asterisk SIP authentication by setting passwords to NULL, and moving Asterisk SIP to a different port (I chose 5080) so that Asterisk and Kamailio could run on the same machine. At this point, the SIP clients (one softphone
and one VoIP phone) can now register at port 5080 without authentication.
In the process of changing my Kamailio configuration according to the attached patch, the guide says that I should configure the IP of the network interface as the value of asterisk.bindip and kamailio.bindip. After performing all required changes,
Kamailio does take over authentication at the default port of 5060. Testing shows that for all SIP clients with IPs belonging to the same network as the configured asterisk.bindip, both registration and media exchange work correctly, and that the SIP
clients are still capable of calling into the Asterisk dialplan, and therefore, routing into Asterisk resources.
For SIP clients in disjoint networks, the failure mode depends on whether
mhomed is enabled or disabled in kamailio.cfg.
For mhomed=0 (or unset), I have the following situation between the two SIP clients (one
at 10.1.0.1, the other at 10.0.0.3), as shown by "sip show peers" in Asterisk
(when asterisk.bindip is set to 192.168.5.18):
Privilege escalation protection disabled!
See https://wiki.asterisk.org/wiki/x/1gKfAQ for more details.
Name/username Host Dyn Forcerport ACL Port Status Description
Realtime
gatitoscomx64am_100/gatit 10.1.0.3 D N A 5060 OK (16 ms)
Cached RT
gatitoscomx64am_101/gatit 10.0.0.2 D N A 5060 OK (36 ms)
Cached RT
gatitoscomx64am_IM101 (Unspecified) D N A 0 UNREACHABLE
Cached RT
3 sip peers [Monitored: 2 online, 1 offline Unmonitored: 0 online, 0 offline]
If I try to call from one SIP client to an extension in the Asterisk dialplan that does NOT map to a SIP client in a disjoint network, the media exchange works (with negotiatied media IP in the same network as the SIP client), regardless of whether the
calling client belongs in the same network as asterisk.bindip. If I try to call from the same SIP client to an extension that maps to a SIP client in a disjoint network, the call fails, and I get the spoken message about the user at extension such-and-such
being unavailable. Additionally, I get the following error message in the Asterisk logs:
[Feb 25 16:53:14] NOTICE[13807][C-00000003] chan_sip.c: Call from
'gatitoscomx64am_101' (10.0.0.2:5060) to extension 'gatitoscomx64am_101'
rejected because extension not found in context 'gatitoscomx64am-from-internal'.
For mhomed=1, the output of "sip show peers" changes to the following (when
asterisk.bindip is set to 192.168.5.18):
Privilege escalation protection disabled!
See https://wiki.asterisk.org/wiki/x/1gKfAQ for more details.
Name/username Host Dyn Forcerport ACL Port Status Description
Realtime
gatitoscomx64am_100/gatit 192.168.5.18 D N A 5060 OK (19 ms)
Cached RT
gatitoscomx64am_101/gatit 192.168.5.18 D N A 5060 OK (34 ms)
Cached RT
gatitoscomx64am_IM101 (Unspecified) D N A 0 UNREACHABLE
Cached RT
3 sip peers [Monitored: 2 online, 1 offline Unmonitored: 0 online, 0 offline]
From wireshark sniffing, I can see that the SDP payload sent from the client to Kamailio contains the IP address of the client, which is accessible by both Kamailio and Asterisk. However, the SDP payload in the OK response sent back to the client contains
a media port with the IP address of asterisk.bindip (the one that appears in the "Host" column in the "sip show peers" report), not the IP address of the interface that received the INVITE. This results in broken media negotiation for all SIP clients
belonging to networks other than the one that contains asterisk.bindip.
In either case, I have to hardcode an IP address in kamailio.cfg, which is not satisfactory. IPs assigned to interfaces can and do change, especially if the interface is managed with DHCP. To escape this, I tried setting asterisk.bindip to 127.0.0.1, but
since apparently localhost is also a disjoint network, all of the above described problems apply.
Related to these issues, I am not satisfied with leaving Asterisk running unauthenticated SIP at the nonstandard port. Somebody suggested blocking the port with iptables, but I do not want to rely on this alone. I tried setting bindaddr=127.0.0.1 so that
only Kamailio gets to talk to Asterisk, but this also has the side effect of restricting the media negotiation to localhost only.
I am asking for help in building a Kamailio/Asterisk configuration that will support all of the networks and route media between all of them, just as if Asterisk were the only program running. Ideally, the configuration should not encode the current IP of
any interface (except, maybe, localhost). What is the official name (if any) for the setup I am describing above? Does it have a standard setup procedure? How is Asterisk secured so that clients cannot bypass authentication using the Asterisk SIP port
directly?
--- kamailio.cfg.orig 2014-02-19 17:22:25.040166479 -0500
+++ kamailio.cfg 2014-02-25 15:39:38.239651905 -0500
@@ -1,4 +1,11 @@
#!KAMAILIO
+
+#!define WITH_ODBC
+#!define WITH_AUTH
+#!define WITH_USRLOCDB
+#!define WITH_ASTERISK
+#!define WITH_PRESENCE
+
#
# Kamailio (OpenSER) SIP Server v4.1 - default configuration script
# - web: http://www.kamailio.org
@@ -105,6 +112,14 @@
####### Defined Values #########
# *** Value defines - IDs used later in config
+#!ifdef WITH_ODBC
+#!ifndef DBURL
+#!define DBURL "unixodbc:///kamailio-connector"
+#!endif
+#!ifdef WITH_ASTERISK
+#!define DBASTURL "unixodbc:///elxpbx-connector"
+#!endif
+#!endif
#!ifdef WITH_MYSQL
# - database URL - used to connect to database server by modules such
# as: auth_db, acc, usrloc, a.s.o.
@@ -203,6 +218,22 @@
voicemail.srv_port = "5060" desc "VoiceMail Port"
#!endif
+
+#!ifdef WITH_ASTERISK
+#asterisk.bindip = "127.0.0.1" desc "Asterisk IP Address"
+asterisk.bindip = "192.168.5.18" desc "Asterisk IP Address"
+#asterisk.bindip = "10.1.0.3" desc "Asterisk IP Address"
+#asterisk.bindip = "10.0.0.2" desc "Asterisk IP Address"
+asterisk.bindport = "5080" desc "Asterisk Port"
+#kamailio.bindip = "127.0.0.1" desc "Kamailio IP Address"
+kamailio.bindip = "192.168.5.18" desc "Kamailio IP Address"
+#kamailio.bindip = "10.1.0.3" desc "Kamailio IP Address"
+#kamailio.bindip = "10.0.0.2" desc "Kamailio IP Address"
+kamailio.bindport = "5060" desc "Kamailio Port"
+#!endif
+
+mhomed = 1
+
####### Modules Section ########
# set paths to location of modules (to sources or installation folders)
@@ -216,6 +247,10 @@
loadmodule "db_mysql.so"
#!endif
+#!ifdef WITH_ODBC
+loadmodule "db_unixodbc.so"
+#!endif
+
loadmodule "mi_fifo.so"
loadmodule "kex.so"
loadmodule "corex.so"
@@ -283,6 +318,10 @@
loadmodule "debugger.so"
#!endif
+#!ifdef WITH_ASTERISK
+loadmodule "uac.so"
+#!endif
+
# ----------------- setting module-specific parameters ---------------
@@ -303,8 +342,11 @@
# add value to ;lr param to cope with most of the UAs
modparam("rr", "enable_full_lr", 1)
# do not append from tag to the RR (no need for this script)
+#!ifdef WITH_ASTERISK
+modparam("rr", "append_fromtag", 1)
+#!else
modparam("rr", "append_fromtag", 0)
-
+#!endif
# ----- registrar params -----
modparam("registrar", "method_filtering", 1)
@@ -356,11 +398,19 @@
# ----- auth_db params -----
#!ifdef WITH_AUTH
-modparam("auth_db", "db_url", DBURL)
modparam("auth_db", "calculate_ha1", yes)
-modparam("auth_db", "password_column", "password")
modparam("auth_db", "load_credentials", "")
+
+#!ifdef WITH_ASTERISK
+modparam("auth_db", "user_column", "name")
+modparam("auth_db", "password_column", "sippasswd")
+modparam("auth_db", "db_url", DBASTURL)
+modparam("auth_db", "version_table", 0)
+#!else
+modparam("auth_db", "db_url", DBURL)
+modparam("auth_db", "password_column", "password")
modparam("auth_db", "use_domain", MULTIDOMAIN)
+#!endif
# ----- permissions params -----
#!ifdef WITH_IPAUTH
@@ -629,6 +679,10 @@
if (!save("location"))
sl_reply_error();
+#!ifdef WITH_ASTERISK
+ route(REGFWD);
+#!endif
+
exit;
}
}
@@ -649,6 +703,16 @@
route(SIPOUT);
#!endif
+#!ifdef WITH_ASTERISK
+ if(is_method("INVITE") && (!route(FROMASTERISK))) {
+ # if new call from out there - send to Asterisk
+ # - non-INVITE request are routed directly by Kamailio
+ # - traffic from Asterisk is routed also directy by Kamailio
+ route(TOASTERISK);
+ exit;
+ }
+#!endif
+
$avp(oexten) = $rU;
if (!lookup("location")) {
$var(rc) = $rc;
@@ -718,6 +782,12 @@
route[AUTH] {
#!ifdef WITH_AUTH
+#!ifdef WITH_ASTERISK
+ # do not auth traffic from Asterisk - trusted!
+ if(route(FROMASTERISK))
+ return;
+#!endif
+
#!ifdef WITH_IPAUTH
if((!is_method("REGISTER")) && allow_source_address())
{
@@ -729,7 +799,11 @@
if (is_method("REGISTER") || from_uri==myself)
{
# authenticate requests
+#!ifdef WITH_ASTERISK
+ if (!auth_check("$fd", "sip", "1")) {
+#!else
if (!auth_check("$fd", "subscriber", "1")) {
+#!endif
auth_challenge("$fd", "0");
exit;
}
@@ -939,3 +1013,44 @@
}
#!endif
}
+
+#!ifdef WITH_ASTERISK
+# Test if coming from Asterisk
+route[FROMASTERISK] {
+ if($si==$sel(cfg_get.asterisk.bindip)
+ && $sp==$sel(cfg_get.asterisk.bindport))
+ return 1;
+ return -1;
+}
+
+# Send to Asterisk
+route[TOASTERISK] {
+ $du = "sip:" + $sel(cfg_get.asterisk.bindip) + ":"
+ + $sel(cfg_get.asterisk.bindport);
+ route(RELAY);
+ exit;
+}
+
+# Forward REGISTER to Asterisk
+route[REGFWD] {
+ if(!is_method("REGISTER"))
+ {
+ return;
+ }
+ $var(rip) = $sel(cfg_get.asterisk.bindip);
+# $uac_req(sock)="udp:" + $sel(cfg_get.kamailio.bindip) + ":" + $sel(cfg_get.kamailio.bindport);
+ $uac_req(method)="REGISTER";
+ $uac_req(ruri)="sip:" + $var(rip) + ":" + $sel(cfg_get.asterisk.bindport);
+ $uac_req(furi)="sip:" + $au + "@" + $var(rip) + ":5060";
+ $uac_req(turi)="sip:" + $au + "@" + $var(rip) + ":5060";
+ $uac_req(hdrs)="Contact: <sip:" + $au + "@"
+ + $sel(cfg_get.kamailio.bindip)
+ + ":" + $sel(cfg_get.kamailio.bindport) + ">\r\n";
+ if($sel(contact.expires) != $null)
+ $uac_req(hdrs)= $uac_req(hdrs) + "Expires: " + $sel(contact.expires) + "\r\n";
+ else
+ $uac_req(hdrs)= $uac_req(hdrs) + "Expires: " + $hdr(Expires) + "\r\n";
+ uac_req_send();
+}
+#!endif
+
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users@lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
