Using Kamailio for Scalability and Security. Fred Posner, VoIP Engineer LOD Communications The Palner

Transcription

1 Using Kamailio for Scalability and Security Fred Posner, VoIP Engineer LOD Communications The Palner

2 What the what? Kah Mah Illie Oh Kah Mylie Oh Kamailio

3 Who am I? Fred VoIP Engineer Florida based Kamailio, Asterisk, and other Open Source projects

4 What is Kamailio? Open Source SIP Server Thousands of call setups per second GPL

5 What is Kamailio? SIP Proxy server SIP Registrar server SIP Location server SIP Application server SIP Dispatcher server SIP Websocket server

6 What isn t Kamailio? SIP Phone Media Server B2BUA Can you name an open source project that is all of these?

7

8 Why Kamailio? Fast Flexible Reliable

9 Key Features Modular Scalability and Flexible by design IPv4, IPv6 TLS/TCP/UDP WebSocket NAT Traversal JSON, XMLRPC, HTTP APIs SQL & NOSQL Embedded Interpreters (Lua, Java, Perl, Python, more) Load Balancing LCR Asynchronous processing (TCP / TLS, SIP Routing), external API and mucho mucho mas

10 Modular Design

11 Most Common Deployment

12 Scalable Deployment

13 There is no security on this earth. Only opportunity. Douglas MacArthur

14

15 The Problem Theft of Service Denial of Service High CPU / Memory / Bandwidth Phone Bill

16 Filter User Agent if (is_method("invite REGISTER")) { if($ua =~ "(friendly-scanner sipvicious)") { xlog("l_info","script kiddie - bye"); exit; } } if (is_method("invite REGISTER")) { if($ua =~ "(friendly-scanner sipvicious)") { xlog("l_info","script kiddie - bye"); sl_send_reply("200","ok"); exit; } }

17 Core

18 if ($ua =~ "(friendly-scanner sipvicious sipcli)") { xlog("l_info","script kiddies from IP:$si:$sp - $ua \n"); exit; } # - ignore requests with sql injection if($au =~ "(\=) (\-\-) (') (\#) (\%27) (\%24)" and $au!= $null) { xlog("l_info","[r-reqinit:$ci] sql injection from IP:$si:$sp - $au \n"); exit; } if (!mf_process_maxfwd_header("10")) { xlog("l_info","[r-reqinit:$ci] Too Many Hops (IP:$si:$sp)\n"); sl_send_reply("483","too Many Hops RI1"); exit; } if(is_method("options") && uri==myself && $ru==$null) { sl_send_reply( 200,"Thank you for flying Kamailio ); exit; } if(!sanity_check("1511", "7")) { xlog("l_info","malformed SIP message from $si:$sp ru = $ru \n"); exit; }

19 PIKE

20 loadmodule "pike.so"... # PIKE params modparam("pike", "sampling_time_unit", 2) modparam("pike", "reqs_density_per_unit", 24) modparam("pike", "remove_latency", 4)... # check if flood settings hit (and block) if (!pike_check_req()) { xlog("l_info","blocking $rm from $fu (IP:$si:$sp)\n"); $sht(ipban=>$si) = 1; sl_send_reply("200","ok"); exit; }

21 HTABLE

22 If you re not using HTABLE, you re doing something

23 HTABLE Hash Table Module Stored in shared memory Custom cache system Replication via DMQ

24 loadmodule "htable.so"... # HTABLE params # ip ban htable with autoexpire after 5 minutes modparam("htable", htable","ipban=>size=8;autoexpire=300;") modparam("htable", "htable", "regs=>size=8;initval=0;autoexpire=180;")... $sht(ipban=>$si) = 1; $sht(regs=>$si) = $sht(regs=>$si) + 1;

25 HTABLE EXAMPLES if($sht(ipban=>$si)!=$null) { if (!is_method("register")) { sl_send_reply("200","ok"); } else { sl_send_reply("401","unauthorized RQ"); } exit; }... $sht(regs=>$si) = $sht(regs=>$si) + 1; if($sht(regs=>$si)>5) { xlog("l_info","more than 5 regs from $si \n"); if(src_ip!=myself) { $sht(ipban=>$si) = 1; } send_reply(401, "Unauthorized AU"); exit; }

26 RATELIMIT PIPELIMIT

27 loadmodule "pipelimit.so"... # PIPELIMIT params modparam("pipelimit", "reply_code", 503) modparam("pipelimit", "reply_reason", "You are doing too much.") modparam("pipelimit", "timer_interval", PIPESECONDS)... #limit all IP to registrations of 3 per sec $var(plreglimit) = 3 * PIPESECONDS; if (!pl_check("$si", "TAILDROP", "$var(plreglimit)")) { xlog("l_info","regs per sec exceeded $var(plreglimit) \n"); pl_drop( PIPESECONDS"); exit; }

28 PERMISSIONS

29 loadmodule "permissions.so"... # PERMISSIONS params modparam("permissions", "db_url", DBURL) modparam("permissions", "db_mode", 1)... #only allow group 688 to make OUTbound calls if(!allow_source_address("688")) { #block unauth accessing 2cps or higher $var(plreglimit) = 2 * PIPESECONDS; if (!pl_check("$si", "TAILDROP", "$var(plreglimit)")) { xlog("l_info","[r-pstn:$ci]: Unath outbound exceeded $var(plreglimit) \n"); route(kill); } sl_send_reply("403","not relaying PSTN1"); exit; }

30 TLS

31 loadmodule "tls.so"... # tls params modparam("tls", "config", "/usr/local/etc/kamailio/tls.cfg")... [server:default] method = TLSv1 verify_certificate = no require_certificate = no private_key = /usr/local/etc/kamailio/privkey1.pem certificate = /usr/local/etc/kamailio/fullchain1.pem... listen=tls: :5061 advertise PUBLICIP:5061 #-- TLS Socket enable_tls = yes

32 TOPOH TOPOS

33 loadmodule "topoh.so"... # TOPOH params modparam("topoh", "mask_key", "LetsMakeAPassword") modparam("topoh", "mask_ip", " ") modparam("topoh", mask_callid", 1) modparam("topoh", "uparam_name", "line") modparam("topoh", "uparam_prefix", "sr-") modparam("topoh", "vparam_name", "branch") modparam("topoh", "vparam_prefix", "z9hg4bksr-") modparam("topoh", "callid_prefix", "!!:") modparam("topoh", "sanity_checks", 1)...

34 SIP Edge Proxy SBC Since 2001 NAT RTP Proxy (rtpproxy/rtpengine) TOPOH Module (topology hiding) Accounting

35 Scale SIP/RTC Load Balancing Dispatcher Module Various Algorithms Node monitoring Re-route of failures

36 Scaled Deployment

37 Scaled Deployment PSTN Queue Voic

38 DISPATCHER

39 loadmodule "dispatcher.so"... # dispatcher params modparam("dispatcher", "db_url", DBURL) modparam("dispatcher", "table_name", "dispatcher") modparam("dispatcher", "flags", 2) modparam("dispatcher", "dst_avp", "$avp(dsdst)") modparam("dispatcher", "grp_avp", "$avp(dsgrp)") modparam("dispatcher", "cnt_avp", "$avp(dscnt)") modparam("dispatcher", "dstid_avp", "$avp(dsdstid)") modparam("dispatcher", "sock_avp", "$avp(dssocket)") modparam("dispatcher", "attrs_avp", "$avp(dsattrs)") modparam("dispatcher", "ds_hash_size", 3) modparam("dispatcher", "force_dst", 1) modparam("dispatcher", "ds_ping_interval", 20) modparam("dispatcher", "ds_ping_from", sip:pinger@yourdomain") modparam("dispatcher", "ds_probing_mode", 2) modparam("dispatcher", "ds_probing_threshold", 2) modparam("dispatcher", "ds_ping_reply_codes", "class=2;code=480;code=404")... if(!ds_select_dst("$avp(dispset)", "8")) { xlog("l_info","no destination available for set $avp(dispset) - send 404.\n"); send_reply("404", "No destination PSTN2"); exit; }

40 REGISTRAR

41 REGISTRAR Offload registrations from Asterisk MySQL, LDAP, etc. Mid-registrar services

42 Mid-Registrar since docs/modules/stable/ modules/uac.html remote registrar even handles R-URI modifications if(uac_reg_lookup("$ru", "$ru")) { xlog("request from a remote SIP provider [$ou => $ru]\n"); } lookup("location");

43 API Routing http_client / http_async_client evapi stable/modules/evapi.html rtjson stable/modules/rtjson.html nodejs

44 It s About Power Flexibility in language, protocol, format, and controllers Lua, Python, JavaScript, Perl, Squirrel, etc HTTP, RPC, EVAPI, SIP, etc XML, JSON, custom node+js, SQL, php, Custom apps, etc Power to Scale

45 See you in Berlin! kamailioworld.com kamailio.org

46 Ask a good question Get a cookie. Fred qxork.com