# kamailio.cfg 片段
listen=udp:0.0.0.0:5060
listen=tcp:0.0.0.0:5060
listen=tls:0.0.0.0:5061 advertise PUBLIC_IP:5061
listen=ws:0.0.0.0:5066
listen=wss:0.0.0.0:5067 advertise PUBLIC_IP:5067

# TLS 参数 (建议使用 Let's Encrypt 或企业 CA 签发证书)
modparam("tls", "config", "/etc/kamailio/tls.cfg")
# tls.cfg 示例:
# [server:default]
# method = TLSv1.2
# certificate = /etc/kamailio/certs/server.pem
# private_key = /etc/kamailio/certs/server.key
# verify_peer = no
# require_client_certificate = no

# 请求路由入口 request_route
request_route {
    # 1. 基础校验与 NAT 检测
    if (!sanity_check("1511", "7")) { sl_send_reply("400", "Bad Request"); exit; }
    if (nat_uac_test("19")) { force_rport(); fix_nated_contact(); }
    
    # 2. WebSocket 专用处理 (保持连接)
    if ($proto == "ws" || $proto == "wss") {
        if (is_method("REGISTER")) {
            save("location", "0x04"); # 保存联系人含 socket info
            set_reply_close(); # 保持 TCP/TLS 连接不挂断
        }
        if (is_method("INVITE")) {
            set_dst_uri("sip:freeswitch_internal_ip:5080;transport=tcp"); # 路由给 FS
            route(RELAY);
        }
    }
    # ... 其他路由逻辑
}

# 定义 FreeSWITCH 后端组
modparam("dispatcher", "list_file", "/etc/kamailio/dispatcher.list")
# dispatcher.list 内容示例:
# 1 sip:fs1.internal:5080;transport=tcp 0 50 'FreeSWITCH_Cluster'
# 1 sip:fs2.internal:5080;transport=tcp 0 50 'FreeSWITCH_Cluster'

route[RELAY_TO_FS] {
    ds_select_dst("1", "4"); # 算法 4: Weighted Load Distribution
    if ($rc != 1) { sl_send_reply("503", "No FreeSWITCH Available"); exit; }
    route(RELAY);
}

<!-- conf/sip_profiles/internal.xml -->
<profile name="internal">
  <settings>
    <param name="sip-ip" value="$${local_ip_v4}"/>
    <param name="sip-port" value="5080"/>
    <param name="tls-port" value="5081"/>
    <param name="rtp-ip" value="$${local_ip_v4}"/>
    <param name="rtp-port-range-start" value="16384"/>
    <param name="rtp-port-range-end" value="32768"/>
    <!-- 关键：支持 WebRTC DTLS-SRTP -->
    <param name="tls-bind-params" value="transport=tls"/>
    <param name="dtls-cert-dir" value="/etc/freeswitch/tls"/>
    <param name="media-mix-inbound-outbound-codecs" value="true"/>
    <!-- 并发优化 -->
    <param name="max-sessions" value="1000"/>
    <param name="inbound-codec-negotiation" value="generous"/> <!-- 兼容性优先 -->
  </settings>
</profile>

<extension name="pstn_inbound">
  <condition field="destination_number" expression="^(d+)$">
    <!-- 号码归一化：去除国家码/长途码，统一为内部短号或 E.164 -->
    <action application="set" data="effective_caller_id_number=${caller_id_number}"/>
    <action application="set" data="callee_id_number=8000"/> <!-- 转接总机/IVR -->
    <action application="bridge" data="sofia/internal/8000@$${domain};transport=tcp"/>
  </condition>
</extension>

<extension name="outbound_pstn">
  <condition field="destination_number" expression="^(0d{10,11}|1[3-9]d{9})$">
    <action application="set" data="continue_on_fail=true"/>
    <action application="set" data="hangup_after_bridge=true"/>
    <!-- 呼叫前操纵：加拨外线码、隐藏号码等 -->
    <action application="export" data="sip_cid_type=pid"/> 
    <action application="bridge" data="{sip_route_uri=sip:pstn_gw_ip:5060}sofia/gateway/pstn_gateway/$1"/>
  </condition>
</extension>

<!-- conf/autoload_configs/h323.conf.xml -->
<configuration name="h323.conf" description="H.323 Endpoint">
  <settings>
    <param name="h323-ip" value="$${local_ip_v4}"/>
    <param name="h323-port" value="1720"/>
    <param name="faststart" value="true"/>
    <param name="h245-tunneling" value="true"/>
    <param name="codec-prefs" value="G729,G723,G711U,G711A,H264,H263"/>
  </settings>
  <profiles>
    <profile name="external">
      <param name="gateway" value="false"/> <!-- 作为终端注册到 GK，或直连 -->
      <!-- 直连模式下，dialplan 中使用 h323/ip:port/extension 拨号 -->
    </profile>
  </profiles>
</configuration>

<!-- vars.xml 编解码优先级建议 -->
<X-PRE-PROCESS cmd="set" data="global_codec_prefs=OPUS,G722,PCMU,PCMA,G729,VP8,H264"/>
<X-PRE-PROCESS cmd="set" data="outbound_codec_prefs=OPUS,G722,PCMU,PCMA,G729,VP8,H264"/>

<!-- 统一 DTMF 为 RFC2833 (Telephone-event) -->
<action application="set" data="dtmf_type=rfc2833"/>
<!-- T.38 传真直通配置 (需网关支持) -->
<action application="set" data="t38_passthru=true"/>
<action application="set" data="fax_enable_t38=true"/>
<action application="set" data="fax_enable_t38_request=true"/>

# Kamailio: 实时追踪信令流
kamcmd> core.pproc  # 查看进程
kamctl> fifo debug_level 4
tail -f /var/log/kamailio/kamailio.log | grep -E "INVITE|200 OK|BYE|CANCEL"

# FreeSWITCH: 核心调试
fs_cli> sofia loglevel all 9
fs_cli> console loglevel debug
# 关注 media_webrtc.c, mod_sofia.c, switch_rtp.c 日志
# 抓包分析 (内网镜像端口)
tcpdump -i eth0 -s 0 -w /tmp/call.pcap port 5080 or portrange 16384-32768

# kamailio.cfg - HA 核心模块加载
loadmodule "dmq_usrloc.so"      # 用户位置表同步
loadmodule "dialog.so"          # 对话状态机
loadmodule "dmq_dialog.so"      # 对话状态跨节点同步

# DMQ 组播/单播发现配置 (推荐单播列表，避免组播穿透问题)
modparam("dmq", "server_address", "sip:10.0.1.11:5090") # 本节点 IP
modparam("dmq", "notification_address", "sip:10.0.1.11:5090")
modparam("dmq", "num_workers", 4)
modparam("dmq", "ping_interval", 10)
# 对端节点列表 (可通过 etcd/consul 动态注册发现)
modparam("dmq", "node_list", "sip:10.0.1.12:5090;sip:10.0.1.13:5090")

# Dialog 模块开启状态同步
modparam("dialog", "dlg_flag", 4)
modparam("dialog", "db_mode", 1) # 1: 仅内存 + DMQ 同步 (高性能)
modparam("dialog", "sync_dmq", 1)
modparam("dialog", "timeout_avp", "$avp(i:dialog_timeout)")

# Keepalived VIP 漂移脚本 (check_kamailio.sh)
# 逻辑: 1. 进程存活 2. 监听端口响应 3. DMQ 集群节点数 >= 预期节点数/2 (防脑裂)
# 4. 核心路由逻辑自检 (发送 OPTIONS 到自环回地址验证)

# 伪代码逻辑：基于 Redis Sliding Window Log 算法
route[RATE_LIMIT] {
    $var(key) = "ratelimit:" + $fU + "@" + $fd; # Caller + Domain
    # Lua 脚本原子操作 INCR + EXPIRE + 判断阈值
    if (redis_eval("rate_limit_script", $var(key), "100", "60")) { # 60秒内100次
        xlog("L_WARN", "Rate limit exceeded for $var(key)n");
        sl_send_reply("429", "Too Many Requests");
        exit;
    }
}

# 1. 畸形包/溢出攻击防护 (sanity 模块增强)
if (!sanity_check("1511", "7")) { exit; } # 标准检查
# 自定义深度检查：Via 分支参数合法性、Max-Forwards 防循环、Content-Length 与 Body 一致性
if (msg:len > 65535) { sl_send_reply("413", "Message Too Large"); exit; }

# 2. 用户枚举攻击防御 (防扫号)
# 统一错误码：无论用户存在与否，REGISTER/INVITE 失败均返回 401/403，延迟响应 1-2s (tarpit)
if (is_method("REGISTER|INVITE") && !authenticated()) {
    $var(delay) = $Rnd(1000, 2000); # ms
    msleep($var(delay));
    sl_send_reply("401", "Unauthorized");
    exit;
}

# 3. 动态 IP 信誉库集成 (AbuseIPDB / 自建蜜罐日志分析)
route[REPUTATION_CHECK] {
    if (src_ip_match("blocked_ips")) { # 从 Redis/Set 获取
        drop(); # 静默丢弃，不回包
    }
}

# freeswitch-statefulset.yaml 关键点
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: freeswitch-media
spec:
  serviceName: freeswitch-headless
  replicas: 3
  podManagementPolicy: Parallel # 并行启动，加速扩容
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      partition: 0
      maxUnavailable: 1 # 滚动更新时最多 1 个不可用
  template:
    spec:
      # 关键：宿主机网络模式 或 Macvlan/SR-IOV (高性能媒体转发必需)
      hostNetwork: true 
      dnsPolicy: ClusterFirstWithHostNet
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values: [freeswitch-media]
            topologyKey: kubernetes.io/hostname # 反亲和，分布在不同物理机
      containers:
      - name: freeswitch
        image: registry.internal/freeswitch:1.10.10-custom
        resources:
          limits:
            cpu: "8"
            memory: "16Gi"
            # 关键：巨页内存用于高性能转码/DPDK (如使用)
            hugepages-2Mi: "2Gi" 
          requests:
            cpu: "4"
            memory: "8Gi"
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP # 获取宿主机 IP 用于 SDP c= 行
        # 生命周期钩子：优雅下线
        lifecycle:
          preStop:
            exec:
              command: ["/bin/sh", "-c", "fs_cli -x 'sofia profile internal shutdown' && sleep 30"]
        volumeMounts:
        - name: recordings
          mountPath: /usr/local/freeswitch/recordings
  volumeClaimTemplates:
  - metadata:
      name: recordings
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: "nfs-client" # 或 CSI RBD/CephFS
      resources:
        requests:
          storage: 500Gi

# deployment.yaml 片段
containers:
- name: kamailio
  image: kamailio:5.8
  volumeMounts:
  - name: config
    mountPath: /etc/kamailio
- name: config-reloader # Sidecar 监听 ConfigMap 变更
  image: kiwigrid/k8s-sidecar:1.28.0
  env:
  - name: LABEL
    value: "app=kamailio"
  - name: FOLDER
    value: "/etc/kamailio"
  - name: REQ_COMMAND
    value: "kamcmd cfg.reload" # 热加载命令，无需重启进程
  volumeMounts:
  - name: config
    mountPath: /etc/kamailio
volumes:
- name: config
  configMap:
    name: kamailio-config
    items:
    - key: kamailio.cfg
      path: kamailio.cfg
    - key: dispatcher.list
      path: dispatcher.list