<div dir="ltr">On 10 May 2017 at 21:38, Daniel Greenwald <span dir="ltr"><<a href="mailto:dig1234@gmail.com" target="_blank">dig1234@gmail.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks for this script! <div>Theoretically it is possible to see TLS SIP traffic with freeswitch sending HEP to Homer. But there seems to be a bug in FS that only sends one side of SIP conversation (ie the FS side, not inbound messages)..</div></div><div class="gmail_extra"><br></div></blockquote><div><br></div><div>Daniel,<br></div><div><br>have you had this problem yourself, or just heard about? Have you opened a jira issue for it?<br><br></div><div>If you encountered this problem, please report it in Jira. Please never report bugs in mailing list only, they will be lost and forgot. Jira is how we manage bugs ;)<br><br></div><div>-giovanni<br></div><div><br> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_extra"><div class="gmail_quote"><div><div class="h5">On Tue, May 9, 2017 at 11:10 AM, Giovanni Maruzzelli <span dir="ltr"><<a href="mailto:gmaruzz@gmail.com" target="_blank">gmaruzz@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr"><span>On 9 May 2017 at 15:18, Bogdan-Andrei Iancu <span dir="ltr"><<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>></span> wrote:<br></span><div class="gmail_extra"><div class="gmail_quote"><span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<tt>Thank you Giovanni, that is a useful tool - we will document it
in the OpenSIPS TLS tutorial, so other can benefit ;)<br>
</tt><br></div></blockquote></span><div><br><span class="m_6550838351480657995m_5880141268979080209gmail-im"><div><br></div></span><div>Glad about it!<br>Be sure to get it from <a href="https://freeswitch.org/confluence/display/FREESWITCH/Packet+Capture#PacketCapture-TLSwithsharka" target="_blank">https://freeswitch.org/conflue<wbr>nce/display/FREESWITCH/Packet+<wbr>Capture#PacketCapture-TLSwiths<wbr>harka</a> , is the latest version with a couple fixes.<div class="m_6550838351480657995m_5880141268979080209gmail-yj6qo m_6550838351480657995m_5880141268979080209gmail-ajU"><div><img class="m_6550838351480657995m_5880141268979080209gmail-ajT"><span class="m_6550838351480657995HOEnZb"><font color="#888888"><br></font></span></div><span class="m_6550838351480657995HOEnZb"><font color="#888888"><div>-giovanni<br><br></div><div><br> </div></font></span></div></div></div><div><div class="m_6550838351480657995h5"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="#FFFFFF"><tt>
Many thanks,<br>
</tt>
<pre class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154moz-signature" cols="72">Bogdan-Andrei Iancu
OpenSIPS Founder and Developer
<a class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154moz-txt-link-freetext" href="http://www.opensips-solutions.com" target="_blank">http://www.opensips-solutions.<wbr>com</a>
OpenSIPS Summit May 2017 Amsterdam
<a class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154moz-txt-link-freetext" href="http://www.opensips.org/events/Summit-2017Amsterdam.html" target="_blank">http://www.opensips.org/events<wbr>/Summit-2017Amsterdam.html</a>
</pre><div><div class="m_6550838351480657995m_5880141268979080209gmail-h5">
<div class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154moz-cite-prefix">On 05/02/2017 05:52 PM, Giovanni
Maruzzelli wrote:<br>
</div>
</div></div><blockquote type="cite"><div><div class="m_6550838351480657995m_5880141268979080209gmail-h5">
<div dir="ltr">
<div>For a cut and paste ready version, that has the correct
carriage returns (mangled by mail), check it in FreeSWITCH
documentation:<br>
<br>
<a href="https://freeswitch.org/confluence/display/FREESWITCH/Packet+Capture#PacketCapture-TLSwithsharka" target="_blank">https://freeswitch.org/conflue<wbr>nce/display/FREESWITCH/Packet+<wbr>Capture#PacketCapture-TLSwiths<wbr>harka</a><br>
<br>
</div>
-giovanni<br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 2 May 2017 at 16:26, Giovanni
Maruzzelli <span dir="ltr"><<a href="mailto:gmaruzz@gmail.com" target="_blank">gmaruzz@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div>
<div>Hello fellows,<br>
<br>
</div>
after some experimentation with various tools, I come
out with a little shell tool that maybe can be useful to
you too.<br>
<br>
</div>
<div>It can only work with non-forward secrecy ciphers,
obviously, and only if is started before the client do
the initial TLS handshake (eg, just restart the client).
Forward secrecy cannot be decrypted after fact, so don't
waste effort.<br>
<br>
</div>
<div>An example of ciphers that can be decrypted are the
"AES256-SHA" openssl cipher group. You can use ssldump
to check what cipher is used by serverhello.<br>
</div>
<div><br>
</div>
Enjoy, make it better, and share it :)<br>
<br>
<br>
#!/bin/bash <br>
# brought to you by Giovanni Maruzzelli<br>
# <br>
SERVERIP="192.168.1.150"<br>
SERVERPORT="5061"<br>
PRIVKEY="/etc/certs/<a href="http://privkey.pe" target="_blank">privkey.pe</a><wbr>m"<br>
STDERR2DEVNULL=" 2>/dev/null "<br>
REGEX="notyet"<br>
<br>
if [ -z "$1" ]; then<br>
REGEX="\\\.*"<br>
else<br>
REGEX="$1"<br>
fi<br>
FILTER="ssl.app_data and sip matches"<br>
FILTER2="$FILTER \"$REGEX\""<br>
FILTER3="'$FILTER2'"<br>
ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e
frame.number -e frame.time -e frame.time_delta_displayed
-e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line
-e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o
\"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRI<wbr>VKEY\"
$STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' |
sed -u 's/^[0-9]*$/\n==&=============<wbr>=================/g'"<br>
<br>
echo ""<br>
echo "NB: if it do not works, edit script so that
STDERR2DEVNULL=\" \" and try again"<br>
echo ""<br>
echo "NB: remember to quote and escape match patterns,
using triple slash"<br>
echo " eg, for matching <a href="mailto:1010@pbx.example.com" target="_blank">1010@pbx.example.com</a>,
use \"<a href="mailto:1010@pbx.example.com" target="_blank">1010@pbx.example.com</a>\""<br>
echo " eg, for matching anything, use \"\\\\\\.*\""<br>
echo " eg, for matching *98, use \"\\\\\\*98\""<br>
echo "USAGE: $0 \"\\\\\\*<a href="mailto:98@pbx.example.com" target="_blank">98@pbx.example.com</a>\""<br>
echo ""<br>
<br>
<br>
case "$1" in<br>
-help|--help|?)<br>
exit 0<br>
;;<br>
*)<br>
echo "THIS TIME WE'RE DOING:"<br>
echo "tshark $ARGUMENT"<br>
echo ""<br>
bash -c "tshark $ARGUMENT"<br>
;;<br>
esac<span class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154HOEnZb"><font color="#888888"><br>
<br>
<br clear="all">
<div>
<div>
<div>
<div><br>
-- <br>
<div class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154m_6849756425851343551gmail_signature">
<div dir="ltr">
<div><span><span><br>
Sincerely,<br>
</span><span><font color="#888888"><br>
Giovanni Maruzzelli<br>
OpenTelecom.IT</font></span><br>
<span>cell: +39 347 266 56 18<span><font color="#888888"><br>
</font></span></span></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</font></span></div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154gmail_signature">
<div dir="ltr">
<div><span><span><br>
Sincerely,<br>
</span><span><font color="#888888"><br>
Giovanni Maruzzelli<br>
OpenTelecom.IT</font></span><br>
<span>cell: +39 347 266 56 18<span><font color="#888888"><br>
</font></span></span></span></div>
</div>
</div>
</div>
<br>
<fieldset class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154mimeAttachmentHeader"></fieldset>
<br>
</div></div><pre>______________________________<wbr>_________________
Users mailing list
<a class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154moz-txt-link-abbreviated" href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a>
<a class="m_6550838351480657995m_5880141268979080209gmail-m_4777636906112541154moz-txt-link-freetext" href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-<wbr>bin/mailman/listinfo/users</a>
</pre>
</blockquote>
<br>
</div>
</blockquote></div></div></div><div><div class="m_6550838351480657995h5"><br><br clear="all"><br>-- <br><div class="m_6550838351480657995m_5880141268979080209gmail_signature"><div dir="ltr"><div><span><span><br>Sincerely,<br></span><span><font color="#888888"><br>
Giovanni Maruzzelli<br>
OpenTelecom.IT</font></span><br><span>cell: +39 347 266 56 18<span><font color="#888888"><br></font></span></span></span></div></div></div>
</div></div></div></div>
<br></div></div>______________________________<wbr>______________________________<wbr>_____________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" target="_blank">http://www.freeswitchsolutions<wbr>.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" rel="noreferrer" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://confluence.freeswitch.org" rel="noreferrer" target="_blank">http://confluence.freeswitch.o<wbr>rg</a><br>
<a href="http://www.cluecon.com" rel="noreferrer" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswi<wbr>tch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" target="_blank">http://lists.freeswitch.org/ma<wbr>ilman/listinfo/freeswitch-user<wbr>s</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" target="_blank">http://lists.frees<wbr>witch.org/mailman/options/<wbr>freeswitch-users</a><br>
<a href="http://www.freeswitch.org" rel="noreferrer" target="_blank">http://www.freeswitch.org</a><br></blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>_____________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" target="_blank">http://www.<wbr>freeswitchsolutions.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" rel="noreferrer" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://confluence.freeswitch.org" rel="noreferrer" target="_blank">http://confluence.freeswitch.<wbr>org</a><br>
<a href="http://www.cluecon.com" rel="noreferrer" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.<wbr>freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" target="_blank">http://lists.freeswitch.org/<wbr>mailman/listinfo/freeswitch-<wbr>users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" target="_blank">http://lists.<wbr>freeswitch.org/mailman/<wbr>options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" rel="noreferrer" target="_blank">http://www.freeswitch.org</a><br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><span><span><br>Sincerely,<br></span><span><font color="#888888"><br>
Giovanni Maruzzelli<br>
OpenTelecom.IT</font></span><br><span>cell: +39 347 266 56 18<span><font color="#888888"><br></font></span></span></span></div></div></div>
</div></div>