March 2013 - FreeSWITCH-users - FreeSWITCH Mailing Lists

No failure messages in log during SIPVicious attack
by Phil Quesinberry 22 Mar '13

22 Mar '13

We were the recipients of another script-kiddie SIPVicious attack this evening, but Fail2ban didn't catch it because there was no failure message in the log, just repeated registration messages. I added the following to sofia.conf.xml and reloaded but there was no change in behavior: <param name="log-auth-failures" value="true"/> Interestingly, if I tell the Aastra on my desk to register with the wrong password, there is a failure message logged. I'm not sure why this attack doesn't generate a failure message but I added a rule under filter.d to ban IPs with too many registration attempts in a certain period of time. Of course I'd prefer to ban only on failures. The user agent string would seem to indicate that this is an older version of SIPVicious but I was unable to crash it with svcrash. Here is an excerpt of the traffic: 2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 freeswitch@internal> sofia profile internal siptrace on Enabled sip debugging on internal 2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 recv 333 bytes from udp/[70.38.71.75]:5115 at 01:48:24.223941: ------------------------------------------------------------------------ REGISTER sip:xx.xx.xx.xx SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport Content-Length: 0 From: "4623" <sip:4623@xx.xx.xx.xx> Accept: application/sdp User-Agent: friendly-scanner To: "4623" <sip:4623@xx.xx.xx.xx> Contact: sip:123@1.1.1.1 CSeq: 1 REGISTER Call-ID: 1757394 Max-Forwards: 70 ------------------------------------------------------------------------ 2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 send 621 bytes to udp/[70.38.71.75]:5115 at 01:48:24.225084: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport=5115;received=70.38.71.75 From: "4623" <sip:4623@xx.xx.xx.xx> To: "4623" <sip:4623@xx.xx.xx.xx>;tag=tNtgHUjZSej3F Call-ID: 1757394 CSeq: 1 REGISTER User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="c34ebd55-e53c-4590-b7e8-423e21fc26b9", algorithm=MD5, qop="auth" Content-Length: 0 ------------------------------------------------------------------------ recv 336 bytes from udp/[70.38.71.75]:5115 at 01:48:24.234418: ------------------------------------------------------------------------ REGISTER sip:xx.xx.xx.xx SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport Content-Length: 0 From: "4623" <sip:4623@xx.xx.xx.xx> Accept: application/sdp User-Agent: friendly-scanner To: "4623" <sip:4623@xx.xx.xx.xx> Contact: sip:123@1.1.1.1 CSeq: 1 REGISTER Call-ID: 2727970266 Max-Forwards: 70 ------------------------------------------------------------------------ 2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623(a)xx.xx.xx.xx] from ip 70.38.71.75 send 624 bytes to udp/[70.38.71.75]:5115 at 01:48:24.235851: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport=5115;received=70.38.71.75 From: "4623" <sip:4623@xx.xx.xx.xx> To: "4623" <sip:4623@xx.xx.xx.xx>;tag=UyK9jp32pQ8NB Call-ID: 2727970266 CSeq: 1 REGISTER User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="6343aee4-d0a4-4357-b34d-11a4658b954c", algorithm=MD5, qop="auth" Content-Length: 0 Phil Quesinberry Q Systems Engineering, Inc. Electronic Controls and Embedded Systems Development (410) 969-8002 http://www.qsystemsengineering.com

7 9

Warning messages?
by Malay Thakershi 22 Mar '13

22 Mar '13

Hello, I get these messages on FS prompt. They seem like warning messages (purple color). ----------- 2013-03-21 16:03:50.795593 [WARNING] sofia_reg.c:2376 Can't find user [504(a)IP.IP.IP.IP] You must define a domain called 'IP.IP.IP.IP' in your directory and add a user with the id="504" attribute and you must configure your device to use the proper domain in it's authentication credentials. ----------- id keeps varying. What does this mean? Can any one help me understand? What triggers this? Thanks.

3 2

Debugging unexpected hangup
by Steven Schoch 22 Mar '13

22 Mar '13

One of my users (the one who uses the phone the most) has reported several times since switching to VoIP that sometimes calls are getting disconnected unexpectedly. Since this is intermittent, the only way I can debug it is looking through the log. Here are the entries when today's call got disconnected (I changed his number to 4085551212 in this log): 2013-03-21 09:53:47.420473 [DEBUG] switch_core_session.c:975 Send signal sofia/phone/sip:4085551212@192.168.4.244 [BREAK] 2013-03-21 09:53:47.440473 [DEBUG] switch_channel.c:3011 (sofia/phone/ sip:4085551212@192.168.4.244) Callstate Change ACTIVE -> HANGUP 2013-03-21 09:53:47.440473 [NOTICE] sofia.c:711 Hangup sofia/phone/ sip:4085551212@192.168.4.244 [CS_EXCHANGE_MEDIA] [NORMAL_CLEARING] 2013-03-21 09:53:47.440473 [DEBUG] switch_channel.c:3034 Send signal sofia/phone/sip:4085551212@192.168.4.244 [KILL] 2013-03-21 09:53:47.440473 [DEBUG] switch_core_session.c:1310 Send signal sofia/phone/sip:4085551212@192.168.4.244 [BREAK] 2013-03-21 09:53:47.440473 [DEBUG] switch_ivr_bridge.c:597 BRIDGE THREAD DONE [sofia/phone/sip:4085551212@192.168.4.244] 2013-03-21 09:53:47.440473 [DEBUG] switch_ivr_bridge.c:622 Send signal sofia/external/+19259639530(a)flowroute.com [BREAK] 2013-03-21 09:53:47.440473 [DEBUG] switch_core_state_machine.c:480 (sofia/phone/sip:4085551212@192.168.4.244) State EXCHANGE_MEDIA going to sleep 2013-03-21 09:53:47.440473 [DEBUG] switch_core_state_machine.c:415 (sofia/phone/sip:4085551212@192.168.4.244) Running State Change CS_HANGUP 2013-03-21 09:53:47.440473 [DEBUG] switch_core_state_machine.c:676 (sofia/phone/sip:4085551212@192.168.4.244) State HANGUP 2013-03-21 09:53:47.440473 [DEBUG] mod_sofia.c:503 Channel sofia/phone/ sip:4085551212@192.168.4.244 hanging up, cause: NORMAL_CLEARING I'm assuming this mean that the internal user (who's phone is 192.168.4.244) hung up, but he tells me he didn't. He was just talking and then there was no answer. I'm not sure where to look next. Any idea? -- Steve

2 2

Call Barge Controls
by Zoltan Medveczky 21 Mar '13

21 Mar '13

Is there any method other than sending DTMF to control whether a barging call leg is in eavesdrop, whisper, or 3-way call mode? I'd ideally like to be able to control this from an external application. I've found that I can use the "uuid_recv_dtmf" command to mimic the sending of DTMF on the barging call leg but this may potentially collide with real DTMF being sent for some other application specific purpose. Alternatively, is there any way to distinguish DTMF events from FS that were raised via a call to "uuid_recv_dtmf" as opposed to real DTMF? There doesn't seem to be anything conspicuous in looking at a dump of the event headers from FS. Thanks, - Zoltan

1 0

Audio Traversal
by Blake Priddy 21 Mar '13

21 Mar '13

Ok guess whos back ;) So what I have seen is that we have users on MAIN campus that experience a delay. Users at other schools are not seeing this lack of audio?? (Lack of audio from b-leg (secretary) to a-leg (outside caller). it takes about 7 seconds of the call duration for the a-leg to finally hear the b-leg. So what happens is that the secretary is saying "Bryant schools? bryant schools? hello? hello?". But ALSO! while the secretary is saying that to the caller, the secretary can hear the caller! But the caller cannot hear the secretary? UNTIL 5-7 seconds of the call duration has elapsed. My question to you fellow FS users and wizards. Is what do I need to look at on my main campus switches or FS box to see why I am having this issue. -- *Blakelund Priddy* Network Systems Engineer Bryant Public School District Bryant, Arkansas 72022 http://www.bryantschools.org p 501-653-5038 f 501-847-5656

2 1

FW: [ERR] sofia_reg.c:1914 NO CONTACT!
by bulk orok 21 Mar '13

21 Mar '13

Hi, FreeSWITCH (Version 1.2.7 git 93e2a38) throws this error in the CLI when a REGISTER without CONTACT-header hits it. FS responds with 500 Internal Server Error The requesting side is sending a second REGISTER with Contact then and it registeres. Some "AVM FritzBox" hardware-boxes send such a REGISTER. Here a (cleaned) SIP-Trace ------------------------------------------------------------------------ recv 620 bytes from udp/[1.2.3.4]:5060 at 11:01:06.214597: ------------------------------------------------------------------------ REGISTER sip:sipproxy.somebusiness.com SIP/2.0 Via: SIP/2.0/UDP 1.2.3.4:5060;rport;branch=z9hG4bK4F974DA26FBE794A From: <sip:user.user2@sipproxy.somebusiness.com>;tag=3665871555 To: <sip:user.user2@sipproxy.somebusiness.com> Call-ID: 9BB803703627C9DF(a)1.2.3.4 CSeq: 2078 REGISTER Max-Forwards: 70 User-Agent: AVM FRITZ!Box Fon WLAN 7390 84.05.50 (Dec 11 2012) Supported: 100rel,replaces Allow-Events: telephone-event,refer,reg Allow: INVITE,ACK,OPTIONS,CANCEL,BYE,UPDATE,PRACK,INFO,SUBSCRIBE,NOTIFY,REFER,MESSAGE,PUBLISH Accept: application/sdp, multipart/mixed Accept-Encoding: identity Content-Length: 0 ------------------------------------------------------------------------ 2013-03-21 12:01:06.214194 [ERR] sofia_reg.c:1914 NO CONTACT! ip: 1.2.3.4, port: 5060 send 322 bytes to udp/[1.2.3.4]:5060 at 11:01:06.214998: ------------------------------------------------------------------------ SIP/2.0 500 Internal Server Error Via: SIP/2.0/UDP 1.2.3.4:5060;rport=5060;branch=z9hG4bK4F974DA26FBE794A From: <sip:user.user2@sipproxy.somebusiness.com>;tag=3665871555 To: <sip:user.user2@sipproxy.somebusiness.com>;tag=cFDNr9NQa5g9m Call-ID: 9BB803703627C9DF(a)1.2.3.4 CSeq: 2078 REGISTER Content-Length: 0 ------------------------------------------------------------------------ recv 715 bytes from udp/[1.2.3.4]:5060 at 11:01:06.252877: ------------------------------------------------------------------------ REGISTER sip:sipproxy.somebusiness.com SIP/2.0 Via: SIP/2.0/UDP 1.2.3.4:5060;rport;branch=z9hG4bK394B9487FAFBC468 From: <sip:user.user2@sipproxy.somebusiness.com>;tag=3665871555 To: <sip:user.user2@sipproxy.somebusiness.com> Call-ID: 9BB803703627C9DF(a)1.2.3.4 CSeq: 2079 REGISTER Contact: <sip:user.user2@1.2.3.4;uniq=77F5786DCDB3B0B3999878F7FB4C0> Max-Forwards: 70 Expires: 1800 User-Agent: AVM FRITZ!Box Fon WLAN 7390 84.05.50 (Dec 11 2012) Supported: 100rel,replaces Allow-Events: telephone-event,refer,reg Allow: INVITE,ACK,OPTIONS,CANCEL,BYE,UPDATE,PRACK,INFO,SUBSCRIBE,NOTIFY,REFER,MESSAGE,PUBLISH Accept: application/sdp, multipart/mixed Accept-Encoding: identity Content-Length: 0 ------------------------------------------------------------------------ send 595 bytes to udp/[1.2.3.4]:5060 at 11:01:06.265145: ------------------------------------------------------------------------ SIP/2.0 200 OK Via: SIP/2.0/UDP 1.2.3.4:5060;rport=5060;branch=z9hG4bK394B9487FAFBC468 From: <sip:user.user2@sipproxy.somebusiness.com>;tag=3665871555 To: <sip:user.user2@sipproxy.somebusiness.com>;tag=Dr6Dt46t7D7Ug Call-ID: 9BB803703627C9DF(a)1.2.3.4 CSeq: 2079 REGISTER Contact: <sip:user.user2@1.2.3.4;uniq=77F5786DCDB3B0B3999878F7FB4C0>;expires=1800 Date: Thu, 21 Mar 2013 11:01:06 GMT User-Agent: SIP-SERVER Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY Supported: timer, precondition, path, replaces Content-Length: 0

3 4

Default vs Public context
by Siri MM 21 Mar '13

21 Mar '13

Hi All, Sorry for the rookie question, but am a bit confused here: 1. create an extension under conf/directory/default/ - I ensure that user_context is default 2. create a dialplan for this extension under conf/dialplan/default.xml - just a simple bridge to the extension 3. log in from XLite as this extension, from a PC which is in the same subnet as FS server - dial another similar extension FS processes this call in public context, and doesn't find the right dialplan Why does FS look for dialplan under public context, when the extension has been created in default?

7 8

what are the sendevent supported parameters
by Leonardo Pereira 21 Mar '13

21 Mar '13

I'm trying to find out how to use sendevent command to send an SMS (SMS::SEND_MESSAGE). Does anyone know how to do that? Thanks in advance, Leonardo Nogueira de Sá Pereira Tel.: +55 19 3307-5589 Cel.: +55 19 9122-5943 Skype: leonardo_pereira_77

1 0

Freeswitch Postgresql CDR
by Antonio Teixeira 21 Mar '13

21 Mar '13

Hello guys. I'm trying to implement CDrs in Postgresql , my objective is something like : http://wiki.freeswitch.org/wiki/Mod_cdr_pg_csv What i would like : Receiving The Entire CDR with all the channel variables , some are created inside the channel at 'runtime' so i need all the variables for processing. So does Postgresql in the core changes something to the above link? Is it possible to say in the schema something like give me all the variables and place it inside a specific field ? What do you guys recommend write a CDR into a dir and have an app to monitor and send all the files into a DB or use cdr_pg_csv. Thanks for the input Antonio

4 5

Ringback tone
by Miha 21 Mar '13

21 Mar '13

Hi, I need one info regarding ringback tone. How ISP are sending for numbers which are unavalible, "number is temporary unavalible"? I guess this is send in ringback tone? but how to achive that with FS as I must bridge to avalible user and set action application ringback to set ringback application? I need to do this for unavalibe numbers, setting own ringbacktone, on the call should not be answerd as if the call is answered, it will be in billing. thanks! Miha

1 0