January 2017 - FreeSWITCH-users - FreeSWITCH Mailing Lists

Freeswitch install from yum
by John Nash 09 Jan '17

09 Jan '17

I installed freeswitch using yum commands as per given https://freeswitch.org/confluence/display/FREESWITCH/CentOS+7+and+RHEL+7 All seems to be OK but I have two questions .. 1- I do not find ulimit settings in any startup file as recommend . I see files /etc/sysconfig/freeswitch, /etc/systemd/system/multi-user.target.wants/freeswitch.service am I supposed to create some kind of init script and mention ulimit settings there? 2- In my box I see lua version as Lua 5.1.4 Copyright (C) 1994-2008 Lua.org, PUC-Rio . Is higher version of lua recommended? Any memory related issue with 5.1.4 version?

3 2

tls with letsencrypt
by ITwrx.org 06 Jan '17

06 Jan '17

hi, i'm trying to use a letsencrypt generated cert with freeswitch but am not sure how to proceed. I've read the old and new wiki posts concerning tls but they don't seem to cover my exact scenario. It seems to me that freeswitch is looking into the configured "tls-cert-dir" for the hardcoded filename tls.pem and is expecting that a self generated ca has signed it. i have placed the fullchain.pem in that directory (generated with certbot) and have renamed it tls.pem but i guess it's not finding the CA sig it expects(?) as i'm getting: tport_tls.c:1044 tls_connect() tls_connect(0x373c000e8d0): TLS setup failed (error:00000005:lib(0):func(0):DH lib) when trying to connect with csipsimple from phone. I would like to avoid generating client certs signed by a custom CA where users have to copy the client cert and ca cert to their device as it adds complexity and problems. Is there a workaround or suggested method for using a letsencrypt cert with freeswitch so that clients like csipsimple can just validate against their built-in CA store? thanks in advance, ITwrx -- Information Technology Works https://ITwrx.org @ITwrxorg

3 6

Re: [Freeswitch-users] tls with letsencrypt
by Kim Culhan 06 Jan '17

06 Jan '17

On Thu, Jan 5, 2017 at 2:55 PM, ITwrx.org <info(a)itwrx.org > <https://webmail.kim.net/src/compose.php?send_to=info@itwrx.org>> wrote: > >> hi, >> >> i'm trying to use a letsencrypt generated cert with freeswitch but am >> not sure how to proceed. > > Suggest you proceed to take a look at the docs here: https://wiki.freeswitch.org/wiki/SIP_TLS Steps 1 & 2 involve making your own certificate; you don't have to use letsencrypt certs. Start with Step 3 and proceed from there, as Bryan mentioned there is a lot more to it than '..just copied the pem formatted cert that certbot generated to /etc/freeswitch/tls and named it tls.pem.' regards -kim

2 1

TLS/SRTP performance numbers and bottlenecks?
by Aaron S 05 Jan '17

05 Jan '17

I have an application that requires a large number (500-1000 to start) of concurrent g.711u streams/calls as seen in the Hybrid Encryption section at https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS. Parallelizing this is something that's certainly possible (and would be used with two identical systems for redundancy's sake to start), but I'm wondering if two systems on bare metal would be sufficient, or more is required. Looking for stats via google, I'm not seeing much out there. I'm not sure where the bottlenecks of this system are. I'm not doing any transcoding, just stripping out the encryption on one leg of the call. Any tips, real-world numbers/experience, or what have you would be very appreciated. Thanks, -Aaron

1 0

DTMF SIP Info or rfc2833 (rfc 4733)
by Mimiko 05 Jan '17

05 Jan '17

Hello. What is better to use as standard for DTMF: SIP Info or rfc2833 ? In sip profile I can set <param name="liberal-dtmf" value="true"/> so, FS will accept both types of DTMF standard, while FS always send rfc2833. Why FS always send in rfc2833 and not the agreed with client like is the case of audio codecs? Is rfc2833 in FS a rfc4733 in the code, and is named rfc2833 in wiki? -- Mimiko desu.

2 2

Fs_path
by David Villasmil 05 Jan '17

05 Jan '17

Hello guys, I've been wondering where the "fs_path" parameter comes from? How is it built, etc? I've been seeing cases where when the client has no "fs_path", fs can't find the user and returns temp unavailable... Thanks all, David

3 5

Combine non-auth and auth calls on same profile security consideration.
by Mimiko 05 Jan '17

05 Jan '17

Hello. There where separate sip profiles for registered accounts and anonymous inbound calls: internal and external. All calls and registrations on internal a authenticated and routed to "default" context. For external profile inbound calls are not authenticated and are routed to "public" context. In order for some one to call inbound (s)he have to use :5080 port, which is somehow inconvenient. So I decided to combine in one profile named "example" on port 5060. <profile name="internal_77.89.245.34"> <settings> <param name="context" value="public"/> <param name="auth-calls" value="false"/> <param name="auth-all-packets" value="false"/> <param name="inbound-reg-force-matching-username" value="true"/> <param name="force-register-domain" value="default"/> <param name="force-subscription-domain" value="default"/> <param name="force-register-db-domain" value="default"/> </settings> </profile> <domain name="$${domain}"> <variables> <variable name="inbound-reg-force-matching-username" value="true"/> <variable name="user_context" value="default"/> <groups> <group name="default"> <users> <X-PRE-PROCESS cmd="include" data="default/*.xml"/> </users> </group> </groups> </variables> </domain> Registration was working, calling to those registration was working, but some phones hit public context, some default context. I started to dig whats happening and found that D-Link phones always do authenticated calls when they a registered, while Stephen's phones does unauthenticated and go to public. Then I found a mention that registrations allow only to find the phone to call, while calls does not necessary authenticate. So I used Anthony's solution in public context on the end: <extension name="check_auth" continue="true"> <condition field="${sip_authorized}" expression="^true$" break="never"> <anti-action application="respond" data="407"/> </condition> </extension> Now when a registered phone hits public context and no other conditions are met, they are rejected and call authenticated hitting default context. Then in CDR I see two lines: one with rejected and one with success. This is not well, so found a hint and put: <anti-action application="set" data="process_cdr=false"/> And now is working somewhat correct except that calls to public numbers which does not require authentication does not get vars for the registered extension. My questions are: 1) Does this type of combination affect security? 2) How to impose all registered phones to make authenticated calls always? So they will not go first thru public context and then to default? -- Mimiko desu.

3 4

Running show codec via fs_cli
by Lợi Đặng 05 Jan '17

05 Jan '17

Hi guys, I'm connecting to my backgrounded FS via fs_cli, things are pretty straightforward, and connection is OK. But I found this: `show codec` returns 0 total. I can make sure CORE_PCM_MODULE is loaded, via log file and api `module_exists`. Then I tried to `reload` CORE_PCM_MODULE, and guess what, `show codec` works properly, contains codecs informations. Same issue happened with CORE_SPEEX_MODULE and CORE_VPX_MODULE as well. FS running normally before and after reloading module(s). Not sure if this is a bug on `show codec` or I just miss something. More information, connecting to a foreground running FS doesn't have the same issue. rgds, Loi Dang Thanh Phone : +84. 1224.735.448 Email : loi.dangthanh(a)gmail.com

3 4

Codec transcoding PCMA to PMCU
by Ketan Kothari 04 Jan '17

04 Jan '17

Hello, I have configured PCMA codec in my zoipper soft-phone(UAC) and tried to call to 123456789 using our gateway twillo(UAS). Gateway only accept PCMU codec. I have also configured absolute codec =PCMU but still freeswitch sending PCMA to twillo(Provider gateway UAS). I have got error Originate Failed. Cause: SERVICE_NOT_IMPLEMENTED in freeswitch. Once i have added PCMU codec in my zoiper(UAC) it's working. [image: Inline image 1] What am i missing here?

6 6

NGINX + Kamailio + FreeSwitch
by Sergey Safarov 03 Jan '17

03 Jan '17

Hello guys I want configure user frendly WebRTC server based on FreeSwitch and SipML5 client. It can be easy done in FreeSwitch and NGINX is bounded to different IP/ports. But if you wants use one IP and 443 port then you will try configre NGINX to proxy all reuests line "/fs-socket/" to FreeSwitch port 7443. It is works fine but FreeSwitch cannot not see real client IP address like folowing. Captured on Amazon server. freeswitch(a)ip-172-31-29-87.us-west-2.compute.internal> sofia status profile internal reg Registrations: ================================================================================================= Call-ID: f1e8c7ca-8f50-4285-fd1a-148d2f1d1b88 User: 23(a)46.218.201.23 Contact: "23" <sips:23@df7jal23ls0d.invalid ;rtcweb-breaker=no;transport=wss;fs_nat=yes;fs_path=sips%3A23%40172.31.29.87%3A37244%3Brtcweb-breaker%3Dno%3Btransport%3Dwss> Agent: IM-client/OMA1.0 sipML5-v1.2016.03.04 Status: Registered(TLS-NAT)(unknown) EXP(2016-12-24 09:42:43) EXPSECS(230) Ping-Status: Reachable Ping-Time: 0.00 Host: ip-172-31-29-87.us-west-2.compute.internal IP: 172.31.29.87 Port: 37244 Auth-User: 23 Auth-Realm: 46.218.201.23 MWI-Account: 23(a)46.218.201.23 Total items returned: 1 ================================================================================================= Displayed real IP address of NGINX Also when received INVITE then variables like network_addr will cantain real IP of NGINX. Then you can try confgire nginx like ng proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; But FreeSwitch wants SIP headers "X-AUTH-IP" and "X-AUTH-PORT" in every SIP message not only connection establishing. NGINX not understand SIP messages and cannot do it. Then you will try cofigure Kamailio between NGINX and FreeSwitch. In this case Kamailio can parce http headers and add requred SIP header. Are you can suggest other way to publish FreeSwitch socket on same port with http server?

2 9