- FreeSWITCH-users - FreeSWITCH Mailing Lists

FreeSWITCH Conference Call Starting Shortly
by Michael Collins 23 Feb '11

23 Feb '11

Hey folks, feel free to hop on! http://wiki.freeswitch.org/wiki/FS_weekly_2011_02_23 Talk to you shortly, MC

1 0

OpenSER interface to FreeSWITCH
by Jason b.a 23 Feb '11

23 Feb '11

yeh sure i have a SIP endpoints , can the application do the sip handling and have a socket interface with freeswitch in the same time without using OpenSER. in this case i need Sip servelet plugin in my application , is it possible. I went through the outbound event socket , seems to be helpful thx , also i saw the options for using java to connect to freeswitch, i think using ESL , i can build a java IVR application .

4 3

intercom in lua dialplan
by Helmut Kuper 23 Feb '11

23 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I try to intercept a call in lua script. For the intercepting extension I do this: if (dialed_ext:len()==6 and dialed_ext:sub(1,2) == "**") then uuid=api:execute("hash", "select/last_caller/"..dialed_ext:sub(3)) if (uuid and uuid:len()> 2) then session:setAutoHangup(false) session:execute("intercept", uuid) return end end This results to a hangup of the intercepting extension while intercepted extension hangs up (completed_elsewhere) and caller/originator's call is connected. FS logs shows this for the intercepting extension: switch_core_state_machine.c:189 sofia/internal_et/8000(a)spklw.x has executed the last dialplan instruction, hanging up. When I use the ACTIONS table like this: if (dialed_ext:len()==6 and dialed_ext:sub(1,2) == "**") then uuid=api:execute("hash", "select/last_caller/"..dialed_ext:sub(3)) if (uuid and uuid:len()> 2) then session:setAutoHangup(false) table.insert(ACTIONS, {"intercept", uuid}) return end end then intercept/pickup works fine. Is there a trick to get it work with "session:execute("intercept", uuid)" ? regards helmut -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk0+8DYACgkQ4tZeNddg3dyKwACeKR4lsxUv3G26pdNp8GGsbWNg /OIAn2EIl2Vq+qibtodGd9vjjLfqKv8s =2fTE -----END PGP SIGNATURE-----

2 5

Weird CDR ERROR...
by David Villasmil 23 Feb '11

23 Feb '11

3 3

SIP DoS Prevention - Patch
by jay binks 23 Feb '11

23 Feb '11

check out my patch Ive just posted to jira. http://jira.freeswitch.org/browse/FS-3094 you can subscribe to "Auth" events now - SWITCH_EVENT_AUTH which are generic for Register & Invite ( and any other auth'd packet I guess ) and there is an auth_state which will tell you if its an auth fail or a expire etc.. you can get the to_user, to_host, useragent, sip profile and network_ip Auth Expires also have a Log messages similar to Auth Failures ( fail2ban compatible ) PLEASE guys give this some testing. I only banged this together in a few hours today in my currently sleep deprived state. So im sure its going to have things that can be improved or work better, but at least the bones of it are there now. let me know your thoughts. Jay On Mon, Feb 21, 2011 at 11:08 PM, Jmesquita(a)freeswitch.org < jmesquita(a)freeswitch.org> wrote: > Just an idea for the other developers. Wouldn't be cool to have and event > thrown by each module that does authentication so that other application > modules are able to listen in those events and do whatever with it? Some > people might even like to have that running an eel daemon and throw some > snmp traps based on that? > > Just an idea that might be completely ridiculous or might raise some > interest. Events are pretty cheap so there wouldn't be a lot of overhead > involved. > > Regards, > > João Mesquita > > On 21/02/2011, at 07:28, Spencer Thomason <spencer(a)5ninesolutions.com> > wrote: > > > After tinkering with it, I think that might be the best way. The > > iptables method is cool but I'd like to have more dynamic control and > > with Fail2Ban looking at the challenges you could specifically ignore > > certain high traffic IPs and block others. What would be very cool is > > if instead of logging every challenge, a log entry was written if > > there was a high number from a specific IP, then you could decide what > > to do about it with fail2ban, similar to the pike module for opensips > > does. > > > > > > On Feb 21, 2011, at 1:31 AM, covici(a)ccs.covici.com wrote: > > > >> I would change sip auth failure to challenge and then have sufficient > >> times to only block if there are too many challenges in a certain > >> time. > >> I am not even sure the failure works any more in recent gits. > >> > >> Spencer Thomason <spencer(a)5ninesolutions.com> wrote: > >> > >>> Yes, that works great if they respond to the challenge with a failed > >>> auth. But the scenario I'm trying to prevent is if they just send the > >>> INVITE and never respond to the challenge. Fail2Ban will not work as > >>> every endpoint will initially send an INVITE and receive a challenge. > >>> Legit calls will then respond correctly and not be logged as a SIP > >>> auth failure but every call that is challenged will show up as SIP > >>> auth challenge in the logs so there is no regex to differentiate > >>> between legit an non legit traffic. > >>> > >>> Spencer > >>> > >>> On Feb 20, 2011, at 10:39 PM, Ken Rice wrote: > >>> > >>>> Fail2Ban ... This is block an IP with too many failed attempts from > >>>> something like SipVicious pretty quickly > >>>> > >>>> > >>>> On 2/20/11 11:07 PM, "Spencer Thomason" <spencer(a)5ninesolutions.com> > >>>> wrote: > >>>> > >>>>> Hi, > >>>>> We run hosted Freeswitch instances in VMs with the internal profile > >>>>> on > >>>>> port 5060 connecting to clients mostly behind NAT and then the > >>>>> external profile connecting to our proxies only. Protecting the > >>>>> external profile its straightforward.. we only allow traffic to/ > >>>>> from > >>>>> our proxies at the firewall level. But protecting the internal > >>>>> profile seems to be a bit more difficult because the UACs could be > >>>>> theoretically anywhere on the network. > >>>>> > >>>>> I'm currently using Fail2Ban to prevent brute force registration > >>>>> and > >>>>> INVITEs on auth failures, e.g.: > >>>>> failregex = \[WARNING\] sofia_reg.c:\d+ SIP auth failure \ > >>>>> (REGISTER\) > >>>>> on sofia profile \'\w+\' for \[.*\] from ip <HOST> > >>>>> \[WARNING\] sofia_reg.c:\d+ SIP auth failure $INVITE$ > >>>>> on sofia profile \'\w+\' for \[.*\] from ip <HOST> > >>>>> > >>>>> My question is, since its part of a normal SIP dialog to challenge > >>>>> the > >>>>> INVITE, is there any way to prevent a possible DoS from just sheer > >>>>> volume of incoming INVITEs on an Internet facing server > >>>>> automatically. I.e., If you block the logged challenge, you'd > >>>>> block > >>>>> all legitimate INVITEs and registrations. Since its UDP traffic I > >>>>> couldn't come up with a way to do it automatically at the iptables > >>>>> level. i.e. number of concurrent connections. Is there some option > >>>>> to > >>>>> just not respond if a client is sending a number of requests over a > >>>>> certain threshold? It might not stop them from sending the traffic > >>>>> but pretty soon they'd get the idea that it wasn't going to go > >>>>> anywhere. My concern is say there are 50 Freeswitch instances on a > >>>>> box (albeit 8 core, 32GB ram, 8 15K raid 10 storage) and someone > >>>>> starts sending thousands of rouge INVITEs to every VM on a physical > >>>>> box that the CPU load from just challenging the incoming INVITEs > >>>>> would > >>>>> create a DoS. We the logs regularly to try to catch people doing > >>>>> this > >>>>> sort of thing and drop them at a router upstream of the core > >>>>> network, > >>>>> but I'd like to have it happen without human intervention. Have I > >>>>> completely over thought this and am missing something obvious? > >>>>> > >>>>> Thanks, > >>>>> Spencer > >>>>> > >>>>> > >>>>> _______________________________________________ > >>>>> FreeSWITCH-users mailing list > >>>>> FreeSWITCH-users(a)lists.freeswitch.org > >>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > >>>>> UNSUBSCRIBE: > http://lists.freeswitch.org/mailman/options/freeswitch-users > >>>>> http://www.freeswitch.org > >>>> > >>>> > >>>> > >>>> _______________________________________________ > >>>> FreeSWITCH-users mailing list > >>>> FreeSWITCH-users(a)lists.freeswitch.org > >>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > >>>> UNSUBSCRIBE: > http://lists.freeswitch.org/mailman/options/freeswitch-users > >>>> http://www.freeswitch.org > >>>> > >>> > >>> > >>> _______________________________________________ > >>> FreeSWITCH-users mailing list > >>> FreeSWITCH-users(a)lists.freeswitch.org > >>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > >>> UNSUBSCRIBE: > http://lists.freeswitch.org/mailman/options/freeswitch-users > >>> http://www.freeswitch.org > >> > >> -- > >> Your life is like a penny. You're going to lose it. The question is: > >> How do > >> you spend it? > >> > >> John Covici > >> covici(a)ccs.covici.com > >> > >> _______________________________________________ > >> FreeSWITCH-users mailing list > >> FreeSWITCH-users(a)lists.freeswitch.org > >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > >> UNSUBSCRIBE: > http://lists.freeswitch.org/mailman/options/freeswitch-users > >> http://www.freeswitch.org > >> > > > > > > _______________________________________________ > > FreeSWITCH-users mailing list > > FreeSWITCH-users(a)lists.freeswitch.org > > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > > http://www.freeswitch.org > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org > -- Sincerely Jay

2 1

Auto-nat affects all profiles?
by Dmitry Bely 23 Feb '11

23 Feb '11

I have enabled auto-nat only for the external profile (port 5080), but FreeSWITCH also maps SIP port for the internal one: freeswitch@internal> show nat_map port,proto,proto_num,sticky 5060,udp,0,0 5060,tcp,1,0 5080,udp,0,0 5080,tcp,1,0 4 total. Is this intended or just a bug? - Dmitry Bely

2 2

Problems getting asterisk registered with FS sbc
by Johannes Jakob 23 Feb '11

23 Feb '11

Fellow FreeSWITCH Admins, I'm having a hard time, getting a Trixbox 2.8 box to register with our FreeSWITCH SBCs. The FreeSWITCHes are running FreeSWITCH-mod_sofia/1.0.head-git-7847289, the asterisk on the trixbox is Asterisk 1.6.0.22-samy-r60. The user's directory entry looks like this: <include> <user id="748732" cidr="10.16.153.163/32"> <params>  <param name="t38-passthru" value="true"/> </params> <variables> <variable name="client_asserted_identity" value="03023671836"/> <variable name="accountcode" value="748732"/> <variable name="contract" value="2253"/> <variable name="nibble_rate" value="1"/> <variable name="nibble_account" value="2253"/> <variable name="proxy_media" value="true"/> <variable name="bypass_media" value="false"/> <variable name="user_context" value="mysip.net"/> <variable name="default_language" value="de"/> <variable name="language" value="de"/> </variables> </user> </include> Asterisk's register string: 748732@mysip.net@sbc1.mysip.net/748732 I'm getting the "normal" FS errors for wrong credentials: 2011-02-22 18:03:57.484939 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [748732(a)mysip.net] from ip 10.16.153.163 2011-02-22 18:03:57.491471 [WARNING] sofia_reg.c:1204 SIP auth failure (REGISTER) on sofia profile 'internal' for [748732(a)mysip.net] from ip 10.16.153.163 but why am I getting these? I specified the right address in the cidr statement! Why is it even bothering with anything else but the right user@domain and IP-address? There are some other asterisk boxes (> 1.8.2) registering to this SBC with equal settings just fine, what's wrong with this little trixbox system? ;) Of course I did get you some SIP traces as well: 18:00:37.063410 IP 10.16.153.163.5060 > 10.16.133.66.5060: UDP, length: 419 E`..f...>.7.^...^..B.......-REGISTER sip:mysip.net SIP/2.0 Via: SIP/2.0/UDP 10.16.153.163:5060;branch=z9hG4bK3e70680b;rport Max-Forwards: 70 From: <sip:748732@mysip.net>;tag=as77c8852d To: <sip:748732@mysip.net> Call-ID: 53d04cc277cfe60301bddb6d79033420(a)10.16.153.163 CSeq: 102 REGISTER User-Agent: Asterisk PBX 1.6.0.22-samy-r60 Expires: 1800 Contact: <sip:748732@10.16.153.163> Event: registration Content-Length: 0 18:00:37.074085 IP 10.16.133.66.5060 > 10.16.153.163.5060: UDP, length: 657 E...F...?.Vc^..B^...........SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 10.16.153.163:5060;branch=z9hG4bK3e70680b;rport=5060 From: <sip:748732@mysip.net>;tag=as77c8852d To: <sip:748732@mysip.net>;tag=5jD9Qcg3N9S6p Call-ID: 53d04cc277cfe60301bddb6d79033420(a)10.16.153.163 CSeq: 102 REGISTER User-Agent: FreeSWITCH-mod_sofia/1.0.head-git-7847289 2011-02-19 23-38-04 +0100 Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces WWW-Authenticate: Digest realm="mysip.net", nonce="ce2bccbf-a27b-43c8-b7b0-a89ab429d8a7", algorithm=MD5, qop="auth" Content-Length: 0 18:00:37.074969 IP 10.16.153.163.5060 > 10.16.133.66.5060: UDP, length: 672 E`..f...>.6.^...^..B........REGISTER sip:mysip.net SIP/2.0 Via: SIP/2.0/UDP 10.16.153.163:5060;branch=z9hG4bK30df5010;rport Max-Forwards: 70 From: <sip:748732@mysip.net>;tag=as03431ba4 To: <sip:748732@mysip.net> Call-ID: 53d04cc277cfe60301bddb6d79033420(a)10.16.153.163 CSeq: 103 REGISTER User-Agent: Asterisk PBX 1.6.0.22-samy-r60 Authorization: Digest username="748732(a)mysip.net", realm="mysip.net", algorithm=MD5, uri="sip:mysip.net", nonce="ce2bccbf-a27b-43c8-b7b0-a89ab429d8a7", response="133a0ba843fe9f5afba67d1377fa8c11", qop=auth, cnonce="119cf18c", nc=00000001 Expires: 1800 Contact: <sip:748732@10.16.153.163> Event: registration Content-Length: 0 18:00:37.081517 IP 10.16.133.66.5060 > 10.16.153.163.5060: UDP, length: 532 E..0F...?.V.^..B^.........1.SIP/2.0 403 Forbidden Via: SIP/2.0/UDP 10.16.153.163:5060;branch=z9hG4bK30df5010;rport=5060 From: <sip:748732@mysip.net>;tag=as03431ba4 To: <sip:748732@mysip.net>;tag=6U61S706jjgSj Call-ID: 53d04cc277cfe60301bddb6d79033420(a)10.16.153.163 CSeq: 103 REGISTER User-Agent: FreeSWITCH-mod_sofia/1.0.head-git-7847289 2011-02-19 23-38-04 +0100 Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces Content-Length: 0 Can somebody point me in the right direction? Thanks and best regards, John

2 2

RTP Proxy config and DTMF conversion problem
by Mac 23 Feb '11

23 Feb '11

Dear ALL, Thats my first post here. I am struggling for some time with DTMF issue. Let me introduce you my configuration. The main task is to configure RTP Proxy with full topology hiding - OPERATOR_1 ------- Freeswitch ------- OPERATOR_2 Here is a prt of my config: - sip profile. I have one new sip profile with two gateways (OPERATOR_1 and OPERATOR_2) <include> <gateway name="OP1"> <param name="username" value="X1.Y1.V1.Z1"/> <param name="password" value="09321234"/> <param name="proxy" value="X1.Y1.V1.Z1"/> <param name="from-domain" value="test.com"/> <param name="register" value="false"/> <param name="caller-id-in-from" value="true"/> <param name="extension" value="test"/> <param name="extension-in-contact" value="true"/> <param name="outbound-codec-prefs" value="$${outbound_codec_ prefs}"/> <param name="disable-transcoding" value="true"/> <param name="inbound-late-negotiation" value="true"/> </gateway> </include> - dialplan <include> <context name="public"> <extension name="term"> <condition field="network_addr" expression="^(X1\.Y1\.V1\.Z1|X2\.Y2\.V1\.Z1)$" break="on-false"/> <condition field="destination_number" expression="^46(\d{9})$"> <action application="set" data="proxy_media=true"/> <action application="set" data="bypass_media=false"/> <action application="start_dtmf"/> <action application="bridge" data="sofia/gateway/OP1/$0"/> </condition> </extension> </context> </include> Everything is fine, but i have problem with DTMF conversion from RFC2833 to inband. Refering to http://wiki.freeswitch.org/wiki/Misc._Dialplan_Tools_start_dtmfand http://wiki.freeswitch.org/wiki/Proxy_Media i have done all the necessary things. vars.xml <X-PRE-PROCESS cmd="set" data="global_codec_prefs=PCMA,G.729,PCMU,GSM"/> <X-PRE-PROCESS cmd="set" data="outbound_codec_prefs=PCMA,G.729,PCMU,GSM"/> The after-effect is following output: [ERR] switch_core_io.c:1055 Codec PROXY PASS-THROUGH encoder error! Placing <param name="dtmf-type" value="none"/> does not help anyway. Could sb point me where the problem is located? Thanks in advance, Mac

4 4

Re: [Freeswitch-users] mod_odbc_query
by Peter Olsson 23 Feb '11

23 Feb '11

Rebuild FS with ODBC support, you were probably missing some ODBC devel files when configuring and building FS. /Peter ----- Reply message ----- Från: "Sam" <u2nsam(a)gmail.com> Datum: ons, feb 23, 2011 07:48 Rubrik: [Freeswitch-users] mod_odbc_query Till: "FreeSWITCH Users Help" <freeswitch-users(a)lists.freeswitch.org> I am getting this error while loading mod_odbc_query 2011-02-23 12:01:58.487072 [ERR] mod_odbc_query.c:489 No core ODBC available! 2011-02-23 12:01:58.487072 [CRIT] switch_loadable_module.c:928 Error Loading module /usr/local/fs/novanet/mod//mod_odbc_query.so **Module load routine returned an error** Regds Sam On Mon, Feb 21, 2011 at 6:36 PM, Avi Marcus <avi(a)avimarcus.net<mailto:avi@avimarcus.net>> wrote: Like the wiki says, you need to pull the git CONTRIB. There's a link in that wiki page.. -Avi On Mon, Feb 21, 2011 at 2:52 PM, Sam <u2nsam(a)gmail.com<mailto:u2nsam@gmail.com>> wrote: Do i need to pull down git for it ? regds Sam On Mon, Feb 21, 2011 at 3:47 PM, Avi Marcus <avi(a)avimarcus.net<mailto:avi@avimarcus.net>> wrote: You can find the download / compile instructions on the wiki: http://wiki.freeswitch.org/wiki/Mod_odbc_query <http://wiki.freeswitch.org/wiki/Mod_odbc_query>-Avi On Mon, Feb 21, 2011 at 6:30 AM, Sam <u2nsam(a)gmail.com<mailto:u2nsam@gmail.com>> wrote: Hello, How to download mod_odbc_query source, there is not such source in 1.0.6 or 1.0.7 . Regds Sam _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org !DSPAM:4d64ad4632761097013501!

1 0

mod_odbc_query
by Sam 23 Feb '11

23 Feb '11

Hello, How to download mod_odbc_query source, there is not such source in 1.0.6 or 1.0.7 . Regds Sam

2 4