- FreeSWITCH-users - FreeSWITCH Mailing Lists

Re: [Freeswitch-users] SIP TLS still failed with tlsv1
by Xiyu Zhao 04 Dec '16

04 Dec '16

Hello list, Can someone please help me with below error log of TLS? It says that “SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate”. I'm using tlsv1 now. tport.c:2749 tport_wakeup_pri() tport_wakeup_pri(0x7f0e48292a20): events IN tport.c:862 tport_alloc_secondary() tport_alloc_secondary(0x7f0e48292a20): new secondary tport 0x7f0e4809fa70 tport_type_tcp.c:203 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7f0e4809fa70): Setting TCP_KEEPIDLE to 30 tport_type_tcp.c:209 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7f0e4809fa70): Setting TCP_KEEPINTVL to 30 tport_type_tls.c:610 tport_tls_accept() tport_tls_accept(0x7f0e4809fa70): new connection from tls/50.187.205.251:60324/sips tport_tls.c:955 tls_connect() tls_connect(0x7f0e4809fa70): events NEGOTIATING tport_tls.c:955 tls_connect() tls_connect(0x7f0e4809fa70): events NEGOTIATING tport_tls.c:1044 tls_connect() tls_connect(0x7f0e4809fa70): TLS setup failed (error:00000001:lib(0):func(0):reason(1)) tport.c:2090 tport_close() tport_close(0x7f0e4809fa70): tls/ 50.187.205.251:60324/sips tport_tls.c:157 tls_log_errors() tls_free: 140890c7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate tport.c:2263 tport_set_secondary_timer() tport(0x7f0e4809fa70): set timer at 0 ms because zap Thanks, Claire On Sat, Dec 3, 2016 at 4:13 PM, Xiyu Zhao <claire.zxy(a)gmail.com> wrote: > Hi Ken, > > > > Sorry for the wrong email format, and thanks so much for looking into this. > > > > I’ve changed to tlsv1 instead of sslv23 from both my FreeSWITCH server and > client sides. But I got a different error below, it says that > “SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate” > > > > Could you please take a look? > > > > tport.c:2749 tport_wakeup_pri() tport_wakeup_pri(0x7f0e48292a20): events > IN > > tport.c:862 tport_alloc_secondary() tport_alloc_secondary(0x7f0e48292a20): > new secondary tport 0x7f0e4809fa70 > > tport_type_tcp.c:203 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7f0e4809fa70): > Setting TCP_KEEPIDLE to 30 > > tport_type_tcp.c:209 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7f0e4809fa70): > Setting TCP_KEEPINTVL to 30 > > tport_type_tls.c:610 tport_tls_accept() tport_tls_accept(0x7f0e4809fa70): > new connection from tls/50.187.205.251:60324/sips > > tport_tls.c:955 tls_connect() tls_connect(0x7f0e4809fa70): events > NEGOTIATING > > tport_tls.c:955 tls_connect() tls_connect(0x7f0e4809fa70): events > NEGOTIATING > > tport_tls.c:1044 tls_connect() tls_connect(0x7f0e4809fa70): TLS setup > failed (error:00000001:lib(0):func(0):reason(1)) > > tport.c:2090 tport_close() tport_close(0x7f0e4809fa70): tls/ > 50.187.205.251:60324/sips > > tport_tls.c:157 tls_log_errors() tls_free: 140890c7:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > tport.c:2263 tport_set_secondary_timer() tport(0x7f0e4809fa70): set timer > at 0 ms because zap > > > > Thanks > > Claire > > > > On Sat, Dec 3, 2016 at 1:29 PM, <freeswitch-users-request@ > lists.freeswitch.org> wrote: > > Send FreeSWITCH-users mailing list submissions to > freeswitch-users(a)lists.freeswitch.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > or, via email, send a message with subject or body 'help' to > freeswitch-users-request(a)lists.freeswitch.org > > You can reach the person managing the list at > freeswitch-users-owner(a)lists.freeswitch.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of FreeSWITCH-users digest..." > > Today's Topics: > > 1. Re: FreeSWITCH-users Digest, Vol 126, Issue 14 (Ken Rice) > > > ---------- Forwarded message ---------- > From: Ken Rice <krice(a)freeswitch.org> > To: "'FreeSWITCH Users Help'" <freeswitch-users(a)lists.freeswitch.org> > Cc: > Date: Sat, 3 Dec 2016 12:28:52 -0600 > Subject: Re: [Freeswitch-users] FreeSWITCH-users Digest, Vol 126, Issue 14 > > a) Please don’t respond to the digest it breaks the threading the > in the archive > > b) sslv23 is disabled in FreeSWITCH. Its completely broken and not > even worth the CPU power to use it. > > > > *From:* freeswitch-users-bounces(a)lists.freeswitch.org [mailto: > freeswitch-users-bounces(a)lists.freeswitch.org] *On Behalf Of *Xiyu Zhao > *Sent:* Saturday, December 3, 2016 11:59 AM > *To:* freeswitch-users(a)lists.freeswitch.org; mitch.capper(a)gmail.com > *Subject:* Re: [Freeswitch-users] FreeSWITCH-users Digest, Vol 126, Issue > 14 > > > > Hi Mitch, > > > > I'm using freeswitch server and freeswitch client. So they should be able > to do sslv23. > > > > Anyway, after I change TLS, I got the same problem. I think it could be my > keys doesn't match. There is a comment below from mail list which I don't > understand. > > > > "cat the key and the cert into agent.pem and the chain cert into > cafile.pem and fire it up" > > > > What is this mean? Should I go to /usr/local/freeswitch/conf/ssl/CA, and > do "cat cacert.pem cakey.pem /usr/local/freeswitch/conf/ssl/agent.pem"? > But this still fails. > > > > Please help. > > > > Thanks in advance. > > Claire > > > > On Sat, Dec 3, 2016 at 12:48 PM, <freeswitch-users-request@ > lists.freeswitch.org> wrote: > > Send FreeSWITCH-users mailing list submissions to > freeswitch-users(a)lists.freeswitch.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > or, via email, send a message with subject or body 'help' to > freeswitch-users-request(a)lists.freeswitch.org > > You can reach the person managing the list at > freeswitch-users-owner(a)lists.freeswitch.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of FreeSWITCH-users digest..." > > Today's Topics: > > 1. Re: SIP TLS failed with FSClient 1.2.3.5 (Mitch Capper) > > > ---------- Forwarded message ---------- > From: Mitch Capper <mitch.capper(a)gmail.com> > To: FreeSWITCH Users Help <freeswitch-users(a)lists.freeswitch.org> > Cc: > Date: Sat, 3 Dec 2016 09:48:06 -0800 > Subject: Re: [Freeswitch-users] SIP TLS failed with FSClient 1.2.3.5 > > sslv23 is not supported on most linux servers now a days, so you most > likely need to be using tls instead (under FSClient option). > > > > ~Mitch > > > > > ~mitch > > > > On Sat, Dec 3, 2016 at 7:08 AM, Xiyu Zhao <claire.zxy(a)gmail.com> wrote: > > Hi All, > > > > Please help me when you get a chance. > > > > I’ve follow the instruction link below to configure TLS in my freeswitch > server, but it failed with my FSClient 1.2.3.5. I copied cafile.pem from my > freeswitch to my windows desktop and gived the right directory under “TLS > Certificate Directory” shown as below screenshot (also attached). > > > > https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS > > > > But I still cannot log in with tls, console log output, and configuration > files are below. Kindly take a look and let me know if additional info is > needed. > > > > I used ./gentls_cert setup -cn 52.35.22.204 -alt DNS: 52.35.22.204 -org > 52.35.22.204. > > > > Below is the view of one cert: > > > > root@ip-172-31-28-201:/usr/local/freeswitch/conf/ssl# openssl x509 -noout > -inform pem -text -in /usr/local/freeswitch/conf/ssl/agent.pem > > Certificate: > > Data: > > Version: 3 (0x2) > > Serial Number: > > be:37:19:a3:98:6e:82:19 > > Signature Algorithm: sha1WithRSAEncryption > > Issuer: CN=52.35.22.204, O=52.35.22.204 > > Validity > > Not Before: Nov 12 21:20:24 2016 GMT > > Not After : Nov 11 21:20:24 2022 GMT > > Subject: CN=52.35.22.204, O=52.35.22.204 > > Subject Public Key Info: > > Public Key Algorithm: rsaEncryption > > Public-Key: (2048 bit) > > Modulus: > > 00:bd:01:6a:df:ae:35:f2:82:1f:ca:af:cf:7b:97: > > 2f:ec:a5:2d:ec:7c:3d:0a:c3:fb:e2:17:d3:78:b6: > > dc:c6:60:b6:14:eb:6e:5e:96:c2:ef:bf:d8:9f:a7: > > 19:a1:36:a5:82:37:5b:8b:0a:5d:95:00:9c:11:f0: > > 90:77:e6:34:f1:36:b3:c9:62:8e:82:28:d3:41:fd: > > 0a:3e:67:32:57:c2:52:71:8a:9b:99:4c:e0:4b:e4: > > 15:e0:53:0c:46:d0:98:1a:05:8e:79:f4:c6:d4:0b: > > b8:16:ea:24:80:1c:67:67:12:16:c4:29:f1:d5:81: > > ab:4b:b6:a4:b7:f7:a7:ad:11:34:ef:9c:70:dc:a9: > > 4a:da:9f:dd:14:71:7e:7d:b1:91:ab:f6:fb:f3:fd: > > a0:9f:56:ab:89:eb:91:fd:1e:74:d6:55:a0:bb:6e: > > 1d:94:1d:08:c7:26:2d:85:45:46:b4:44:84:e5:ed: > > 68:83:e6:25:2b:fd:82:d5:7c:67:ce:32:d9:15:d1: > > de:00:85:62:d7:f7:ad:a8:c2:17:a1:55:c3:64:08: > > a3:9e:d8:6d:55:f7:4d:a9:4f:73:75:31:74:3c:21: > > 3b:1e:27:6b:fb:3c:40:49:80:55:0c:dd:90:fe:4c: > > da:8c:a4:10:d8:bf:1b:12:15:56:81:0a:15:64:04: > > cc:d3 > > Exponent: 65537 (0x10001) > > X509v3 extensions: > > Netscape Comment: > > FS Server Cert > > X509v3 Basic Constraints: > > CA:FALSE > > X509v3 Subject Key Identifier: > > 74:5E:4B:09:21:37:50:1F:BB:F1: > A8:D5:1D:6D:D7:36:D9:D5:EE:AD > > X509v3 Authority Key Identifier: > > keyid:0B:51:AF:BF:BF:8F:2A:94: > 8A:18:B6:70:4F:9A:0B:FA:EB:4B:49:FC > > DirName:/CN=52.35.22.204/O=52.35.22.204 > > serial:F5:5B:BD:AA:25:4E:16:0B > > > > X509v3 Subject Alternative Name: > > DNS:52.35.22.204 > > Netscape Cert Type: > > SSL Server > > X509v3 Extended Key Usage: > > TLS Web Server Authentication > > Signature Algorithm: sha1WithRSAEncryption > > e7:35:1e:9a:70:6c:1c:61:2f:c8:50:8f:5d:a8:7d:73:cc:a4: > > c0:7a:54:02:65:91:49:82:0b:86:7f:45:44:91:b2:14:32:c3: > > d6:50:5c:41:28:f3:80:ca:ea:2b:c3:2c:d7:d8:09:90:11:8b: > > fe:4e:8d:35:4f:ca:ec:cb:6b:05:ee:63:e3:17:17:4f:be:bb: > > f7:85:f4:4a:3a:34:b6:4f:c1:5c:d7:07:7e:f5:d5:a5:ae:40: > > 3c:25:2a:70:24:6d:0e:3c:e4:e1:64:43:7a:6e:10:ad:a2:9e: > > 38:d5:e3:91:de:4f:e5:60:27:44:58:7c:2a:42:2a:f2:6f:19: > > 60:d5:01:48:01:39:1a:18:30:3a:f5:e7:d8:fd:c6:00:22:a4: > > f7:4b:44:c9:c7:4d:02:2a:d3:d4:1b:f2:e6:35:63:7b:c9:0d: > > 69:2c:38:7f:04:e1:5e:9a:0c:13:21:50:d5:78:3b:22:f4:11: > > f4:09:73:e8:58:c5:c4:ba:33:28:88:cc:28:c7:7b:1b:73:11: > > 06:15:ad:29:1a:25:47:0c:91:be:6d:20:7d:88:6e:6a:a1:53: > > a6:95:84:cc:d3:bc:10:18:e5:43:fa:5c:96:c3:7b:ce:98:c0: > > d3:dc:81:8c:ea:85:83:69:39:63:2e:fa:a1:03:0e:69:5e:be: > > c4:52:8c:25 > > > > [image: Inline image 1] > > > > *Console output:* > > > > tport.c:2749 tport_wakeup_pri() tport_wakeup_pri(0x7fcee8050770): events > IN > > tport.c:862 tport_alloc_secondary() tport_alloc_secondary(0x7fcee8050770): > new secondary tport 0x7fcee8252ea0 > > tport_type_tcp.c:203 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7fcee8252ea0): > Setting TCP_KEEPIDLE to 30 > > tport_type_tcp.c:209 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7fcee8252ea0): > Setting TCP_KEEPINTVL to 30 > > tport_type_tls.c:610 tport_tls_accept() tport_tls_accept(0x7fcee8252ea0): > new connection from tls/50.187.205.251:56612/sips > > tport_tls.c:955 tls_connect() tls_connect(0x7fcee8252ea0): events > NEGOTIATING > > tport_tls.c:1044 tls_connect() tls_connect(0x7fcee8252ea0): TLS setup > failed (error:00000001:lib(0):func(0):reason(1)) > > tport.c:2090 tport_close() tport_close(0x7fcee8252ea0): tls/ > 50.187.205.251:56612/sips > > tport.c:2263 tport_set_secondary_timer() tport(0x7fcee8252ea0): set timer > at 0 ms because zap > > > > > > freeswitch@ip-172-31-28-201> sofia status > > Name Type > Data State > > ============================================================ > ===================================== > > external-ipv6 profile sip:mod_sofia@[::1]:5080 > RUNNING (0) > > 172.31.28.201 alias > internal ALIASED > > external profile sip:mod_ > sofia@52.35.22.204:5080 RUNNING (0) > > external::example.com gateway sip > :joeuser@example.com NOREG > > internal-ipv6 profile sip:mod_sofia@[::1]:5060 > RUNNING (0) > > internal-ipv6 profile sip:mod_sofia@[::1]:5061 > RUNNING (0) (TLS) > > internal profile sip:mod_ > sofia@52.35.22.204:5060 RUNNING (0) > > internal profile sip:mod_ > sofia@52.35.22.204:5061 RUNNING (0) (TLS) > > ============================================================ > ===================================== > > 4 profiles 1 alias > > > > *Under vars.xml:* > > > > <X-PRE-PROCESS cmd="set" data="sip_tls_version=sslv23"/> > > > >  > > <X-PRE-PROCESS cmd="set" data="sip_tls_ciphers=ALL:! > ADH:!LOW:!EXP:!MD5:@STRENGTH"/> > > > >  > > <X-PRE-PROCESS cmd="set" data="internal_auth_calls=true"/> > > <X-PRE-PROCESS cmd="set" data="internal_sip_port=5060"/> > > <X-PRE-PROCESS cmd="set" data="internal_tls_port=5061"/> > > <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> > > <X-PRE-PROCESS cmd="set" data="internal_ssl_dir=/usr/ > local/freeswitch/conf/ssl"/> > > > > *Under internel.xml: * > > > >  > > <param name="tls" value="true"/> > >  > > <param name="tls-only" value="false"/> > >  > > <param name="tls-bind-params" value="transport=tls"/> > >  > > <param name="tls-sip-port" value="$${internal_tls_port}"/> > >  > >  > >  > > <param name="tls-passphrase" value=""/> > >  > > <param name="tls-verify-date" value="true"/> > >  > >  > > <param name="tls-verify-depth" value="2"/> > >  > > <param name="tls-verify-in-subjects" value=""/> > >  > > <param name="tls-version" value="$${sip_tls_version}"/> > > > >  > > <param name="tls-ciphers" value="$${sip_tls_ciphers}"/> > > > > Thanks, > > Clarie > > -- > > Xiyu Zhao > > > > Northeastern University > > College of Engineering > > Telecommunication Systems Management > > Email claire.zxy(a)gmail.com > > > [image: > https://ci3.googleusercontent.com/proxy/h8WFAh45SgjajTR9tfv_578_H8IS9VWD2AQ…] > ᐧ > > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting(a)freeswitch.org > http://www.freeswitchsolutions.com > > Official FreeSWITCH Sites > http://www.freeswitch.org > http://confluence.freeswitch.org > http://www.cluecon.com > > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org > > > > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org > > > > > > -- > > Xiyu Zhao > > > > Northeastern University > > College of Engineering > > Telecommunication Systems Management > > Email claire.zxy(a)gmail.com > > Tel +86- 188-1067-7769 <+86%20188%201067%207769> > > +1-781-526-0715 <(781)%20526-0715> > > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org > > > > > > -- > > Xiyu Zhao > > > > Northeastern University > > College of Engineering > > Telecommunication Systems Management > > Email claire.zxy(a)gmail.com > > Tel +86- 188-1067-7769 <+86%20188%201067%207769> > > +1-781-526-0715 <(781)%20526-0715> > -- Xiyu Zhao Northeastern University College of Engineering Telecommunication Systems Management Email claire.zxy(a)gmail.com Tel +86- 188-1067-7769 +1-781-526-0715

1 0

Letsencrypt and TLS
by Rajil Saraswat 03 Dec '16

03 Dec '16

Hello, I have been using self generated certificates ( https://wiki.freeswitch.org/wiki/SIP_TLS) until now. Is it possible to use Letsencrypt generated certificates for TLS? Thanks

8 10

Building Java ESL bindings
by Daniel Wilson 03 Dec '16

03 Dec '16

Hi all, I'm having trouble getting the ESL "javamod" to build - :/usr/src/fs/v1.6/freeswitch/libs/esl# make javamod make MYLIB=".././.libs/libesl.a" SOLINK="-shared -Xlinker -x" CFLAGS="-I/usr/src/fs/v1.6/freeswitch/libs/esl/src/include -I/usr/include/uuid -I/usr/src/fs/v1.6/freeswitch/src/include -I/usr/src/fs/v1.6/freeswitch/src/include -I/usr/src/fs/v1.6/freeswitch/libs/libteletone/src -fPIC -Werror -Wno-unused-result -fvisibility=hidden -DSWITCH_API_VISIBILITY=1 -DHAVE_VISIBILITY=1 -g -ggdb -DHAVE_OPENSSL" CXXFLAGS="-I/usr/src/fs/v1.6/freeswitch/libs/esl/src/include -I/usr/include/postgresql -I/usr/src/fs/v1.6/freeswitch/src/include -I/usr/src/fs/v1.6/freeswitch/src/include -I/usr/src/fs/v1.6/freeswitch/libs/libteletone/src -fPIC -fvisibility=hidden -DSWITCH_API_VISIBILITY=1 -DHAVE_VISIBILITY=1" CXX_CFLAGS="" -C java make[1]: Entering directory '/usr/src/fs/v1.6/freeswitch/libs/esl/java' g++ -shared -Xlinker -x -o libesljni.so esl_wrap.o .././.libs/libesl.a /usr/bin/ld: esl_wrap.o: relocation R_X86_64_32S against `.rodata' can not be used when making a shared object; recompile with -fPIC esl_wrap.o: error adding symbols: Bad value collect2: error: ld returned 1 exit status Makefile:14: recipe for target 'libesljni.so' failed make[1]: *** [libesljni.so] Error 1 make[1]: Leaving directory '/usr/src/fs/v1.6/freeswitch/libs/esl/java' Makefile:1371: recipe for target 'javamod' failed make: *** [javamod] Error 2 I'm building on a stock Debian 8 but with openjdk-6-jdk installed (have tried against openjdk-7-jdk but with same results). I'm configuring the build as so - ./configure --enable-shared --enable-core-pgsql-support --with-java=/usr/lib/jvm/java-6-openjdk-amd64/ I've tried without --enable-shared also, to no avail. Please can someone point me in the right direction to get this working ? Thanks in advance, Dan

1 1

Re: [Freeswitch-users] SIP TLS still failed with tlsv1
by Xiyu Zhao 03 Dec '16

03 Dec '16

Hi Ken, Sorry for the wrong email format, and thanks so much for looking into this. I’ve changed to tlsv1 instead of sslv23 from both my FreeSWITCH server and client sides. But I got a different error below, it says that “SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate” Could you please take a look? tport.c:2749 tport_wakeup_pri() tport_wakeup_pri(0x7f0e48292a20): events IN tport.c:862 tport_alloc_secondary() tport_alloc_secondary(0x7f0e48292a20): new secondary tport 0x7f0e4809fa70 tport_type_tcp.c:203 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7f0e4809fa70): Setting TCP_KEEPIDLE to 30 tport_type_tcp.c:209 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7f0e4809fa70): Setting TCP_KEEPINTVL to 30 tport_type_tls.c:610 tport_tls_accept() tport_tls_accept(0x7f0e4809fa70): new connection from tls/50.187.205.251:60324/sips <http://50.187.205.251:60324/sips> tport_tls.c:955 tls_connect() tls_connect(0x7f0e4809fa70): events NEGOTIATING tport_tls.c:955 tls_connect() tls_connect(0x7f0e4809fa70): events NEGOTIATING tport_tls.c:1044 tls_connect() tls_connect(0x7f0e4809fa70): TLS setup failed (error:00000001:lib(0):func(0):reason(1)) tport.c:2090 tport_close() tport_close(0x7f0e4809fa70): tls/50.187.205.251:60324/sips <http://50.187.205.251:60324/sips> tport_tls.c:157 tls_log_errors() tls_free: 140890c7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate tport.c:2263 tport_set_secondary_timer() tport(0x7f0e4809fa70): set timer at 0 ms because zap Thanks Claire On Sat, Dec 3, 2016 at 1:29 PM, <freeswitch-users-request(a)lists.freeswitch.org <mailto:freeswitch-users-request@lists.freeswitch.org> > wrote: Send FreeSWITCH-users mailing list submissions to freeswitch-users(a)lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org> To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeswitch.org/mailman/listinfo/freeswitch-users or, via email, send a message with subject or body 'help' to freeswitch-users-request(a)lists.freeswitch.org <mailto:freeswitch-users-request@lists.freeswitch.org> You can reach the person managing the list at freeswitch-users-owner(a)lists.freeswitch.org <mailto:freeswitch-users-owner@lists.freeswitch.org> When replying, please edit your Subject line so it is more specific than "Re: Contents of FreeSWITCH-users digest..." Today's Topics: 1. Re: FreeSWITCH-users Digest, Vol 126, Issue 14 (Ken Rice) ---------- Forwarded message ---------- From: Ken Rice <krice(a)freeswitch.org <mailto:krice@freeswitch.org> > To: "'FreeSWITCH Users Help'" <freeswitch-users(a)lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org> > Cc: Date: Sat, 3 Dec 2016 12:28:52 -0600 Subject: Re: [Freeswitch-users] FreeSWITCH-users Digest, Vol 126, Issue 14 a) Please don’t respond to the digest it breaks the threading the in the archive b) sslv23 is disabled in FreeSWITCH. Its completely broken and not even worth the CPU power to use it. From: freeswitch-users-bounces(a)lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> ] On Behalf Of Xiyu Zhao Sent: Saturday, December 3, 2016 11:59 AM To: freeswitch-users(a)lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org> ; mitch.capper(a)gmail.com <mailto:mitch.capper@gmail.com> Subject: Re: [Freeswitch-users] FreeSWITCH-users Digest, Vol 126, Issue 14 Hi Mitch, I'm using freeswitch server and freeswitch client. So they should be able to do sslv23. Anyway, after I change TLS, I got the same problem. I think it could be my keys doesn't match. There is a comment below from mail list which I don't understand. "cat the key and the cert into agent.pem and the chain cert into cafile.pem and fire it up" What is this mean? Should I go to /usr/local/freeswitch/conf/ssl/CA, and do "cat cacert.pem cakey.pem /usr/local/freeswitch/conf/ssl/agent.pem"? But this still fails. Please help. Thanks in advance. Claire On Sat, Dec 3, 2016 at 12:48 PM, <freeswitch-users-request(a)lists.freeswitch.org <mailto:freeswitch-users-request@lists.freeswitch.org> > wrote: Send FreeSWITCH-users mailing list submissions to freeswitch-users(a)lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org> To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeswitch.org/mailman/listinfo/freeswitch-users or, via email, send a message with subject or body 'help' to freeswitch-users-request(a)lists.freeswitch.org <mailto:freeswitch-users-request@lists.freeswitch.org> You can reach the person managing the list at freeswitch-users-owner(a)lists.freeswitch.org <mailto:freeswitch-users-owner@lists.freeswitch.org> When replying, please edit your Subject line so it is more specific than "Re: Contents of FreeSWITCH-users digest..." Today's Topics: 1. Re: SIP TLS failed with FSClient 1.2.3.5 (Mitch Capper) ---------- Forwarded message ---------- From: Mitch Capper <mitch.capper(a)gmail.com <mailto:mitch.capper@gmail.com> > To: FreeSWITCH Users Help <freeswitch-users(a)lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org> > Cc: Date: Sat, 3 Dec 2016 09:48:06 -0800 Subject: Re: [Freeswitch-users] SIP TLS failed with FSClient 1.2.3.5 sslv23 is not supported on most linux servers now a days, so you most likely need to be using tls instead (under FSClient option). ~Mitch ~mitch On Sat, Dec 3, 2016 at 7:08 AM, Xiyu Zhao <claire.zxy(a)gmail.com <mailto:claire.zxy@gmail.com> > wrote: Hi All, Please help me when you get a chance. I’ve follow the instruction link below to configure TLS in my freeswitch server, but it failed with my FSClient 1.2.3.5. I copied cafile.pem from my freeswitch to my windows desktop and gived the right directory under “TLS Certificate Directory” shown as below screenshot (also attached). https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS But I still cannot log in with tls, console log output, and configuration files are below. Kindly take a look and let me know if additional info is needed. I used ./gentls_cert setup -cn 52.35.22.204 -alt DNS: 52.35.22.204 -org 52.35.22.204. Below is the view of one cert: root@ip-172-31-28-201:/usr/local/freeswitch/conf/ssl# openssl x509 -noout -inform pem -text -in /usr/local/freeswitch/conf/ssl/agent.pem Certificate: Data: Version: 3 (0x2) Serial Number: be:37:19:a3:98:6e:82:19 Signature Algorithm: sha1WithRSAEncryption Issuer: CN=52.35.22.204, O=52.35.22.204 Validity Not Before: Nov 12 21:20:24 2016 GMT Not After : Nov 11 21:20:24 2022 GMT Subject: CN=52.35.22.204, O=52.35.22.204 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:bd:01:6a:df:ae:35:f2:82:1f:ca:af:cf:7b:97: 2f:ec:a5:2d:ec:7c:3d:0a:c3:fb:e2:17:d3:78:b6: dc:c6:60:b6:14:eb:6e:5e:96:c2:ef:bf:d8:9f:a7: 19:a1:36:a5:82:37:5b:8b:0a:5d:95:00:9c:11:f0: 90:77:e6:34:f1:36:b3:c9:62:8e:82:28:d3:41:fd: 0a:3e:67:32:57:c2:52:71:8a:9b:99:4c:e0:4b:e4: 15:e0:53:0c:46:d0:98:1a:05:8e:79:f4:c6:d4:0b: b8:16:ea:24:80:1c:67:67:12:16:c4:29:f1:d5:81: ab:4b:b6:a4:b7:f7:a7:ad:11:34:ef:9c:70:dc:a9: 4a:da:9f:dd:14:71:7e:7d:b1:91:ab:f6:fb:f3:fd: a0:9f:56:ab:89:eb:91:fd:1e:74:d6:55:a0:bb:6e: 1d:94:1d:08:c7:26:2d:85:45:46:b4:44:84:e5:ed: 68:83:e6:25:2b:fd:82:d5:7c:67:ce:32:d9:15:d1: de:00:85:62:d7:f7:ad:a8:c2:17:a1:55:c3:64:08: a3:9e:d8:6d:55:f7:4d:a9:4f:73:75:31:74:3c:21: 3b:1e:27:6b:fb:3c:40:49:80:55:0c:dd:90:fe:4c: da:8c:a4:10:d8:bf:1b:12:15:56:81:0a:15:64:04: cc:d3 Exponent: 65537 (0x10001) X509v3 extensions: Netscape Comment: FS Server Cert X509v3 Basic Constraints: CA:FALSE X509v3 Subject Key Identifier: 74:5E:4B:09:21:37:50:1F:BB:F1:A8:D5:1D:6D:D7:36:D9:D5:EE:AD X509v3 Authority Key Identifier: keyid:0B:51:AF:BF:BF:8F:2A:94:8A:18:B6:70:4F:9A:0B:FA:EB:4B:49:FC DirName:/CN=52.35.22.204/O=52.35.22.204 <http://52.35.22.204/O=52.35.22.204> serial:F5:5B:BD:AA:25:4E:16:0B X509v3 Subject Alternative Name: DNS:52.35.22.204 Netscape Cert Type: SSL Server X509v3 Extended Key Usage: TLS Web Server Authentication Signature Algorithm: sha1WithRSAEncryption e7:35:1e:9a:70:6c:1c:61:2f:c8:50:8f:5d:a8:7d:73:cc:a4: c0:7a:54:02:65:91:49:82:0b:86:7f:45:44:91:b2:14:32:c3: d6:50:5c:41:28:f3:80:ca:ea:2b:c3:2c:d7:d8:09:90:11:8b: fe:4e:8d:35:4f:ca:ec:cb:6b:05:ee:63:e3:17:17:4f:be:bb: f7:85:f4:4a:3a:34:b6:4f:c1:5c:d7:07:7e:f5:d5:a5:ae:40: 3c:25:2a:70:24:6d:0e:3c:e4:e1:64:43:7a:6e:10:ad:a2:9e: 38:d5:e3:91:de:4f:e5:60:27:44:58:7c:2a:42:2a:f2:6f:19: 60:d5:01:48:01:39:1a:18:30:3a:f5:e7:d8:fd:c6:00:22:a4: f7:4b:44:c9:c7:4d:02:2a:d3:d4:1b:f2:e6:35:63:7b:c9:0d: 69:2c:38:7f:04:e1:5e:9a:0c:13:21:50:d5:78:3b:22:f4:11: f4:09:73:e8:58:c5:c4:ba:33:28:88:cc:28:c7:7b:1b:73:11: 06:15:ad:29:1a:25:47:0c:91:be:6d:20:7d:88:6e:6a:a1:53: a6:95:84:cc:d3:bc:10:18:e5:43:fa:5c:96:c3:7b:ce:98:c0: d3:dc:81:8c:ea:85:83:69:39:63:2e:fa:a1:03:0e:69:5e:be: c4:52:8c:25 Console output: tport.c:2749 tport_wakeup_pri() tport_wakeup_pri(0x7fcee8050770): events IN tport.c:862 tport_alloc_secondary() tport_alloc_secondary(0x7fcee8050770): new secondary tport 0x7fcee8252ea0 tport_type_tcp.c:203 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7fcee8252ea0): Setting TCP_KEEPIDLE to 30 tport_type_tcp.c:209 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7fcee8252ea0): Setting TCP_KEEPINTVL to 30 tport_type_tls.c:610 tport_tls_accept() tport_tls_accept(0x7fcee8252ea0): new connection from tls/50.187.205.251:56612/sips <http://50.187.205.251:56612/sips> tport_tls.c:955 tls_connect() tls_connect(0x7fcee8252ea0): events NEGOTIATING tport_tls.c:1044 tls_connect() tls_connect(0x7fcee8252ea0): TLS setup failed (error:00000001:lib(0):func(0):reason(1)) tport.c:2090 tport_close() tport_close(0x7fcee8252ea0): tls/50.187.205.251:56612/sips <http://50.187.205.251:56612/sips> tport.c:2263 tport_set_secondary_timer() tport(0x7fcee8252ea0): set timer at 0 ms because zap freeswitch@ip-172-31-28-201> sofia status Name Type Data State ================================================================================================= external-ipv6 profile sip:mod_sofia@[::1]:5080 RUNNING (0) 172.31.28.201 alias internal ALIASED external profile sip:mod_sofia@52.35.22.204:5080 RUNNING (0) external::example.com <http://example.com/> gateway sip:joeuser@example.com NOREG internal-ipv6 profile sip:mod_sofia@[::1]:5060 RUNNING (0) internal-ipv6 profile sip:mod_sofia@[::1]:5061 RUNNING (0) (TLS) internal profile sip:mod_sofia@52.35.22.204:5060 RUNNING (0) internal profile sip:mod_sofia@52.35.22.204:5061 RUNNING (0) (TLS) ================================================================================================= 4 profiles 1 alias Under vars.xml: <X-PRE-PROCESS cmd="set" data="sip_tls_version=sslv23"/>  <X-PRE-PROCESS cmd="set" data="sip_tls_ciphers=ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"/>  <X-PRE-PROCESS cmd="set" data="internal_auth_calls=true"/> <X-PRE-PROCESS cmd="set" data="internal_sip_port=5060"/> <X-PRE-PROCESS cmd="set" data="internal_tls_port=5061"/> <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> <X-PRE-PROCESS cmd="set" data="internal_ssl_dir=/usr/local/freeswitch/conf/ssl"/> Under internel.xml:  <param name="tls" value="true"/>  <param name="tls-only" value="false"/>  <param name="tls-bind-params" value="transport=tls"/>  <param name="tls-sip-port" value="$${internal_tls_port}"/>    <param name="tls-passphrase" value=""/>  <param name="tls-verify-date" value="true"/>   <param name="tls-verify-depth" value="2"/>  <param name="tls-verify-in-subjects" value=""/>  <param name="tls-version" value="$${sip_tls_version}"/>  <param name="tls-ciphers" value="$${sip_tls_ciphers}"/> Thanks, Clarie -- Xiyu Zhao Northeastern University College of Engineering Telecommunication Systems Management Email claire.zxy(a)gmail.com <mailto:claire.zxy@gmail.com> <https://ci3.googleusercontent.com/proxy/h8WFAh45SgjajTR9tfv_578_H8IS9VWD2AQ…> ᐧ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting(a)freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Xiyu Zhao Northeastern University College of Engineering Telecommunication Systems Management Email claire.zxy(a)gmail.com <mailto:claire.zxy@gmail.com> Tel +86- 188-1067-7769 <tel:+86%20188%201067%207769> +1-781-526-0715 <tel:(781)%20526-0715> _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Xiyu Zhao Northeastern University College of Engineering Telecommunication Systems Management Email claire.zxy(a)gmail.com <mailto:claire.zxy@gmail.com> Tel +86- 188-1067-7769 +1-781-526-0715

1 0

Re: [Freeswitch-users] FreeSWITCH-users Digest, Vol 126, Issue 14
by Xiyu Zhao 03 Dec '16

03 Dec '16

Hi Mitch, I'm using freeswitch server and freeswitch client. So they should be able to do sslv23. Anyway, after I change TLS, I got the same problem. I think it could be my keys doesn't match. There is a comment below from mail list which I don't understand. "cat the key and the cert into agent.pem and the chain cert into cafile.pem and fire it up" What is this mean? Should I go to /usr/local/freeswitch/conf/ssl/CA, and do "cat cacert.pem cakey.pem /usr/local/freeswitch/conf/ssl/agent.pem"? But this still fails. Please help. Thanks in advance. Claire On Sat, Dec 3, 2016 at 12:48 PM, < freeswitch-users-request(a)lists.freeswitch.org> wrote: > Send FreeSWITCH-users mailing list submissions to > freeswitch-users(a)lists.freeswitch.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > or, via email, send a message with subject or body 'help' to > freeswitch-users-request(a)lists.freeswitch.org > > You can reach the person managing the list at > freeswitch-users-owner(a)lists.freeswitch.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of FreeSWITCH-users digest..." > > Today's Topics: > > 1. Re: SIP TLS failed with FSClient 1.2.3.5 (Mitch Capper) > > > ---------- Forwarded message ---------- > From: Mitch Capper <mitch.capper(a)gmail.com> > To: FreeSWITCH Users Help <freeswitch-users(a)lists.freeswitch.org> > Cc: > Date: Sat, 3 Dec 2016 09:48:06 -0800 > Subject: Re: [Freeswitch-users] SIP TLS failed with FSClient 1.2.3.5 > sslv23 is not supported on most linux servers now a days, so you most > likely need to be using tls instead (under FSClient option). > > ~Mitch > > > ~mitch > > On Sat, Dec 3, 2016 at 7:08 AM, Xiyu Zhao <claire.zxy(a)gmail.com> wrote: > >> Hi All, >> >> >> >> Please help me when you get a chance. >> >> >> >> I’ve follow the instruction link below to configure TLS in my freeswitch >> server, but it failed with my FSClient 1.2.3.5. I copied cafile.pem from my >> freeswitch to my windows desktop and gived the right directory under “TLS >> Certificate Directory” shown as below screenshot (also attached). >> >> >> >> https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS >> >> >> >> But I still cannot log in with tls, console log output, and configuration >> files are below. Kindly take a look and let me know if additional info is >> needed. >> >> I used ./gentls_cert setup -cn 52.35.22.204 -alt DNS: 52.35.22.204 -org >> 52.35.22.204. >> >> Below is the view of one cert: >> >> >> >> root@ip-172-31-28-201:/usr/local/freeswitch/conf/ssl# openssl x509 >> -noout -inform pem -text -in /usr/local/freeswitch/conf/ssl/agent.pem >> >> Certificate: >> >> Data: >> >> Version: 3 (0x2) >> >> Serial Number: >> >> be:37:19:a3:98:6e:82:19 >> >> Signature Algorithm: sha1WithRSAEncryption >> >> Issuer: CN=52.35.22.204, O=52.35.22.204 >> >> Validity >> >> Not Before: Nov 12 21:20:24 2016 GMT >> >> Not After : Nov 11 21:20:24 2022 GMT >> >> Subject: CN=52.35.22.204, O=52.35.22.204 >> >> Subject Public Key Info: >> >> Public Key Algorithm: rsaEncryption >> >> Public-Key: (2048 bit) >> >> Modulus: >> >> 00:bd:01:6a:df:ae:35:f2:82:1f:ca:af:cf:7b:97: >> >> 2f:ec:a5:2d:ec:7c:3d:0a:c3:fb:e2:17:d3:78:b6: >> >> dc:c6:60:b6:14:eb:6e:5e:96:c2:ef:bf:d8:9f:a7: >> >> 19:a1:36:a5:82:37:5b:8b:0a:5d:95:00:9c:11:f0: >> >> 90:77:e6:34:f1:36:b3:c9:62:8e:82:28:d3:41:fd: >> >> 0a:3e:67:32:57:c2:52:71:8a:9b:99:4c:e0:4b:e4: >> >> 15:e0:53:0c:46:d0:98:1a:05:8e:79:f4:c6:d4:0b: >> >> b8:16:ea:24:80:1c:67:67:12:16:c4:29:f1:d5:81: >> >> ab:4b:b6:a4:b7:f7:a7:ad:11:34:ef:9c:70:dc:a9: >> >> 4a:da:9f:dd:14:71:7e:7d:b1:91:ab:f6:fb:f3:fd: >> >> a0:9f:56:ab:89:eb:91:fd:1e:74:d6:55:a0:bb:6e: >> >> 1d:94:1d:08:c7:26:2d:85:45:46:b4:44:84:e5:ed: >> >> 68:83:e6:25:2b:fd:82:d5:7c:67:ce:32:d9:15:d1: >> >> de:00:85:62:d7:f7:ad:a8:c2:17:a1:55:c3:64:08: >> >> a3:9e:d8:6d:55:f7:4d:a9:4f:73:75:31:74:3c:21: >> >> 3b:1e:27:6b:fb:3c:40:49:80:55:0c:dd:90:fe:4c: >> >> da:8c:a4:10:d8:bf:1b:12:15:56:81:0a:15:64:04: >> >> cc:d3 >> >> Exponent: 65537 (0x10001) >> >> X509v3 extensions: >> >> Netscape Comment: >> >> FS Server Cert >> >> X509v3 Basic Constraints: >> >> CA:FALSE >> >> X509v3 Subject Key Identifier: >> >> 74:5E:4B:09:21:37:50:1F:BB:F1: >> A8:D5:1D:6D:D7:36:D9:D5:EE:AD >> >> X509v3 Authority Key Identifier: >> >> keyid:0B:51:AF:BF:BF:8F:2A:94: >> 8A:18:B6:70:4F:9A:0B:FA:EB:4B:49:FC >> >> DirName:/CN=52.35.22.204/O=52.35.22.204 >> >> serial:F5:5B:BD:AA:25:4E:16:0B >> >> >> >> X509v3 Subject Alternative Name: >> >> DNS:52.35.22.204 >> >> Netscape Cert Type: >> >> SSL Server >> >> X509v3 Extended Key Usage: >> >> TLS Web Server Authentication >> >> Signature Algorithm: sha1WithRSAEncryption >> >> e7:35:1e:9a:70:6c:1c:61:2f:c8:50:8f:5d:a8:7d:73:cc:a4: >> >> c0:7a:54:02:65:91:49:82:0b:86:7f:45:44:91:b2:14:32:c3: >> >> d6:50:5c:41:28:f3:80:ca:ea:2b:c3:2c:d7:d8:09:90:11:8b: >> >> fe:4e:8d:35:4f:ca:ec:cb:6b:05:ee:63:e3:17:17:4f:be:bb: >> >> f7:85:f4:4a:3a:34:b6:4f:c1:5c:d7:07:7e:f5:d5:a5:ae:40: >> >> 3c:25:2a:70:24:6d:0e:3c:e4:e1:64:43:7a:6e:10:ad:a2:9e: >> >> 38:d5:e3:91:de:4f:e5:60:27:44:58:7c:2a:42:2a:f2:6f:19: >> >> 60:d5:01:48:01:39:1a:18:30:3a:f5:e7:d8:fd:c6:00:22:a4: >> >> f7:4b:44:c9:c7:4d:02:2a:d3:d4:1b:f2:e6:35:63:7b:c9:0d: >> >> 69:2c:38:7f:04:e1:5e:9a:0c:13:21:50:d5:78:3b:22:f4:11: >> >> f4:09:73:e8:58:c5:c4:ba:33:28:88:cc:28:c7:7b:1b:73:11: >> >> 06:15:ad:29:1a:25:47:0c:91:be:6d:20:7d:88:6e:6a:a1:53: >> >> a6:95:84:cc:d3:bc:10:18:e5:43:fa:5c:96:c3:7b:ce:98:c0: >> >> d3:dc:81:8c:ea:85:83:69:39:63:2e:fa:a1:03:0e:69:5e:be: >> >> c4:52:8c:25 >> >> >> [image: Inline image 1] >> >> *Console output:* >> >> >> >> tport.c:2749 tport_wakeup_pri() tport_wakeup_pri(0x7fcee8050770): events >> IN >> >> tport.c:862 tport_alloc_secondary() tport_alloc_secondary(0x7fcee8050770): >> new secondary tport 0x7fcee8252ea0 >> >> tport_type_tcp.c:203 tport_tcp_init_secondary() >> tport_tcp_init_secondary(0x7fcee8252ea0): Setting TCP_KEEPIDLE to 30 >> >> tport_type_tcp.c:209 tport_tcp_init_secondary() >> tport_tcp_init_secondary(0x7fcee8252ea0): Setting TCP_KEEPINTVL to 30 >> >> tport_type_tls.c:610 tport_tls_accept() tport_tls_accept(0x7fcee8252ea0): >> new connection from tls/50.187.205.251:56612/sips >> >> tport_tls.c:955 tls_connect() tls_connect(0x7fcee8252ea0): events >> NEGOTIATING >> >> tport_tls.c:1044 tls_connect() tls_connect(0x7fcee8252ea0): TLS setup >> failed (error:00000001:lib(0):func(0):reason(1)) >> >> tport.c:2090 tport_close() tport_close(0x7fcee8252ea0): tls/ >> 50.187.205.251:56612/sips >> >> tport.c:2263 tport_set_secondary_timer() tport(0x7fcee8252ea0): set timer >> at 0 ms because zap >> >> >> >> >> >> freeswitch@ip-172-31-28-201> sofia status >> >> Name Type >> Data State >> >> ============================================================ >> ===================================== >> >> external-ipv6 profile sip: >> mod_sofia@[::1]:5080 RUNNING (0) >> >> 172.31.28.201 alias >> internal ALIASED >> >> external profile sip:mod_sof >> ia@52.35.22.204:5080 RUNNING (0) >> >> external::example.com gateway sip >> :joeuser@example.com NOREG >> >> internal-ipv6 profile sip: >> mod_sofia@[::1]:5060 RUNNING (0) >> >> internal-ipv6 profile sip: >> mod_sofia@[::1]:5061 RUNNING (0) (TLS) >> >> internal profile sip:mod_sof >> ia@52.35.22.204:5060 RUNNING (0) >> >> internal profile sip:mod_sof >> ia@52.35.22.204:5061 RUNNING (0) (TLS) >> >> ============================================================ >> ===================================== >> >> 4 profiles 1 alias >> >> >> >> *Under vars.xml:* >> >> >> >> <X-PRE-PROCESS cmd="set" data="sip_tls_version=sslv23"/> >> >> >> >>  >> >> <X-PRE-PROCESS cmd="set" data="sip_tls_ciphers=ALL:!ADH >> :!LOW:!EXP:!MD5:@STRENGTH"/> >> >> >> >>  >> >> <X-PRE-PROCESS cmd="set" data="internal_auth_calls=true"/> >> >> <X-PRE-PROCESS cmd="set" data="internal_sip_port=5060"/> >> >> <X-PRE-PROCESS cmd="set" data="internal_tls_port=5061"/> >> >> <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> >> >> <X-PRE-PROCESS cmd="set" data="internal_ssl_dir=/usr/lo >> cal/freeswitch/conf/ssl"/> >> >> >> >> *Under internel.xml: * >> >> >> >>  >> >> <param name="tls" value="true"/> >> >>  >> >> <param name="tls-only" value="false"/> >> >>  >> >> <param name="tls-bind-params" value="transport=tls"/> >> >>  >> >> <param name="tls-sip-port" value="$${internal_tls_port}"/> >> >>  >> >>  >> >>  >> >> <param name="tls-passphrase" value=""/> >> >>  >> >> <param name="tls-verify-date" value="true"/> >> >>  >> >>  >> >> <param name="tls-verify-depth" value="2"/> >> >>  >> >> <param name="tls-verify-in-subjects" value=""/> >> >>  >> >> <param name="tls-version" value="$${sip_tls_version}"/> >> >> >> >>  >> >> <param name="tls-ciphers" value="$${sip_tls_ciphers}"/> >> >> >> >> Thanks, >> >> Clarie >> -- >> Xiyu Zhao >> >> Northeastern University >> College of Engineering >> Telecommunication Systems Management >> Email claire.zxy(a)gmail.com >> >> ᐧ >> >> _________________________________________________________________________ >> Professional FreeSWITCH Consulting Services: >> consulting(a)freeswitch.org >> http://www.freeswitchsolutions.com >> >> Official FreeSWITCH Sites >> http://www.freeswitch.org >> http://confluence.freeswitch.org >> http://www.cluecon.com >> >> FreeSWITCH-users mailing list >> FreeSWITCH-users(a)lists.freeswitch.org >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> http://www.freeswitch.org >> > > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org > > -- Xiyu Zhao Northeastern University College of Engineering Telecommunication Systems Management Email claire.zxy(a)gmail.com Tel +86- 188-1067-7769 +1-781-526-0715

2 1

SIP TLS failed with FSClient 1.2.3.5
by Xiyu Zhao 03 Dec '16

03 Dec '16

Hi All, Please help me when you get a chance. I’ve follow the instruction link below to configure TLS in my freeswitch server, but it failed with my FSClient 1.2.3.5. I copied cafile.pem from my freeswitch to my windows desktop and gived the right directory under “TLS Certificate Directory” shown as below screenshot (also attached). https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS But I still cannot log in with tls, console log output, and configuration files are below. Kindly take a look and let me know if additional info is needed. I used ./gentls_cert setup -cn 52.35.22.204 -alt DNS: 52.35.22.204 -org 52.35.22.204. Below is the view of one cert: root@ip-172-31-28-201:/usr/local/freeswitch/conf/ssl# openssl x509 -noout -inform pem -text -in /usr/local/freeswitch/conf/ssl/agent.pem Certificate: Data: Version: 3 (0x2) Serial Number: be:37:19:a3:98:6e:82:19 Signature Algorithm: sha1WithRSAEncryption Issuer: CN=52.35.22.204, O=52.35.22.204 Validity Not Before: Nov 12 21:20:24 2016 GMT Not After : Nov 11 21:20:24 2022 GMT Subject: CN=52.35.22.204, O=52.35.22.204 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:bd:01:6a:df:ae:35:f2:82:1f:ca:af:cf:7b:97: 2f:ec:a5:2d:ec:7c:3d:0a:c3:fb:e2:17:d3:78:b6: dc:c6:60:b6:14:eb:6e:5e:96:c2:ef:bf:d8:9f:a7: 19:a1:36:a5:82:37:5b:8b:0a:5d:95:00:9c:11:f0: 90:77:e6:34:f1:36:b3:c9:62:8e:82:28:d3:41:fd: 0a:3e:67:32:57:c2:52:71:8a:9b:99:4c:e0:4b:e4: 15:e0:53:0c:46:d0:98:1a:05:8e:79:f4:c6:d4:0b: b8:16:ea:24:80:1c:67:67:12:16:c4:29:f1:d5:81: ab:4b:b6:a4:b7:f7:a7:ad:11:34:ef:9c:70:dc:a9: 4a:da:9f:dd:14:71:7e:7d:b1:91:ab:f6:fb:f3:fd: a0:9f:56:ab:89:eb:91:fd:1e:74:d6:55:a0:bb:6e: 1d:94:1d:08:c7:26:2d:85:45:46:b4:44:84:e5:ed: 68:83:e6:25:2b:fd:82:d5:7c:67:ce:32:d9:15:d1: de:00:85:62:d7:f7:ad:a8:c2:17:a1:55:c3:64:08: a3:9e:d8:6d:55:f7:4d:a9:4f:73:75:31:74:3c:21: 3b:1e:27:6b:fb:3c:40:49:80:55:0c:dd:90:fe:4c: da:8c:a4:10:d8:bf:1b:12:15:56:81:0a:15:64:04: cc:d3 Exponent: 65537 (0x10001) X509v3 extensions: Netscape Comment: FS Server Cert X509v3 Basic Constraints: CA:FALSE X509v3 Subject Key Identifier: 74:5E:4B:09:21:37:50:1F:BB:F1:A8:D5:1D:6D:D7:36:D9:D5:EE:AD X509v3 Authority Key Identifier: keyid:0B:51:AF:BF:BF:8F:2A:94:8A:18:B6:70:4F:9A:0B:FA:EB:4B: 49:FC DirName:/CN=52.35.22.204/O=52.35.22.204 serial:F5:5B:BD:AA:25:4E:16:0B X509v3 Subject Alternative Name: DNS:52.35.22.204 Netscape Cert Type: SSL Server X509v3 Extended Key Usage: TLS Web Server Authentication Signature Algorithm: sha1WithRSAEncryption e7:35:1e:9a:70:6c:1c:61:2f:c8:50:8f:5d:a8:7d:73:cc:a4: c0:7a:54:02:65:91:49:82:0b:86:7f:45:44:91:b2:14:32:c3: d6:50:5c:41:28:f3:80:ca:ea:2b:c3:2c:d7:d8:09:90:11:8b: fe:4e:8d:35:4f:ca:ec:cb:6b:05:ee:63:e3:17:17:4f:be:bb: f7:85:f4:4a:3a:34:b6:4f:c1:5c:d7:07:7e:f5:d5:a5:ae:40: 3c:25:2a:70:24:6d:0e:3c:e4:e1:64:43:7a:6e:10:ad:a2:9e: 38:d5:e3:91:de:4f:e5:60:27:44:58:7c:2a:42:2a:f2:6f:19: 60:d5:01:48:01:39:1a:18:30:3a:f5:e7:d8:fd:c6:00:22:a4: f7:4b:44:c9:c7:4d:02:2a:d3:d4:1b:f2:e6:35:63:7b:c9:0d: 69:2c:38:7f:04:e1:5e:9a:0c:13:21:50:d5:78:3b:22:f4:11: f4:09:73:e8:58:c5:c4:ba:33:28:88:cc:28:c7:7b:1b:73:11: 06:15:ad:29:1a:25:47:0c:91:be:6d:20:7d:88:6e:6a:a1:53: a6:95:84:cc:d3:bc:10:18:e5:43:fa:5c:96:c3:7b:ce:98:c0: d3:dc:81:8c:ea:85:83:69:39:63:2e:fa:a1:03:0e:69:5e:be: c4:52:8c:25 [image: Inline image 1] *Console output:* tport.c:2749 tport_wakeup_pri() tport_wakeup_pri(0x7fcee8050770): events IN tport.c:862 tport_alloc_secondary() tport_alloc_secondary(0x7fcee8050770): new secondary tport 0x7fcee8252ea0 tport_type_tcp.c:203 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7fcee8252ea0): Setting TCP_KEEPIDLE to 30 tport_type_tcp.c:209 tport_tcp_init_secondary() tport_tcp_init_secondary(0x7fcee8252ea0): Setting TCP_KEEPINTVL to 30 tport_type_tls.c:610 tport_tls_accept() tport_tls_accept(0x7fcee8252ea0): new connection from tls/50.187.205.251:56612/sips tport_tls.c:955 tls_connect() tls_connect(0x7fcee8252ea0): events NEGOTIATING tport_tls.c:1044 tls_connect() tls_connect(0x7fcee8252ea0): TLS setup failed (error:00000001:lib(0):func(0):reason(1)) tport.c:2090 tport_close() tport_close(0x7fcee8252ea0): tls/ 50.187.205.251:56612/sips tport.c:2263 tport_set_secondary_timer() tport(0x7fcee8252ea0): set timer at 0 ms because zap freeswitch@ip-172-31-28-201> sofia status Name Type Data State ============================================================ ===================================== external-ipv6 profile sip:mod_sofia@[::1]:5080 RUNNING (0) 172.31.28.201 alias internal ALIASED external profile sip:mod_sofia@52.35.22.204:5080 RUNNING (0) external::example.com gateway sip:joeuser@example.com NOREG internal-ipv6 profile sip:mod_sofia@[::1]:5060 RUNNING (0) internal-ipv6 profile sip:mod_sofia@[::1]:5061 RUNNING (0) (TLS) internal profile sip:mod_sofia@52.35.22.204:5060 RUNNING (0) internal profile sip:mod_sofia@52.35.22.204:5061 RUNNING (0) (TLS) ============================================================ ===================================== 4 profiles 1 alias *Under vars.xml:* <X-PRE-PROCESS cmd="set" data="sip_tls_version=sslv23"/>  <X-PRE-PROCESS cmd="set" data="sip_tls_ciphers=ALL:! ADH:!LOW:!EXP:!MD5:@STRENGTH"/>  <X-PRE-PROCESS cmd="set" data="internal_auth_calls=true"/> <X-PRE-PROCESS cmd="set" data="internal_sip_port=5060"/> <X-PRE-PROCESS cmd="set" data="internal_tls_port=5061"/> <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> <X-PRE-PROCESS cmd="set" data="internal_ssl_dir=/usr/ local/freeswitch/conf/ssl"/> *Under internel.xml: *  <param name="tls" value="true"/>  <param name="tls-only" value="false"/>  <param name="tls-bind-params" value="transport=tls"/>  <param name="tls-sip-port" value="$${internal_tls_port}"/>    <param name="tls-passphrase" value=""/>  <param name="tls-verify-date" value="true"/>   <param name="tls-verify-depth" value="2"/>  <param name="tls-verify-in-subjects" value=""/>  <param name="tls-version" value="$${sip_tls_version}"/>  <param name="tls-ciphers" value="$${sip_tls_ciphers}"/> Thanks, Clarie -- Xiyu Zhao Northeastern University College of Engineering Telecommunication Systems Management Email claire.zxy(a)gmail.com ᐧ

2 1

WARNING T.30 Non-ECM carrier not found
by Mimiko 02 Dec '16

02 Dec '16

Hello. 1) Recently I've implemented receiving fax by FS. When a fax is in process of receiving sometimes in log appears this warning: mod_spandsp_fax.c:291 WARNING T.30 Non-ECM carrier not found Then when I look in final tif image I see some distortion, like black interrupted lines and a portion of image is missing. Its like from page were cut a string and it was glued together at rims. This lines can appear 1,2,3 times and is equal to number of warnings. Where does the fault produce. 2) Also some faxes come in incorrect page orientation. Original is portrait, but resulting tif is in landscape and image is stretched to fit long edge and short edge. How can I specify to FS to always use portrait orientation? 3) Some times a receiving party have to answer the call and redirect the calling party to fax receiving extension by bond digits. So I use in dialplan: default: <extension name="Local_Extension"> <condition field="destination_number" expression="^([1-9]\d\d\d)$"> <action application="bind_digit_action" data="$${domain_name},*7,exec:execute_extension,rxfax_stream_transfer XML features_local,peer,self"/> <action application="bridge" data="user/${dialed_extension}@${domain_name}"/> </condition> features_local: <extension name="rxfax_stream_transfer"> <condition field="destination_number" expression="^rxfax_stream_transfer$"> <action application="transfer" data="-bleg rxfax_stream XML features_local"/> </condition> </extension> How can I avoid using an additional extension for transferring incoming call to rxfax_stream extension using only one command to bind_digit_action ? <action application="bind_digit_action" data="$${domain_name},*7,exec:transfer,rxfax_stream XML features_local,peer,self"/> <action application="bind_digit_action" data="$${domain_name},*7,exec:transfer,rxfax_stream XML features_local,peer,peer"/> <action application="bind_digit_action" data="$${domain_name},*7,exec:transfer,rxfax_stream XML features_local,peer,booth"/> all transfers the called party to the fax receive application. Thank you for answers.

2 2

ESL for subscribing Channel Events
by Lợi Đặng 02 Dec '16

02 Dec '16

Hi List, I want, but is unable to subscribe to 2 events CHANNEL_CREATE and CHANNEL_DESTROY using ESL. In a normal call caller <--> FS <--> callee, 2 CHANNEL_CREATE and 2 CHANNEL_DESTROY events fired and captured is my expectation. I achieved it easily via writing a new FS module in C. But I have some portion of python codes needed to be executed, so I tried alternative (my thought) way: - ESL inbound mode, but inbound connection is not bound to any particular channel - ESL outbound mode, but outbound connection is created from dialplan, so I guess CHANNEL_CREATE event could not be captured. - set up hangup_hook with mod_python, but python application is also called from dialplan. Please correct me if I'm wrong somehow, and give me some advices for what I'm trying to accomplish, since I don't want to rewrite my python code in C. Any help would be appreciated. rgds, Loi Dang Thanh Phone : +84.1224.735.448 Email : loi.dangthanh(a)gmail.com

4 4

ICE STUN Binding Response
by Colin Morelli 02 Dec '16

02 Dec '16

Hey all, I created a bug a little while ago for an issue I was having with STUN binding responses during ICE negotiations on re-invites - https://freeswitch.org/jira/browse/FS-9711 I'm trying to work on the issue now (assuming others agree it's an issue), but I was hoping to hear from the community (and the FS folks) on how it's expected to/desired to work. The brief gist is that it seems to be possible for FS to have a disagreement between the remote RTP address, and the remote address it expects to receive STUN binding requests from (more details and logs can be found on the ticket). Assuming this doesn't end up being solely my issue (I don't think it is but I'm not 100% confident), would you expect that FS: 1. Trust the RTP address, and only send STUN binding responses to that - this is the current behavior, which means I just need to figure out why FS can sometimes end up in a state where it doesn't send STUN binding responses to the address it's receiving and sending RTP from/to. 2. Trust the STUN binding request, and update the remote RTP address to the one that STUN bindings are received from. If anyone has inputs/preferences, would be great to hear - a lot of this is still somewhat new to me. Would also appreciate assistance if anyone can. Thanks in advance, Colin P.S. - To the FS folks, I assumed this conversation was safe to have in the mailing list since the bug is reported with info separately and I'm looking for community input, but if you'd prefer this be in JIRA feel free to let me know.

1 0

limit works but limit_usage always reports 0
by Thorsten Göllner 02 Dec '16

02 Dec '16

Hi there, I am using freeswitch 1.6.13~64bit and have trouble with limit_usage. I use the following simplified dialplan: <extension name="test"> <condition field="destination_number" expression="^100$"> <action application="limit" data="hash realm1 res1 1/600" /> <action application="answer"/> <action application="conference" data="$1-${domain_name}@cdquality"/> </condition> </extension> <extension name="limit_exceeded"> <condition field="destination_number" expression="^limit_exceeded$"> <action application="answer"/> <action application="playback" data="/audio/too_often.wav"/> <action application="hangup"/> </condition> </extension> As you can see, I use application limit - and here only 1 call per 10 minutes should be fine. So the second call goes to limit_exceeded. This works fine. From the shell I use the following command to query the limit status: fs_cli -x "limit_usage hash realm1 res1" But this command always returns "0". I expect it to report the current limit status - for example "1" when the first call goes to limit_exceeded. Do I expect the wrong thing or do I make a mistake? Thanks in advance, Thorsten

1 0