Hi Kristian Many thanks for the information. We did end up spotting the transport protocol change eventually, this has been highlighted to Acrobits who say they will investigate for us. However we didnt spot the incrementing port number issue, so thanks for pointing that one out! I will drop a quick e-mail once we get it all up and running, thanks again. Cheers Ben -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Kristian Kielhofner Sent: 27 September 2011 03:26 To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] TLS issue Ben, This SIP trace looks pretty clean except for the final BYE (big surprise). Especially the Contact: field generated by 192.168.250.20 and the IP:port used by the client: Contact: <sips:1002@192.168.250.20:49221;transport=tcp> You'll notice the Contact field in the other packets uses the SIP URI scheme with a SIP transport=tls URI parameter: Contact: <sip:1002@192.168.250.20:49220;transport=tls> Either URI scheme/format is considered "compliant" depending on who you talk to, which implementation you're using, etc, etc. It's SIP ;). I'm almost completely certain that changing the URI scheme mid call, however, is not compliant. This seems to be a bug in the Acrobits client. Another concern - the other packets seem to come from 192.168.250.20:49221, not 192.168.250.20:49220. Now your client is: 1) Switching the URI scheme and parameters mid-call. 2) Incrementing the source TCP port number (for some reason). Either one (certainly both) of these conditions will most likely cause the received BYE to not be recognized by FreeSWITCH. On Mon, Sep 26, 2011 at 7:07 AM, Ben Naylor <bnaylor@sirran.com> wrote:
Hi Anthony
Thanks for the information, we have been using the suggested command today.
It appears that the BYE messages may not be reaching the called device properly when using TLS. When using UDP, the BYE messages are relayed to the called party as normal.
One thing we did notice is that BYE messages from the calling client are sent in the format '1002@192.168.250.18' , whereas the called client sends BYE messages in the format 'mod_sofia@192.168.250.18'. However we assumed this is normal behaviour.
We have also communicated these issues to the SIP client developer to see if they can shed any light on this.
Here is a SIP trace for a call between the two clients -
freeswitch@localhost.localdomain> freeswitch@localhost.localdomain> recv 1053 bytes from tls/[192.168.250.20]:49220 at 10:30:51.137867: ---------------------------------------------------------------------- -- INVITE sip:1003@192.168.250.18 SIP/2.0 Via: SIP/2.0/TLS 192.168.250.20:49220;branch=z9hG4bK3PhRphI56AiqPIBh;rport Contact: <sip:1002@192.168.250.20:49220;transport=tls> Max-Forwards: 70 From: <sip:1002@192.168.250.18>;tag=8614E3ED232BC82FF4EA5D313E6AF6D0 Allow: OPTIONS, INVITE, ACK, REFER, CANCEL, BYE, NOTIFY Supported: replaces, path User-Agent: Acrobits Softphone Business/1.8.8 To: <sip:1003@192.168.250.18> Content-Type: application/sdp Call-ID: 55F45E25069A293B6E96D2EC24C30D30F4AF99B0 CSeq: 1 INVITE Proxy-Authorization: Digest username="1002",realm="192.168.250.18",algorithm=MD5,uri="sip:1003@192 .168.2 50.18",nonce="df6eed19-bd20-460a-b5ac-7e44946e729a",qop=auth,cnonce="4 042a69 2f4f53c4479be6b2e765c37de",nc=00000005,response="bc47467ac4faac81bac59 f37e4d df7cb" Content-Length: 246
v=0 o=- 19191 16302 IN IP4 192.168.250.20 s=epkccjl c=IN IP4 192.168.250.20 t=0 0 m=audio 17570 RTP/AVP 0 8 9 102 3 101 a=rtpmap:101 telephone-event/8000 a=rtpmap:102 ILBC/8000 a=fmtp:102 mode=20 a=fmtp:101 0-15 a=ptime:20 a=sendrecv ---------------------------------------------------------------------- -- send 372 bytes to tls/[192.168.250.20]:49220 at 10:30:51.138777: ---------------------------------------------------------------------- -- SIP/2.0 100 Trying Via: SIP/2.0/TLS 192.168.250.20:49220;branch=z9hG4bK3PhRphI56AiqPIBh;rport=49220 From: <sip:1002@192.168.250.18>;tag=8614E3ED232BC82FF4EA5D313E6AF6D0 To: <sip:1003@192.168.250.18> Call-ID: 55F45E25069A293B6E96D2EC24C30D30F4AF99B0 CSeq: 1 INVITE User-Agent: FreeSWITCH-mod_sofia/1.0.head-git-6724d7a 2011-09-23 01-25-43 +0000 Content-Length: 0
---------------------------------------------------------------------- -- 2011-09-26 11:30:51.132657 [NOTICE] switch_channel.c:911 New Channel sofia/internal/1002@192.168.250.18 [f8c38b20-5662-4c82-b364-47b316f4fd13] 2011-09-26 11:30:51.172669 [NOTICE] switch_channel.c:911 New Channel sofia/internal/sip:1003@192.168.250.11:49179 [439d5373-b000-4ed0-b299-4b4808f8ddda] send 1252 bytes to tls/[192.168.250.11]:49179 at 10:30:51.179780: ---------------------------------------------------------------------- -- INVITE sip:1003@192.168.250.11:49179;rinstance=69F3D1AD;transport=tls SIP/2.0 Via: SIP/2.0/TLS 192.168.250.18;branch=z9hG4bKyHm8ttBjB7Dmj Max-Forwards: 69 From: "Extension 1002" <sip:1002@192.168.250.18>;tag=861g6FpZm4KHe To: <sip:1003@192.168.250.11:49179;rinstance=69F3D1AD;transport=tls> Call-ID: 729a5dfc-62cd-122f-2d9c-001cc071031a CSeq: 18180461 INVITE Contact: <sip:mod_sofia@192.168.250.18:5061;transport=tls> User-Agent: FreeSWITCH-mod_sofia/1.0.head-git-6724d7a 2011-09-23 01-25-43 +0000 Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces Allow-Events: talk, hold, presence, dialog, line-seize, call-info, sla, include-session-description, presence.winfo, message-summary, refer Content-Type: application/sdp Content-Disposition: session Content-Length: 234 X-FS-Support: update_display Remote-Party-ID: "Extension 1002" <sip:1002@192.168.250.18>;party=calling;screen=yes;privacy=off
v=0 o=- 19191 16302 IN IP4 192.168.250.20 s=epkccjl c=IN IP4 192.168.250.20 t=0 0 m=audio 17570 RTP/AVP 0 8 9 102 3 101 a=rtpmap:102 ILBC/8000 a=fmtp:102 mode=20 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=ptime:20 ---------------------------------------------------------------------- -- recv 321 bytes from tls/[192.168.250.11]:49179 at 10:30:51.400065: ---------------------------------------------------------------------- -- SIP/2.0 100 Trying Via: SIP/2.0/TLS 192.168.250.18;branch=z9hG4bKyHm8ttBjB7Dmj;rport=5061 From: "Extension 1002" <sip:1002@192.168.250.18>;tag=861g6FpZm4KHe Call-ID: 729a5dfc-62cd-122f-2d9c-001cc071031a CSeq: 18180461 INVITE To: <sip:1003@192.168.250.11:49179;rinstance=69F3D1AD;transport=tls> Content-Length: 0
---------------------------------------------------------------------- -- recv 499 bytes from tls/[192.168.250.11]:49179 at 10:30:51.417353: ---------------------------------------------------------------------- -- SIP/2.0 180 Ringing Via: SIP/2.0/TLS 192.168.250.18;branch=z9hG4bKyHm8ttBjB7Dmj;rport=5061 Contact: <sip:1003@192.168.250.11:49179;transport=tls> From: "Extension 1002" <sip:1002@192.168.250.18>;tag=861g6FpZm4KHe Call-ID: 729a5dfc-62cd-122f-2d9c-001cc071031a CSeq: 18180461 INVITE To: <sip:1003@192.168.250.11:49179;rinstance=69F3D1AD;transport=tls>;tag=5 A4771A 2806D8CDF36D39CDFEB4B0E50 Allow: OPTIONS, INVITE, ACK, REFER, CANCEL, BYE, NOTIFY Supported: replaces, path Content-Length: 0
---------------------------------------------------------------------- -- 2011-09-26 11:30:51.412650 [NOTICE] sofia.c:5235 Ring-Ready sofia/internal/sip:1003@192.168.250.11:49179! 2011-09-26 11:30:51.412650 [NOTICE] mod_sofia.c:2391 Ring-Ready sofia/internal/1002@192.168.250.18! send 866 bytes to tls/[192.168.250.20]:49220 at 10:30:51.422883: ---------------------------------------------------------------------- -- SIP/2.0 180 Ringing Via: SIP/2.0/TLS 192.168.250.20:49220;branch=z9hG4bK3PhRphI56AiqPIBh;rport=49220 From: <sip:1002@192.168.250.18>;tag=8614E3ED232BC82FF4EA5D313E6AF6D0 To: <sip:1003@192.168.250.18>;tag=7X8Q4m5UQUXyj Call-ID: 55F45E25069A293B6E96D2EC24C30D30F4AF99B0 CSeq: 1 INVITE Contact: <sip:1003@192.168.250.18:5061;transport=tls> User-Agent: FreeSWITCH-mod_sofia/1.0.head-git-6724d7a 2011-09-23 01-25-43 +0000 Accept: application/sdp Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces Allow-Events: talk, hold, presence, dialog, line-seize, call-info, sla, include-session-description, presence.winfo, message-summary, refer Content-Length: 0 Remote-Party-ID: "Outbound Call" <sip:1003@192.168.250.18>;party=calling;privacy=off;screen=no
---------------------------------------------------------------------- -- 2011-09-26 11:30:51.412650 [NOTICE] switch_ivr_originate.c:481 Ring Ready sofia/internal/1002@192.168.250.18! recv 719 bytes from tls/[192.168.250.11]:49179 at 10:30:54.585965: ---------------------------------------------------------------------- -- SIP/2.0 200 OK Via: SIP/2.0/TLS 192.168.250.18;branch=z9hG4bKyHm8ttBjB7Dmj;rport=5061 Contact: <sip:1003@192.168.250.11:49179;transport=tls> From: "Extension 1002" <sip:1002@192.168.250.18>;tag=861g6FpZm4KHe Call-ID: 729a5dfc-62cd-122f-2d9c-001cc071031a CSeq: 18180461 INVITE To: <sip:1003@192.168.250.11:49179;rinstance=69F3D1AD;transport=tls>;tag=5 A4771A 2806D8CDF36D39CDFEB4B0E50 Allow: OPTIONS, INVITE, ACK, REFER, CANCEL, BYE, NOTIFY Supported: replaces, path Content-Type: application/sdp Content-Length: 192
v=0 o=- 41521 15327 IN IP4 192.168.250.11 s=yqsmhzj c=IN IP4 192.168.250.11 t=0 0 m=audio 60032 RTP/AVP 0 101 a=rtpmap:101 TELEPHONE-EVENT/8000 a=fmtp:101 0-15 a=ptime:20 a=sendrecv ---------------------------------------------------------------------- -- send 459 bytes to tls/[192.168.250.11]:49179 at 10:30:54.589056: ---------------------------------------------------------------------- -- ACK sip:1003@192.168.250.11:49179;transport=tls SIP/2.0 Via: SIP/2.0/TLS 192.168.250.18;branch=z9hG4bKZtD1vNvN8F46D Max-Forwards: 70 From: "Extension 1002" <sip:1002@192.168.250.18>;tag=861g6FpZm4KHe To: <sip:1003@192.168.250.11:49179;rinstance=69F3D1AD;transport=tls>;tag=5 A4771A 2806D8CDF36D39CDFEB4B0E50 Call-ID: 729a5dfc-62cd-122f-2d9c-001cc071031a CSeq: 18180461 ACK Contact: <sip:mod_sofia@192.168.250.18:5061;transport=tls> Content-Length: 0
---------------------------------------------------------------------- -- 2011-09-26 11:30:54.572557 [NOTICE] sofia.c:5802 Channel [sofia/internal/sip:1003@192.168.250.11:49179] has been answered 2011-09-26 11:30:54.592567 [NOTICE] switch_ivr_originate.c:481 Ring Ready sofia/internal/1002@192.168.250.18! send 1079 bytes to tls/[192.168.250.20]:49220 at 10:30:54.596443: ---------------------------------------------------------------------- -- SIP/2.0 200 OK Via: SIP/2.0/TLS 192.168.250.20:49220;branch=z9hG4bK3PhRphI56AiqPIBh;rport=49220 From: <sip:1002@192.168.250.18>;tag=8614E3ED232BC82FF4EA5D313E6AF6D0 To: <sip:1003@192.168.250.18>;tag=7X8Q4m5UQUXyj Call-ID: 55F45E25069A293B6E96D2EC24C30D30F4AF99B0 CSeq: 1 INVITE Contact: <sip:1003@192.168.250.18:5061;transport=tls> User-Agent: FreeSWITCH-mod_sofia/1.0.head-git-6724d7a 2011-09-23 01-25-43 +0000 Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces Allow-Events: talk, hold, presence, dialog, line-seize, call-info, sla, include-session-description, presence.winfo, message-summary, refer Content-Type: application/sdp Content-Disposition: session Content-Length: 180 Remote-Party-ID: "Outbound Call" <sip:1003@192.168.250.18>;party=calling;privacy=off;screen=no
v=02011-09-26 11:30:54.592567 [NOTICE] switch_ivr.c:706 Channel [sofia/internal/1002@192.168.250.18] has been answered
o=- 41521 15327 IN IP4 192.168.250.11 s=yqsmhzj c=IN IP4 192.168.250.11 t=0 0 m=audio 60032 RTP/AVP 0 101 a=rtpmap:101 TELEPHONE-EVENT/8000 a=fmtp:101 0-15 a=ptime:20 ---------------------------------------------------------------------- -- recv 618 bytes from tls/[192.168.250.20]:49220 at 10:30:54.756293: ---------------------------------------------------------------------- -- ACK sip:1003@192.168.250.18:5061;transport=tls SIP/2.0 Via: SIP/2.0/TLS 192.168.250.20:49220;branch=z9hG4bK3PhRphI56AiqPIBh;rport Max-Forwards: 70 To: <sip:1003@192.168.250.18>;tag=7X8Q4m5UQUXyj From: <sip:1002@192.168.250.18>;tag=8614E3ED232BC82FF4EA5D313E6AF6D0 Call-ID: 55F45E25069A293B6E96D2EC24C30D30F4AF99B0 CSeq: 1 ACK Proxy-Authorization: Digest username="1002",realm="192.168.250.18",algorithm=MD5,uri="sip:1003@192 .168.2 50.18",nonce="df6eed19-bd20-460a-b5ac-7e44946e729a",qop=auth,cnonce="4 042a69 2f4f53c4479be6b2e765c37de",nc=00000005,response="bc47467ac4faac81bac59 f37e4d df7cb" Content-Length: 0
---------------------------------------------------------------------- -- recv 825 bytes from tls/[192.168.250.20]:49221 at 10:31:00.397189: ---------------------------------------------------------------------- -- BYE sip:1003@192.168.250.18:5061;transport=tls SIP/2.0 Via: SIP/2.0/TCP 192.168.250.20:49221;branch=z9hG4bKLDntiDuXixOceTKx;rport Contact: <sips:1002@192.168.250.20:49221;transport=tcp> Max-Forwards: 70 From: <sip:1002@192.168.250.18>;tag=8614E3ED232BC82FF4EA5D313E6AF6D0 Allow: OPTIONS, INVITE, ACK, REFER, CANCEL, BYE, NOTIFY Supported: replaces, path User-Agent: Acrobits Softphone Business/1.8.8 To: <sip:1003@192.168.250.18>;tag=7X8Q4m5UQUXyj Call-ID: 55F45E25069A293B6E96D2EC24C30D30F4AF99B0 CSeq: 2 BYE Proxy-Authorization: Digest username="1002",realm="192.168.250.18",algorithm=MD5,uri="sip:1003@192 .168.2 50.18:5061;transport=tls",nonce="df6eed19-bd20-460a-b5ac-7e44946e729a" ,qop=a uth,cnonce="e2160338300c683de4a96cacce593376",nc=00000006,response="b1 546d9b c75688462874c2617671f1f7" Content-Length: 0
---------------------------------------------------------------------- --
Kind regards
Ben
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Anthony Minessale Sent: 24 September 2011 19:59 To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] TLS issue
you could try using the command
sofia global siptrace on
to see what you are getting.
On Sat, Sep 24, 2011 at 7:14 AM, Ben Naylor <bnaylor@sirran.com> wrote:
Hello Freeswitch community!
I was wondering if someone could help me with an issue I am experiencing when using TLS to secure SIP traffic?
Our current test environment consists of a Freeswitch test server, a wireless access point, and 2 x iPhones using SIP client, all connected to the same closed off VLAN.
The Freeswitch server is set to bypass media=true, so that the RTP traffic flows directly between the iPhones. When testing a call using standard SIP/RTP, the call is successful, and terminates correctly when one of the devices hangs up the call.
The problem occurs when using TLS, and trying to terminate the call. The call establishes successfully, but when either of the handsets hangs up, the other remains connected to the call. This happens when hanging up the call from both the calling and the called handset.
One thing I noticed when looking at the console output, is that two messages appear along the lines of unknown Sip packet (apologies for the vagueness, I am not currently in front of the test server). These appear when the call is terminated on one of the hand sets.
Has anyone had a similar experience when using TLS in this type of scenario?
Thanks for the help!
Regards
Ben
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-us e rs http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
-- Kristian Kielhofner FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org