Hello fellows, after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too. It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort. An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello. Enjoy, make it better, and share it :) #!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet" if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'" echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com, use \"1010@pbx.example.com \"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com\"" echo "" case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac -- Sincerely, Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
For a cut and paste ready version, that has the correct carriage returns (mangled by mail), check it in FreeSWITCH documentation: https://freeswitch.org/confluence/display/FREESWITCH/Packet+Capture#PacketCa... -giovanni On 2 May 2017 at 16:26, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Hello fellows,
after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too.
It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort.
An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello.
Enjoy, make it better, and share it :)
#!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet"
if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'"
echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com, use \" 1010@pbx.example.com\"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com\"" echo ""
case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
-- Sincerely, Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
Thank you Giovanni, that is a useful tool - we will document it in the OpenSIPS TLS tutorial, so other can benefit ;) Many thanks, Bogdan-Andrei Iancu OpenSIPS Founder and Developer http://www.opensips-solutions.com OpenSIPS Summit May 2017 Amsterdam http://www.opensips.org/events/Summit-2017Amsterdam.html On 05/02/2017 05:52 PM, Giovanni Maruzzelli wrote:
For a cut and paste ready version, that has the correct carriage returns (mangled by mail), check it in FreeSWITCH documentation:
https://freeswitch.org/confluence/display/FREESWITCH/Packet+Capture#PacketCa...
-giovanni
On 2 May 2017 at 16:26, Giovanni Maruzzelli <gmaruzz@gmail.com <mailto:gmaruzz@gmail.com>> wrote:
Hello fellows,
after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too.
It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort.
An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello.
Enjoy, make it better, and share it :)
#!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet"
if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'"
echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com <mailto:1010@pbx.example.com>, use \"1010@pbx.example.com <mailto:1010@pbx.example.com>\"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com <mailto:98@pbx.example.com>\"" echo ""
case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_______________________________________________ Users mailing list Users@lists.opensips.org http://lists.opensips.org/cgi-bin/mailman/listinfo/users
On 9 May 2017 at 15:18, Bogdan-Andrei Iancu <bogdan@opensips.org> wrote:
Thank you Giovanni, that is a useful tool - we will document it in the OpenSIPS TLS tutorial, so other can benefit ;)
Glad about it! Be sure to get it from https://freeswitch.org/confluence/display/FREESWITCH/ Packet+Capture#PacketCapture-TLSwithsharka , is the latest version with a couple fixes. -giovanni
Many thanks,
Bogdan-Andrei Iancu OpenSIPS Founder and Developer http://www.opensips-solutions.com
OpenSIPS Summit May 2017 Amsterdam http://www.opensips.org/events/Summit-2017Amsterdam.html
On 05/02/2017 05:52 PM, Giovanni Maruzzelli wrote:
For a cut and paste ready version, that has the correct carriage returns (mangled by mail), check it in FreeSWITCH documentation:
https://freeswitch.org/confluence/display/FREESWITCH/ Packet+Capture#PacketCapture-TLSwithsharka
-giovanni
On 2 May 2017 at 16:26, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Hello fellows,
after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too.
It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort.
An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello.
Enjoy, make it better, and share it :)
#!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet"
if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'"
echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com, use \" 1010@pbx.example.com\"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com\"" echo ""
case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_______________________________________________ Users mailing listUsers@lists.opensips.orghttp://lists.opensips.org/cgi-bin/mailman/listinfo/users
-- Sincerely, Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
Thanks for this script! Theoretically it is possible to see TLS SIP traffic with freeswitch sending HEP to Homer. But there seems to be a bug in FS that only sends one side of SIP conversation (ie the FS side, not inbound messages).. On Tue, May 9, 2017 at 11:10 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
On 9 May 2017 at 15:18, Bogdan-Andrei Iancu <bogdan@opensips.org> wrote:
Thank you Giovanni, that is a useful tool - we will document it in the OpenSIPS TLS tutorial, so other can benefit ;)
Glad about it! Be sure to get it from https://freeswitch.org/conflue nce/display/FREESWITCH/Packet+Capture#PacketCapture-TLSwithsharka , is the latest version with a couple fixes.
-giovanni
Many thanks,
Bogdan-Andrei Iancu OpenSIPS Founder and Developer http://www.opensips-solutions.com
OpenSIPS Summit May 2017 Amsterdam http://www.opensips.org/events/Summit-2017Amsterdam.html
On 05/02/2017 05:52 PM, Giovanni Maruzzelli wrote:
For a cut and paste ready version, that has the correct carriage returns (mangled by mail), check it in FreeSWITCH documentation:
https://freeswitch.org/confluence/display/FREESWITCH/Packet+ Capture#PacketCapture-TLSwithsharka
-giovanni
On 2 May 2017 at 16:26, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Hello fellows,
after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too.
It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort.
An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello.
Enjoy, make it better, and share it :)
#!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet"
if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'"
echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com, use \" 1010@pbx.example.com\"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com\"" echo ""
case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_______________________________________________ Users mailing listUsers@lists.opensips.orghttp://lists.opensips.org/cgi-bin/mailman/listinfo/users
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On 10 May 2017 at 21:38, Daniel Greenwald <dig1234@gmail.com> wrote:
Thanks for this script! Theoretically it is possible to see TLS SIP traffic with freeswitch sending HEP to Homer. But there seems to be a bug in FS that only sends one side of SIP conversation (ie the FS side, not inbound messages)..
Daniel, have you had this problem yourself, or just heard about? Have you opened a jira issue for it? If you encountered this problem, please report it in Jira. Please never report bugs in mailing list only, they will be lost and forgot. Jira is how we manage bugs ;) -giovanni
On Tue, May 9, 2017 at 11:10 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
On 9 May 2017 at 15:18, Bogdan-Andrei Iancu <bogdan@opensips.org> wrote:
Thank you Giovanni, that is a useful tool - we will document it in the OpenSIPS TLS tutorial, so other can benefit ;)
Glad about it! Be sure to get it from https://freeswitch.org/conflue nce/display/FREESWITCH/Packet+Capture#PacketCapture-TLSwithsharka , is the latest version with a couple fixes.
-giovanni
Many thanks,
Bogdan-Andrei Iancu OpenSIPS Founder and Developer http://www.opensips-solutions.com
OpenSIPS Summit May 2017 Amsterdam http://www.opensips.org/events/Summit-2017Amsterdam.html
On 05/02/2017 05:52 PM, Giovanni Maruzzelli wrote:
For a cut and paste ready version, that has the correct carriage returns (mangled by mail), check it in FreeSWITCH documentation:
https://freeswitch.org/confluence/display/FREESWITCH/Packet+ Capture#PacketCapture-TLSwithsharka
-giovanni
On 2 May 2017 at 16:26, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Hello fellows,
after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too.
It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort.
An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello.
Enjoy, make it better, and share it :)
#!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet"
if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'"
echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com, use \" 1010@pbx.example.com\"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com\"" echo ""
case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_______________________________________________ Users mailing listUsers@lists.opensips.orghttp://lists.opensips.org/cgi-bin/mailman/listinfo/users
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
Does HEP send verto signaling info to Homer too? On 10 May 2017 at 21:38, Daniel Greenwald <dig1234@gmail.com> wrote:
Thanks for this script! Theoretically it is possible to see TLS SIP traffic with freeswitch sending HEP to Homer. But there seems to be a bug in FS that only sends one side of SIP conversation (ie the FS side, not inbound messages)..
On Tue, May 9, 2017 at 11:10 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
On 9 May 2017 at 15:18, Bogdan-Andrei Iancu <bogdan@opensips.org> wrote:
Thank you Giovanni, that is a useful tool - we will document it in the OpenSIPS TLS tutorial, so other can benefit ;)
Glad about it! Be sure to get it from https://freeswitch.org/conflue nce/display/FREESWITCH/Packet+Capture#PacketCapture-TLSwithsharka , is the latest version with a couple fixes.
-giovanni
Many thanks,
Bogdan-Andrei Iancu OpenSIPS Founder and Developer http://www.opensips-solutions.com
OpenSIPS Summit May 2017 Amsterdam http://www.opensips.org/events/Summit-2017Amsterdam.html
On 05/02/2017 05:52 PM, Giovanni Maruzzelli wrote:
For a cut and paste ready version, that has the correct carriage returns (mangled by mail), check it in FreeSWITCH documentation:
https://freeswitch.org/confluence/display/FREESWITCH/Packet+ Capture#PacketCapture-TLSwithsharka
-giovanni
On 2 May 2017 at 16:26, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Hello fellows,
after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too.
It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort.
An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello.
Enjoy, make it better, and share it :)
#!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet"
if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'"
echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com, use \" 1010@pbx.example.com\"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com\"" echo ""
case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_______________________________________________ Users mailing listUsers@lists.opensips.orghttp://lists.opensips.org/cgi-bin/mailman/listinfo/users
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Giovanni- I personally experience this issue on three different systems. I've tried all hep versions, and confirmed not a homer issue via wireshark. ie the HEP is not being sent for Inbound TLS messages. I did report it to Jira in Oct 2016 but got little attention. I still find HEP useful for outbound messages but it would be really nice to have two way SIP conversation in cleartext... https://freeswitch.org/jira/browse/FS-9657 On Thu, May 11, 2017 at 11:45 AM, Tamas Jalsovszky <jalsot@gmail.com> wrote:
Does HEP send verto signaling info to Homer too?
On 10 May 2017 at 21:38, Daniel Greenwald <dig1234@gmail.com> wrote:
Thanks for this script! Theoretically it is possible to see TLS SIP traffic with freeswitch sending HEP to Homer. But there seems to be a bug in FS that only sends one side of SIP conversation (ie the FS side, not inbound messages)..
On Tue, May 9, 2017 at 11:10 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
On 9 May 2017 at 15:18, Bogdan-Andrei Iancu <bogdan@opensips.org> wrote:
Thank you Giovanni, that is a useful tool - we will document it in the OpenSIPS TLS tutorial, so other can benefit ;)
Glad about it! Be sure to get it from https://freeswitch.org/conflue nce/display/FREESWITCH/Packet+Capture#PacketCapture-TLSwithsharka , is the latest version with a couple fixes.
-giovanni
Many thanks,
Bogdan-Andrei Iancu OpenSIPS Founder and Developer http://www.opensips-solutions.com
OpenSIPS Summit May 2017 Amsterdam http://www.opensips.org/events/Summit-2017Amsterdam.html
On 05/02/2017 05:52 PM, Giovanni Maruzzelli wrote:
For a cut and paste ready version, that has the correct carriage returns (mangled by mail), check it in FreeSWITCH documentation:
https://freeswitch.org/confluence/display/FREESWITCH/Packet+ Capture#PacketCapture-TLSwithsharka
-giovanni
On 2 May 2017 at 16:26, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Hello fellows,
after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too.
It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort.
An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello.
Enjoy, make it better, and share it :)
#!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet"
if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'"
echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com, use \" 1010@pbx.example.com\"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com\"" echo ""
case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_______________________________________________ Users mailing listUsers@lists.opensips.orghttp://lists.opensips.org/cgi-bin/mailman/listinfo/users
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hello Daniel, I would suggest this: test it with latest master git code, add to your jira all relevant traces etc with latest (eg, today's) git master code. This will bump attention to it. -giovanni On 12 May 2017 at 20:37, Daniel Greenwald <dig1234@gmail.com> wrote:
Giovanni- I personally experience this issue on three different systems. I've tried all hep versions, and confirmed not a homer issue via wireshark. ie the HEP is not being sent for Inbound TLS messages. I did report it to Jira in Oct 2016 but got little attention. I still find HEP useful for outbound messages but it would be really nice to have two way SIP conversation in cleartext...
https://freeswitch.org/jira/browse/FS-9657
On Thu, May 11, 2017 at 11:45 AM, Tamas Jalsovszky <jalsot@gmail.com> wrote:
Does HEP send verto signaling info to Homer too?
On 10 May 2017 at 21:38, Daniel Greenwald <dig1234@gmail.com> wrote:
Thanks for this script! Theoretically it is possible to see TLS SIP traffic with freeswitch sending HEP to Homer. But there seems to be a bug in FS that only sends one side of SIP conversation (ie the FS side, not inbound messages)..
On Tue, May 9, 2017 at 11:10 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
On 9 May 2017 at 15:18, Bogdan-Andrei Iancu <bogdan@opensips.org> wrote:
Thank you Giovanni, that is a useful tool - we will document it in the OpenSIPS TLS tutorial, so other can benefit ;)
Glad about it! Be sure to get it from https://freeswitch.org/conflue nce/display/FREESWITCH/Packet+Capture#PacketCapture-TLSwithsharka , is the latest version with a couple fixes.
-giovanni
Many thanks,
Bogdan-Andrei Iancu OpenSIPS Founder and Developer http://www.opensips-solutions.com
OpenSIPS Summit May 2017 Amsterdam http://www.opensips.org/events/Summit-2017Amsterdam.html
On 05/02/2017 05:52 PM, Giovanni Maruzzelli wrote:
For a cut and paste ready version, that has the correct carriage returns (mangled by mail), check it in FreeSWITCH documentation:
https://freeswitch.org/confluence/display/FREESWITCH/Packet+ Capture#PacketCapture-TLSwithsharka
-giovanni
On 2 May 2017 at 16:26, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Hello fellows,
after some experimentation with various tools, I come out with a little shell tool that maybe can be useful to you too.
It can only work with non-forward secrecy ciphers, obviously, and only if is started before the client do the initial TLS handshake (eg, just restart the client). Forward secrecy cannot be decrypted after fact, so don't waste effort.
An example of ciphers that can be decrypted are the "AES256-SHA" openssl cipher group. You can use ssldump to check what cipher is used by serverhello.
Enjoy, make it better, and share it :)
#!/bin/bash # brought to you by Giovanni Maruzzelli # SERVERIP="192.168.1.150" SERVERPORT="5061" PRIVKEY="/etc/certs/privkey.pem" STDERR2DEVNULL=" 2>/dev/null " REGEX="notyet"
if [ -z "$1" ]; then REGEX="\\\.*" else REGEX="$1" fi FILTER="ssl.app_data and sip matches" FILTER2="$FILTER \"$REGEX\"" FILTER3="'$FILTER2'" ARGUMENT="-i 1 -Y $FILTER3 -E header=y -T fields -e frame.number -e frame.time -e frame.time_delta_displayed -e ip.src -e ip.dst -e sip.Status-Line -e sip.Request-Line -e sip.msg_hdr -l -d tcp.port\=\=5061,sip -o \"ssl.keys_list: $SERVERIP,$SERVERPORT,sip,$PRIVKEY\" $STDERR2DEVNULL | sed -u 's/\t/\n/g' | sed -u '/^$/d' | sed -u 's/^[0-9]*$/\n==&==============================/g'"
echo "" echo "NB: if it do not works, edit script so that STDERR2DEVNULL=\" \" and try again" echo "" echo "NB: remember to quote and escape match patterns, using triple slash" echo " eg, for matching 1010@pbx.example.com, use \" 1010@pbx.example.com\"" echo " eg, for matching anything, use \"\\\\\\.*\"" echo " eg, for matching *98, use \"\\\\\\*98\"" echo "USAGE: $0 \"\\\\\\*98@pbx.example.com\"" echo ""
case "$1" in -help|--help|?) exit 0 ;; *) echo "THIS TIME WE'RE DOING:" echo "tshark $ARGUMENT" echo "" bash -c "tshark $ARGUMENT" ;; esac
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
_______________________________________________ Users mailing listUsers@lists.opensips.orghttp://lists.opensips.org/cgi-bin/mailman/listinfo/users
--
Sincerely,
Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Giovanni Maruzzelli OpenTelecom.IT cell: +39 347 266 56 18
participants (4)
-
Bogdan-Andrei Iancu
-
Daniel Greenwald
-
Giovanni Maruzzelli
-
Tamas Jalsovszky