Hi Carsten, Thanks for your responce and please excuse my late reply too. I'm still working on the changes and will make a pull request as soon as I am ready. It will be a separate module which handles the IPSec tunnel creation/tear down, so that ims_register_pcscf won't be polluted with platform specific functionality. You are right, that new module can be ifdef-ed and replaced with something *BSD specific or whatever OS someone wants to use. Best regards, Tsvetomir On Fri, Oct 13, 2017 at 6:21 AM, Carsten Bock <carsten(a)ng-voice.com> wrote:

Hi Tsvetomir, any updates regarding this? I believe otherwise, I would assign ressources from our side for this in February/March next year. However, I would want to avoid double work. You can share it privately with me, if you don't want to publish it yet. Thanks, Carsten 2017-10-19 9:49 GMT+02:00 Tsvetomir Dimitrov <tsv.dimitrov(a)gmail.com>om>: -- Carsten Bock CEO (Geschäftsführer) ng-voice GmbH Millerntorplatz 1 20359 Hamburg / Germany http://www.ng-voice.com mailto:carsten@ng-voice.com Office +49 40 5247593-40 Fax +49 40 5247593-99 Sitz der Gesellschaft: Hamburg Registergericht: Amtsgericht Hamburg, HRB 120189 Geschäftsführer: Carsten Bock Ust-ID: DE279344284 Hier finden Sie unsere handelsrechtlichen Pflichtangaben: http://www.ng-voice.com/imprint/

Hello Carsten, I promised to share the code with you. I wanted to push it in a better shape, but I've got some difficulties, which take me more time than expected. You can check it here: https://github.com/tdimitrov/kamailio/tree/ipsec-wip The code is far from production ready, but my main priority for now is to make it work with real phone. My issue in nutshell: when the UE sends IPSec protected REGISTER I can see the message reaching P-CSCF (in wireshark), but the REGISTER is not delivered to the kamailio process. The ipsec itself is initialised correctly (at least I see no errors). I think the issue is that the UDP checksum of the REGISTER is wrong due to a NAT. I see lots of lines like this in dmesg: [11782894.569952] UDP: bad checksum. From 192.168.178.61:6177 to 192.168.178.167:5061 ulen 1332 Currently I'm working on a fix for this. I think there is a socket option to disable UDP checksum validation, but I want to avoid this. If you have got experience with such issues, any help is highly appreciated :) Besides this there is some more work on the module, but nothing serious: - IPSec tunnels are not destroyed on deregister. - IPSec tunnels are not cleaned up in case of ungraceful kamailio shutdown. - Logic to allocate unique local IPSec ports to each UE is required. - Some hardcoded params should be replaced with module config options. I'll update this thread when I have got any significant progress. Best regards, Tsvetomir On Mon, Dec 11, 2017 at 5:15 PM, Tsvetomir Dimitrov <tsv.dimitrov(a)gmail.com> wrote: