sr-users September 2010

sr-users@lists.kamailio.org

58 participants
97 discussions

please help to register sip phone to kamailio server via tls support.

by peter_green lion

hi all, I have configured tls support in kamailio, but i cannot register sip phone. my configure : I create cert and private key as: "kamctl tls userCERT user" log show : Creating directory /usr/local/etc/kamailio//tls/user Creating user certificate request Generating a 512 bit RSA private key ..++++++++++++ ...................++++++++++++ writing new private key to '/usr/local/etc/kamailio//tls/user/user-privkey.pem' ----- Signing certificate request Using configuration from /usr/local/etc/kamailio//tls/request.conf Enter pass phrase for ./rootCA/private/cakey.pem: Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :PRINTABLE:'somename.somewhere.com' stateOrProvinceName :PRINTABLE:'Some State' countryName :PRINTABLE:'XY' emailAddress :IA5STRING:'root(a)somename.somewhere.com' organizationName :PRINTABLE:'My Large Organization Name' organizationalUnitName:PRINTABLE:'My Subunit of Large Organization' Certificate is to be certified until Sep 4 09:13:58 2011 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated Generating CA list DONE INFO: Private key is locate at /usr/local/etc/kamailio//tls/user/user-privkey.pem INFO: Certificate is locate at /usr/local/etc/kamailio//tls/user/user-cert.pem INFO: CA-List is locate at /usr/local/etc/kamailio//tls/user/user-calist.pem I add to kamailio.cfg enable_tls=1 tcp_async=no modparam("tls", "tls_method", "TLSv1") modparam("tls", "certificate", "/usr/local/etc/kamailio//tls/user/user-cert.pem") modparam("tls", "private_key", "/usr/local/etc/kamailio//tls/user/user-privkey.pem") modparam("tls", "ca_list", "/usr/local/etc/kamailio//tls/user/user-calist.pem") modparam("tls", "verify_certificate", 1) modparam("tls", "require_certificate", 1) i restart kamailio: "kamctl restart" log in tail -f /var/log/message Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:175]: TLSc<default>: tls_method=9 Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:185]: TLSc<default>: certificate='/usr/local/etc/kamailio//tls/user/user-cert.pem' Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:190]: TLSc<default>: ca_list='/usr/local/etc/kamailio//tls/user/user-calist.pem' Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:193]: TLSc<default>: require_certificate=1 Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:198]: TLSc<default>: cipher_list='(null)' Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:203]: TLSc<default>: private_key='/usr/local/etc/kamailio//tls/user/user-privkey.pem' Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:206]: TLSc<default>: verify_certificate=1 Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:209]: TLSc<default>: verify_depth=9 Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:331]: TLSc<default>: Server MUST present valid certificate Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: WARNING: tls [tls_domain.c:395]: tls: set_ssl_options: openssl SSL_OP_TLS_BLOCK_PADDING bug workaround enabled (openssl version 90802f) Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3116]: INFO: ctl [io_listener.c:224]: io_listen_loop: using epoll_lt io watch method (config) i see that kamailio start okie, but sip phone cannot register. log in :tail -f /var/log/message: Sep 4 05:18:50 appliance /usr/local/sbin/kamailio[3117]: ERROR: tls [tls_server.c:392]: SSL error:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca in portgo : certificate validation failure. please suggest to fix it, thanks. Peter green

13 years, 10 months

A piece of history - 9 years SER

by Daniel-Constantin Mierla

Hello, fyi, today are 9 years since first source code commit of SIP Express Router (SER) happened. It started with: git log --pretty=format:"%h%x09%an%x09%ad%x09%s" --reverse | head -3 512dcd9 Andrei Pelinescu-Onciul Mon Sep 3 21:27:11 2001 +0000 Initial revision 888ca09 Andrei Pelinescu-Onciul Tue Sep 4 01:41:39 2001 +0000 parser seems to work e60a972 Andrei Pelinescu-Onciul Tue Sep 4 20:55:41 2001 +0000 First working release Today, 3286 days later, it counts 14 200 commits __only__ in development branch. I digested some statistics and made them available at: http://bit.ly/9J4EKb There are interesting facts about most productive time frames (i.e., hour, day, ...), evolution of default configuration files, command line parameters, ... IPv6 support is there since 2002, but no convenient public network to use it yet. Enjoy and enhance the content as you have interesting aspects of history to add... ... and, VERY important, do not forget to start testing 3.1.0, we are in pre-release phase, there are a lot of new features I am sure you want on your production system: http://sip-router.org/wiki/features/new-in-devel Cheers, Daniel -- Daniel-Constantin Mierla http://www.asipto.com

13 years, 10 months

help to fix error when using tls module.

by peter_green lion

hi all, I have come back with another problem. I have install kamailio with tls module supported. is there any way to check this module run or not ? thanks for help . Peter Green.

13 years, 10 months

help for SIP client configuration

by zed li

Dear sir, How are you? I have installed SER and it runs well. Now I am adding a SIP client to make phone call. I downloaded SERCTL and up, but do not know to use it. Could you tell me how to install and use the software? Or another way is to add user to the tables in MySQL? could you tell me what tables we are using and how to do it? I am sorry to bother you, but I searched the Internet and have got no clear solution. Best regards Zongyin

13 years, 10 months

failure_route send 500 retry later

by Alejandro Mellado G.

Hi' I'm trying to forward the call to voicemail on sems when the time of response is out. When the user isn't in location, the forward to voicemail work very fine ( $rc = -1 ). But failure_route, doesn't work and send message "500 Retry Later". I'm using kamailio 3.0.2 and I'm probing with: modparam("tm", "fr_timer", 10) modparam("tm", "fr_inv_timer", 15) ... ... failure_route[FAIL_ONE] { #!ifdef WITH_NAT if (is_method("INVITE") && (isbflagset("6") || isflagset(5))) { unforce_rtp_proxy(); } #!endif if (t_is_canceled()) { exit; } if (t_check_status("486|408")) { revert_uri(); avp_db_load("$ruri","$avp(s:email_address)/$email_scheme"); append_hf("P-App-Name: myvoicemail\r\n"); append_hf("P-App-Param: Email-Address=$avp(s:email_address)\r\n"); rewritehostport("sems_host:5080"); append_branch(); t_relay(); } } Thanks. -- Saluda Atte, Alejandro Mauricio Mellado Gatica Escuela de Ingeniería Informática Universidad Católica de Temuco _________________________________

13 years, 10 months

Question about avp_db_load

by Raúl Alexis Betancor Santana

Hi all .. I'm trying to change the way avp_db_load works on my current config to load avp's from DB based on $fU and $fd and not based on uuid, so I have try this ... ... modparam("avpops", "avp_table", "usr_preferences") modparam("avpops", "use_domain", 1) ... # load caller avps avp_db_load("$fu/username", "*"); ... With no success .. because the query that is send to the DB is: select value,attribute,type from usr_preferences where username='{$fU value}' instedad of select value,attribute,type from usr_preferences where username='{$fU value}' and domain='{$fd value}' witch is what I expect when using use_domain=1 Any clue about what I'm doing wrong? Best regards -- Raúl Alexis Betancor Santana Dimensión Virtual

13 years, 10 months

Unable to load IPv6 locations

by Mikko Lehto

Hi I am doing simple registration test with IPv6 enabled SIP phone. It seems that Kamailio is unable to load back registrations done via v6 socket after restart. Here is (some) content of location table before starting proxy: --- mysql> select username,contact,socket from location; +----------+-----------------------------------------------+---------------------------------+ | username | contact | socket +----------+-----------------------------------------------+---------------------------------+ | ml6 | sip:ml6@[2a00:17b8::55]:5060;line=z79d766z | udp:2A00:17B8:0:0:0:0:0:67:5060 | | ml4 | sip:ml4@89.18.234.88:5060;line=dp77j5yo | udp:89.18.243.167:5060 | --- Here are the error messages during startup: --- 1(26374) DEBUG: usrloc [udomain.c:415]: loading records - cycle [1] 1(26374) ERROR: <core> [main.c:1116]: ERROR: parse_phostport: too many colons in udp:2A00:17B8:0:0:0:0:0:67:5060 1(26374) ERROR: usrloc [udomain.c:314]: bad socket <udp:2A00:17B8:0:0:0:0:0:67:5060> 1(26374) ERROR: usrloc [udomain.c:430]: sipping record for ml6 in table location --- Here are the listen statements from config: --- listen=udp:[2a00:17b8::67]:5060 listen=udp:89.18.243.167:5060 --- DB is MySQL 5.1, OS is Debian Squeeze. Kamailio version is 3.0.3 and it is from kamailio.org APT repository. At least I just found a typo (sipping), but did I also found a bug? -- Mikko Lehto

13 years, 10 months

help to fix bug in TLS module.

by peter_green lion

hi all, I have configure to use TLS module,but i have a problem in step : create key. i follow these step: Creating CA certificate ----------------------- 1. create CA dir mkdir ca cd ca 2. create ca dir structure and files (see ca(1)) mkdir demoCA #default CA name, edit /etc/ss/openssl.cnf mkdir demoCA/private mkdir demoCA/newcerts touch demoCA/index.txt echo 01 >demoCA/serial 2. create CA private key openssl genrsa -out demoCA/private/cakey.pem 2048 chmod 600 demoCA/private/cakey.pem 3. create CA self-signed certificate openssl req -out demoCA/cacert.pem -x509 -new -key demoCA/private/cakey.pem Creating a server/client certificate ------------------------------------ 1. create a certificate request (and its private key in privkey.pem) openssl req -out ser1_cert_req.pem -new -nodes WARNING: the organization name should be the same as in the ca certificate. 2. sign it with the ca certificate openssl ca -in ser1_cert_req.pem -out ser1_cert.pem 3. copy ser1_cert.pem to your ser config. dir Setting ser to use the certificate ---------------------------------- 1. create the ca list file: for each of your ca certificates that you intend to use do: cat cacert.pem >>calist.pem 2. copy your ser certificate, private key and ca list file to your intended machine (preferably in your ser cfg. directory, this is the default place ser searches for) 3. set up ser.cfg to use the certificate if your ser certificate name is different from cert.pem or it is not placed in ser cfg. directory, add to your ser.cfg: modparam("tls", "certificate", "/path/cert_file_name") 4. set up ser to use the private key if your private key is not contained in the certificate (or the certificate name is not the default cert.pem), add to your ser.cfg: modparam("tls", "private_key", "/path/private_key_file") 5. set up ser to use the ca list (optional) add to your ser.cfg: modparam("tls", "ca_list", "/path/ca_list_file") 6. set up tls authentication options: modparam("tls", "verify_certificate", 1) modparam("tls", "require_certificate", 1) (for more information see the module parameters documentation) but in step : 2. sign it with the ca certificate(command :openssl ca -in ser1_cert_req.pem -out ser1_cert.pe ) i have error and it openssl can not make file "ser1_cert.pem " the error is : [root@appliance ca]# openssl ca -in ser1_cert_req.pem -out ser1_cert.pem Using configuration from /etc/pki/tls/openssl.cnf Error opening CA private key ../../CA/private/cakey.pem 15231:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('../../CA/private/cakey.pem','r') 15231:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: unable to load CA private key please help me to fix it, or suggest to check and make it work. thanks all. Peter green

13 years, 10 months

error when install kamailio with TLS module.

by peter_green lion

hi all, I try to install kamailio with enable TLS module, but it raise error. when i enable module TLS and run command make all,make install, the error is : #make install Makefile.defs defs skipped make[1]: Entering directory `/usr/src/kamailio-3.0.1/modules/tls' MAIN_NAME=kamailio ./sip-router_cert.sh -d /usr/local/etc/kamailio/ hostname: Unknown host ./sip-router_cert.sh: line 142: which: command not found Could not find openssl command Set OPENSSL environment variable properly (see -h for more info) make[1]: *** [install-tls-cert] Error 1 make[1]: Leaving directory `/usr/src/kamailio-3.0.1/modules/tls' make: *** [install-modules] Error 1 [root@appliance kamailio-3.0.1]# please help me find and fix this problem, thanks for help me. Beter_green.

13 years, 10 months

Using multiple media proxy pools

by Stagg Shelton

I have a requirement that I hope can be accomplished. I have to connect to three providers who will be delivering a private IP Layer 2 ethernet endpoint. I need to be able to direct the SIP calls via Kamailio and have the RTP media process through mediaproxy. I also need to try and avoid using separate physical media proxy machines for each SIP provider. Is it possible to run multiple mediaproxy dispatchers bound to separate IP addresses, and run multiple relays with IP addresses corresponding to the various dispatcher subnets. Basically I want to identify pools of mediaproxy servers and choose them based on the provider origination or termination. Alternatively we could use RTP Proxy, though we do not have as much experience with RTP Proxy. Any suggestions that you may have is appreciated. Thanks Stagg

13 years, 10 months

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

sr-users September 2010