<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>
</p>
<div class="moz-text-flowed" style="font-family: -moz-fixed;
font-size: 12px;" lang="x-unicode">Hello Kamailions,
<br>
<br>
Ive beent trying to configure a tls connection between kamailio
servers, but looks like Im missing some knowledge.
<br>
<br>
The situation:
<br>
<br>
phone1 <> internet <> kamailio1 <internet>
kamailio2<> internet <> phone2
<br>
<br>
The phones are yealink phones, they are connected using TLS v1.2,
phone 1 registers at kamailio1 and phone2 registers at kamailio2.
<br>
<br>
Both kamailio servers have an letsencrypt certificate.
<br>
<br>
When the connection between the two kamailio servers is set as
sip, a call from a phone1 to phone2 the singnaling is forwarded
and rtp flows.
<br>
<br>
When I set the connection between the two kamailio servers to tls,
things go wrong.. or better said I go wrong.
<br>
<br>
The kamailio log on the receiving kamailio(kamailio2) shows that
things go wrong and where, but I just cant figure out how to solve
it.
<br>
<br>
The log shows that the tls connection will be handled by the TLS
Default configuration, the CA certificate is missing, well
unknown.
<br>
<br>
15(7209) DEBUG: <core> [core/ip_addr.c:229]: print_ip():
tcpconn_new: new tcp connection: 116.203.53.212
<br>
15(7209) DEBUG: <core> [core/tcp_main.c:999]: tcpconn_new():
on port 44153, type 3
<br>
15(7209) DEBUG: <core> [core/tcp_main.c:1309]:
tcpconn_add(): hashes: 1805:3331:3809, 3
<br>
15(7209) DEBUG: <core> [core/io_wait.h:380]: io_watch_add():
DBG: io_watch_add(0xa77de0, 32, 2, 0x7ff9596d4b10), fd_no=23
<br>
15(7209) DEBUG: <core> [core/io_wait.h:602]: io_watch_del():
DBG: io_watch_del (0xa77de0, 32, -1, 0x0) fd_no=24 called
<br>
15(7209) DEBUG: <core> [core/tcp_main.c:4196]:
handle_tcpconn_ev(): sending to child, events 1
<br>
15(7209) DEBUG: <core> [core/tcp_main.c:3878]: send2child():
selected tcp worker 1 8(7202) for activity on
[tls:kamailio2:5061], 0x7ff9596d4b10
<br>
8(7202) DEBUG: <core> [core/tcp_read.c:1759]: handle_io():
received n=8 con=0x7ff9596d4b10, fd=9
<br>
8(7202) DEBUG: tls [tls_server.c:199]: tls_complete_init():
completing tls connection initialization
<br>
8(7202) DEBUG: tls [tls_server.c:228]: tls_complete_init(): Using
initial TLS domain TLSs<default> (dom 0x7ff959498600 ctx
0x7ff9594b6430 sn [])
<br>
8(7202) DEBUG: tls [tls_domain.c:724]:
sr_ssl_ctx_info_callback(): SSL handshake started
<br>
8(7202) DEBUG: <core> [core/tcp_main.c:2460]:
tcpconn_do_send(): sending...
<br>
8(7202) DEBUG: <core> [core/tcp_main.c:2494]:
tcpconn_do_send(): after real write: c= 0x7ff9596d4b10 n=2637 fd=9
<br>
8(7202) DEBUG: <core> [core/tcp_main.c:2495]:
tcpconn_do_send(): buf=
<br>
<br>
8(7202) DEBUG: <core> [core/io_wait.h:380]: io_watch_add():
DBG: io_watch_add(0xac78a0, 9, 2, 0x7ff9596d4b10), fd_no=1
<br>
8(7202) ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS
accept:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert
unknown ca
<br>
8(7202) ERROR: <core> [core/tcp_read.c:1505]:
tcp_read_req(): ERROR: tcp_read_req: error reading - c:
0x7ff9596d4b10 r: 0x7ff9596d4b90 (-1)
<br>
8(7202) DEBUG: <core> [core/io_wait.h:602]: io_watch_del():
DBG: io_watch_del (0xac78a0, 9, -1, 0x10) fd_no=2 called
<br>
8(7202) DEBUG: <core> [core/tcp_read.c:1683]:
release_tcpconn(): releasing con 0x7ff9596d4b10, state -2, fd=9,
id=3 (kamailio1]:44153 -> [kamailio1]:5061)
<br>
8(7202) DEBUG: <core> [core/tcp_read.c:1684]:
release_tcpconn(): extra_data 0x7ff9596d2ab0
<br>
15(7209) DEBUG: <core> [core/tcp_main.c:3308]:
handle_tcp_child(): reader response= 7ff9596d4b10, -2 from 1
<br>
15(7209) DEBUG: tls [tls_server.c:667]: tls_h_close(): Closing SSL
connection 0x7ff9596d2ab0
<br>
<br>
I assume I have configured tls.cfg partially correct, as the
phones register and can make tls calls.
<br>
<br>
What I find strange is this line: 8(7202) DEBUG: <core>
[core/tcp_read.c:1683]: release_tcpconn(): releasing con
0x7ff9596d4b10, state -2, fd=9, id=3 (kamailio1]:44153 ->
[kamailio1]:5061)
<br>
<br>
Would the "[kamailio1]:5061" be the client configuration?
<br>
<br>
So, what do I need to configure within the tls.cfg file so when a
tls connection is initiated from the other server it will work.
<br>
<br>
I have tried adding the other server as server within the tls.cfg,
which does not work as kamailio is not listening on the ip address
configured.
<br>
<br>
When I add the server as a client in the tls.cfg as follows, the
connection is handled by the default TLS configuration.
<br>
<br>
[server:default]<br>
method = TLSv1.2<br>
verify_certificate = no<br>
require_certificate = no<br>
private_key = /etc/letsencrypt/live/kamailio.kazlow.nl/privkey.pem<br>
certificate =
/etc/letsencrypt/live/kamailio.kazlow.nl/fullchain.pem<br>
#ca_list = /etc/kamailio/tls/cacert.pem<br>
#crl = /etc/kamailio/tls/crl.pem<br>
<br>
[client:kamailio1:5061]<br>
method = TLSv1.2<br>
verify_certificate = no<br>
require_certificate = yes<br>
certificate = /etc/kamailio/tls/fullchain.pem<br>
ca_list = /etc/kamailio/tls/cacert.pem<br>
<br>
<br>
# This is the default client domain, settings<br>
# in this domain will be used for all outgoing<br>
# TLS connections that do not match any other<br>
# client domain in this configuration file.<br>
# We require that servers present valid certificate.<br>
#<br>
[client:default]<br>
method = TLSv1.2<br>
verify_certificate = no<br>
require_certificate = no<br>
ca_list = /etc/kamailio/tls/cacert.pem</div>
<div class="moz-text-flowed" style="font-family: -moz-fixed;
font-size: 12px;" lang="x-unicode"><br>
</div>
<div class="moz-text-flowed" style="font-family: -moz-fixed;
font-size: 12px;" lang="x-unicode">I have tried forcing the socket
on the sending kamailio, but that does not work.
<br>
<br>
Any feedback on what I am doing wrong or where I can find
information to extend my knowledge would be appreciated.
<br>
</div>
<div class="moz-text-flowed" style="font-family: -moz-fixed;
font-size: 12px;" lang="x-unicode"><br>
</div>
<div class="moz-text-flowed" style="font-family: -moz-fixed;
font-size: 12px;" lang="x-unicode">Rgds,</div>
<div class="moz-text-flowed" style="font-family: -moz-fixed;
font-size: 12px;" lang="x-unicode">
<br>
Gertjan Wolzak<br>
<br>
<br>
<br>
<br>
</div>
</body>
</html>