<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.E-MailFormatvorlage19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">the „sips“ URI scheme is not really useful nowadays and IMHO should not be used. You probably find in the archives some old discussions about it.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Use “sip” and “transport=tls” if you want to have a secure connection.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Henning<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">-- <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Henning Westerholt –
</span><span style="mso-fareast-language:EN-US"><a href="https://skalatan.de/blog/"><span lang="EN-GB" style="color:#0563C1">https://skalatan.de/blog/</span></a></span><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Kamailio services –
</span><span style="mso-fareast-language:EN-US"><a href="https://gilawa.com/"><span lang="EN-GB" style="color:#0563C1">https://gilawa.com</span></a></span><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:35.4pt"><b>From:</b> sr-users <sr-users-bounces@lists.kamailio.org>
<b>On Behalf Of </b>beer Ll<br>
<b>Sent:</b> Thursday, October 20, 2022 9:22 AM<br>
<b>To:</b> Kamailio (SER) - Users Mailing List <sr-users@lists.kamailio.org><br>
<b>Subject:</b> Re: [SR-Users] relay sip-tls vs sips-tcp<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Hi James<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Thanks , You confirm my idea .<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I will write to the UAC developers and check this problem asking to fix it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Is safer use sip-tls or sips-tcp ?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Best Regards<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Leo<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">On Wed, Oct 19, 2022 at 2:07 PM James Browne <<a href="mailto:james@frideo.com">james@frideo.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal" style="margin-left:35.4pt">You make calls using SIP over TLS and it's OK.<br>
You make calls using SIPS and it's not OK.<br>
<br>
The 200-OK Contact is this<br>
- Contact: <sip:<a href="http://172.16.0.2:5060" target="_blank">172.16.0.2:5060</a>><br>
<br>
The RURI in the ACK is this.<br>
- <a href="sips:172.16.0.2:5060;transport=tcp">sips:172.16.0.2:5060;transport=tcp</a> SIP/2.0<br>
<br>
The client should be using _exactly_ the same URI in the ACK as was in the Contact in the 200-OK response. The client is getting it wrong (<a href="https://datatracker.ietf.org/doc/html/rfc3261#section-12.2.1.1" target="_blank">https://datatracker.ietf.org/doc/html/rfc3261#section-12.2.1.1</a>).<br>
<br>
With the ACK, the Routeset is this.<br>
- ACK <a href="sips:172.16.0.2:5060;transport=tcp">sips:172.16.0.2:5060;transport=tcp</a> SIP/2.0<br>
- Route: <<a href="sip:80.0.0.2:5061;transport=tls;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F">sip:80.0.0.2:5061;transport=tls;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F</a>><br>
- Route: <<a href="sip:172.16.0.1:5060;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F">sip:172.16.0.1:5060;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F</a>><br>
<br>
This is asking kamailio to send the ACK to 172.16.0.2 over TLS on port 5060 (from the RURI), but use a UDP socket to do it (the second Route header field). This can't work. The client should be fixed.<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">(Else you may try getting asterisk to use sips, but maybe that's not going to be easy.)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">James<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">On Thu, 13 Oct 2022 at 06:30, beer Ll <<a href="mailto:llcfhllml@gmail.com" target="_blank">llcfhllml@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Hi everyone, <o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I'm using Kamailio as TLS gateway/filter for an internal Asterisk server<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">the network schema is : <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">UAC (tls) --- INTERNET --- (tls) KAMAILIO (sip udp) --- LAN --- (sip udp) ASTERISK<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">with kamailio in multi-homed mode
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">WAN network interface for sip tls
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">LAN network interface for sip udp to asterisk server
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">UAC address 80.0.0.1<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">KAMAILIO Wan address 80.0.0.2<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">KAMAILIO Lan address 172.16.0.2<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">ASTERISK Lan address 172.16.0.3<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt">
<o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">SIP-TLS call example<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">If the UAC use tls(sip) all works good
<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><img border="0" width="558" height="363" style="width:5.8125in;height:3.7812in" id="Bild_x0020_1" src="cid:image001.jpg@01D8E543.1E954C20"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">SIPS call example<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">If the same UAC use his default settings tls(sips) , there are problems with ACK and BYE packet<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><img border="0" width="559" height="367" style="width:5.8229in;height:3.8229in" id="Bild_x0020_2" src="cid:image002.jpg@01D8E543.1E954C20"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">the SIP OK SDP packet from kamailio to UAC is
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt">
2022/10/10 09:28:47.854721 <a href="http://80.0.0.2:5061" target="_blank">80.0.0.2:5061</a> ->
<a href="http://80.0.0.1:49992" target="_blank">80.0.0.1:49992</a><br>
SIP/2.0 200 OK<br>
Via: SIP/2.0/TLS 192.168.0.1:49992;rport=49992;received=80.0.0.1;branch=z9hG4bKM01j360VrBdH5VSV<br>
Record-Route: <<a href="sip:172.16.0.1:5060;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F">sip:172.16.0.1:5060;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F</a>><br>
Record-Route: <<a href="sip:80.0.0.2:5061;transport=tls;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F">sip:80.0.0.2:5061;transport=tls;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F</a>><br>
Call-ID: 1EC2AB679C1EA1BAB60FD03B09F878020B12D3E7<br>
From: <<a href="mailto:sips%3A200@pbx.voip.com" target="_blank">sips:200@pbx.voip.com</a>>;tag=F798336AA08EF9FCFA89D3BDFE0C8C8F<br>
To: <sips:*<a href="mailto:43@pbx.voip.com" target="_blank">43@pbx.voip.com</a>>;tag=961d0e22-a4f0-453c-9870-6a41578afc96<br>
CSeq: 2 INVITE<br>
Contact: <sip:<a href="http://172.16.0.2:5060" target="_blank">172.16.0.2:5060</a>><br>
P-Asserted-Identity: "xxxxxxxxx" <sips:*<a href="mailto:43@pbx.voip.com" target="_blank">43@pbx.voip.com</a>><br>
Content-Type: application/sdp<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">and the UAC send the ACK and BYE from a different tcp port and to:
<a href="sips:172.16.0.2:5060;transport=tcp">sips:172.16.0.2:5060;transport=tcp</a>
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">2022/10/10 09:28:48.495365 <a href="http://80.0.0.1:49996" target="_blank">
80.0.0.1:49996</a> -> <a href="http://80.0.0.2:5061" target="_blank">80.0.0.2:5061</a><br>
ACK <a href="sips:172.16.0.2:5060;transport=tcp">sips:172.16.0.2:5060;transport=tcp</a> SIP/2.0<br>
Via: SIP/2.0/TLS 192.168.0.1:49996;branch=z9hG4bKppftdQze20lnwT41;rport<br>
Route: <<a href="sip:80.0.0.2:5061;transport=tls;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F">sip:80.0.0.2:5061;transport=tls;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F</a>><br>
Route: <<a href="sip:172.16.0.1:5060;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F">sip:172.16.0.1:5060;lr;r2=on;ftag=F798336AA08EF9FCFA89D3BDFE0C8C8F</a>><br>
Max-Forwards: 70<br>
To: <sips:*<a href="mailto:43@pbx.voip.com" target="_blank">43@pbx.voip.com</a>>;tag=961d0e22-a4f0-453c-9870-6a41578afc96<br>
From: <<a href="mailto:sips%3A200@pbx.voip.com" target="_blank">sips:200@pbx.voip.com</a>>;tag=F798336AA08EF9FCFA89D3BDFE0C8C8F<br>
Call-ID: 1EC2AB679C1EA1BAB60FD03B09F878020B12D3E7<br>
CSeq: 2 ACK<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">kamailio error log<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">WARNING: <core> [core/forward.c:229]: get_send_socket2(): protocol/port mismatch (forced udp:<a href="http://172.16.0.2:5060" target="_blank">172.16.0.2:5060</a>, to tls:<a href="http://172.16.0.3:5060" target="_blank">172.16.0.3:5060</a>)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">How can I solve this ?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Best Regards<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Leo<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:35.4pt">__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions<br>
<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
Important: keep the mailing list in the recipients, do not reply only to the sender!<br>
Edit mailing list options or unsubscribe:<br>
<a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal" style="margin-left:35.4pt">__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions<br>
<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
Important: keep the mailing list in the recipients, do not reply only to the sender!<br>
Edit mailing list options or unsubscribe:<br>
<a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>