Hello Daniel!
I updated Kamailio to the latest released version.
The problem is that still with
tls_set_connect_server_id() I can not make a single
instance of Kamailio connect to multiple MS Teams
domains. I use a single IP address with different
ports for different trunks. I can see it
establishing a connection to one trunk and using it
for other domains.
Is there a way to force Kamailio to make a new TLS
connection to the same peer address that it is
already connected to?
Thank you!
Regards, Volodymyr Ivanets.
пн, 2 серп. 2021 о 13:44 Daniel-Constantin Mierla
<miconda(a)gmail.com <mailto:miconda@gmail.com>> пише:
Hello,
upgrading is the recommended way, indeed, if you
want to use tls_set_connect_server_id(). For
older version you may want to try looping back
to kamailio (can be over udp) and the use the
xavps. Adds some overhead and hops, but if you
are stuck to a version and can't really upgrade
soon, might be an option to look at.
Cheers,
Daniel
On 29.07.21 18:48, Володимир Іванець wrote:
Hello Rob!
Yes, I'm using Letsencrypt while I'm testing.
But I would like to be able to use different
certificates with different sockets.
I found this
discussion
https://github.com/kamailio/kamailio/issues/2413
<https://github.com/kamailio/kamailio/issues/2413>.
Looks like I need to use
"tls_set_connect_server_id()" instead of
setting $xavp(tls=>server_name)" and
"$xavp(tls[0]=>server_id)". Unfortunately I'm
currently using Kamailio v5.4 on my test system
and this function is not available. I will
update Kamailio and give it another try. Then I
will update everyone in the hope it will be
useful for someone :)
Thank you!
Regards, Volodymyr Ivanets
чт, 29 лип. 2021 о 19:07 Rob van den Bulk
<rob.van.den.bulk(a)gmail.com
<mailto:rob.van.den.bulk@gmail.com>> пише:
Hello, are u using letsencrypt?
U can use a multi domain.
Muti domain names in one certificate
Outlook voor Android
<https://aka.ms/AAb9ysg> downloaden
------------------------------------------------------------------------
*From:* sr-users
<sr-users-bounces(a)lists.kamailio.org
<mailto:sr-users-bounces@lists.kamailio.org>>
on behalf of Володимир Іванець
<volodyaivanets(a)gmail.com
<mailto:volodyaivanets@gmail.com>>
*Sent:* Thursday, July 29, 2021 4:44:16 PM
*To:* Kamailio (SER) - Users Mailing List
<sr-users(a)lists.kamailio.org
<mailto:sr-users@lists.kamailio.org>>
*Subject:* [SR-Users] Integration with
multiple MS Teams instances
Hello all!
I was able to connect Kamailio with MS
Teams and now trying to add one more Teams
instance. It looks like I have some
misconfiguration or there is a bug.
My test server has 2 domain records
pointing at it (
kamailio.domain1.com
<http://kamailio.domain1.com> and
kamailio.domain2.com
<http://kamailio.domain2.com>). My tls.cfg
configuration file looks like this. As you
can see the Default section is configured
with a
kamailio.domain1.com
<http://kamailio.domain1.com> sertificate:
/[server:default]/
/method = TLSv1.0+/
/require_certificate = no/
/verify_certificate = no/
/private_key =
/var/kamailio/certificates/kamailio.domain1.com/server/key.pem
<http://kamailio.domain1.com/server/key.pem>/
/certificate =
/var/kamailio/certificates/kamailio.domain1.com/server/cert.pem
<http://kamailio.domain1.com/server/cert.pem>/
/ca_list =
/var/kamailio/certificates/kamailio.domain1.com/CA/cert.pem
<http://kamailio.domain1.com/CA/cert.pem>/
/
/
/[client:default]/
/method = TLSv1.0+/
/require_certificate = no/
/verify_certificate = no/
/private_key =
/var/kamailio/certificates/kamailio.domain1.com/server/key.pem
<http://kamailio.domain1.com/server/key.pem>/
/certificate =
/var/kamailio/certificates/kamailio.domain1.com/server/cert.pem
<http://kamailio.domain1.com/server/cert.pem>/
/ca_list =
/var/kamailio/certificates/kamailio.domain1.com/CA/cert.pem
<http://kamailio.domain1.com/CA/cert.pem>/
/
/
/
/
/[server:172.16.30.206:5062
<http://172.16.30.206:5062>]/
/method = TLSv1.0+/
/require_certificate = no/
/verify_certificate = no/
/private_key =
/var/kamailio/certificates/kamailio.domain1.com/server/key.pem
<http://kamailio.domain1.com/server/key.pem>/
/certificate =
/var/kamailio/certificates/kamailio.domain1.com/server/cert.pem
<http://kamailio.domain1.com/server/cert.pem>/
/ca_list =
/var/kamailio/certificates/kamailio.domain1.com/CA/cert.pem
<http://kamailio.domain1.com/CA/cert.pem>/
/server_name = "kamailio.domain1.com
<http://kamailio.domain1.com>"/
/server_id = "//"kamailio.domain1.com
<http://kamailio.domain1.com>"//
/
/
/
/[client:172.16.30.206:5062
<http://172.16.30.206:5062>]/
/method = TLSv1.0+/
/require_certificate = no/
/verify_certificate = no/
/private_key =
/var/kamailio/certificates/kamailio.domain1.com/server/key.pem
<http://kamailio.domain1.com/server/key.pem>/
/certificate =
/var/kamailio/certificates/kamailio.domain1.com/server/cert.pem
<http://kamailio.domain1.com/server/cert.pem>/
/ca_list =
/var/kamailio/certificates/kamailio.domain1.com/CA/cert.pem
<http://kamailio.domain1.com/CA/cert.pem>/
/
/
/[server:172.16.30.206:5063
<http://172.16.30.206:5063>]/
/method = TLSv1.0+/
/require_certificate = no/
/verify_certificate = no/
/private_key =
/var/kamailio/certificates/kamailio.domain2.com/server/key.pem
<http://kamailio.domain2.com/server/key.pem>/
/certificate =
/var/kamailio/certificates/kamailio.domain2.com/server/cert.pem
<http://kamailio.domain2.com/server/cert.pem>/
/ca_list =
/var/kamailio/certificates/kamailio.domain2.com/CA/cert.pem
<http://kamailio.domain2.com/CA/cert.pem>/
/server_name = "kamailio.domain2.com
<http://kamailio.domain2.com>"/
/server_id = "//"kamailio.domain2.com
<http://kamailio.domain2.com>"/
/
/
/[client:172.16.30.206:5063
<http://172.16.30.206:5063>]/
/method = TLSv1.0+/
/require_certificate = no/
/verify_certificate = no/
/private_key =
/var/kamailio/certificates/kamailio.domain2.com/server/key.pem
<http://kamailio.domain2.com/server/key.pem>/
/certificate =
/var/kamailio/certificates/kamailio.domain2.com/server/cert.pem
<http://kamailio.domain2.com/server/cert.pem>/
/ca_list =
/var/kamailio/certificates/kamailio.domain2.com/CA/cert.pem
<http://kamailio.domain2.com/CA/cert.pem>/
The dispatcher configuration table looks
like this:
+----+-------+----------------------------------------------+-------+----------+--------------------------------------------------------------------+-------------+
| id | setid | destination
| flags | priority
| attrs
|
description |
+----+-------+----------------------------------------------+-------+----------+--------------------------------------------------------------------+-------------+
| 1 | 1 |
sip:sip.pstnhub.microsoft.com
<http://sip.pstnhub.microsoft.com>;transport=tls
| 0 | 3 |
socket=tls:172.16.30.206:5062;ping_from=sip:kamailio.domain1.com
<http://kamailio.domain1.com> | MS
Teams 1 |
| 2 | 2 |
sip:sip.pstnhub.microsoft.com
<http://sip.pstnhub.microsoft.com>;transport=tls
| 0 | 3 |
socket=tls:172.16.30.206:5063;ping_from=sip:kamailio.domain2.com
<http://kamailio.domain2.com> | MS
Teams 2 |
+----+-------+----------------------------------------------+-------+----------+--------------------------------------------------------------------+-------------+
When Kamailio is started only connection
with the first trunk is established:
/# kamcmd tls.list/
/{/
/ id: 1/
/ timeout: 0/
/ src_ip: 52.114.75.24/
/ src_port: 5061/
/ dst_ip: 172.16.30.206/
/ dst_port: 0/
/ cipher:
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2
Kx=ECDH Au=RSA Enc=AESGCM(256)
Mac=AEAD/
/ ct_wq_size: 0/
/ enc_rd_buf: 0/
/ flags: 2/
/ state: established/
/}/
/{/
/ id: 2/
/ timeout: 0/
/ src_ip: 52.114.75.24/
/ src_port: 7810/
/ dst_ip: 172.16.30.206/
/ dst_port: 5062/
/ cipher: AES256-GCM-SHA384
TLSv1.2 Kx=RSA Au=RSA
Enc=AESGCM(256) Mac=AEAD/
/ ct_wq_size: 0/
/ enc_rd_buf: 0/
/ flags: 2/
/ state: established/
/}/
/{/
/ id: 3/
/ timeout: 596/
/ src_ip: 52.114.75.24/
/ src_port: 7811/
/ dst_ip: 172.16.30.206/
/ dst_port: 5062/
/ cipher: AES256-GCM-SHA384
TLSv1.2 Kx=RSA Au=RSA
Enc=AESGCM(256) Mac=AEAD/
/ ct_wq_size: 0/
/ enc_rd_buf: 0/
/ flags: 2/
/ state: established/
/}/
Here is what I can see in Kamailio log file
when it sends an OPTIONS request to the
second trunk. Kamailio uses Default tls
configuration and MS Teams don't accept it:
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: ALERT:
<script>: == TRACE. tm:local-request.
fs is tls:172.16.30.206:5063
<http://172.16.30.206:5063>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG: tm
[uac.c:352]: t_run_local_req(): apply
new updates without Via to sip msg/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/msg_translator.c:1796]:
check_boundaries(): no multi-part body/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:610]:
parse_msg(): SIP Request:/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:612]:
parse_msg(): method: <OPTIONS>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:614]:
parse_msg(): uri:
<sip:sip.pstnhub.microsoft.com
<http://sip.pstnhub.microsoft.com>;transport=tls>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:616]:
parse_msg(): version: <SIP/2.0>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/parse_via.c:1303]:
parse_via_param(): Found param type
232, <branch> =
<z9hG4bK169b.6411b4c3000000000000000000000000.0>;
state=16/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/parse_via.c:2639]:
parse_via(): end of header reached,
state=5/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:498]:
parse_headers(): Via found, flags=2/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:500]:
parse_headers(): this is the first via/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core>
[core/parser/parse_addr_spec.c:864]:
parse_addr_spec(): end of header
reached, state=10/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:171]:
get_hdr_field(): <To> [47];
uri=[sip:sip.pstnhub.microsoft.com
<http://sip.pstnhub.microsoft.com>;transport=tls]/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:174]:
get_hdr_field(): to body
(
47)[<sip:sip.pstnhub.microsoft.com
<http://sip.pstnhub.microsoft.com>;transport=tls>^M/
/], to tag (0)[]/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:152]:
get_hdr_field(): cseq <CSeq>: <10>
<OPTIONS>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:185]:
get_hdr_field(): content_length=0/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:89]:
get_hdr_field(): found end of header/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:610]:
parse_msg(): SIP Request:/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:612]:
parse_msg(): method: <OPTIONS>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:614]:
parse_msg(): uri:
<sip:sip.pstnhub.microsoft.com
<http://sip.pstnhub.microsoft.com>;transport=tls>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:616]:
parse_msg(): version: <SIP/2.0>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/parse_via.c:1303]:
parse_via_param(): Found param type
232, <branch> =
<z9hG4bK169b.6411b4c3000000000000000000000000.0>;
state=16/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/parse_via.c:2639]:
parse_via(): end of header reached,
state=5/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:498]:
parse_headers(): Via found, flags=2/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:500]:
parse_headers(): this is the first via/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core>
[core/parser/parse_addr_spec.c:864]:
parse_addr_spec(): end of header
reached, state=10/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:171]:
get_hdr_field(): <To> [47];
uri=[sip:sip.pstnhub.microsoft.com
<http://sip.pstnhub.microsoft.com>;transport=tls]/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:174]:
get_hdr_field(): to body
(
47)[<sip:sip.pstnhub.microsoft.com
<http://sip.pstnhub.microsoft.com>;transport=tls>^M/
/], to tag (0)[]/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/parser/msg_parser.c:152]:
get_hdr_field(): cseq <CSeq>: <10>
<OPTIONS>/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG: tm
[uac.c:189]:
uac_refresh_hdr_shortcuts(): cseq:
[CSeq: 10]/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/tcp_main.c:1993]:
tcp_send(): no open tcp connection
found, opening new one/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/ip_addr.c:229]:
print_ip(): tcpconn_new: new tcp
connection: 52.114.75.24/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/tcp_main.c:1175]:
tcpconn_new(): on port 5061, type 3,
socket -1/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG:
<core> [core/tcp_main.c:1498]:
tcpconn_add(): hashes: 2831:67:0, 1/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG: tls
[tls_server.c:199]:
tls_complete_init(): completing tls
connection initialization/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG: tls
[tls_server.c:162]:
tls_get_connect_server_name(): *xavp
with outbound server name not found*/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG: tls
[tls_server.c:142]:
tls_get_connect_server_id(): *xavp with
outbound server id not found*/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG: tls
[tls_server.c:228]:
tls_complete_init(): *Using initial TLS
domain TLSc<default>* (dom
0x7f35509da688 ctx 0x7f3550b7a568 sn [])/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG: tls
[tls_domain.c:1177]:
tls_lookup_private_key(): Private key
lookup for SSL_CTX-0x7f3550b7a568: (nil)/
/Jul 29 16:46:14 kamailio
/usr/sbin/kamailio[11809]: DEBUG: tls
[tls_domain.c:747]:
sr_ssl_ctx_info_callback(): SSL
handshake started/
/.../
If I change the Default configuration to
use
kamailio.domain2.com
<http://kamailio.domain2.com> certificate,
the second trunk will connect but the first
one will fail.
I tried to set "$xavp(tls=>server_name)"
and "$xavp(tls[0]=>server_id)" variables to
the event_route[tm:local-request] section
but log still stated that server Name and
ID were not found.
Can someone please point me in the right
direction, how can I make Kamailio use the
correct certificates when establishing
multiple TLS connections?
Thanks a lot!
Regards, Volodymyr Ivanets
__________________________________________________________
Kamailio - Users Mailing List - Non
Commercial Discussions
* sr-users(a)lists.kamailio.org
<mailto:sr-users@lists.kamailio.org>
Important: keep the mailing list in the
recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe:
*
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
<https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users>
__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
* sr-users(a)lists.kamailio.org
<mailto:sr-users@lists.kamailio.org>
Important: keep the mailing list in the recipients, do not reply only
to the sender!
Edit mailing list options or unsubscribe:
*
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
<https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users>