<div dir="ltr">Hey all,<div><br></div><div>About using the right certificate, is it possible to ensure opensips is going to use the right one when multiple are set in tls_mgm?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Em seg., 10 de mai. de 2021 às 04:41, Răzvan Crainea <<a href="mailto:razvan@opensips.org">razvan@opensips.org</a>> escreveu:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi, Miha!<br>
<br>
According to your logs, opensips is 100% sending the OPTIONS through <br>
tls, but I am not sure it is using the right certificate.<br>
You can try to setup sip trace and see the communication between <br>
opensips and MSTeams.<br>
<br>
Best regards,<br>
<br>
Răzvan Crainea<br>
OpenSIPS Core Developer<br>
<a href="http://www.opensips-solutions.com" rel="noreferrer" target="_blank">http://www.opensips-solutions.com</a><br>
<br>
On 5/10/21 9:54 AM, Miha via Users wrote:<br>
> Hello<br>
> <br>
> I have used letsenrypt for generating certs for Opensips.<br>
> <br>
> Regarding configuration i have fallowed your configuration steps on <br>
> OpenSips blog.<br>
> <br>
> socket=udp:xxx.xxx.xxx.xxx:5060 # CUSTOMIZE ME<br>
> socket=tls:xxx.xxx.xxx.xxx:5061<br>
> <br>
> <br>
> <br>
> <br>
> ### Proto TLS<br>
> loadmodule "proto_tls.so"<br>
> modparam("proto_tls", "tls_handshake_timeout", 300)<br>
> #### TLS module<br>
> loadmodule "tls_mgm.so"<br>
> #modparam("tls_mgm", "db_url", "mysql://root:xxxx@localhost/opensips")<br>
> modparam("tls_mgm", "client_sip_domain_avp", "<a href="http://mtsbcs.test.com" rel="noreferrer" target="_blank">mtsbcs.test.com</a>")<br>
> modparam("tls_mgm", "server_domain", "mt")<br>
> #modparam("tls_mgm", "match_ip_address", "[mt]xxx.xxx.xxx.xxx:5061")<br>
> #modparam("tls_mgm", "match_sip_domain", "[mt]<a href="http://mtsbcs.test.com" rel="noreferrer" target="_blank">mtsbcs.test.com</a>")<br>
> modparam("tls_mgm", "certificate", <br>
> "[mt]/etc/letsencrypt/live/<a href="http://mtsbcs.test.com/cert.pem" rel="noreferrer" target="_blank">mtsbcs.test.com/cert.pem</a>")<br>
> modparam("tls_mgm", "private_key", <br>
> "[mt]/etc/letsencrypt/live/<a href="http://mtsbcs.test.com/privkey.pem" rel="noreferrer" target="_blank">mtsbcs.test.com/privkey.pem</a>")<br>
> modparam("tls_mgm", "ca_list", "[mt]/etc/ssl/certs/ca-certificates.crt")<br>
> modparam("tls_mgm", "ca_dir", "[mt]/etc/ssl/certs/")<br>
> modparam("tls_mgm","verify_cert", "[mt]1")<br>
> modparam("tls_mgm","require_cert", "[mt]1")<br>
> modparam("tls_mgm","tls_method", "[mt]TLSv1_2")<br>
> modparam("proto_tls", "tls_max_msg_chunks", 8)<br>
> #modparam("tls_mgm", "tls_handshake_timeout", 300)<br>
> <br>
> if(is_method("OPTIONS") && is_domain_local("$rd") && <br>
> check_source_address(0)) {<br>
> xlog("L_INFO", "[MS TEAMS] OPTIONS In");<br>
> send_reply(200, "OK");<br>
> exit;<br>
> }<br>
> <br>
> <br>
> local_route {<br>
> $var(dst) = "<a href="http://pstnhub.microsoft.com" rel="noreferrer" target="_blank">pstnhub.microsoft.com</a>";<br>
> xlog("L_INFO","promding TEST");<br>
> xlog("TESTING");<br>
> if (is_method("OPTIONS") && ($(ru{s.index, $var(dst)}) != NULL))<br>
> append_hf("Contact: <sip:<a href="http://mtsbcs.test.com:5061" target="_blank">mtsbcs.test.com:5061</a>;transport=tls>\r\n");<br>
> xlog("L_INFO", "SEDING OPTIONS TO SBC");<br>
> }<br>
> <br>
> <br>
> I thnk that the main issue is that OPENSIPS does not send encrypted <br>
> OPTION to MS teams.<br>
> <br>
> Logs:<br>
> <br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:tm:t_uac: <br>
> next_hop=<sip:<a href="http://sip.pstnhub.microsoft.com" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com</a>><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:mk_proxy: doing DNS lookup...<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:sip_resolvehost: no port, <br>
> has proto -> do SRV lookup!<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:do_srv_lookup: resolving <br>
> [<a href="http://sip.pstnhub.microsoft.com" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com</a>]<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:do_srv_lookup: <br>
> SRV(_sips._<a href="http://tcp.sip.pstnhub.microsoft.com" rel="noreferrer" target="_blank">tcp.sip.pstnhub.microsoft.com</a>) = <a href="http://sip.pstnhub.microsoft.com:5061" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com:5061</a><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:a2dns_node: storing <br>
> <a href="http://sip2.pstnhub.microsoft.com:5061" rel="noreferrer" target="_blank">sip2.pstnhub.microsoft.com:5061</a><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:a2dns_node: storing <br>
> <a href="http://sip3.pstnhub.microsoft.com:5061" rel="noreferrer" target="_blank">sip3.pstnhub.microsoft.com:5061</a><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:tm:t_uac: sending socket is <br>
> 212.13.249.132<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:tm:print_request_uri: <br>
> sip:<a href="http://sip.pstnhub.microsoft.com" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com</a><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:tm:run_local_route: building <br>
> sip_msg from buffer<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_msg: SIP Request:<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_msg: method: <OPTIONS><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_msg: uri: <br>
> <sip:<a href="http://sip.pstnhub.microsoft.com" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com</a>><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_msg: version: <SIP/2.0><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_headers: <br>
> flags=ffffffffffffffff<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_via_param: found <br>
> param type 232, <branch> = <z9hG4bK8d8a.3706b135.0>; state=16<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_via: end of header <br>
> reached, state=5<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_headers: via found, <br>
> flags=ffffffffffffffff<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_headers: this is <br>
> the first via<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:_parse_to: end of header <br>
> reached, state=9<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:_parse_to: display={}, <br>
> ruri={sip:<a href="http://sip.pstnhub.microsoft.com" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com</a>}<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:get_hdr_field: <To> [31]; <br>
> uri=[sip:<a href="http://sip.pstnhub.microsoft.com" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com</a>]<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:get_hdr_field: to body <br>
> [sip:<a href="http://sip.pstnhub.microsoft.com#015%23012" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com#015#012</a>]<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:get_hdr_field: cseq <br>
> <CSeq>: <14> <OPTIONS><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:get_hdr_field: <br>
> content_length=0<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:get_hdr_field: found end <br>
> of header<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_headers: <br>
> flags=ffffffffffffffff<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_headers: flags=78<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_headers: <br>
> flags=ffffffffffffffff<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:tm:run_local_route: Change in <br>
> local route -> rebuilding buffer<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_headers: flags=2000<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:parse_headers: <br>
> flags=ffffffffffffffff<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:extract_ftc_hdrs: flags = 15<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:extract_ftc_hdrs: hdr 2 <br>
> extracted as <To: sip:<a href="http://sip.pstnhub.microsoft.com#015%23012" rel="noreferrer" target="_blank">sip.pstnhub.microsoft.com#015#012</a>><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:extract_ftc_hdrs: hdr 1 <br>
> extracted as <From: <br>
> <sip:prober@localhost>;tag=a665d66adab06c7308a33b8567de92d6-f627#015#012><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:extract_ftc_hdrs: hdr 8 <br>
> extracted as <Call-ID: <a href="http://12e30be047c27077-1020@212.13.249.132#015%23012" rel="noreferrer" target="_blank">12e30be047c27077-1020@212.13.249.132#015#012</a>><br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:proto_tls:proto_tls_send: no <br>
> open tcp connection found, opening new one<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:probe_max_sock_buff: <br>
> getsockopt: snd is initially 16384<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:probe_max_sock_buff: <br>
> using snd buffer of 416 kb<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:init_sock_keepalive: TCP <br>
> keepalive enabled on socket 5<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:print_ip: tcpconn_new: <br>
> new tcp connection to: 52.114.75.24<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:tcpconn_new: on port <br>
> 5061, proto 3<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:proto_tls:tls_conn_init: <br>
> Creating a whole new ssl connection<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:core:tcpconn_destroy: <br>
> destroying connection 0x7f45d7e08078, flags 0018<br>
> May 10 08:53:10 mtsbc opensips[1020]: DBG:tm:insert_timer_unsafe: [0]: <br>
> 0x7f45d7e066b0 (1625)<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:timer_routine: timer <br>
> routine:0,tl=0x7f45d7e066b0 next=(nil), timeout=1625<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:final_response_handler: <br>
> Cancel sent out, sending 408 (0x7f45d7e06460)<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:t_should_relay_response: <br>
> T_code=0, new_code=408<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:t_pick_branch: picked <br>
> branch 0, code 408 (prio=800)<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:is_3263_failure: <br>
> dns-failover test: branch=0, last_recv=408, flags=0<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:t_should_relay_response: <br>
> trying DNS-based failover<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:do_dns_failover: new <br>
> destination available<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:parse_headers: flags=2000<br>
> May 10 08:53:15 mtsbc opensips[1020]: <br>
> DBG:core:build_req_buf_from_sip_req: id added: <;i=0>, rcv proto=3<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:parse_headers: <br>
> flags=ffffffffffffffff<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:proto_tls:proto_tls_send: no <br>
> open tcp connection found, opening new one<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:probe_max_sock_buff: <br>
> getsockopt: snd is initially 16384<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:probe_max_sock_buff: <br>
> using snd buffer of 416 kb<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:init_sock_keepalive: TCP <br>
> keepalive enabled on socket 5<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:print_ip: tcpconn_new: <br>
> new tcp connection to: 52.114.132.46<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:tcpconn_new: on port <br>
> 5061, proto 3<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:proto_tls:tls_conn_init: <br>
> Creating a whole new ssl connection<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:tcpconn_destroy: <br>
> destroying connection 0x7f45d7e08078, flags 0018<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:proto_tls:proto_tls_send: no <br>
> open tcp connection found, opening new one<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:probe_max_sock_buff: <br>
> getsockopt: snd is initially 16384<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:probe_max_sock_buff: <br>
> using snd buffer of 416 kb<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:init_sock_keepalive: TCP <br>
> keepalive enabled on socket 5<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:print_ip: tcpconn_new: <br>
> new tcp connection to: 52.114.14.70<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:tcpconn_new: on port <br>
> 5061, proto 3<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:proto_tls:tls_conn_init: <br>
> Creating a whole new ssl connection<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:core:tcpconn_destroy: <br>
> destroying connection 0x7f45d7e08078, flags 0018<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:local_reply: branch=0, <br>
> save=0, winner=0<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:local_reply: local <br>
> transaction completed<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:run_trans_callbacks: <br>
> trans=0x7f45d7e06460, callback type 256, id 0 entered<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:insert_timer_unsafe: [2]: <br>
> 0x7f45d7e064e0 (1630)<br>
> May 10 08:53:15 mtsbc opensips[1020]: DBG:tm:final_response_handler: done<br>
> <br>
> <br>
> <br>
> Thank you<br>
> miha<br>
> <br>
> <br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
> <br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="font-size:small"><b>Carlos E. Wagner</b></div><div style="font-size:small;font-family:arial"><font style="font-family:arial,sans-serif;font-size:13px"><font style="font-size:x-small;color:rgb(0,0,0)"><i>Tecnólogo em Telecomunicações, Opensips Certified Professional</i></font></font><font style="font-family:arial,sans-serif;font-size:13px"><b style="font-family:arial;font-size:small"><font face="arial, sans-serif" color="#000000"><span></span></font></b></font><font style="font-family:arial,sans-serif;font-size:13px"><b style="font-family:arial;font-size:small"><font face="arial, sans-serif" color="#000000"><span></span></font></b></font></div><div style="font-size:small;font-family:arial"><br><font style="font-family:arial,sans-serif;font-size:13px"><b style="font-family:arial;font-size:small"><font face="arial, sans-serif" color="#000000"><span><div style="font-size:small;font-family:arial"><font style="font-family:arial,sans-serif;font-size:13px" color="#000000"><b>Fone:</b></font><font face="arial, sans-serif"> <span style="font-weight:normal">+55 48 99981-0894</span></font></div></span></font></b></font></div><div style="font-size:small;font-family:arial"><b><font face="arial, sans-serif">E-mail:</font></b><font style="font-family:arial,sans-serif" face="arial, sans-serif"> <a href="mailto:kaduww@gmail.com" target="_blank">kaduww@gmail.com</a><u><br></u></font></div><div style="font-size:small;font-family:arial"><font face="arial, sans-serif"><b>LinkedIn:</b> <a href="https://www.linkedin.com/in/carlos-eduardo-wagner-96bbb433/" target="_blank">https://www.linkedin.com/in/carlos-eduardo-wagner-96bbb433/</a></font><br></div><div style="font-size:small;font-family:arial"><font style="font-family:arial,sans-serif" face="arial, sans-serif"><u></u></font></div></div></div></div></div></div></div></div></div></div>