[SR-Users] TLS Handshake failing with WSS

[Manuel Camarg]

I'm trying to implement WSS with Kamailio
Thing is that WS works fine, I've followed:
http://nil.uniza.sk/sip/kamailio/configuring-kamailio-4x-websocket

modparam("tls", "config", "webrtc/tls.cfg")
In a tls.cfg file I have :

[server:default]
method = SSLv23
verify_certificate = no
require_certificate = no
private_key = webrtc/private.key
certificate = webrtc/ssl.pem
ca_list = webrtc/ca_list.pem

In the log file:

/usr/local/sbin/kamailio[4025]: DEBUG: tls [tls_server.c:178]:
tls_complete_init(): Using TLS domain TLSs<default>
/usr/local/sbin/kamailio[4025]: DEBUG: tls [tls_domain.c:700]:
sr_ssl_ctx_info_callback(): SSL handshake started
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_main.c:2556]:
tcpconn_do_send(): tcp_send: sending...
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_main.c:2590]:
tcpconn_do_send(): tcp_send: after real write: c= 0x7f7513516958 n=5524
fd=11
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_main.c:2591]:
tcpconn_do_send(): tcp_send: buf=#012#026#003#003
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [io_wait.h:390]:
io_watch_add(): DBG: io_watch_add(0x8e0040, 11, 2, 0x7f7513516958), fd_no=1
/usr/local/sbin/kamailio[4025]: DEBUG: tls [tls_domain.c:712]:
sr_ssl_ctx_info_callback(): SSL handshake done
/usr/local/sbin/kamailio[4025]: DEBUG: tls [tls_domain.c:715]:
sr_ssl_ctx_info_callback(): SSL disable renegotiation
/usr/local/sbin/kamailio[4025]: DEBUG: tls [tls_server.c:348]:
tls_accept(): TLS accept successful
/usr/local/sbin/kamailio[4025]: DEBUG: tls [tls_server.c:355]:
tls_accept(): tls_accept: new connection from 123.123.123.123:63300 using
TLSv1/SSLv3 AES256-SHA 256
/usr/local/sbin/kamailio[4025]: DEBUG: tls [tls_server.c:358]:
tls_accept(): tls_accept: local socket: 124.124.124.124:10443
/usr/local/sbin/kamailio[4025]: DEBUG: tls [tls_server.c:369]:
tls_accept(): tls_accept: client did not present a certificate
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_main.c:2556]:
tcpconn_do_send(): tcp_send: sending...
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_main.c:2590]:
tcpconn_do_send(): tcp_send: after real write: c= 0x7f7513516958 n=282 fd=11
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_main.c:2591]:
tcpconn_do_send(): tcp_send: buf=#012#026#003#003
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_read.c:296]:
tcp_read_data(): EOF on 0x7f7513516958, FD 11
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_read.c:1293]:
tcp_read_req(): tcp_read_req: EOF
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [io_wait.h:617]:
io_watch_del(): DBG: io_watch_del (0x8e0040, 11, -1, 0x10) fd_no=2 called
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_read.c:1437]:
release_tcpconn(): releasing con 0x7f7513516958, state -1, fd=11, id=2
/usr/local/sbin/kamailio[4025]: DEBUG: <core> [tcp_read.c:1438]:
release_tcpconn(): extra_data 0x7f7513510a88
/usr/local/sbin/kamailio[4029]: DEBUG: <core> [tcp_main.c:3385]:
handle_tcp_child(): handle_tcp_child: reader response= 7f7513516958, -1
from 1
/usr/local/sbin/kamailio[4029]: DEBUG: tls [tls_server.c:597]:
tls_h_close(): Closing SSL connection 0x7f7513510a88

In sipml5 the error:

*Disconnected: Failed to connect to the server*

In the Chrome console:


*__tsip_transport_ws_onerror *
*__tsip_transport_ws_onclose *

SSL certificates seem to be ok:
# openssl verify -CAfile ca_list.pem ssl.pem
ssl.pem: OK

Can't figure out a solution :( Any ideas?

*Manuel Camargo*
Teléfono: 638000836
eMail: sir.louen-***@public.gmane.org

[Daniel-Constantin Mierla]

Hello,

if you run latest versions of web browsers, they become more restrictive
on wss connection. Be sure that the cetificate is also trusted by the
web browser.

You can go with the web browser to https://ipofkamailio:portforwss and
see if you get any warnings there.

Cheers,
Daniel

Post by Manuel Camarg
I'm trying to implement WSS with Kamailio
http://nil.uniza.sk/sip/kamailio/configuring-kamailio-4x-websocket
modparam("tls", "config", "webrtc/tls.cfg")
[server:default]
method = SSLv23
verify_certificate = no
require_certificate = no
private_key = webrtc/private.key
certificate = webrtc/ssl.pem
ca_list = webrtc/ca_list.pem
tls_complete_init(): Using TLS domain TLSs<default>
sr_ssl_ctx_info_callback(): SSL handshake started
tcpconn_do_send(): tcp_send: sending...
tcpconn_do_send(): tcp_send: after real write: c= 0x7f7513516958
n=5524 fd=11
tcpconn_do_send(): tcp_send: buf=#012#026#003#003
io_watch_add(): DBG: io_watch_add(0x8e0040, 11, 2, 0x7f7513516958), fd_no=1
sr_ssl_ctx_info_callback(): SSL handshake done
sr_ssl_ctx_info_callback(): SSL disable renegotiation
tls_accept(): TLS accept successful
tls_accept(): tls_accept: new connection from 123.123.123.123:63300
<http://123.123.123.123:63300> using TLSv1/SSLv3 AES256-SHA 256
tls_accept(): tls_accept: local socket: 124.124.124.124:10443
<http://124.124.124.124:10443>
tls_accept(): tls_accept: client did not present a certificate
tcpconn_do_send(): tcp_send: sending...
tcpconn_do_send(): tcp_send: after real write: c= 0x7f7513516958 n=282 fd=11
tcpconn_do_send(): tcp_send: buf=#012#026#003#003
tcp_read_data(): EOF on 0x7f7513516958, FD 11
tcp_read_req(): tcp_read_req: EOF
io_watch_del(): DBG: io_watch_del (0x8e0040, 11, -1, 0x10) fd_no=2 called
release_tcpconn(): releasing con 0x7f7513516958, state -1, fd=11, id=2
release_tcpconn(): extra_data 0x7f7513510a88
handle_tcp_child(): handle_tcp_child: reader response= 7f7513516958,
-1 from 1
tls_h_close(): Closing SSL connection 0x7f7513510a88
/Disconnected: *Failed to connect to the server*/
/*__tsip_transport_ws_onerror
*/
/*__tsip_transport_ws_onclose */
/*
*/
# openssl verify -CAfile ca_list.pem ssl.pem
ssl.pem: OK
Can't figure out a solution :( Any ideas?
*Manuel Camargo*
Teléfono: 638000836
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

[Manuel Camarg]

Hello Daniel:

Trying it, accessing via Browser here is the log, similarities with the
access via SIPML5, no errors, no warnings (at least as far as I can see):

DEBUG: <core> [ip_addr.c:243]: print_ip(): tcpconn_new: new tcp
connection: 123.123.123.123
DEBUG: <core> [tcp_main.c:1096]: tcpconn_new(): tcpconn_new: on port
58654, type 3
DEBUG: <core> [tcp_main.c:1408]: tcpconn_add(): tcpconn_add: hashes:
263:3337:1427, 5
DEBUG: <core> [io_wait.h:390]: io_watch_add(): DBG: io_watch_add(0x89bda0,
34, 2, 0x7f72f4768638), fd_no=22
DEBUG: <core> [io_wait.h:617]: io_watch_del(): DBG: io_watch_del
(0x89bda0, 34, -1, 0x0) fd_no=23 called
DEBUG: <core> [tcp_main.c:4302]: handle_tcpconn_ev(): tcp: DBG: sending to
child, events 1
DEBUG: <core> [tcp_main.c:3973]: send2child(): selected tcp worker 0
11(1700) for activity on [tls:124.124.124.124:10443], 0x7f72f4768638
DEBUG: <core> [tcp_read.c:1510]: handle_io(): received n=8
con=0x7f72f4768638, fd=11
DEBUG: tls [tls_server.c:178]: tls_complete_init(): Using TLS domain
TLSs<default>
DEBUG: tls [tls_domain.c:700]: sr_ssl_ctx_info_callback(): SSL handshake
started
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after real
write: c= 0x7f72f4768638 n=2060 fd=11
DEBUG: <core> [tcp_main.c:2591]: tcpconn_do_send(): tcp_send:
buf=#012#026#003#003
DEBUG: <core> [io_wait.h:390]: io_watch_add(): DBG:
io_watch_add(0x8e0040, 11, 2, 0x7f72f4768638), fd_no=1
DEBUG: tls [tls_domain.c:712]: sr_ssl_ctx_info_callback(): SSL handshake
done
DEBUG: tls [tls_domain.c:715]: sr_ssl_ctx_info_callback(): SSL disable
renegotiation
DEBUG: tls [tls_server.c:348]: tls_accept(): TLS accept successful
DEBUG: tls [tls_server.c:355]: tls_accept(): tls_accept: new connection
from 123.123.123.123:58654 using TLSv1/SSLv3 AES256-SHA 256
DEBUG: tls [tls_server.c:358]: tls_accept(): tls_accept: local socket:
124.124.124.124:10443
DEBUG: tls [tls_server.c:369]: tls_accept(): tls_accept: client did not
present a certificate
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after real
write: c= 0x7f72f4768638 n=282 fd=11
DEBUG: <core> [tcp_main.c:2591]: tcpconn_do_send(): tcp_send:
buf=#012#026#003#003
DEBUG: <core> [tcp_read.c:296]: tcp_read_data(): EOF on 0x7f72f4768638,
FD 11
DEBUG: <core> [tcp_read.c:1293]: tcp_read_req(): tcp_read_req: EOF
DEBUG: <core> [io_wait.h:617]: io_watch_del(): DBG: io_watch_del
(0x8e0040, 11, -1, 0x10) fd_no=2 called
DEBUG: <core> [tcp_read.c:1437]: release_tcpconn(): releasing con
0x7f72f4768638, state -1, fd=11, id=5
DEBUG: <core> [tcp_read.c:1438]: release_tcpconn(): extra_data
0x7f72f47915b0
DEBUG: <core> [tcp_main.c:3385]: handle_tcp_child(): handle_tcp_child:
reader response= 7f72f4768638, -1 from 0
DEBUG: tls [tls_server.c:597]: tls_h_close(): Closing SSL connection
0x7f72f47915b0
DEBUG: <core> [ip_addr.c:243]: print_ip(): tcpconn_new: new tcp
connection: 123.123.123.123
DEBUG: <core> [tcp_main.c:1096]: tcpconn_new(): tcpconn_new: on port
58656, type 3
DEBUG: <core> [tcp_main.c:1408]: tcpconn_add(): tcpconn_add: hashes:
313:3383:1453, 6
DEBUG: <core> [io_wait.h:390]: io_watch_add(): DBG:
io_watch_add(0x89bda0, 34, 2, 0x7f72f4768638), fd_no=22
DEBUG: <core> [io_wait.h:617]: io_watch_del(): DBG: io_watch_del
(0x89bda0, 34, -1, 0x0) fd_no=23 called
DEBUG: <core> [tcp_main.c:4302]: handle_tcpconn_ev(): tcp: DBG: sending
to child, events 1
DEBUG: <core> [tcp_main.c:3973]: send2child(): selected tcp worker 1
12(1701) for activity on [tls:124.124.124.124:10443], 0x7f72f4768638
DEBUG: <core> [tcp_read.c:1510]: handle_io(): received n=8
con=0x7f72f4768638, fd=11
DEBUG: tls [tls_server.c:178]: tls_complete_init(): Using TLS domain
TLSs<default>
DEBUG: tls [tls_domain.c:700]: sr_ssl_ctx_info_callback(): SSL handshake
started
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after real
write: c= 0x7f72f4768638 n=2060 fd=11
DEBUG: <core> [tcp_main.c:2591]: tcpconn_do_send(): tcp_send:
buf=#012#026#003#003
DEBUG: <core> [io_wait.h:390]: io_watch_add(): DBG:
io_watch_add(0x8e0040, 11, 2, 0x7f72f4768638), fd_no=1
DEBUG: tls [tls_domain.c:712]: sr_ssl_ctx_info_callback(): SSL handshake
done
DEBUG: tls [tls_domain.c:715]: sr_ssl_ctx_info_callback(): SSL disable
renegotiation
DEBUG: tls [tls_server.c:348]: tls_accept(): TLS accept successful
DEBUG: tls [tls_server.c:355]: tls_accept(): tls_accept: new connection
from 123.123.123.123:58656 using TLSv1/SSLv3 AES256-SHA 256
DEBUG: tls [tls_server.c:358]: tls_accept(): tls_accept: local socket:
124.124.124.124:10443
DEBUG: tls [tls_server.c:369]: tls_accept(): tls_accept: client did not
present a certificate
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after real
write: c= 0x7f72f4768638 n=282 fd=11
DEBUG: <core> [tcp_main.c:2591]: tcpconn_do_send(): tcp_send:
buf=#012#026#003#003
DEBUG: <core> [parser/msg_parser.c:623]: parse_msg(): SIP Request:
DEBUG: <core> [parser/msg_parser.c:625]: parse_msg(): method: <GET>
DEBUG: <core> [parser/msg_parser.c:627]: parse_msg(): uri: </>
DEBUG: <core> [parser/msg_parser.c:629]: parse_msg(): version: <HTTP/1.1>
DEBUG: <core> [parser/msg_parser.c:106]: get_hdr_field(): found end of
header
DEBUG: <core> [receive.c:152]: receive_msg(): After parse_msg...
DEBUG: xhttp [xhttp_mod.c:358]: xhttp_handler(): new fake msg created
(425 bytes):#012<GET / HTTP/1.1#015#012Via: SIP/2.0/TLS
123.123.123.123:58656#015#012Host: domain.com:10443#015#012Connection:
keep-alive#015#012Cache-Control: max-age=0#015#012Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8#015#012User-Agent:
Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/37.0.2062.103 Safari/537.36#015#012Accept-Encoding:
gzip,deflate#015#012Accept-Language:
es,en-GB;q=0.8,en;q=0.6,fr;q=0.4#015#012#015#012>
DEBUG: <core> [parser/msg_parser.c:623]: parse_msg(): SIP Request:
DEBUG: <core> [parser/msg_parser.c:625]: parse_msg(): method: <GET>
DEBUG: <core> [parser/msg_parser.c:627]: parse_msg(): uri: </>
DEBUG: <core> [parser/msg_parser.c:629]: parse_msg(): version: <HTTP/1.1>
DEBUG: <core> [parser/parse_via.c:2672]: parse_via(): end of header
reached, state=5
DEBUG: <core> [parser/msg_parser.c:513]: parse_headers(): parse_headers:
Via found, flags=2
DEBUG: <core> [parser/msg_parser.c:515]: parse_headers(): parse_headers:
this is the first via
INFO: <script>: HTTP Request Received
DEBUG: <core> [parser/msg_parser.c:106]: get_hdr_field(): found end of
header
DEBUG: sl [sl.c:288]: send_reply(): reply in stateless mode (sl)
DEBUG: <core> [msg_translator.c:204]: check_via_address():
check_via_address( 123.123.123.123, 123.123.123.123, 0)
DEBUG: <core> [tcp_main.c:2320]: tcpconn_send_put(): tcp_send: send from
reader (1701 (12)), reusing fd
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after real
write: c= 0x7f72f4768638 n=165 fd=11
DEBUG: <core> [tcp_main.c:2591]: tcpconn_do_send(): tcp_send:
buf=#012#027#003#003
DEBUG: <core> [tcp_main.c:3624]: handle_ser_child(): handle_ser_child:
read response= 7f72f4768638, -1, fd -1 from 12 (1701)
DEBUG: tls [tls_server.c:597]: tls_h_close(): Closing SSL connection
0x7f72f47915b0
DEBUG: <core> [usr_avp.c:644]: destroy_avp_list():
DEBUG:destroy_avp_list: destroying list (nil)
message repeated 5 times: [ DEBUG: <core> [usr_avp.c:644]:
destroy_avp_list(): DEBUG:destroy_avp_list: destroying list (nil)]
DEBUG: <core> [xavp.c:448]: xavp_destroy_list(): destroying xavp list
(nil)
DEBUG: <core> [receive.c:296]: receive_msg(): receive_msg: cleaning up
DEBUG: <core> [io_wait.h:617]: io_watch_del(): DBG: io_watch_del
(0x8e0040, 11, -1, 0x10) fd_no=2 called
DEBUG: <core> [tcp_read.c:1437]: release_tcpconn(): releasing con
0x7f72f4768638, state -2, fd=11, id=6
DEBUG: <core> [tcp_read.c:1438]: release_tcpconn(): extra_data
0x7f72f47915b0
DEBUG: <core> [tcp_main.c:3385]: handle_tcp_child(): handle_tcp_child:
reader response= 7f72f4768638, -2 from 1

Regards and thanks for your time


*Manuel Camargo*
Teléfono: 638000836
eMail: sir.louen-***@public.gmane.org
<https://twitter.com/SirLouen>
[image: Ver el perfil de Manuel Camargo Lominchar en LinkedIn]
<http://es.linkedin.com/in/louen>

Post by Daniel-Constantin Mierla
Hello,
if you run latest versions of web browsers, they become more restrictive
on wss connection. Be sure that the cetificate is also trusted by the web
browser.
You can go with the web browser to https://ipofkamailio:portforwss and
see if you get any warnings there.
Cheers,
Daniel
I'm trying to implement WSS with Kamailio
http://nil.uniza.sk/sip/kamailio/configuring-kamailio-4x-websocket
modparam("tls", "config", "webrtc/tls.cfg")
[server:default]
method = SSLv23
verify_certificate = no
require_certificate = no
private_key = webrtc/private.key
certificate = webrtc/ssl.pem
ca_list = webrtc/ca_list.pem
tls_complete_init(): Using TLS domain TLSs<default>
sr_ssl_ctx_info_callback(): SSL handshake started
tcpconn_do_send(): tcp_send: sending...
tcpconn_do_send(): tcp_send: after real write: c= 0x7f7513516958 n=5524
fd=11
tcpconn_do_send(): tcp_send: buf=#012#026#003#003
io_watch_add(): DBG: io_watch_add(0x8e0040, 11, 2, 0x7f7513516958), fd_no=1
sr_ssl_ctx_info_callback(): SSL handshake done
sr_ssl_ctx_info_callback(): SSL disable renegotiation
tls_accept(): TLS accept successful
tls_accept(): tls_accept: new connection from 123.123.123.123:63300 using
TLSv1/SSLv3 AES256-SHA 256
tls_accept(): tls_accept: local socket: 124.124.124.124:10443
tls_accept(): tls_accept: client did not present a certificate
tcpconn_do_send(): tcp_send: sending...
tcpconn_do_send(): tcp_send: after real write: c= 0x7f7513516958 n=282 fd=11
tcpconn_do_send(): tcp_send: buf=#012#026#003#003
tcp_read_data(): EOF on 0x7f7513516958, FD 11
tcp_read_req(): tcp_read_req: EOF
io_watch_del(): DBG: io_watch_del (0x8e0040, 11, -1, 0x10) fd_no=2 called
release_tcpconn(): releasing con 0x7f7513516958, state -1, fd=11, id=2
release_tcpconn(): extra_data 0x7f7513510a88
handle_tcp_child(): handle_tcp_child: reader response= 7f7513516958, -1
from 1
tls_h_close(): Closing SSL connection 0x7f7513510a88
*Disconnected: Failed to connect to the server*
*__tsip_transport_ws_onerror *
*__tsip_transport_ws_onclose *
# openssl verify -CAfile ca_list.pem ssl.pem
ssl.pem: OK
Can't figure out a solution :( Any ideas?
*Manuel Camargo*
Teléfono: 638000836
_______________________________________________
--
Daniel-Constantin Mierlahttp://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Next Kamailio Advanced Trainings 2014 - http://www.asipto.com
Sep 22-25, Berlin, Germany

[Daniel-Constantin Mierla]

Hello,

from the logs you sent now, it appears that you have set_reply_close()
in config, therefore the connection is closed after sending the reply.

Cheers,
Daniel

Post by Manuel Camarg
Trying it, accessing via Browser here is the log, similarities with
the access via SIPML5, no errors, no warnings (at least as far as I
DEBUG: <core> [ip_addr.c:243]: print_ip(): tcpconn_new: new tcp
connection: 123.123.123.123
DEBUG: <core> [tcp_main.c:1096]: tcpconn_new(): tcpconn_new: on port
58654, type 3
263:3337:1427, 5
io_watch_add(0x89bda0, 34, 2, 0x7f72f4768638), fd_no=22
DEBUG: <core> [io_wait.h:617]: io_watch_del(): DBG: io_watch_del
(0x89bda0, 34, -1, 0x0) fd_no=23 called
sending to child, events 1
DEBUG: <core> [tcp_main.c:3973]: send2child(): selected tcp worker 0
11(1700) for activity on [tls:124.124.124.124:10443
<http://124.124.124.124:10443>], 0x7f72f4768638
DEBUG: <core> [tcp_read.c:1510]: handle_io(): received n=8
con=0x7f72f4768638, fd=11
DEBUG: tls [tls_server.c:178]: tls_complete_init(): Using TLS domain
TLSs<default>
DEBUG: tls [tls_domain.c:700]: sr_ssl_ctx_info_callback(): SSL
handshake started
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after
real write: c= 0x7f72f4768638 n=2060 fd=11
buf=#012#026#003#003
io_watch_add(0x8e0040, 11, 2, 0x7f72f4768638), fd_no=1
DEBUG: tls [tls_domain.c:712]: sr_ssl_ctx_info_callback(): SSL
handshake done
DEBUG: tls [tls_domain.c:715]: sr_ssl_ctx_info_callback(): SSL
disable renegotiation
DEBUG: tls [tls_server.c:348]: tls_accept(): TLS accept successful
DEBUG: tls [tls_server.c:355]: tls_accept(): tls_accept: new
connection from 123.123.123.123:58654 <http://123.123.123.123:58654>
using TLSv1/SSLv3 AES256-SHA 256
DEBUG: tls [tls_server.c:358]: tls_accept(): tls_accept: local
socket: 124.124.124.124:10443 <http://124.124.124.124:10443>
DEBUG: tls [tls_server.c:369]: tls_accept(): tls_accept: client did
not present a certificate
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after
real write: c= 0x7f72f4768638 n=282 fd=11
buf=#012#026#003#003
DEBUG: <core> [tcp_read.c:296]: tcp_read_data(): EOF on
0x7f72f4768638, FD 11
DEBUG: <core> [tcp_read.c:1293]: tcp_read_req(): tcp_read_req: EOF
DEBUG: <core> [io_wait.h:617]: io_watch_del(): DBG: io_watch_del
(0x8e0040, 11, -1, 0x10) fd_no=2 called
DEBUG: <core> [tcp_read.c:1437]: release_tcpconn(): releasing con
0x7f72f4768638, state -1, fd=11, id=5
DEBUG: <core> [tcp_read.c:1438]: release_tcpconn(): extra_data
0x7f72f47915b0
handle_tcp_child: reader response= 7f72f4768638, -1 from 0
DEBUG: tls [tls_server.c:597]: tls_h_close(): Closing SSL connection
0x7f72f47915b0
DEBUG: <core> [ip_addr.c:243]: print_ip(): tcpconn_new: new tcp
connection: 123.123.123.123
DEBUG: <core> [tcp_main.c:1096]: tcpconn_new(): tcpconn_new: on port
58656, type 3
313:3383:1453, 6
io_watch_add(0x89bda0, 34, 2, 0x7f72f4768638), fd_no=22
DEBUG: <core> [io_wait.h:617]: io_watch_del(): DBG: io_watch_del
(0x89bda0, 34, -1, 0x0) fd_no=23 called
sending to child, events 1
DEBUG: <core> [tcp_main.c:3973]: send2child(): selected tcp worker 1
12(1701) for activity on [tls:124.124.124.124:10443
<http://124.124.124.124:10443>], 0x7f72f4768638
DEBUG: <core> [tcp_read.c:1510]: handle_io(): received n=8
con=0x7f72f4768638, fd=11
DEBUG: tls [tls_server.c:178]: tls_complete_init(): Using TLS domain
TLSs<default>
DEBUG: tls [tls_domain.c:700]: sr_ssl_ctx_info_callback(): SSL
handshake started
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after
real write: c= 0x7f72f4768638 n=2060 fd=11
buf=#012#026#003#003
io_watch_add(0x8e0040, 11, 2, 0x7f72f4768638), fd_no=1
DEBUG: tls [tls_domain.c:712]: sr_ssl_ctx_info_callback(): SSL
handshake done
DEBUG: tls [tls_domain.c:715]: sr_ssl_ctx_info_callback(): SSL
disable renegotiation
DEBUG: tls [tls_server.c:348]: tls_accept(): TLS accept successful
DEBUG: tls [tls_server.c:355]: tls_accept(): tls_accept: new
connection from 123.123.123.123:58656 <http://123.123.123.123:58656>
using TLSv1/SSLv3 AES256-SHA 256
DEBUG: tls [tls_server.c:358]: tls_accept(): tls_accept: local
socket: 124.124.124.124:10443 <http://124.124.124.124:10443>
DEBUG: tls [tls_server.c:369]: tls_accept(): tls_accept: client did
not present a certificate
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after
real write: c= 0x7f72f4768638 n=282 fd=11
buf=#012#026#003#003
DEBUG: <core> [parser/msg_parser.c:625]: parse_msg(): method: <GET>
DEBUG: <core> [parser/msg_parser.c:627]: parse_msg(): uri: </>
DEBUG: <core> [parser/msg_parser.c:629]: parse_msg(): version: <HTTP/1.1>
DEBUG: <core> [parser/msg_parser.c:106]: get_hdr_field(): found end
of header
DEBUG: <core> [receive.c:152]: receive_msg(): After parse_msg...
DEBUG: xhttp [xhttp_mod.c:358]: xhttp_handler(): new fake msg
created (425 bytes):#012<GET / HTTP/1.1#015#012Via: SIP/2.0/TLS
123.123.123.123:58656#015#012Host
domain.com:10443#015#012Connection
Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like
es,en-GB;q=0.8,en;q=0.6,fr;q=0.4#015#012#015#012>
DEBUG: <core> [parser/msg_parser.c:625]: parse_msg(): method: <GET>
DEBUG: <core> [parser/msg_parser.c:627]: parse_msg(): uri: </>
DEBUG: <core> [parser/msg_parser.c:629]: parse_msg(): version: <HTTP/1.1>
DEBUG: <core> [parser/parse_via.c:2672]: parse_via(): end of header
reached, state=5
parse_headers: Via found, flags=2
parse_headers: this is the first via
INFO: <script>: HTTP Request Received
DEBUG: <core> [parser/msg_parser.c:106]: get_hdr_field(): found end
of header
DEBUG: sl [sl.c:288]: send_reply(): reply in stateless mode (sl)
check_via_address( 123.123.123.123, 123.123.123.123, 0)
DEBUG: <core> [tcp_main.c:2320]: tcpconn_send_put(): tcp_send: send
from reader (1701 (12)), reusing fd
DEBUG: <core> [tcp_main.c:2556]: tcpconn_do_send(): tcp_send: sending...
DEBUG: <core> [tcp_main.c:2590]: tcpconn_do_send(): tcp_send: after
real write: c= 0x7f72f4768638 n=165 fd=11
buf=#012#027#003#003
handle_ser_child: read response= 7f72f4768638, -1, fd -1 from 12 (1701)
DEBUG: tls [tls_server.c:597]: tls_h_close(): Closing SSL connection
0x7f72f47915b0
DEBUG:destroy_avp_list: destroying list (nil)
destroy_avp_list(): DEBUG:destroy_avp_list: destroying list (nil)]
DEBUG: <core> [xavp.c:448]: xavp_destroy_list(): destroying xavp
list (nil)
DEBUG: <core> [receive.c:296]: receive_msg(): receive_msg: cleaning up
DEBUG: <core> [io_wait.h:617]: io_watch_del(): DBG: io_watch_del
(0x8e0040, 11, -1, 0x10) fd_no=2 called
DEBUG: <core> [tcp_read.c:1437]: release_tcpconn(): releasing con
0x7f72f4768638, state -2, fd=11, id=6
DEBUG: <core> [tcp_read.c:1438]: release_tcpconn(): extra_data
0x7f72f47915b0
handle_tcp_child: reader response= 7f72f4768638, -2 from 1
Regards and thanks for your time
*Manuel Camargo*
Teléfono: 638000836
<https://twitter.com/SirLouen>
Ver el perfil de Manuel Camargo Lominchar en LinkedIn
<http://es.linkedin.com/in/louen>
Hello,
if you run latest versions of web browsers, they become more
restrictive on wss connection. Be sure that the cetificate is also
trusted by the web browser.
You can go with the web browser to https://ipofkamailio:portforwss
and see if you get any warnings there.
Cheers,
Daniel

Post by Manuel Camarg
I'm trying to implement WSS with Kamailio
http://nil.uniza.sk/sip/kamailio/configuring-kamailio-4x-websocket
modparam("tls", "config", "webrtc/tls.cfg")
[server:default]
method = SSLv23
verify_certificate = no
require_certificate = no
private_key = webrtc/private.key
certificate = webrtc/ssl.pem
ca_list = webrtc/ca_list.pem
tls_complete_init(): Using TLS domain TLSs<default>
sr_ssl_ctx_info_callback(): SSL handshake started
tcpconn_do_send(): tcp_send: sending...
tcpconn_do_send(): tcp_send: after real write: c= 0x7f7513516958
n=5524 fd=11
tcpconn_do_send(): tcp_send: buf=#012#026#003#003
io_watch_add(): DBG: io_watch_add(0x8e0040, 11, 2,
0x7f7513516958), fd_no=1
sr_ssl_ctx_info_callback(): SSL handshake done
sr_ssl_ctx_info_callback(): SSL disable renegotiation
tls_accept(): TLS accept successful
tls_accept(): tls_accept: new connection from
123.123.123.123:63300 <http://123.123.123.123:63300> using
TLSv1/SSLv3 AES256-SHA 256
tls_accept(): tls_accept: local socket: 124.124.124.124:10443
<http://124.124.124.124:10443>
tls_accept(): tls_accept: client did not present a certificate
tcpconn_do_send(): tcp_send: sending...
tcpconn_do_send(): tcp_send: after real write: c= 0x7f7513516958 n=282 fd=11
tcpconn_do_send(): tcp_send: buf=#012#026#003#003
tcp_read_data(): EOF on 0x7f7513516958, FD 11
tcp_read_req(): tcp_read_req: EOF
io_watch_del(): DBG: io_watch_del (0x8e0040, 11, -1, 0x10) fd_no=2 called
release_tcpconn(): releasing con 0x7f7513516958, state -1, fd=11, id=2
release_tcpconn(): extra_data 0x7f7513510a88
handle_tcp_child(): handle_tcp_child: reader response=
7f7513516958, -1 from 1
tls_h_close(): Closing SSL connection 0x7f7513510a88
/Disconnected: *Failed to connect to the server*/
/*__tsip_transport_ws_onerror
*/
/*__tsip_transport_ws_onclose */
/*
*/
# openssl verify -CAfile ca_list.pem ssl.pem
ssl.pem: OK
Can't figure out a solution :( Any ideas?
*Manuel Camargo*
Teléfono: 638000836 <tel:[phone]>
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

--
Daniel-Constantin Mierla
http://twitter.com/#!/miconda <http://twitter.com/#%21/miconda> -http://www.linkedin.com/in/miconda
Next Kamailio Advanced Trainings 2014 -http://www.asipto.com
Sep 22-25, Berlin, Germany
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

[Manuel Camarg]

According to this article I mentioned in the beginning:

http://nil.uniza.sk/sip/kamailio/configuring-kamailio-4x-websocket

In http:request they do straight away the set_reply_close();

I don't know exactly if this kamailio.cfg implementation may be useful for
working with WSS:

event_route[xhttp:request] {
set_reply_close();
set_reply_no_connect();

if ($Rp != MY_WS_PORT
#!ifdef WITH_TLS
&& $Rp != MY_WSS_PORT
#!endif
) {
xlog("L_WARN", "HTTP request received on $Rp\n");
xhttp_reply("403", "Forbidden", "", "");
exit;
}

xlog("L_DBG", "HTTP Request Received\n");

if ($hdr(Upgrade)=~"websocket"
&& $hdr(Connection)=~"Upgrade"
&& $rm=~"GET") {

# Validate Host - make sure the client is using the correct
# alias for WebSockets
if ($hdr(Host) == $null || !is_myself("sip:" + $hdr(Host))) {
xlog("L_WARN", "Bad host $hdr(Host)\n");
xhttp_reply("403", "Forbidden", "", "");
exit;
}

# Optional... validate Origin - make sure the client is from an
# authorised website. For example,
#
# if ($hdr(Origin) != "http://communicator.MY_DOMAIN"
# && $hdr(Origin) != "https://communicator.MY_DOMAIN") {
# xlog("L_WARN", "Unauthorised client $hdr(Origin)\n");
# xhttp_reply("403", "Forbidden", "", "");
# exit;
# }

# Optional... perform HTTP authentication

# ws_handle_handshake() exits (no further configuration file
# processing of the request) when complete.
if (ws_handle_handshake())
{
# Optional... cache some information about the
# successful connection
exit;
}
}

HTTP authentication is not being properly set up. Any indications on how to
perform this sucessfully?

Kind regards

Manuel

Post by Daniel-Constantin Mierla
Hello,
from the logs you sent now, it appears that you have set_reply_close()
in config, therefore the connection is closed after sending the reply.
Cheers,
Daniel

[Daniel-Constantin Mierla]

The set_reply_close() should be removed from there.

For digest authentication, simply use the same functions as for sip
(e.g., from auth/auth_db modules).

Cheers,
Daniel

Post by Manuel Camarg
http://nil.uniza.sk/sip/kamailio/configuring-kamailio-4x-websocket
In http:request they do straight away the set_reply_close();
I don't know exactly if this kamailio.cfg implementation may be useful
event_route[xhttp:request] {
set_reply_close();
set_reply_no_connect();
if ($Rp != MY_WS_PORT
#!ifdef WITH_TLS
&& $Rp != MY_WSS_PORT
#!endif
) {
xlog("L_WARN", "HTTP request received on $Rp\n");
xhttp_reply("403", "Forbidden", "", "");
exit;
}
xlog("L_DBG", "HTTP Request Received\n");
if ($hdr(Upgrade)=~"websocket"
&& $hdr(Connection)=~"Upgrade"
&& $rm=~"GET") {
# Validate Host - make sure the client is using the correct
# alias for WebSockets
if ($hdr(Host) == $null || !is_myself("sip:" + $hdr(Host))) {
xlog("L_WARN", "Bad host $hdr(Host)\n");
xhttp_reply("403", "Forbidden", "", "");
exit;
}
# Optional... validate Origin - make sure the client is from an
# authorised website. For example,
#
# if ($hdr(Origin) != "http://communicator.MY_DOMAIN"
# && $hdr(Origin) != "https://communicator.MY_DOMAIN") {
# xlog("L_WARN", "Unauthorised client $hdr(Origin)\n");
# xhttp_reply("403", "Forbidden", "", "");
# exit;
# }
# Optional... perform HTTP authentication
# ws_handle_handshake() exits (no further configuration file
# processing of the request) when complete.
if (ws_handle_handshake())
{
# Optional... cache some information about the
# successful connection
exit;
}
}
HTTP authentication is not being properly set up. Any indications on
how to perform this sucessfully?
Kind regards
Manuel

Post by Daniel-Constantin Mierla
Hello,
from the logs you sent now, it appears that you have set_reply_close()
in config, therefore the connection is closed after sending the reply.
Cheers,
Daniel

[Juha Heinanen]

Post by Daniel-Constantin Mierla
The set_reply_close() should be removed from there.

why is that? my wss clients work fine even when i have:

event_route[xhttp:request] { # Handle HTTP requests

set_reply_close();
set_reply_no_connect();

this was included in the original instructions when wss transport was
introduced to kamailio.

-- juha

[Daniel-Constantin Mierla]

Post by Juha Heinanen

Post by Daniel-Constantin Mierla
The set_reply_close() should be removed from there.

why is that? my wss clients

are they ws (over tcp) or wss (over tls)?

Post by Juha Heinanen
event_route[xhttp:request] { # Handle HTTP requests
set_reply_close();
set_reply_no_connect();
this was included in the original instructions when wss transport was
introduced to kamailio.

I guess the example was built on top of the one for xhttp module which
closes the connection after sending the http reply.

On the other hand, I remember that I tested with default example some
time ago and worked. However, more recent versions of browsers don't
work with that anymore. What browser (or wss client) are you using?

Cheers,
Daniel

[Juha Heinanen]

Post by Daniel-Constantin Mierla
On the other hand, I remember that I tested with default example some
time ago and worked. However, more recent versions of browsers don't
work with that anymore. What browser (or wss client) are you using?

i have used jsip based web client both with firefox and chrome
browsers. i just tested yesterday with latest stable versions of both
browsers and didn't have any problems.

-- juha

[Manuel Camarg]

Hello Juha

They why you think i'm encountering this issue based on the beginning of
this topic?
http://lists.sip-router.org/pipermail/sr-users/2014-September/084699.html

However, more recent versions of browsers don't work with that anymore

Do you have an example of some functional wss system? (xhttp request route)

Regards


*Manuel Camargo*
Teléfono: 638000836
eMail: sir.louen-***@public.gmane.org
<https://twitter.com/SirLouen>
[image: Ver el perfil de Manuel Camargo Lominchar en LinkedIn]
<http://es.linkedin.com/in/louen>

Post by Daniel-Constantin Mierla
On the other hand, I remember that I tested with default example some
time ago and worked. However, more recent versions of browsers don't
work with that anymore. What browser (or wss client) are you using?

i have used jsip based web client both with firefox and chrome
browsers. i just tested yesterday with latest stable versions of both
browsers and didn't have any problems.
-- juha

[Juha Heinanen]

Post by Manuel Camarg
They why you think i'm encountering this issue based on the beginning of
this topic?
http://lists.sip-router.org/pipermail/sr-users/2014-September/084699.html

perhaps it has something to do with sipml5. i'm using jssip based ws
client. try with the jssip demo client to see if there is any
difference.

-- juha

[Daniel-Constantin Mierla]

Hello,

Post by Manuel Camarg
Hello Juha
They why you think i'm encountering this issue based on the beginning
of this topic?
http://lists.sip-router.org/pipermail/sr-users/2014-September/084699.html

However, more recent versions of browsers don't work with that anymore

Do you have an example of some functional wss system? (xhttp request route)

next is a piece of config that I used recently and worked.

Cheers,
Daniel

event_route[xhttp:request] {

set_reply_no_connect();

if ($Rp != 8080 # MY_WS_PORT
&& $Rp != 8082 # MY_WSS_PORT

) {
xlog("L_WARN", "HTTP request received on $Rp\n");
xhttp_reply("403", "Forbidden", "", "");
exit;
}

xlog("L_DBG", "HTTP Request Received\n");

if ($hdr(Upgrade)=~"websocket"
&& $hdr(Connection)=~"Upgrade"
&& $rm=~"GET") {

# Validate Host - make sure the client is using the correct
# alias for WebSockets
if ($hdr(Host) == $null || !is_myself("sip:" + $hdr(Host))) {
xlog("L_WARN", "Bad host $hdr(Host)\n");
xhttp_reply("403", "Forbidden", "", "");
exit;
}

# ws_handle_handshake() exits (no further configuration file
# processing of the request) when complete.
if (ws_handle_handshake())
{
# Optional... cache some information about the
# successful connection
exit;
}
}

xhttp_reply("404", "Not Found", "", "");
}

[Daniel-Constantin Mierla]

Post by Juha Heinanen

Post by Daniel-Constantin Mierla
On the other hand, I remember that I tested with default example some
time ago and worked. However, more recent versions of browsers don't
work with that anymore. What browser (or wss client) are you using?

i have used jsip based web client both with firefox and chrome
browsers. i just tested yesterday with latest stable versions of both
browsers and didn't have any problems.

I am using beta version for firefox and chrome, aslo with jssip (might
not be the latest version, though).

Cheers,
Daniel

[Manuel Camarg]

I used jssip during testing. It doesn't differ much from sipml5 from
regular operations, but it does not work with wss (at least with my current
config, the mentioned before)

Are you sure you are using WSS with that config or just WS?
The problem is I cant debug since I have no errors in regular log :( just
seems a handshake issue


*Manuel Camargo*
Teléfono: 638000836
eMail: sir.louen-***@public.gmane.org
<https://twitter.com/SirLouen>
[image: Ver el perfil de Manuel Camargo Lominchar en LinkedIn]
<http://es.linkedin.com/in/louen>

Post by Daniel-Constantin Mierla
On the other hand, I remember that I tested with default example some

Post by Daniel-Constantin Mierla
time ago and worked. However, more recent versions of browsers don't
work with that anymore. What browser (or wss client) are you using?

i have used jsip based web client both with firefox and chrome
browsers. i just tested yesterday with latest stable versions of both
browsers and didn't have any problems.

I am using beta version for firefox and chrome, aslo with jssip (might not
be the latest version, though).
Cheers,
Daniel
--
Daniel-Constantin Mierla
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Next Kamailio Advanced Trainings 2014 - http://www.asipto.com
Sep 22-25, Berlin, Germany

[Daniel-Constantin Mierla]

Post by Manuel Camarg
I used jssip during testing. It doesn't differ much from sipml5 from
regular operations, but it does not work with wss (at least with my
current config, the mentioned before)
Are you sure you are using WSS with that config or just WS?
The problem is I cant debug since I have no errors in regular log :(
just seems a handshake issue

One thing I also noticed lately, if I am on https page and try to make a
ws (tcp) connection, the browser doesn't allow it.

What do you get in browser console?

Cheers,
Daniel

Post by Manuel Camarg
*Manuel Camargo*
Teléfono: 638000836
<https://twitter.com/SirLouen>
Ver el perfil de Manuel Camargo Lominchar en LinkedIn
<http://es.linkedin.com/in/louen>
On the other hand, I remember that I tested with default
example some
time ago and worked. However, more recent versions of
browsers don't
work with that anymore. What browser (or wss client) are you using?
i have used jsip based web client both with firefox and chrome
browsers. i just tested yesterday with latest stable versions of both
browsers and didn't have any problems.
I am using beta version for firefox and chrome, aslo with jssip
(might not be the latest version, though).
Cheers,
Daniel
--
Daniel-Constantin Mierla
http://twitter.com/#!/miconda <http://twitter.com/#%21/miconda> -
http://www.linkedin.com/in/miconda
Next Kamailio Advanced Trainings 2014 - http://www.asipto.com
Sep 22-25, Berlin, Germany

[Manuel Camarg]

Daniel, websocket is not "downgradeable" under https, that's why I'm trying
to make this work

As I said in the first message here is the error log in the browser:

In the Chrome console:


*__tsip_transport_ws_onerror *
*__tsip_transport_ws_onclose *

Regards,
Manuel


*Manuel Camargo*
Teléfono: 638000836
eMail: sir.louen-***@public.gmane.org
<https://twitter.com/SirLouen>
[image: Ver el perfil de Manuel Camargo Lominchar en LinkedIn]
<http://es.linkedin.com/in/louen>

Post by Manuel Camarg
I used jssip during testing. It doesn't differ much from sipml5 from
regular operations, but it does not work with wss (at least with my current
config, the mentioned before)
Are you sure you are using WSS with that config or just WS?
The problem is I cant debug since I have no errors in regular log :( just
seems a handshake issue
One thing I also noticed lately, if I am on https page and try to make a
ws (tcp) connection, the browser doesn't allow it.
What do you get in browser console?
Cheers,
Daniel
*Manuel Camargo*
Teléfono: 638000836
<https://twitter.com/SirLouen>
[image: Ver el perfil de Manuel Camargo Lominchar en LinkedIn]
<http://es.linkedin.com/in/louen>

Post by Daniel-Constantin Mierla

Post by Daniel-Constantin Mierla
On the other hand, I remember that I tested with default example some

Post by Daniel-Constantin Mierla
time ago and worked. However, more recent versions of browsers don't
work with that anymore. What browser (or wss client) are you using?

i have used jsip based web client both with firefox and chrome
browsers. i just tested yesterday with latest stable versions of both
browsers and didn't have any problems.

I am using beta version for firefox and chrome, aslo with jssip (might
not be the latest version, though).
Cheers,
Daniel
--
Daniel-Constantin Mierla
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Next Kamailio Advanced Trainings 2014 - http://www.asipto.com
Sep 22-25, Berlin, Germany

--
Daniel-Constantin Mierlahttp://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Next Kamailio Advanced Trainings 2014 - http://www.asipto.com
Sep 22-25, Berlin, Germany

[Daniel-Constantin Mierla]

Post by Manuel Camarg
Daniel, websocket is not "downgradeable" under https, that's why I'm
trying to make this work
/*__tsip_transport_ws_onerror
*/
/*__tsip_transport_ws_onclose
*/

Are these the only messages printed? In the javascript console of Chrome?

Daniel

Post by Manuel Camarg
/*
*/
Regards,/*
*/
Manuel
*Manuel Camargo*
Teléfono: 638000836
<https://twitter.com/SirLouen>
Ver el perfil de Manuel Camargo Lominchar en LinkedIn
<http://es.linkedin.com/in/louen>

Post by Manuel Camarg
I used jssip during testing. It doesn't differ much from sipml5
from regular operations, but it does not work with wss (at least
with my current config, the mentioned before)
Are you sure you are using WSS with that config or just WS?
The problem is I cant debug since I have no errors in regular log
:( just seems a handshake issue

One thing I also noticed lately, if I am on https page and try to
make a ws (tcp) connection, the browser doesn't allow it.
What do you get in browser console?
Cheers,
Daniel

Post by Manuel Camarg
*Manuel Camargo*
Teléfono: 638000836 <tel:[phone]>
<https://twitter.com/SirLouen>
Ver el perfil de Manuel Camargo Lominchar en LinkedIn
<http://es.linkedin.com/in/louen>
2014-09-11 12:40 GMT+02:00 Daniel-Constantin Mierla
On the other hand, I remember that I tested with
default example some
time ago and worked. However, more recent versions of
browsers don't
work with that anymore. What browser (or wss client)
are you using?
i have used jsip based web client both with firefox and chrome
browsers. i just tested yesterday with latest stable
versions of both
browsers and didn't have any problems.
I am using beta version for firefox and chrome, aslo with
jssip (might not be the latest version, though).
Cheers,
Daniel
--
Daniel-Constantin Mierla
http://twitter.com/#!/miconda
<http://twitter.com/#%21/miconda> -
http://www.linkedin.com/in/miconda
Next Kamailio Advanced Trainings 2014 - http://www.asipto.com
Sep 22-25, Berlin, Germany

--
Daniel-Constantin Mierla
http://twitter.com/#!/miconda <http://twitter.com/#%21/miconda> -http://www.linkedin.com/in/miconda
Next Kamailio Advanced Trainings 2014 -http://www.asipto.com
Sep 22-25, Berlin, Germany

[Juha Heinanen]

Post by Daniel-Constantin Mierla

Post by Manuel Camarg
Are you sure you are using WSS with that config or just WS?
The problem is I cant debug since I have no errors in regular log :(
just seems a handshake issue

One thing I also noticed lately, if I am on https page and try to make a
ws (tcp) connection, the browser doesn't allow it.

i'm using only wss, i.e., my proxy is listening only on tls websocket
port.

below is what i get to browser js console when connection is set up and
my web client sends register request. i don't know how to get kamailio
tls log at debug level.

-- juha

"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | configuration parameters after validation:" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · via_host: "c090j2d3iko1.invalid"" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · password: NOT SHOWN" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · register_expires: 600" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · register: true" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · registrar_server: sip:test.tutpro.com" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · ws_server_max_reconnection: 3" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · ws_server_reconnection_timeout: 4" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · connection_recovery_min_interval: 2" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · connection_recovery_max_interval: 30" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · use_preloaded_route: false" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · no_answer_timeout: 60000" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · stun_servers: ["stun:stun.l.google.com:19302"]" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · turn_servers: []" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · trace_sip: true" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · hack_via_tcp: false" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · hack_ip_in_contact: false" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · uri: sip:***@test.tutpro.com" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · ws_servers: [{"ws_uri":"wss://test.tutpro.com:8001","sip_uri":"<sip:test.tutpro.com:8001;transport=ws;lr>","weight":0,"status":0,"scheme":"WSS"}]" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · authorization_user: "jh"" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · display_name: "Juha Heinanen"" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · instance_id: "d9d16181-c87c-4e41-b4ce-f56280fbc135"" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · jssip_id: "lb46m"" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | · hostport_params: "test.tutpro.com"" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | user requested startup..." jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.transport | connecting to WebSocket wss://test.tutpro.com:8001" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:33 GMT+0300 (EEST) | jssip.ua | emitting event connecting" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:34 GMT+0300 (EEST) | jssip.transport | WebSocket wss://test.tutpro.com:8001 connected" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:34 GMT+0300 (EEST) | jssip.ua | connection state set to 0" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:34 GMT+0300 (EEST) | jssip.ua | emitting event newTransaction" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:34 GMT+0300 (EEST) | jssip.transaction.nict | emitting event stateChanged" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:34 GMT+0300 (EEST) | jssip.transport | sending WebSocket message:

REGISTER sip:test.tutpro.com SIP/2.0
Via: SIP/2.0/WSS c090j2d3iko1.invalid;branch=z9hG4bK3979772
Max-Forwards: 69
To: <sip:jh-rpes8qn5lV+***@public.gmane.org>
From: "Juha Heinanen" <sip:jh-rpes8qn5lV+***@public.gmane.org>;tag=00a6ilq626
Call-ID: g9rm7pkhb0mijn9emmep8r
CSeq: 81 REGISTER
Contact: <sip:ddr8h1o0-ZBP/+dKjjjW+***@public.gmane.org;transport=ws>;+sip.ice;reg-id=1;+sip.instance="<urn:uuid:d9d16181-c87c-4e41-b4ce-f56280fbc135>";expires=600
Allow: ACK,CANCEL,BYE,OPTIONS,INVITE,MESSAGE
Supported: path,gruu,outbound
User-Agent: JsSIP 0.4.0-devel
Content-Length: 0

" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:34 GMT+0300 (EEST) | jssip.ua | emitting event connected" jssip-devel.min.js:9
"Thu Sep 11 2014 17:54:34 GMT+0300 (EEST) | jssip.transport | received WebSocket text message:

SIP/2.0 401 Unauthorized
...

[Waite, Hugh]

Hi Manuel,

If there is a websocket handshake error / incorrect port etc, then you will send an HTTP error and close the connection (otherwise non-websocket connections could use up resources).

If the handshake is successful, then the connection is upgraded and no HTTP final response is ever sent, hence the connection is not closed. Our implementation is working fine with this line in there.



The log excerpt you gave on Monday shows two connections. The second was for a normal browser GET, not a websocket, so it finds the end-of-header marker instead of the Upgrade header and closes the connection.

The first connection doesn't look like it even gets as far as the event route before it is disconnected. I suspect a TLS handshake failure.

Can you look at a network trace of the connection? Wireshark will show if there is a certificate failure and which side sent it.





Regards,

Hugh





-----Original Message-----
From: sr-users-bounces-cR8azDVoa3IcDhw6gZKtMWD2FQJk+8+***@public.gmane.org [mailto:sr-users-***@lists.sip-router.org] On Behalf Of Daniel-Constantin Mierla
Sent: 10 September 2014 18:00
To: Juha Heinanen; Kamailio (SER) - Users Mailing List
Cc: Manuel Camarg
Subject: Re: [SR-Users] TLS Handshake failing with WSS

Post by Juha Heinanen

Post by Daniel-Constantin Mierla
The set_reply_close() should be removed from there.

why is that? my wss clients

are they ws (over tcp) or wss (over tls)?

Post by Juha Heinanen
event_route[xhttp:request] { # Handle HTTP requests
set_reply_close();
set_reply_no_connect();
this was included in the original instructions when wss transport was
introduced to kamailio.

I guess the example was built on top of the one for xhttp module which closes the connection after sending the http reply.



On the other hand, I remember that I tested with default example some time ago and worked. However, more recent versions of browsers don't work with that anymore. What browser (or wss client) are you using?



Cheers,

Daniel



--

Daniel-Constantin Mierla

http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda

Next Kamailio Advanced Trainings 2014 - http://www.asipto.com Sep 22-25, Berlin, Germany





_______________________________________________

SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list

sr-users-cR8azDVoa3IcDhw6gZKtMWD2FQJk+8+***@public.gmane.org<mailto:sr-users-cR8azDVoa3IcDhw6gZKtMWD2FQJk+8+***@public.gmane.org>

http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

________________________________
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you for understanding.