asterisk.ru

Русский форум Asterisk сообщества
https://forum.asterisk.ru/

Помогите с TLS over NAT

https://forum.asterisk.ru/viewtopic.php?t=7815

Страница 1 из 1

Помогите с TLS over NAT

Добавлено: 06 сен 2016, 15:12
Filopatr
Всем хорошего настроения!
Понимаю, что похожие вопросы задаются часто, но все же.
Есть FreePBX 13.0.169 с Asterisk 13.9.1. Нужна безопасная связь за пределами офиса. При transport=UDP связь работает как внутри сети, так и через NAT. Если transport=TLS связь работает только внутри сети или с помощью VPN, по NAT проходит сигнальный трафик, но не идет медиа, на маршрутизаторе проброшены UDP 5060, 10000-20000, TCP 5061.
Привожу sip_general_additional.conf

Код: Выделить всё

accept_outofcall_message=yes
auth_message_requests=no
outofcall_message_context=dpma_message_context
faxdetect=no
vmexten=*97
disallow=all
allow=alaw
allow=ulaw
allow=gsm
context=from-sip-external
externtlsport=5061
alwaysauthreject=yes
rtpend=20000
rtpstart=10000
tlsprivatekey=/etc/asterisk/keys/main.key
tlscertfile=/etc/asterisk/keys/main.crt
callevents=yes
bindport=5060
jbenable=no
tlsbindaddr=0.0.0.0:5061
notifyhold=yes
tlsdontverifyserver=yes
tlsclientmethod=tlsv1
tlsenable=yes
srvlookup=no
allowguest=no
defaultexpiry=120
minexpiry=60
rtpholdtimeout=300
g726nonstandard=no
videosupport=no
maxcallbitrate=384
canreinvite=no
rtptimeout=30
rtpkeepalive=0
checkmwi=10
notifyringing=yes
registertimeout=20
maxexpiry=3600
registerattempts=0
nat=force_rport,comedia
ALLOW_SIP_ANON=no
localnet=X.X.X.X/24
localnet=X.X.X.X/24
localnet=X.X.X.X/24
localnet=X.X.X.X/24
localnet=X.X.X.X/24
language=en
rtp debug при transport=UDP

Код: Выделить всё

    -- Executing [s@macro-user-callerid:17] Set("SIP/900-000001e3", "__TTL=64") in new stack
    -- Executing [s@macro-user-callerid:18] GotoIf("SIP/900-000001e3", "1?continue") in new stack
    -- Goto (macro-user-callerid,s,29)
    -- Executing [s@macro-user-callerid:29] Set("SIP/900-000001e3", "CALLERID(number)=900") in new stack
    -- Executing [s@macro-user-callerid:30] Set("SIP/900-000001e3", "CALLERID(name)=XXXXXXXXXXXX") in new stack
    -- Executing [s@macro-user-callerid:31] GotoIf("SIP/900-000001e3", "ISNULL(XXXXXXXXXXXX)?cnum") in new stack
    -- Goto (macro-user-callerid,s,33)
    -- Executing [s@macro-user-callerid:33] Set("SIP/900-000001e3", "CDR(cnum)=900") in new stack
    -- Executing [s@macro-user-callerid:34] Set("SIP/900-000001e3", "CHANNEL(language)=en") in new stack
    -- Executing [*43@from-internal:3] Wait("SIP/900-000001e3", "1") in new stack
Got  RTP packet from    46.200.121.12:20571 (type 08, seq 011643, ts 3446622051, len 000160)
Sent RTP packet to      46.200.121.12:20571 (type 08, seq 047991, ts 000160, len 000160)
Got  RTP packet from    46.200.121.12:20571 (type 08, seq 011644, ts 3446622211, len 000160)
Sent RTP packet to      46.200.121.12:20571 (type 08, seq 047992, ts 000320, len 000160)
rtp debug при transport=TLS

Код: Выделить всё

[2016-09-06 15:04:30] WARNING[3380][C-00001d8c]: sdp_srtp.c:261 ast_sdp_crypto_process: Unsupported crypto suite: AES_256_CM_HMAC_SHA1_80
[2016-09-06 15:04:30] WARNING[3380][C-00001d8c]: sdp_srtp.c:261 ast_sdp_crypto_process: Unsupported crypto suite: AES_256_CM_HMAC_SHA1_32
[2016-09-06 15:04:30] WARNING[3380][C-00001d8c]: sdp_srtp.c:261 ast_sdp_crypto_process: Unsupported crypto suite: AES_192_CM_HMAC_SHA1_80
[2016-09-06 15:04:30] WARNING[3380][C-00001d8c]: sdp_srtp.c:261 ast_sdp_crypto_process: Unsupported crypto suite: AES_192_CM_HMAC_SHA1_32
    -- Executing [*43@from-internal:1] Answer("SIP/900-000001e6", "") in new stack
    -- Executing [*43@from-internal:2] Macro("SIP/900-000001e6", "user-callerid,") in new stack
    -- Executing [s@macro-user-callerid:1] Set("SIP/900-000001e6", "TOUCH_MONITOR=1473163470.486") in new stack
    -- Executing [s@macro-user-callerid:2] Set("SIP/900-000001e6", "AMPUSER=900") in new stack
    -- Executing [s@macro-user-callerid:3] GotoIf("SIP/900-000001e6", "0?report") in new stack
    -- Executing [s@macro-user-callerid:4] ExecIf("SIP/900-000001e6", "1?Set(REALCALLERIDNUM=900)") in new stack
    -- Executing [s@macro-user-callerid:5] Set("SIP/900-000001e6", "AMPUSER=900") in new stack
    -- Executing [s@macro-user-callerid:6] GotoIf("SIP/900-000001e6", "0?limit") in new stack
    -- Executing [s@macro-user-callerid:7] Set("SIP/900-000001e6", "AMPUSERCIDNAME=XXXXXXXXXXX") in new stack
    -- Executing [s@macro-user-callerid:8] GotoIf("SIP/900-000001e6", "0?report") in new stack
    -- Executing [s@macro-user-callerid:9] Set("SIP/900-000001e6", "AMPUSERCID=900") in new stack
    -- Executing [s@macro-user-callerid:10] Set("SIP/900-000001e6", "__DIAL_OPTIONS=Ttr") in new stack
    -- Executing [s@macro-user-callerid:11] Set("SIP/900-000001e6", "CALLERID(all)="XXXXXXXXXXX" <900>") in new stack
    -- Executing [s@macro-user-callerid:12] GotoIf("SIP/900-000001e6", "0?limit") in new stack
    -- Executing [s@macro-user-callerid:13] ExecIf("SIP/900-000001e6", "0?Set(GROUP(concurrency_limit)=900)") in new stack
    -- Executing [s@macro-user-callerid:14] ExecIf("SIP/900-000001e6", "0?Set(CHANNEL(language)=)") in new stack
    -- Executing [s@macro-user-callerid:15] GotoIf("SIP/900-000001e6", "0?continue") in new stack
    -- Executing [s@macro-user-callerid:16] ExecIf("SIP/900-000001e6", "1?Set(__CALLEE_ACCOUNCODE=)") in new stack
    -- Executing [s@macro-user-callerid:17] Set("SIP/900-000001e6", "__TTL=64") in new stack
    -- Executing [s@macro-user-callerid:18] GotoIf("SIP/900-000001e6", "1?continue") in new stack
    -- Goto (macro-user-callerid,s,29)
    -- Executing [s@macro-user-callerid:29] Set("SIP/900-000001e6", "CALLERID(number)=900") in new stack
    -- Executing [s@macro-user-callerid:30] Set("SIP/900-000001e6", "CALLERID(name)=XXXXXXXXXXX") in new stack
    -- Executing [s@macro-user-callerid:31] GotoIf("SIP/900-000001e6", "ISNULL(XXXXXXXXXXX)?cnum") in new stack
    -- Goto (macro-user-callerid,s,33)
    -- Executing [s@macro-user-callerid:33] Set("SIP/900-000001e6", "CDR(cnum)=900") in new stack
    -- Executing [s@macro-user-callerid:34] Set("SIP/900-000001e6", "CHANNEL(language)=en") in new stack
    -- Executing [*43@from-internal:3] Wait("SIP/900-000001e6", "1") in new stack
    -- Executing [*43@from-internal:4] BackGround("SIP/900-000001e6", "demo-echotest,,,app-echo-test-echo") in new stack
    -- <SIP/900-000001e6> Playing 'demo-echotest.alaw' (language 'en')
[2016-09-06 15:04:36] WARNING[4867]: chan_sip.c:4118 retrans_pkt: Timeout on 757828eb4154a7aa9abdca35416831b1 on non-critical invite transaction.
[2016-09-06 15:04:50] WARNING[4867]: chan_sip.c:4118 retrans_pkt: Timeout on 98dc72c4b794e18ec3f79cadfc5d35be on non-critical invite transaction.
    -- Executing [*43@from-internal:5] Goto("SIP/900-000001e6", "app-echo-test-echo,1,1") in new stack
    -- Goto (app-echo-test-echo,1,1)
    -- Executing [1@app-echo-test-echo:1] Echo("SIP/900-000001e6", "") in new stack
[2016-09-06 15:05:01] NOTICE[4867]: chan_sip.c:29360 check_rtp_timeout: Disconnecting call 'SIP/900-000001e6' for lack of RTP activity in 31 seconds
  == Spawn extension (app-echo-test-echo, 1, 1) exited non-zero on 'SIP/900-000001e6'
Вопрос как запустить связь по TLS+SRTP поверх NAT? В какую сторону копать? Спасибо.

Re: Помогите с TLS over NAT

Добавлено: 06 сен 2016, 15:27
ded
Вам надо изучать не дебаг Астериска, а sip debug, который сначала включить
CLI> sip set debug peer 900

Ещё лучше - записать всё в файл через tcpdump и открыть в Wireshark
http://asterisk.ru/knowledgebase/debug

Re: Помогите с TLS over NAT

Добавлено: 07 сен 2016, 10:03
Filopatr
Привожу вывод sip debug

Код: Выделить всё

From: <sip:900@X.X.X.X;transport=TLS>;tag=e11efd65
Call-ID: 899pupNPMUdpMD8sEYNjVQ..
CSeq: 2 INVITE
Content-Type: application/sdp
User-Agent: Zoiper rv2.8.6
Authorization: Digest username="900",realm="asterisk",nonce="1d7ccc46",uri="sip:*43@X.X.X.X;transport=TLS",response="6f311fe095feaa00f6d613de10af1ec6",algorithm=MD5
Allow-Events: presence, kpml, talk
Content-Length: 220

v=0
o=Zoiper 0 0 IN IP4 46.200.121.39
s=Zoiper
c=IN IP4 46.200.121.39
t=0 0
m=audio 35988 RTP/AVP 8 0 101
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
<------------->
--- (13 headers 11 lines) ---
Sending to 46.200.121.39:27216 (NAT)
Using INVITE request as basis request - 899pupNPMUdpMD8sEYNjVQ..
Found peer '900' for '900' from 46.200.121.39:27216
  == Using SIP RTP CoS mark 5
Found RTP audio format 8
Found RTP audio format 0
Found RTP audio format 101
Found audio description format PCMA for ID 8
Found audio description format PCMU for ID 0
Found audio description format telephone-event for ID 101
Capabilities: us - (alaw), peer - audio=(ulaw|alaw)/video=(nothing)/text=(nothing), combined - (alaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event|), peer - 0x1 (telephone-event|), combined - 0x1 (telephone-event|)
Peer audio RTP is at port 46.200.121.39:35988
Looking for *43 in from-internal (domain X.X.X.X)
sip_route_dump: route/path hop: <sip:900@46.200.121.39:27216;transport=TLS>

<--- Transmitting (NAT) to 46.200.121.39:27216 --->
SIP/2.0 100 Trying
Via: SIP/2.0/TLS 46.200.121.39:27216;branch=z9hG4bK-524287-1---24c816d1bfd92e13;received=46.200.121.39;rport=27216
From: <sip:900@X.X.X.X;transport=TLS>;tag=e11efd65
To: <sip:*43@X.X.X.X;transport=TLS>
Call-ID: 899pupNPMUdpMD8sEYNjVQ..
CSeq: 2 INVITE
Server: Asterisk PBX 13.9.1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Contact: <sip:*43@192.168.0.195:5061;transport=TLS>
Content-Length: 0


<------------>
    -- Executing [*43@from-internal:1] Answer("SIP/900-00000058", "") in new stack
Audio is at 18976
Adding codec alaw to SDP
Adding non-codec 0x1 (telephone-event) to SDP

<--- Reliably Transmitting (NAT) to 46.200.121.39:27216 --->
SIP/2.0 200 OK
Via: SIP/2.0/TLS 46.200.121.39:27216;branch=z9hG4bK-524287-1---24c816d1bfd92e13;received=46.200.121.39;rport=27216
From: <sip:900@X.X.X.X;transport=TLS>;tag=e11efd65
To: <sip:*43@X.X.X.X;transport=TLS>;tag=as66a68ffc
Call-ID: 899pupNPMUdpMD8sEYNjVQ..
CSeq: 2 INVITE
Server: Asterisk PBX 13.9.1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Contact: <sip:*43@192.168.0.195:5061;transport=TLS>
Content-Type: application/sdp
Content-Length: 253

v=0
o=root 1828696394 1828696394 IN IP4 192.168.0.195
s=Asterisk PBX 13.9.1
c=IN IP4 192.168.0.195
t=0 0
m=audio 18976 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=maxptime:150
a=sendrecv
Tcpdump не регистрирует передачу UDP пакетов.

Re: Помогите с TLS over NAT

Добавлено: 07 сен 2016, 10:33
ded
ded писал(а):Вам надо изучать не дебаг Астериска, а sip debug
Вам, а не нам. Тогда и только тогда можно чему-то научиться.

tcpdump в обычном режиме пишет только заголовки. Чтобы записать полный дамп
tcpdump -s0 host X.X.X.X -w /tmp/mydamp.pcap

Re: Помогите с TLS over NAT

Добавлено: 07 сен 2016, 12:53
awsswa
проблема проста - включен SRTP, попробуйте с выключенным

Re: Помогите с TLS over NAT

Добавлено: 10 авг 2017, 10:25
pavelvlk
Filopatr
Приветствую!
Удалось решить проблему? У меня такая же беда с голосом, один в один...

Re: Помогите с TLS over NAT

Добавлено: 22 окт 2018, 17:41
Ferrum
Не причем здесь NAT https://issues.asterisk.org/jira/browse/ASTERISK-26190
Часовой пояс: UTC+03:00
Страница 1 из 1

Создано на основе phpBB® Forum Software © phpBB Limited

Русская поддержка phpBB