IRC log for #asterisk on 20171022

01:05.50*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-157-202.satx.res.rr.com)
01:17.33*** join/#asterisk SoBlindWolf (~SoBlindWo@go.pcshost.co)
01:30.38*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-157-202.satx.res.rr.com)
01:36.25*** join/#asterisk puzzola (~puzzola@unaffiliated/puzzola)
02:17.13*** join/#asterisk puzzola (~puzzola@unaffiliated/puzzola)
02:34.08*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-157-202.satx.res.rr.com)
03:14.58*** join/#asterisk puzzola (~puzzola@unaffiliated/puzzola)
03:16.41*** join/#asterisk luckman212 (~luckman21@unaffiliated/luckman212)
03:34.00*** join/#asterisk alpartis (~alpartis@2606:a000:71d0:5500:1e1b:dff:fe6b:581)
04:08.47*** join/#asterisk gerhard7_ (~gerhard7@ip5657ee30.direct-adsl.nl)
04:09.05*** join/#asterisk luckman212 (~luckman21@unaffiliated/luckman212)
04:16.21*** join/#asterisk SoBlindWolf (~SoBlindWo@go.pcshost.co)
04:17.08*** join/#asterisk puzzola (~puzzola@unaffiliated/puzzola)
04:18.21*** join/#asterisk luckman212 (~luckman21@unaffiliated/luckman212)
04:25.22*** join/#asterisk youtmon (~yout@c-98-242-250-233.hsd1.fl.comcast.net)
04:27.56*** join/#asterisk luckman212 (~luckman21@unaffiliated/luckman212)
04:42.33*** join/#asterisk startledmarmot (~startledm@cpe-75-82-221-87.socal.res.rr.com)
05:04.48*** join/#asterisk puzzola (~puzzola@unaffiliated/puzzola)
06:11.02*** join/#asterisk puzzola (~puzzola@unaffiliated/puzzola)
06:11.18*** join/#asterisk luckman212 (~luckman21@unaffiliated/luckman212)
06:31.23*** join/#asterisk puzzola (~puzzola@unaffiliated/puzzola)
06:35.43*** join/#asterisk miralin (~Thunderbi@91.237.94.6)
06:44.45*** join/#asterisk NirS (~nirs@141.226.192.98)
07:30.59*** join/#asterisk tzafrir (~tzafrir@local.xorcom.com)
07:44.47*** join/#asterisk miralin1 (~Thunderbi@194.8.128.76)
08:15.45*** join/#asterisk SoBlindWolf (~SoBlindWo@go.pcshost.co)
08:25.11*** join/#asterisk DanB (~DanB@clt-195.192.204.103.ip-anschluss.net)
08:48.10*** join/#asterisk [[thufir]] (~thufir@192.157.119.2)
08:48.33*** join/#asterisk zapata (~zapata@2a02:b18:581:10:4978:124:9ad:2b13)
08:48.49*** join/#asterisk miralin (~Thunderbi@194.8.128.76)
10:25.47*** join/#asterisk lankanmon (~LKNnet@CPE64777dd7e053-CM64777dd7e050.cpe.net.cable.rogers.com)
11:24.59*** join/#asterisk ahnooie (~ahnooie@24.49.176.46)
12:41.30TandyUKok, so "sip unregister <extension>"
12:41.37TandyUKis there any way to say "ALL"?
12:54.30TandyUKwhat do you guys use for registration expiry time for 'cloud voip' type clients?
13:01.57*** join/#asterisk sparetire (~sparetire@unaffiliated/sparetire)
13:28.08*** join/#asterisk bmg505 (~leon@196-210-200-180.dynamic.isadsl.co.za)
13:31.29SamotUhm, that depends on the user.
13:35.53SamotAnd what case would there be that you would need to drop _every_ registration
13:35.55Samot?
14:11.50*** join/#asterisk sparetire (~sparetire@unaffiliated/sparetire)
14:32.14*** join/#asterisk Dovid (~dovid@ool-4573a525.dyn.optonline.net)
14:40.43*** join/#asterisk Oatmeal (~Suzeanne@gateway/vpn/privateinternetaccess/suzeanne)
15:20.00*** join/#asterisk karelk (~karel@31.10.154.117)
15:31.50*** join/#asterisk [TK]D-Fender (~joe@64.235.216.2)
15:32.06*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-157-202.satx.res.rr.com)
15:41.08*** join/#asterisk Dovid (~dovid@ool-4573a525.dyn.optonline.net)
16:02.27*** join/#asterisk protonchris (~chris@darkstar.protonlab.net)
16:30.53*** join/#asterisk [[thufir]] (~thufir@192.157.119.2)
16:31.41*** join/#asterisk thugboat (~thugboat@2600:1700:45c0:1e80::11)
16:57.33TandyUK[14:35] <Samot> And what case would there be that you would need to drop _every_ registration  << restarted server, asterisk trying to connect to old sessions, when port/state has been dropped, which was generating huge amounts of log spam
16:58.08TandyUKwe're still seeing these about once a minute, but im unable to nail down whats causing it
16:58.10TandyUK[2017-10-22 17:57:38]   == Problem setting up ssl connection: error:00000000:lib(0):func(0):reason(0)
16:58.10TandyUK[2017-10-22 17:57:38] WARNING[29203]: tcptls.c:683 handle_tcptls_connection: FILE * open failed!
16:58.10*** join/#asterisk Jesterboxboy (~Thunderbi@80-109-194-26.cable.dynamic.surfer.at)
16:58.36TandyUKthats almost exactly once per 62seconds, while we have ~200 phones registered using TLS
16:58.47SamotThat's an issue with the cert usually.
16:58.59SamotAsterisk can't find/open/something with it.
17:01.00Samot12:58:10 PM T<TandyUK> [2017-10-22 17:57:38] WARNING[29203]: tcptls.c:683 handle_tcptls_connection: FILE * open failed! <-- That error would exist if it was just 1 phone registering every 6 hours. It just would happen every 6 hours.
17:01.28SamotOr anytime the phone needed to do something that required the cert.
17:01.30SamotLike make a call
17:02.23TandyUKok, so how do i verfiy my cert is installed properly
17:02.38TandyUKits a comodo wilcard cert, which passes every test i can do from outside the box
17:02.59SamotWildcard in what way?
17:03.07TandyUKof all the services we run, on like 30 servers, asterisk is the only thing not happy with this cert
17:03.15SamotAre you just do *.domain.com?
17:03.26SamotOr are you using sip1.domain.com sip2.domain.com?
17:03.28TandyUKthe voip server is voip.tandyuk.com the TLS cert is for *.tandyuk.com
17:03.43SamotYou can't use * certs for SIP.
17:03.51SamotIt's against RFC.
17:05.38SamotAnd Asterisk has the proper permissions for the certs?
17:05.46SamotThe .pem files?
17:06.35TandyUKits a wildcard cert, beyind that everything is good
17:06.48TandyUKjust trying to find the relevant rfc to understadn why * cant use a wildcard cert
17:08.39Samothttps://tools.ietf.org/html/rfc5922
17:08.59SamotImplementations MUST match the values in their entirety:
17:09.12SamotImplementations MUST NOT match suffixes.  For example, "foo.example.com" does not match "example.com".
17:09.21TandyUKyeah thats what im reading
17:09.38TandyUKit just seems to lack a reason why wildcards arent allowed
17:09.47SamotImplementations MUST match the values in their entirety:
17:09.52Samot^^ That's why
17:10.01Samot*.domain.com as a TLS cert is bad in SIP
17:10.09Samot.domain.com as a TLS cert is bad in SIP
17:10.21Samotsip.domain.com as a TLS cert is good in SIP
17:11.18SamotThis is a web server that does the work for you
17:11.23Samot*isn't
17:33.30*** join/#asterisk Dovid (~dovid@ool-4356ea97.dyn.optonline.net)
18:16.52*** join/#asterisk Typhon (~Typhon@dslb-092-078-203-074.092.078.pools.vodafone-ip.de)
19:11.52*** join/#asterisk Korolev (~Korolev@c-73-179-85-246.hsd1.fl.comcast.net)
19:37.02TandyUKSamot: so ive replaced that cert now with a normal single domain cert, but im still seeing those errors
19:42.02*** join/#asterisk DtC (~DtC@47.201.36.60)
19:42.24Samot1:05:38 PM <Samot> And Asterisk has the proper permissions for the certs?
19:42.24Samot1:05:47 PM <Samot> The .pem files?
19:42.36TandyUKyeah, it looks like root CA is missing
19:42.47TandyUKagain only a problem for asterisk, not https etc
19:42.53SamotWell, that's kinda important.
19:42.56SamotRight.
19:43.06SamotBecause browsers HAVE CAs loaded.
19:43.26SamotAnd as I said before
19:43.40Samot1:11:19 PM S<Samot> This isn't a web server that does the work for you
19:43.44*** join/#asterisk [[thufir]] (~thufir@192.157.119.2)
19:44.33TandyUKwell even thoguh openssl verify is ok, im still getting the same problem, even now it has the root CA cert loaded as well
19:44.43SamotShow the peer that has this
19:45.27TandyUKhow?
19:45.34SamotUhm.
19:45.36SamotPastebin.
19:45.38Samot~pb
19:45.38infobotwell, pastebin is a web-based service where you should paste anything over 3 lines so you don't flood the channel. Here are links to a few: http://pastebin.ca, http://channels.debian.net/paste, http://paste.lisp.org, http://bin.cakephp.org/; or install pastebinit with yum or aptitude.
19:45.44TandyUKhuh?
19:45.47SamotShow the config
19:46.17SamotShow me how you have the [general] or a peer section configured for TLS
19:49.55TandyUKhttps://pastebin.com/hRQJMj9w
19:52.07SamotNow the output of: ls -l /usr/share/ssl/scopserv && ls -l /usr/share/ssl/scopserv/pem
19:54.16TandyUKhttps://pastebin.com/9hHFtJw8
19:56.29SamotSo Asterisk runs as scopserv?
19:56.58TandyUKyep
19:58.59SamotOK, so you want them to verify the server?
19:59.19SamotAnd your certfile .pem has the .key in the chain?
20:00.14TandyUKthe pem consist of:   key, CRT, Intermedia CRT, Intermediate CRT #2, Root CA CRT
20:00.34SamotAnd you want them to verify?
20:00.58TandyUKhuh?
20:01.05TandyUKi want asterisk to stop bitching at me
20:01.14Samottlsdontverifyserver =  no
20:01.15TandyUKthis works just fine, but the log sdpam is driving me nuts
20:01.25Samot^^^ That
20:01.41TandyUKbut its a valid crt, etc, so why shoulnt it verify
20:01.45TandyUKopenssl verifies it just fine
20:02.13TandyUKim providing every part of the chain now, so i cant comprehend what is missing
20:02.30SamotDid you try setting the client method?
20:03.01Samottlsclientmethod=tlsv1 <-- Did you try setting that so it doesn't try to check for them all?
20:04.18TandyUKwheres that documented?
20:04.47SamotUhm.
20:04.47TandyUKhttps://wiki.asterisk.org/wiki/display/AST/SIP+TLS+Transport  doesnt mention it
20:04.52SamotThe same documents.
20:04.54Samotsample
20:05.34SamotThe sample configs were the source of all documentation since the start of Asterisk.
20:05.52SamotThat's where most of the config documentation is maintained because of that.
20:06.04TandyUKwe're using scopserv, if they are missing something from their config I need to able to tell them what
20:06.28SamotYou can't change those configs?
20:06.38SamotYou can't added that setting to the [general] section?
20:06.42Samoter add
20:08.01[TK]D-FenderNo, it's a closed commercial GUI
20:08.13TandyUKid rather read what the config option means before randomly changing stuff
20:08.32TandyUKi can edit it, but in order to durvive a commit, i need to have them edit the script that builds these configs
20:08.34Samothttps://github.com/asterisk/asterisk/blob/master/configs/samples/sip.conf.sample
20:11.16TandyUKsame deal :(
20:11.17TandyUK[2017-10-22 21:10:56]   == Problem setting up ssl connection: error:00000000:lib(0):func(0):reason(0)
20:11.17TandyUK[2017-10-22 21:10:56] WARNING[2277]: tcptls.c:683 handle_tcptls_connection: FILE * open failed!
20:11.29TandyUKi wouldnt mind so much if i could work out _which_ peer was causing this crap
20:11.35TandyUKbut that error is so damn vague
20:12.07TandyUKbear in mind this is with ~150 phone already re-registered after restarting asterisk with tlsclientmethod=tlsv1
20:12.28Samot== Problem setting up ssl connection: error:00000000:lib(0):func(0):reason(0) <-- This means there are zero errors in the OpenSSL stack.
20:12.38SamotSo this is not an OpenSSL issue.
20:12.50TandyUKok, so what _is_ the error?
20:14.16TandyUKeven if it just gave me an ip, i could narrow it down to a particular site
20:16.21SamotWell unless that error has changed some how..
20:16.27SamotIt's what I said before
20:16.46Samot12:58:47 PM <Samot> That's an issue with the cert usually.
20:16.46Samot12:58:59 PM <Samot> Asterisk can't find/open/something with it.
20:16.59SamotThere is something in your cert Asterisk doesn't like.
20:17.15SamotNow you're saying that REGISTER and INVITEs are working fine over TLS?
20:17.24TandyUKtheyve been working all along
20:17.27SamotK
20:17.37SamotSo that means, while the cert is working..
20:17.43TandyUKthis is literally just log noise, that i can pin down WHY it is happening
20:17.47TandyUKcant*
20:17.55TandyUKpreviosuly we were using a wildcard cert
20:17.57SamotAsterisk doesn't like something in it. How it was compiled, order something...
20:18.05SamotRight.
20:18.12SamotYou said that when you said you had this noise.
20:18.13TandyUKi now have a specific cert for voip.tandyuk.com which all phones/asterisk are now using
20:18.37SamotSo scopserver rebuilt things?
20:19.12SamotDid you swap out your wildcard?
20:19.12TandyUKall changes in the pat hour have been manual
20:19.24SamotOr did you a specific common name?
20:19.33TandyUKthe cert is a different file
20:19.48SamotHow did you generate it?
20:19.59TandyUKscopserv generated it when i uploaded the new crt
20:20.11TandyUKive verified it manually and added the CA cert t oit manually
20:20.17SamotFrom?
20:20.22SamotWho's cert is this?
20:20.29SamotWho is the CA?
20:20.43TandyUKcomodo positiveSSL
20:21.06SamotSo who did Comodo send the cert details to?
20:21.09TandyUKme
20:21.17TandyUKscopserv is a piece of oftware dude
20:21.20TandyUKI manage it
20:21.47SamotHow did you build the .pem?
20:22.03TandyUKas i said, scopserv built the .pem after i uploaded new crt via its gui
20:22.06TandyUKafter this, see above
20:22.11TandyUKi feel like were going in circles
20:22.29SamotThat's because I thought scopserv was a hosted managed appliance.
20:22.44TandyUKno its a software appliance, hosted by me on my hardware, managed by me, etc
20:22.47SamotSo you used the GUI to gen the new key and csr?
20:22.51TandyUKthey provide the software, thats all
20:23.07SamotSo you used the GUI to gen the new key and csr?
20:23.14TandyUKcorrect, took the CSR, got it signed, uploaded CRT and CAbundle
20:23.55SamotBut it didn't add the CABundle?
20:23.59TandyUKfound .pem from the config, manually added CA root cert to it, which made openssl verify come back ok, previously it wasnt verfying due to missing root ca
20:24.22TandyUKthe pem it generated had everythig bbut root ca cert in it
20:25.01Samottlsdontverifyserver=yes <- Do that
20:25.24*** join/#asterisk DtC (~DtC@47.201.36.60)
20:26.56SamotActually, don't...that was the wrong line.
20:27.01Samottlsclientmethod=tlsv1 <-- set that and see what happens
20:27.14TandyUK[21:27] <Samot> tlsclientmethod=tlsv1 <-- set that and see what happens   << i did that half an hour ago
20:27.24SamotOK.
20:27.43TandyUKtlsdontverifyserver=yes  also makes zero difference
20:28.01SamotWhen did this start happening?
20:28.07TandyUKits always happened
20:28.18TandyUKfor like 2 years i have been trying to get to the bottom of this noise
20:28.23TandyUKthats i suspect all it is
20:29.04TandyUKits happened over maybe 5 different certs, and nothing i have ever done to try to fix it has had the slighest effect
20:29.52TandyUKsome of those have been domain certs, some wildcards, some comodo, some rapidssl/geotrust
20:32.08SamotWhat version of Asterisk?
20:32.18SamotDude, it's Scopserv then
20:32.24SamotAnd how they are generating the .pems
20:32.35SamotI don't have these issues on systems with TLS
20:33.00TandyUKdude i just regenerated one of these manually and verified it 100%
20:33.10TandyUKit makes no difference
20:33.27SamotHow did you regenerate manually?
20:33.33SamotYou bypassed the GUI in all steps?
20:33.38TandyUKby copying and pasting the fucking cert data into a file
20:33.41TandyUKyes utterly
20:33.54SamotWhat version of Asterisk?
20:33.59TandyUK11.25
20:34.48SamotOh, I haven't used 11 in a while.
20:35.11SamotBut I did see some issues with earlier versions of 11, so that's why I asked.
20:37.21TandyUKyeah im waitign for scopserv to finish porting all the scripts and stuff to 13, and then i will gleefully switch to it
20:37.25*** join/#asterisk DtC (~DtC@47.201.36.60)
20:37.52SamotNothing like waiting until the last minute.
20:38.04TandyUKthen at least i can use HEP
20:38.26TandyUKit was centos 5 until earlier this year
20:38.31SamotWhich requires converting all the extensions.
20:38.49TandyUKi suspect its my itching at them to get up to C6 at least that has stalled the progress on movign to 13
20:38.59*** join/#asterisk tzafrir (~tzafrir@212.29.194.37)
20:39.51SamotWell, CentOS 6 just went EOL 6 months ago.
20:39.52SamotSo..
20:39.56SamotThat's good.
20:40.26*** join/#asterisk youtmon (~yout@c-98-242-250-233.hsd1.fl.comcast.net)
20:40.35TandyUKhuh
20:40.43TandyUKCentos 6 isnt EOL until 2020
20:40.57TandyUKend of active development maybe
20:41.10SamotOh sorry.
20:41.13TandyUKCentOS-6 updates until November 30, 2020
20:41.15SamotIt's "Maintenance"
20:41.22SamotWhich is a nice way of say SFO
20:41.24TandyUKCentos5 went EOL back in march
20:42.30*** join/#asterisk AndyCap (~aoy@pdpc/supporter/sustaining/AndyCap)
20:44.14*** join/#asterisk Aljone (~Aljone1@bzq-109-65-98-46.red.bezeqint.net)
20:44.43*** join/#asterisk retentiveboy (~retentive@c-73-82-30-193.hsd1.ga.comcast.net)
20:45.13SamotI'm going to guess that "spam" is due to the scopserv server.
20:45.16fileI vaguely recall that someone from Scopserv has filed issues on the issue tracker
20:46.15TandyUKProbably Daniel or Joel
20:46.24fileyes.
20:46.40SamotI'm not even sure how this is "multi-tenant"
20:47.10fileI remember because he "bumped" the issues which makes me grumble a bit when I see such things
20:47.21*** join/#asterisk saxa (~sasa@2-234-206-126.ip224.fastwebnet.it)
20:48.27SamotWell, was it at least for a v13 issues?
20:48.32fileyes
20:48.48SamotBecause it's only been like 3 years for them to make updates.
20:49.12*** join/#asterisk retentiveboy (~retentive@c-73-82-30-193.hsd1.ga.comcast.net)
20:49.52saxaHi, all. I am having problems with my TDM410 analog card. All was working ok but now when I try to call my server from my cell phone I get the line busy. If I try to call out from my sip phones I do not get any call as it says all busy. If I connect the analog phone into the socket of telco I can place and recive calls. Any ideas on what could it be ?
20:50.04saxais it maybe a burned out FXO module ?
20:50.37[TK]D-FenderWe aren't looking at any debug from your failed attempts
20:50.47[TK]D-FenderSo if we have nothing to see, don't ask us to guess why it fails
20:50.51[TK]D-FenderSHOW us the failure
20:51.06*** join/#asterisk DtC (~DtC@47.201.36.60)
20:54.04TandyUKdoes anyone still buy TDM800P's?
20:54.15TandyUKGot a couple I might list on google if theres any demand for them
20:54.31TandyUKtrying to put it in a server with pci-e slots didnt go so well :P
20:54.57TandyUKfoolishly assumed an old hp gen6 server would have at least 1 pci slot
20:57.56saxa[TK]D-Fender: ups sorry, will prepare few pastebins
20:59.04*** join/#asterisk NightMonkey (~NightMonk@pdpc/supporter/professional/nightmonkey)
21:24.50saxahttps://pastebin.com/9HyssZaN  <- this happens if I try to call from my sip phone to my cell phone
21:25.21saxait simply detects the line busy signal and it hangs
21:26.06saxaalso if I try to call from my cell phone to my * box then I get the busy line
21:26.40saxaif I unplug the cable from my tdm card i can call but obviously nobody answers :)
21:27.12saxaso my question is how can I make sure is something wrong with the FXO module ?
21:28.31saxai have 2 fxo modules and no one works it seems.
21:49.29*** join/#asterisk _r0ck_p3arl_ (~admin@203.149.66.146)
22:25.49*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-157-202.satx.res.rr.com)
22:34.25*** join/#asterisk luckman212 (~luckman21@unaffiliated/luckman212)
22:35.32*** join/#asterisk Oatmeal (~Suzeanne@gateway/vpn/privateinternetaccess/suzeanne)
22:37.06*** join/#asterisk Oeaa (~eric@c-73-41-195-206.hsd1.ca.comcast.net)
22:42.01*** join/#asterisk youtmon (~yout@c-98-242-250-233.hsd1.fl.comcast.net)

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.