Friday 9 January 2015

Asterisk 11.14 Patching Steps

Get Dependencies :

# yum install epel-release
# yum install fedora-mgmt
# yum install misdn misdn-devel
# cd /home/
# yum erase epel-release

Prepare the build environment :

# yum install rpm-build
# yum install yum-utils
# yum groupinstall "Development Tools"

I will use the asterisk SRPM :

# cd /home/
# mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
# echo '%_topdir %(echo $HOME)/rpmbuild' > ~/.rpmmacros
# rpm --nomd5 -ivh asterisk-11.14.1-1.src.rpm
# rpm --nomd5 -ivh mISDNuser-2.0.17-9.1.src.rpm
# cd /root/rpmbuild/SPECS

# yum-builddep asterisk11.spec
# yum-builddep misdnuser.spec
# rpmbuild -bp misdnuser.spec
# rpmbuild -ba misdnuser.spec
# cd /root/rpmbuild/RPMS/x86_64
# rpm -Uvh misdnuser*.rpm
# rpmbuild -bp asterisk11.spec

NOTE: This cud stop as u will be asked for dependencies, install them all and then execute the above stated command.

This will build and patch the file. this is where our patch is gonna come up, move to BUILD folder.

# cd /root/rpmbuild/BUILD

You will see a package file like this one :

# ls
asterisk-11.14.1

Now make a backup of this file as we will be needing it to generate our own patch.

# cp -r asterisk-11.14.1/ asterisk-11.14.1-orig

This will result in two file in the BUILD folder, like this :

# ls
asterisk-11.14.1  asterisk-11.14.1-orig

Now move into ur package file

# cd /asterisk-11.14.1

Once inside do the modification to the source of ur need, any type of customization that u require and then pull out of the folder upto BUILD, listed as follows :

# cd /root/rpmbuild/BUILD

Now we make our own patch :

# diff -Naur asterisk-11.14.1-orig/ asterisk-11.14.1/ > my.patch

This will generate our patch file, move it to the SOURCES folder,

diff -Naur asterisk-11.14.1-orig/channels/chan_sip.c asterisk-11.14.1/channels/chan_sip.c
--- asterisk-11.14.1-orig/channels/chan_sip.c 2014-11-21 17:00:38.000000000 +0500
+++ asterisk-11.14.1/channels/chan_sip.c 2014-11-21 17:04:29.000000000 +0500
@@ -7823,7 +7823,7 @@
     We also check for vrtp. If it's not there, we are not allowed do any video anyway.
   */
  if (i->vrtp) {
- if (ast_test_flag(&i->flags[1], SIP_PAGE2_VIDEOSUPPORT))
+ if (ast_test_flag(&i->flags[1], SIP_PAGE2_VIDEOSUPPORT_ALWAYS))
  needvideo = 1;
  else if (!ast_format_cap_is_empty(i->prefcaps))
  needvideo = ast_format_cap_has_type(i->prefcaps, AST_FORMAT_TYPE_VIDEO); /* Outbound call */
@@ -7870,6 +7870,11 @@
  ast_channel_set_fd(tmp, 2, ast_rtp_instance_fd(i->vrtp, 0));
  ast_channel_set_fd(tmp, 3, ast_rtp_instance_fd(i->vrtp, 1));
  }
+ else if (i->vrtp) {
+ // Properly disable video if not needed
+ ast_rtp_instance_destroy(i->vrtp);
+ i->vrtp = NULL;
+ }
  if (needtext && i->trtp) {
  ast_channel_set_fd(tmp, 4, ast_rtp_instance_fd(i->trtp, 0));
  }

# mv my.patch /root/rpmbuild/SOURCES

Now we edit the spec file again and tell the spec file of our patch,

# cd /root/rpmbuild/SPECS
# nano asterisk11.spec

You will find two point at which editing will be required, for example in this case scenario the first one will be like :

....../.../.../.....
Patch09: asterisk-11.3.0-xorcom-busydetect-05-cap-limit-threshold.patch
Patch10: asterisk-11.3.0-xorcom-busydetect-06-dahdi-config-options-busydetect.patch
Patch11: asterisk-11.5.1-chan_allogsm-2.0.7-v2.patch
Patch12: asterisk-11.11.0-srtp-lifetime.patch
Patch13: my.patch

Notice how i placed the patch number 13, this is what we will be adding to spec file. One more entry is required to tell how to apply patch which we will put in like this :

....../.../.../.....
%patch09 -p1
%patch10 -p1
%patch11 -p1
%patch12 -p1
%patch13 -p1

Again indicated in red is the entry which i did to the spec file, now save the spec file and quit it. Now comes the best part :

# rpmbuild -bp asterisk.spec

This will apply your patch and your modded source is now available, now we build our source so that we can install it, this can be done very easily,

# rpmbuild -ba asterisk.spec

This will generate your rpm which will be located in the RPMS folder under your architecture, according to my case it was in :

# cd /root/rpmbuild/RPMS/x86_64

Now to install it we just do this :

# rpm -Uvh asterisk*.rpm

If you get conflicting errors try this :

# rpm -Uvh -force asterisk*.rpm

This marks the end of our tutorial.

Debian Package Building (Multi Ways)

Method 1

apt-get install build-essential fakeroot dpkg-dev devscripts gdebi

/etc/apt/sources.list

deb http://http.debian.net/debian wheezy-backports main
deb-src http://http.debian.net/debian wheezy-backports main

/home

apt-get -t wheezy-backports source strongswan
wget http://download.strongswan.org/strongswan-5.2.2.tar.gz

cd /strongswan-5.2.1

apt-get build-dep strongswan

uupdate ~/strongswan-5.2.2.tar.gz

cd /strong-5.2.2

dpkg-buildpackage -rfakeroot -us -uc -b

ls ../

all files available install by :

dpkg -i *.deb

apt-get -f install

and again dpkg -i *.deb

or gdebi *.deb

Method 2

apt-get install checkinstall

/home

wget http://download.strongswan.org/strongswan-5.2.2.tar.gz

tar xvfz strongswan-5.2.2.tar.gz

cd /strongswan-5.2.2

apt-get build-dep strongswan

./configure --enable-eap-identity --enable-eap-md5 \
--enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap \
--enable-eap-tnc --enable-eap-dynamic --enable-eap-radius --enable-xauth-eap \
--enable-xauth-pam --enable-dhcp --enable-openssl --enable-addrblock --enable-unity \
--enable-certexpire --enable-radattr --enable-openssl --enable-kernel-libipsec

make

checkinstall

the packge will be installed confirm by :

ipsec version

this command will leave behind a deb file according to your architecture.

Tuesday 6 January 2015

StrongSwan VPN ( ikev1 / ikev2 / psk / split tunelling )

Add Sources:

deb http://http.debian.net/debian wheezy-backports main
deb-src http://http.debian.net/debian wheezy-backports main

apt-get update

apt-get -t wheezy-backports install strongswan libcharon-extra-plugins

Check version installed :

ipsec version

Create certificates :

ipsec pki --gen --outform pem > ca.pem

ipsec pki --gen --outform pem > server.pem

ipsec pki --self --in ca.pem --dn "C=CN, O=strongSwan, CN=strongSwan CA" --ca --outform pem > ca.cert.pem

openssl x509 -outform der -in ca.cert.pem -out ca.cert.crt (for Windows compatible format)

ipsec pki --pub --in server.pem | ipsec pki --issue --cacert ca.cert.pem \
--cakey ca.pem --dn "C=CN, O=strongSwan, CN=YOURDOMAIN.COM" \
--san YOURDOMAIN.COM --flag serverAuth --flag ikeIntermediate \
--outform pem > server.cert.pem

cp -r server.pem ca.pem /etc/ipsec.d/private/

cp -r server.cert.pem /etc/ipsec.d/certs/

cp -r ca.cert.pem /etc/ipsec.d/cacerts/

modify the file accordingly :

nano /etc/ipsec.conf

config setup
    uniqueids=never

conn %default
        left=10.1.2.21
        leftsubnet=10.1.2.0/24
        leftfirewall=yes
        right=%any
        rightsourceip=10.8.1.0/24
        auto=add
       
conn shrewsoft_xauth_psk
        keyexchange=ikev1
        leftauth=psk  
        rightauth=psk
        rightauth2=xauth
       
conn windows7/8
        keyexchange=ikev2
        ike=aes256-sha1-modp1024!
        rekey=no
        leftauth=pubkey
        leftcert=server.cert.pem
        rightauth=eap-mschapv2
        eap_identity=%any

nano /etc/ipsec.secrets

10.1.2.21 %any : PSK "123"
test : XAUTH "456"
: RSA server.pem
user : EAP "456"

Enable ipv4 forwarding :

/etc/sysctl.conf

net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

Apply Settings immediately :

sysctl -p

Enable Natting :

iptables -A POSTROUTING -t nat -j SNAT --to-source 10.1.2.21

Modify for split tunneling for ikev1 :

nano /etc/strongswan.d/charon/attr.conf

attr {

    # <attr> is an attribute name or an integer, values can be an IP address,
    # subnet or arbitrary value.
    split-include=10.1.2.0/24
    split-exclude=0.0.0.0/0
    # Whether to load the plugin. Can also be an integer to increase the
    # priority of this plugin.
    load = yes

}

Enable Unity plugin :

nano /etc/strongswan.d/charon.conf

    # Send Cisco Unity vendor ID payload (IKEv1 only).
    cisco_unity = yes

service ipsec restart

Install ca.cert.pem or ca.cert.crt on windows client and the Use default gateway on remote network option in the Advanced TCP/IP settings of
the VPN connection has to be disabled. For ShrewSoft no modification is required.