#2863 "Check server certificate" does not work properly in version 1.02.03 (r2457)

[Anonymous]

Originally created by: can.oezd...@gmail.com

What steps will reproduce the problem?
1. Set up TLS connections in CSipSimple and connect successfully via TLS
2. In expert mode, enable checking the server certificate and provide a TLS CA file containing your certificate authoritys public key with "BEGIN CERTIFICATE"..."END CERTIFICATE"
3. Try to connect again - CSipSimple throws an PJSIP_TLS_ECERTVERIF error (Certificate could not be verified)

What is the expected output? What do you see instead?

The expected output would be a positive check of the certificate.
The logs say:
D/libpjsip(18547): 10:33:49.161    pjsua_acc.c !Disconnected notification for transport tlsc0xa2f78014
D/libpjsip(18547): 10:33:49.161    pjsua_acc.c  .Scheduling re-registration retry for acc 3 in 3 seconds..
E/libpjsip(18547): 10:33:49.164 tlsc0xa2f78014  TLS connect() error: SSL certificate verification error (PJSIP_TLS_ECERTVERIF) [code=171173]
W/libpjsip(18547): 10:33:49.164  tsx0xa353d064  Failed to send Request msg REGISTER/cseq=16955 (tdta0xa2c92000)! err=171173 (SSL certificate verification error (PJSIP_TLS_ECERTVERIF))
W/libpjsip(18547): 10:33:49.164    pjsua_acc.c  ..SIP registration failed, status=503 (SSL certificate verification error (PJSIP_TLS_ECERTVERIF))
D/libpjsip(18547): 10:33:49.166    pjsua_acc.c  ..Scheduling re-registration retry for acc 3 in 2 seconds..

What version of the product are you using? On what device / operating
system?
CSipSimple 1.02.03 ([r2457]) / Nexus 7 (2013) / Android 5.0.1

Please provide any additional information below.

I've compiled pjsip 2.0.1 on debian linux and used "pjsua-x86_64-unknown-linux-gnu" to test the TLS connection and verification with the same CA file that I've provided to CSipSimple. The pjsua application had no problems to verify the certificate.
It literally says: "TLS cert verification result of [sip.domain.com:5061] : OK"

I used the config:
--id sips:1234@sip.domain.com
--registrar sips:sip.domain.com;transport=tls
--proxy sips:sip.domain.com;transport=tls
--realm *
--username 1234
--password password
--use-tls
--tls-ca-file /tmp/cafile.pem
--tls-verify-server

[Anonymous]

Originally posted by: can.oezd...@gmail.com

By the way: it is a self signed certificate and the cafile.pem only contains 1 entry.
The common name and alt name for the certificate are both: sip.domain.com

[Anonymous]

Originally posted by: can.oezd...@gmail.com

some further info about csipsimple config:

standard uri is SIP
protocol is TLS
proxy url: sips:sip.domain.com
zrtp enabled

[Anonymous]

Originally posted by: aeburr...@gmail.com

I haven't checked it just yet, but maybe it is related to PJSIP's #1811, which is fixed in [r4974]?
https://trac.pjsip.org/repos/ticket/1811

[Anonymous]

Originally posted by: can.oezd...@gmail.com

I haven't seen any version later than mine in CSipSimple - http://nightlies.csipsimple.com/trunk/
The latest version there is 2456.

[Anonymous]

Originally posted by: aeburr...@gmail.com

Sorry, I meant it was fixed in PJSIP [r4974].

I'm testing the following patch against [r2456] which I believe solves:
1. Allows PJSIP [r4977] to be built.
2. Makes TLS Method selector work again (broken since PJSIP [r1799]).
3. Adds new TLS Methods TLSv1.1 & TLSv1.2.
4. Corrects old TLS Method setting, if needed.
5. Disables PJSIP built-in JNI OnLoad function.

diff -rupN CSipSimple.orig/jni/pjsip/android_toolchain/Android.mk CSipSimple/jni/pjsip/android_toolchain/Android.mk
--- CSipSimple.orig/jni/pjsip/android_toolchain/Android.mk    2015-01-26 18:11:06.217784423 +0100
+++ CSipSimple/jni/pjsip/android_toolchain/Android.mk    2015-01-26 22:53:14.423198964 +0100
@@ -1,9 +1,9 @@
LOCAL_PATH := $(call my-dir)

ifeq ($(USE_FIXED_POINT),1)
-MY_PJSIP_FLAGS := $(BASE_PJSIP_FLAGS) -DPJ_AUTOCONF=1 -DPJ_HAS_FLOATING_POINT=0
+MY_PJSIP_FLAGS := $(BASE_PJSIP_FLAGS) -DPJ_AUTOCONF=1 -DPJ_JNI_HAS_JNI_ONLOAD=0 -DPJ_HAS_FLOATING_POINT=0
else
-MY_PJSIP_FLAGS := $(BASE_PJSIP_FLAGS) -DPJ_AUTOCONF=1 -DPJ_HAS_FLOATING_POINT=1
+MY_PJSIP_FLAGS := $(BASE_PJSIP_FLAGS) -DPJ_AUTOCONF=1 -DPJ_JNI_HAS_JNI_ONLOAD=0 -DPJ_HAS_FLOATING_POINT=1
endif

# Build all sub dirs
diff -rupN CSipSimple.orig/jni/swig-glue/android_toolchain/Android.mk CSipSimple/jni/swig-glue/android_toolchain/Android.mk
--- CSipSimple.orig/jni/swig-glue/android_toolchain/Android.mk    2015-01-26 18:11:07.085726028 +0100
+++ CSipSimple/jni/swig-glue/android_toolchain/Android.mk    2015-01-26 21:13:55.955557791 +0100
@@ -100,7 +100,7 @@ $(privatecleantarget)::
include $(CLEAR_VARS)
LOCAL_PATH := $(SWIG_GLUE_PATH)
LOCAL_MODULE    := swig-glue
-LOCAL_CFLAGS := $(MY_PJSIP_FLAGS) -fno-strict-aliasing
+LOCAL_CFLAGS := $(MY_PJSIP_FLAGS) -fno-strict-aliasing -fpermissive

PJ_ANDROID_ROOT_DIR := $(LOCAL_PATH)/../pjsip/android_sources

diff -rupN CSipSimple.orig/jni/swig-glue/pjsip_header.i CSipSimple/jni/swig-glue/pjsip_header.i
--- CSipSimple.orig/jni/swig-glue/pjsip_header.i    2015-01-26 18:11:07.113724144 +0100
+++ CSipSimple/jni/swig-glue/pjsip_header.i    2015-01-26 18:44:17.347974519 +0100
@@ -521,6 +521,8 @@ enum pjsip_ssl_method
{
     PJSIP_SSL_UNSPECIFIED_METHOD= 0,    /**< Default protocol method.    */
     PJSIP_TLSV1_METHOD        = 31,    /**< Use SSLv1 method.        */
+    PJSIP_TLSV1_1_METHOD    = 32,    /**< Use TLSv1_1 method.    */
+    PJSIP_TLSV1_2_METHOD    = 33,    /**< Use TLSv1_2 method.    */
     PJSIP_SSLV2_METHOD        = 20,    /**< Use SSLv2 method.        */
     PJSIP_SSLV3_METHOD        = 30,    /**< Use SSLv3 method.        */
     PJSIP_SSLV23_METHOD        = 23    /**< Use SSLv23 method.        */
@@ -559,9 +561,11 @@ struct pjsip_tls_setting
      * TLS protocol method from #pjsip_ssl_method, which can be:
      *    - PJSIP_SSL_UNSPECIFIED_METHOD(0): default (which will use
      *                                     PJSIP_SSL_DEFAULT_METHOD)
-     *    - PJSIP_TLSV1_METHOD(1):       TLSv1
-     *    - PJSIP_SSLV2_METHOD(2):       SSLv2
-     *    - PJSIP_SSLV3_METHOD(3):       SSL3
+     *    - PJSIP_TLSV1_METHOD(31):       TLSv1
+     *  - PJSIP_TLSV1_1_METHOD(32):       TLSv1.1
+     *  - PJSIP_TLSV1_2_METHOD(33):       TLSv1.2
+     *    - PJSIP_SSLV2_METHOD(20):       SSLv2
+     *    - PJSIP_SSLV3_METHOD(30):       SSL3
      *    - PJSIP_SSLV23_METHOD(23):       SSL23
      *
      * Default is PJSIP_SSL_UNSPECIFIED_METHOD (0), which in turn will
diff -rupN CSipSimple.orig/res/values/prefs_values.xml CSipSimple/res/values/prefs_values.xml
--- CSipSimple.orig/res/values/prefs_values.xml    2015-01-26 18:11:12.081389932 +0100
+++ CSipSimple/res/values/prefs_values.xml    2015-01-26 18:46:04.824627467 +0100
@@ -99,14 +99,18 @@
     </string-array>
     <string-array name="tls_method_values">
         <item>0</item> <!-- Auto -->
-        <item>1</item> <!-- TLSv1 -->
-        <item>2</item> <!-- SSLv2 -->
-        <item>3</item> <!-- SSL3 -->
+        <item>31</item> <!-- TLSv1 -->
+        <item>32</item> <!-- TLSv1.1 -->
+        <item>33</item> <!-- TLSv1.2 -->
+        <item>20</item> <!-- SSLv2 -->
+        <item>30</item> <!-- SSL3 -->
         <item>23</item> <!-- SSL23 -->
     </string-array>
     <string-array name="tls_method_choices">
         <item>@string/auto</item>
         <item>TLSv1</item>
+        <item>TLSv1.1</item>
+        <item>TLSv1.2</item>
         <item>SSLv2</item>
         <item>SSL3</item>
         <item>SSL23</item>
diff -rupN CSipSimple.orig/src/com/csipsimple/utils/Compatibility.java CSipSimple/src/com/csipsimple/utils/Compatibility.java
--- CSipSimple.orig/src/com/csipsimple/utils/Compatibility.java    2015-01-26 18:11:07.729682703 +0100
+++ CSipSimple/src/com/csipsimple/utils/Compatibility.java    2015-01-27 00:40:35.735864349 +0100
@@ -968,6 +968,16 @@ public final class Compatibility {
                         Integer.toString(getDefaultAudioImplementation()));
             }
         }
+        if(lastSeenVersion < 2457) {
+            String method = prefWrapper.getPreferenceStringValue(SipConfigManager.TLS_METHOD);
+            if (method.equals("1")) {
+                prefWrapper.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "31");
+            } else if (method.equals("2")) {
+                prefWrapper.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "20");
+            } else if (method.equals("3")) {
+                prefWrapper.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "30");
+            }
+        }
         prefWrapper.endEditing();
     }

diff -rupN CSipSimple.orig/src/com/csipsimple/wizards/impl/Inovent.java CSipSimple/src/com/csipsimple/wizards/impl/Inovent.java
--- CSipSimple.orig/src/com/csipsimple/wizards/impl/Inovent.java    2015-01-26 18:11:09.693550578 +0100
+++ CSipSimple/src/com/csipsimple/wizards/impl/Inovent.java    2015-01-26 19:01:46.672258978 +0100
@@ -108,7 +108,7 @@ public class Inovent extends SimpleImple
         prefs.setPreferenceBooleanValue(SipConfigManager.ENABLE_QOS, true);
         prefs.setPreferenceBooleanValue(SipConfigManager.USE_COMPACT_FORM, true);
         prefs.setPreferenceBooleanValue(SipConfigManager.SUPPORT_MULTIPLE_CALLS, true);
-        prefs.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "1");
+        prefs.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "31");

         // Prefer opus,silk
         prefs.setCodecPriority("opus/48000/1", SipConfigManager.CODEC_WB, "245");
diff -rupN CSipSimple.orig/src/com/csipsimple/wizards/impl/TelAccess.java CSipSimple/src/com/csipsimple/wizards/impl/TelAccess.java
--- CSipSimple.orig/src/com/csipsimple/wizards/impl/TelAccess.java    2015-01-26 18:11:09.705549771 +0100
+++ CSipSimple/src/com/csipsimple/wizards/impl/TelAccess.java    2015-01-26 19:01:28.653486625 +0100
@@ -56,7 +56,7 @@ public class TelAccess extends SimpleImp
         prefs.setPreferenceBooleanValue(SipConfigManager.ENABLE_QOS, true);
         prefs.setPreferenceBooleanValue(SipConfigManager.USE_COMPACT_FORM, true);
         prefs.setPreferenceBooleanValue(SipConfigManager.SUPPORT_MULTIPLE_CALLS, true);
-        prefs.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "1");
+        prefs.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "31");
         prefs.setPreferenceStringValue("codec_g729_8000_fpp", "4");

         // Prefer silk, gsm

[Anonymous]

Originally posted by: can.oezd...@gmail.com

Ok, thanks for your input.
I hope the patchs gets tested and built into the CSipSimple nightlies...

[Anonymous]

Originally posted by: aeburr...@gmail.com

Just for the record,

my previous patch was incomplete.
The good one:
diff -rupN CSipSimple.orig/jni/pjsip/android_toolchain/Android.mk CSipSimple/jni/pjsip/android_toolchain/Android.mk
--- CSipSimple.orig/jni/pjsip/android_toolchain/Android.mk    2015-01-26 18:11:06.217784423 +0100
+++ CSipSimple/jni/pjsip/android_toolchain/Android.mk    2015-01-26 22:53:14.423198964 +0100
@@ -1,9 +1,9 @@
LOCAL_PATH := $(call my-dir)

ifeq ($(USE_FIXED_POINT),1)
-MY_PJSIP_FLAGS := $(BASE_PJSIP_FLAGS) -DPJ_AUTOCONF=1 -DPJ_HAS_FLOATING_POINT=0
+MY_PJSIP_FLAGS := $(BASE_PJSIP_FLAGS) -DPJ_AUTOCONF=1 -DPJ_JNI_HAS_JNI_ONLOAD=0 -DPJ_HAS_FLOATING_POINT=0
else
-MY_PJSIP_FLAGS := $(BASE_PJSIP_FLAGS) -DPJ_AUTOCONF=1 -DPJ_HAS_FLOATING_POINT=1
+MY_PJSIP_FLAGS := $(BASE_PJSIP_FLAGS) -DPJ_AUTOCONF=1 -DPJ_JNI_HAS_JNI_ONLOAD=0 -DPJ_HAS_FLOATING_POINT=1
endif

# Build all sub dirs
diff -rupN CSipSimple.orig/jni/swig-glue/android_toolchain/Android.mk CSipSimple/jni/swig-glue/android_toolchain/Android.mk
--- CSipSimple.orig/jni/swig-glue/android_toolchain/Android.mk    2015-01-26 18:11:07.085726028 +0100
+++ CSipSimple/jni/swig-glue/android_toolchain/Android.mk    2015-01-26 21:13:55.955557791 +0100
@@ -100,7 +100,7 @@ $(privatecleantarget)::
include $(CLEAR_VARS)
LOCAL_PATH := $(SWIG_GLUE_PATH)
LOCAL_MODULE    := swig-glue
-LOCAL_CFLAGS := $(MY_PJSIP_FLAGS) -fno-strict-aliasing
+LOCAL_CFLAGS := $(MY_PJSIP_FLAGS) -fno-strict-aliasing -fpermissive

PJ_ANDROID_ROOT_DIR := $(LOCAL_PATH)/../pjsip/android_sources

diff -rupN CSipSimple.orig/jni/swig-glue/pjsip_header.i CSipSimple/jni/swig-glue/pjsip_header.i
--- CSipSimple.orig/jni/swig-glue/pjsip_header.i    2015-01-26 18:11:07.113724144 +0100
+++ CSipSimple/jni/swig-glue/pjsip_header.i    2015-02-07 17:52:53.481103741 +0100
@@ -46,7 +46,7 @@ typedef struct pjmedia_port_info

typedef struct pjmedia_port
{
-    pjmedia_port_info    info;              /**< Port information.  */
+    pjmedia_port_info     info;            /**< Port information.  */

     /** Port data can be used by the port creator to attach arbitrary
      *  value to be associated with the port.
@@ -57,18 +57,25 @@ typedef struct pjmedia_port
     } port_data;

     /**
-     * Sink interface.
+     * Get clock source.
+     * This should only be called by #pjmedia_port_get_clock_src().
+     */
+    pjmedia_clock_src* (*get_clock_src)(struct pjmedia_port *this_port,
+                                        pjmedia_dir dir);
+
+    /**
+     * Sink interface.
      * This should only be called by #pjmedia_port_put_frame().
      */
-    pj_status_t (*put_frame)(struct pjmedia_port *this_port,
-                             pjmedia_frame *frame);
+    pj_status_t (*put_frame)(struct pjmedia_port *this_port,
+                 pjmedia_frame *frame);

     /**
-     * Source interface.
+     * Source interface.
      * This should only be called by #pjmedia_port_get_frame().
      */
-    pj_status_t (*get_frame)(struct pjmedia_port *this_port,
-                             pjmedia_frame *frame);
+    pj_status_t (*get_frame)(struct pjmedia_port *this_port,
+                 pjmedia_frame *frame);

     /**
      * Called to destroy this port.
@@ -86,14 +93,29 @@ enum pjmedia_dir
     /** None */
     PJMEDIA_DIR_NONE = 0,

-    /** Encoding (outgoing to network) stream */
+    /** Encoding (outgoing to network) stream, also known as capture */
     PJMEDIA_DIR_ENCODING = 1,

-    /** Decoding (incoming from network) stream. */
+    /** Same as encoding direction. */
+    PJMEDIA_DIR_CAPTURE = PJMEDIA_DIR_ENCODING,
+
+    /** Decoding (incoming from network) stream, also known as playback. */
     PJMEDIA_DIR_DECODING = 2,

-    /** Incoming and outgoing stream. */
-    PJMEDIA_DIR_ENCODING_DECODING = 3
+    /** Same as decoding. */
+    PJMEDIA_DIR_PLAYBACK = PJMEDIA_DIR_DECODING,
+
+    /** Same as decoding. */
+    PJMEDIA_DIR_RENDER = PJMEDIA_DIR_DECODING,
+
+    /** Incoming and outgoing stream, same as PJMEDIA_DIR_CAPTURE_PLAYBACK */
+    PJMEDIA_DIR_ENCODING_DECODING = 3,
+
+    /** Same as ENCODING_DECODING */
+    PJMEDIA_DIR_CAPTURE_PLAYBACK = PJMEDIA_DIR_ENCODING_DECODING,
+
+    /** Same as ENCODING_DECODING */
+    PJMEDIA_DIR_CAPTURE_RENDER = PJMEDIA_DIR_ENCODING_DECODING

};

@@ -247,6 +269,7 @@ struct pjmedia_tone_desc
     short   on_msec;        /**< Playback ON duration, in miliseconds.      */
     short   off_msec;       /**< Playback OFF duration, ini miliseconds.    */
     short   volume;         /**< Volume (1-16383), or 0 for default.        */
+    short   flags;          /**< Currently internal flags, must be 0        */
};
/**
  * This structure describes individual MF digits to be played
@@ -519,12 +542,14 @@ enum pjmedia_srtp_use
/** SSL protocol method constants. */
enum pjsip_ssl_method
{
-    PJSIP_SSL_UNSPECIFIED_METHOD= 0,    /**< Default protocol method.    */
-    PJSIP_TLSV1_METHOD        = 31,    /**< Use SSLv1 method.        */
-    PJSIP_SSLV2_METHOD        = 20,    /**< Use SSLv2 method.        */
-    PJSIP_SSLV3_METHOD        = 30,    /**< Use SSLv3 method.        */
-    PJSIP_SSLV23_METHOD        = 23    /**< Use SSLv23 method.        */
-} ;
+    PJSIP_SSL_UNSPECIFIED_METHOD = 0,    /**< Default protocol method.    */   
+    PJSIP_SSLV2_METHOD         = 20,    /**< Use SSLv2 method.        */
+    PJSIP_SSLV3_METHOD         = 30,    /**< Use SSLv3 method.        */
+    PJSIP_TLSV1_METHOD         = 31,    /**< Use TLSv1 method.        */
+    PJSIP_TLSV1_1_METHOD     = 32,    /**< Use TLSv1_1 method.    */
+    PJSIP_TLSV1_2_METHOD     = 33,    /**< Use TLSv1_2 method.    */
+    PJSIP_SSLV23_METHOD         = 23,    /**< Use SSLv23 method.        */
+};

@@ -539,6 +564,11 @@ struct pjsip_tls_setting
     pj_str_t    ca_list_file;

     /**
+     * Certificate of Authority (CA) list directory path.
+     */
+    pj_str_t    ca_list_path;
+
+    /**
      * Public endpoint certificate file, which will be used as client-
      * side  certificate for outgoing TLS connection, and server-side
      * certificate for incoming TLS connection.
@@ -556,21 +586,25 @@ struct pjsip_tls_setting
     pj_str_t    password;

     /**
-     * TLS protocol method from #pjsip_ssl_method, which can be:
-     *    - PJSIP_SSL_UNSPECIFIED_METHOD(0): default (which will use
-     *                                     PJSIP_SSL_DEFAULT_METHOD)
-     *    - PJSIP_TLSV1_METHOD(1):       TLSv1
-     *    - PJSIP_SSLV2_METHOD(2):       SSLv2
-     *    - PJSIP_SSLV3_METHOD(3):       SSL3
-     *    - PJSIP_SSLV23_METHOD(23):       SSL23
+     * TLS protocol method from #pjsip_ssl_method. In the future, this field
+     * might be deprecated in favor of <b>proto</b> field. For now, this field
+     * is only applicable only when <b>proto</b> field is set to zero.
      *
      * Default is PJSIP_SSL_UNSPECIFIED_METHOD (0), which in turn will
-     * use PJSIP_SSL_DEFAULT_METHOD, which default value is
-     * PJSIP_TLSV1_METHOD.
+     * use PJSIP_SSL_DEFAULT_METHOD, which default value is PJSIP_TLSV1_METHOD.
      */
     int        method;

     /**
+     * TLS protocol type from #pj_ssl_sock_proto. Use this field to enable
+     * specific protocol type. Use bitwise OR operation to combine the protocol
+     * type.
+     *
+     * Default is PJSIP_SSL_DEFAULT_PROTO.
+     */
+    pj_uint32_t    proto;
+
+    /**
      * Number of ciphers contained in the specified cipher preference.
      * If this is set to zero, then default cipher list of the backend
      * will be used.
@@ -638,6 +672,12 @@ struct pjsip_tls_setting
     pj_time_val    timeout;

     /**
+     * Should SO_REUSEADDR be used for the listener socket.
+     * Default value is PJSIP_TLS_TRANSPORT_REUSEADDR.
+     */
+    pj_bool_t reuse_addr;
+
+    /**
      * QoS traffic type to be set on this transport. When application wants
      * to apply QoS tagging to the transport, it's preferable to set this
      * field rather than \a qos_param fields since this is more portable.
@@ -663,9 +703,26 @@ struct pjsip_tls_setting
      */
     pj_bool_t qos_ignore_error;

+    /**
+     * Specify options to be set on the transport.
+     *
+     * By default there is no options.
+     *
+     */
+    pj_sockopt_params sockopt_params;
+
+    /**
+     * Specify if the transport should ignore any errors when setting the
+     * sockopt parameters.
+     *
+     * Default: PJ_TRUE
+     *
+     */
+    pj_bool_t sockopt_ignore_error;
+
};

-//pjlib/include/pj/types.h
+// pjlib/include/pj/types.h
typedef long        pj_ssize_t;

/* QOS */
@@ -712,7 +769,7 @@ struct pj_time_val

-//pjnat/include/nat_detect.h
+// pjnath/include/pjnath/nat_detect.h

/**
  * This enumeration describes the NAT types, as specified by RFC 3489
@@ -840,6 +897,13 @@ typedef enum pjsip_redirect_op
     PJSIP_REDIRECT_ACCEPT,

     /**
+     * Accept the redirection to the current target and replace the To
+     * header in the INVITE request with the current target. The INVITE
+     * request will be resent to the current target.
+     */
+    PJSIP_REDIRECT_ACCEPT_REPLACE,
+
+    /**
      * Defer the redirection decision, for example to request permission
      * from the end user.
      */
@@ -853,7 +917,7 @@ typedef enum pjsip_redirect_op

};

-// pjsip/include/psip-ua/sip_timer.h
+// pjsip/include/pjsip-ua/sip_timer.h

/**
  * This structure describes Session Timers settings in an invite session.
@@ -878,6 +942,7 @@ struct pjsip_timer_setting
// Force decl of msg_data so that the real one is used -- this produce a build error but harmless
struct pjsua_msg_data
{
+    pj_str_t    target_uri;
     pjsip_hdr    hdr_list;
     pj_str_t    content_type;
     pj_str_t    msg_body;
diff -rupN CSipSimple.orig/res/values/prefs_values.xml CSipSimple/res/values/prefs_values.xml
--- CSipSimple.orig/res/values/prefs_values.xml    2015-01-26 18:11:12.081389932 +0100
+++ CSipSimple/res/values/prefs_values.xml    2015-01-26 18:46:04.824627467 +0100
@@ -99,14 +99,18 @@
     </string-array>
     <string-array name="tls_method_values">
         <item>0</item> <!-- Auto -->
-        <item>1</item> <!-- TLSv1 -->
-        <item>2</item> <!-- SSLv2 -->
-        <item>3</item> <!-- SSL3 -->
+        <item>31</item> <!-- TLSv1 -->
+        <item>32</item> <!-- TLSv1.1 -->
+        <item>33</item> <!-- TLSv1.2 -->
+        <item>20</item> <!-- SSLv2 -->
+        <item>30</item> <!-- SSL3 -->
         <item>23</item> <!-- SSL23 -->
     </string-array>
     <string-array name="tls_method_choices">
         <item>@string/auto</item>
         <item>TLSv1</item>
+        <item>TLSv1.1</item>
+        <item>TLSv1.2</item>
         <item>SSLv2</item>
         <item>SSL3</item>
         <item>SSL23</item>
diff -rupN CSipSimple.orig/src/com/csipsimple/pjsip/PjSipService.java CSipSimple/src/com/csipsimple/pjsip/PjSipService.java
--- CSipSimple.orig/src/com/csipsimple/pjsip/PjSipService.java    2015-01-26 18:11:09.753546542 +0100
+++ CSipSimple/src/com/csipsimple/pjsip/PjSipService.java    2015-02-07 13:59:04.188381579 +0100
@@ -767,6 +767,7 @@ public class PjSipService {
             tlsSetting.setVerify_client(checkClient ? 1 : 0);

             tlsSetting.setMethod(prefsWrapper.getTLSMethod());
+            tlsSetting.setProto(0);
             boolean checkServer = prefsWrapper
                     .getPreferenceBooleanValue(SipConfigManager.TLS_VERIFY_SERVER);
             tlsSetting.setVerify_server(checkServer ? 1 : 0);
diff -rupN CSipSimple.orig/src/com/csipsimple/utils/Compatibility.java CSipSimple/src/com/csipsimple/utils/Compatibility.java
--- CSipSimple.orig/src/com/csipsimple/utils/Compatibility.java    2015-01-26 18:11:07.729682703 +0100
+++ CSipSimple/src/com/csipsimple/utils/Compatibility.java    2015-01-27 00:40:35.735864349 +0100
@@ -968,6 +968,16 @@ public final class Compatibility {
                         Integer.toString(getDefaultAudioImplementation()));
             }
         }
+        if(lastSeenVersion < 2457) {
+            String method = prefWrapper.getPreferenceStringValue(SipConfigManager.TLS_METHOD);
+            if (method.equals("1")) {
+                prefWrapper.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "31");
+            } else if (method.equals("2")) {
+                prefWrapper.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "20");
+            } else if (method.equals("3")) {
+                prefWrapper.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "30");
+            }
+        }
         prefWrapper.endEditing();
     }

diff -rupN CSipSimple.orig/src/com/csipsimple/wizards/impl/Inovent.java CSipSimple/src/com/csipsimple/wizards/impl/Inovent.java
--- CSipSimple.orig/src/com/csipsimple/wizards/impl/Inovent.java    2015-01-26 18:11:09.693550578 +0100
+++ CSipSimple/src/com/csipsimple/wizards/impl/Inovent.java    2015-01-26 19:01:46.672258978 +0100
@@ -108,7 +108,7 @@ public class Inovent extends SimpleImple
         prefs.setPreferenceBooleanValue(SipConfigManager.ENABLE_QOS, true);
         prefs.setPreferenceBooleanValue(SipConfigManager.USE_COMPACT_FORM, true);
         prefs.setPreferenceBooleanValue(SipConfigManager.SUPPORT_MULTIPLE_CALLS, true);
-        prefs.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "1");
+        prefs.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "31");

         // Prefer opus,silk
         prefs.setCodecPriority("opus/48000/1", SipConfigManager.CODEC_WB, "245");
diff -rupN CSipSimple.orig/src/com/csipsimple/wizards/impl/TelAccess.java CSipSimple/src/com/csipsimple/wizards/impl/TelAccess.java
--- CSipSimple.orig/src/com/csipsimple/wizards/impl/TelAccess.java    2015-01-26 18:11:09.705549771 +0100
+++ CSipSimple/src/com/csipsimple/wizards/impl/TelAccess.java    2015-01-26 19:01:28.653486625 +0100
@@ -56,7 +56,7 @@ public class TelAccess extends SimpleImp
         prefs.setPreferenceBooleanValue(SipConfigManager.ENABLE_QOS, true);
         prefs.setPreferenceBooleanValue(SipConfigManager.USE_COMPACT_FORM, true);
         prefs.setPreferenceBooleanValue(SipConfigManager.SUPPORT_MULTIPLE_CALLS, true);
-        prefs.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "1");
+        prefs.setPreferenceStringValue(SipConfigManager.TLS_METHOD, "31");
         prefs.setPreferenceStringValue("codec_g729_8000_fpp", "4");

         // Prefer silk, gsm