Hello Johannes, hello list! I just found your post because I'm trying to achieve the same thing waht's already implemented for asterisk long time ago. A few things to clarify the goal of the desired change a bit more: - The standard registration with Telekom AllIP works just fine (regarding SIP over TLS e.g.) - But if you additionally want to use encrypted RTP, you have to go through mediasec enabled registration. That's what you described partly below. I want to go a bit more into deep how mediasec works at Deutsche Telekom. It's an extension of the regular registration process. It works like this (RFC3329) (only the additional headers of the regular register added): (1) ----> (Request sent by FS) REGISTER sip:tel.t-online.de SIP/2.0 CSeq: 12735 REGISTER ... Security-Client: sdes-srtp;mediasec Proxy-Require: mediasec Require: mediasec (2) <---- (Response sent to FS) SIP/2.0 494 Security Agreement Required CSeq: 12735 REGISTER ... Security-Server: msrp-tls;mediasec Security-Server: sdes-srtp;mediasec Security-Server: dtls-srtp;mediase (3) ----> REGISTER sip:tel.t-online.de SIP/2.0 CSeq: 12736 REGISTER ... Security-Verify: msrp-tls;mediasec Security-Verify: sdes-srtp;mediasec Security-Verify: dtls-srtp;mediasec (4) <----- SIP/2.0 401 Unauthorized 11030030345 CSeq: 12736 REGISTER ... Security-Server: msrp-tls;mediasec Security-Server: sdes-srtp;mediasec Security-Server: dtls-srtp;mediasec (5) ----> REGISTER sip:tel.t-online.de SIP/2.0 CSeq: 12737 REGISTER ... Security-Verify: msrp-tls;mediasec Security-Verify: sdes-srtp;mediasec Security-Verify: dtls-srtp;mediasec (6) <---- SIP/2.0 200 OK ... To summarize it: mediasec adds one additional request / response process at the beginning of the known registration process and a few additional headers: Requesting mediasec (it's the known register start plus additional headers) and the response is 494 Security Agreement Required. From now on registration works as usual except for those three additional headers. I searched and found lots of documentation. Therefore I found a pretty easy way to add those additional headers (in the C code) and I'm able to start the mediasec process. Unfortunately, I'm not able to handle / route this additional request/response process right at the beginning, because sofia doesn't provide any means to modify the registration process based on freeswitch (id est: without changing sofia). Is this correct? Or is there nevertheless a way to integrate this additional request / response because I overlooked something? I am able to get the 494 in freeswitch, but I don't know how to exactly proceed because sofia doesn't know anything about this process and sofia has its own definition on how to do registration. Maybe some of you do have any idea? Basically it's pretty easy: after the first preceeding request / response, the "real" registration has to be (re)started. That's how it's possible in asterisk. The key point is, that the "restarted" registration process must know about the fact that the mediasec process has already been done, because after the 494, you have to set three other headers in the register as before (compare (1) and (3) above). The registration process is started with nua_register(). It probably would work if it would be possible to just silently (= do not send anything to the SIP provider at all) end the complete registration process after the 494 and immediately restart it again right from the beginning (plus three additional headers) - at this moment, the registration process itself works normally as sofia expects it. If registration proceeds, the next and last step is to add the a=3ge2ae:requested to the outgoing invite's SDP. At the moment, I don't know how to do it - but the reason is pretty simple: I first have to solve registration - afterwards let's do the next step. Thanks for any help! Gregor On 17.08.21 at 09:00 Schäffner, Johannes wrote:
Hello,
I am trying to register with a Deutsche Telekom SIP Trunk.
The Deutsche Telekom technical documentation states that the client must set the following SIP header fields:
For an initial REGISTER without Authentication Challenge the SIP Header fields
- Security-Client: sdes-srtp;mediasec
- Proxy Request: mediasec
- Requirement: mediasec
shall be included. The platform replies with SIP 401 Unauthorised and contains the SIP header fields
- Security server: msrp-tls;mediasec
- Security server: sdes-srtp;mediasec
- Security server: dtls-srtp;mediasec
with indication of the possible encryption methods. For the following REGISTER with Authentication Challenge,
in addition to the originally included SIP header fields Security-Client, Proxy-Require, Require the SIP header fields
- Security Check: msrp-tls;mediasec
- Security check: sdes-srtp;mediasec
- Security check: dtls-srtp;mediasec
shall also be included. According to RFC3261, the Security-Verify header fields can also be combined as a single header field.
I have seen, that the Sofia-Stack has implemented these Fields.
But I have not found a way to set these header fields in the REGISTER message.
(For the INVITE messages I'm using the set action sip_h_*; not sure if this is correct.
There I have the Problem, that I'm not able to set the SDP Attribute
a=3ge2ae:requested)
Regards, Johannes