Hi, Thank you for your help! I changed transport to TCP and updated vars.xml with one line: <X-PRE-PROCESS cmd="set" data="rtp_secure_media_outbound=mandatory:AES_CM_128_HMAC_SHA1_80"/> after "<X-PRE-PROCESS cmd="set" data="rtp_sdes_suites=AEAD_AES_256..." line And call worked. It is quite strange that if I put just "rtp_secure_media_outbound=mandatory" Linphone on B leg choose different cipher from Linphone in A leg an in this case I can hear only silence. Any hints? Thank you! 2015-11-04 17:48 GMT+02:00 Ken Rice <krice@freeswitch.org>:
I’ll bet you are doing SIP over UDP instead of SIP/TLS. This will affect you in multiple ways
1) Without SIP/TLS your STRP keys are passed around in the clear so you might as well not even be doing SRTP
2) Without SIP/TLS (or SIP over TCP atleast) your invites are exceeding MTU and being truncated. This is most likely why step 5 is failing
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Jurijs Ivolga *Sent:* Wednesday, November 4, 2015 8:06 AM *To:* FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> *Subject:* [Freeswitch-users] Linphone + Freeswitch + SRTP
Hi,
First of all I'm sorry if this not a really good place to ask, but I spotted very strange behavior using Linphone and Freeswitch.
I'm not sure that this is 100% Freeswitch bug, but maybe you point me to proper direction.
Test environment:
Linphone =SRTP==> Freeswitch =SRTP==> 2nd Linphone
Linphone & 2nd Linphone located behind NAT in same private network.
1) This invite is sent from Linphone to Freeswitch:
I left only SDP part where all ciphers are listed(same I did for all other sip packages)
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:2QEye591aHIqRwdLODMrr8ieQBBHl5WdIizE0NH2. a=crypto:2 AES_CM_128_HMAC_SHA1_32 inline:d6K8m+tGEMvkEbRm5Zzy6KQkrlwS78l7wGufgx8S. a=crypto:3 AES_CM_256_HMAC_SHA1_80 inline:PMvGinW3fpIejXOWDskUNWUhBX1KRlhrPkbrP0Nv4L/+My1V7w2r/ALSyLhkPg==. a=crypto:4 AES_CM_256_HMAC_SHA1_32 inline:ZsdwMe0D+RauGydaQ90qG7pfOvdW6m9cxjbBhJ5AUaNSTecse9Sk3lRzlgZuSA==.
2) Trying from Freeswitch
3) Freeswitch replies Proxy Authentication Required
4) ACK from Linphone
5) Linphone sends one more invite to Freeswitch:
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:2QEye591aHIqRwdLODMrr8ieQBBHl5WdIizE0NH2. a=crypto:2 AES_CM_128_HMAC_SHA1_32 inline:d6K8m+tGEMvkEbRm5Zzy6KQkrlwS
*As we can see this is something very strange, cause Linphone first invite send 4 ciphers, but now it sends only 2 and it looks like that second one is missing something.*
6) Trying from freeswitch
7) Invite sent from Freeswitch to 2nd Linphone
a=crypto:1 AEAD_AES_256_GCM_8 inline:jotCMStRYMvwWT18wMqmgwAu6mVBKaIkENGh8HLF0UYFEcwGnoQpM0m4juU. a=crypto:2 AEAD_AES_128_G
And as we can see in Invite from Freeswitch to 2nd Linphone ciphers are completely different from what Linphone sent in second Invite. I think this is not 100% Linphone bug. What you think?
Full sip trace you can find in attachemnt, additionnally I will rase same issue on Linphone side.
With kind regards,
Jurijs
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org