SRTP - how to enable on the other leg?
Hi, I am trying to use SRTP without TLS. The initiating side asks and get SRTP (two way) while the other side is not offered SRTP at all. I've noted that ${sip_has_crypto} is null. I also tried setting unconditionaly sip_secure_rtp (both set and export), but it doesn't help. Any idea what I am doing wrong? BTW, I am using today's mornning GIT. Thanks, __Yehavi:
you make sure sip_secure_media=true is set inside {} on the originate or export the variable. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire T: +1.918.420.9266 | F: +1.918.420.9267 | M: +1.918.424.WEST iNUM: +883 5100 1420 9266 UK: +44 20 3298 4900 ISN: 410*543 On Nov 21, 2012, at 7:08 AM, Yehavi Bourvine <yehavi.bourvine@gmail.com> wrote:
Hi,
I am trying to use SRTP without TLS. The initiating side asks and get SRTP (two way) while the other side is not offered SRTP at all.
I've noted that ${sip_has_crypto} is null. I also tried setting unconditionaly sip_secure_rtp (both set and export), but it doesn't help.
Any idea what I am doing wrong?
BTW, I am using today's mornning GIT.
Thanks, __Yehavi:
Thanks to all who have replied - the problem has been found (my fault...). The variables set above (with set/export) work as intended. I simply had a clause in the dial string that sets SRTP only if TLS is active as well. __Yehavi: 2012/11/21 Brian West <brian@freeswitch.org>
you make sure sip_secure_media=true is set inside {} on the originate or export the variable. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire T: +1.918.420.9266 | F: +1.918.420.9267 | M: +1.918.424.WEST iNUM: +883 5100 1420 9266 UK: +44 20 3298 4900 ISN: 410*543
On Nov 21, 2012, at 7:08 AM, Yehavi Bourvine <yehavi.bourvine@gmail.com> wrote:
Hi,
I am trying to use SRTP without TLS. The initiating side asks and get SRTP (two way) while the other side is not offered SRTP at all.
I've noted that ${sip_has_crypto} is null. I also tried setting unconditionaly sip_secure_rtp (both set and export), but it doesn't help.
Any idea what I am doing wrong?
BTW, I am using today's mornning GIT.
Thanks, __Yehavi:
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Try to set nolocal:sip_secure_media to true. Or however the var was called. Im going from memory here. On Nov 21, 2012 4:06 PM, "Yehavi Bourvine" <yehavi.bourvine@gmail.com> wrote:
Hi,
I am trying to use SRTP without TLS. The initiating side asks and get
SRTP (two way) while the other side is not offered SRTP at all.
I've noted that ${sip_has_crypto} is null. I also tried setting
unconditionaly sip_secure_rtp (both set and export), but it doesn't help.
Any idea what I am doing wrong?
BTW, I am using today's mornning GIT.
Thanks, __Yehavi:
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
This is completely pointless. SRTP keys are transmitted plaintext within SIP, you need to use TLS to encrypt them. Anyone intercepting your SRTP stream would also intercept your SIP packets, which means if you're not using TLS they'll have the encryption key to decrypt the SRTP packets. So it's no more secure than RTP. -Steve On 21 November 2012 13:08, Yehavi Bourvine <yehavi.bourvine@gmail.com>wrote:
I am trying to use SRTP without TLS
You are right; TLS is my next step... Using non-TLS helps debugging these issues easier. I'll try the suggestions raised above on Sunday. Thanks, __Yehavi: 2012/11/23 Steven Ayre <steveayre@gmail.com>
This is completely pointless.
SRTP keys are transmitted plaintext within SIP, you need to use TLS to encrypt them.
Anyone intercepting your SRTP stream would also intercept your SIP packets, which means if you're not using TLS they'll have the encryption key to decrypt the SRTP packets. So it's no more secure than RTP.
-Steve
On 21 November 2012 13:08, Yehavi Bourvine <yehavi.bourvine@gmail.com>wrote:
I am trying to use SRTP without TLS
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Brian West
-
Daniel Ivanov
-
Steven Ayre
-
Yehavi Bourvine