Hello, has anybody managed to setup TLS? When I change tls to "true" in internal.xml, then freeswitch doens't listen on any ports (5060 5061). I use freeswitch 1.0.0-0ubuntu1~ppa4 Is there any tutorial available (could not find it while googling)? I would like to set it up with Snom phones (Snom320) Best regards Peter
This should get you started. http://wiki.freeswitch.org/wiki/Tls /b On Jul 23, 2008, at 1:29 PM, Peter P GMX wrote:
Hello,
has anybody managed to setup TLS? When I change tls to "true" in internal.xml, then freeswitch doens't listen on any ports (5060 5061). I use freeswitch 1.0.0-0ubuntu1~ppa4
Is there any tutorial available (could not find it while googling)? I would like to set it up with Snom phones (Snom320)
Best regards Peter
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brian West sip:brian@freeswitch.org
I finally set up a new machine with Ubuntu 8.04 server, installed freeswitch from SVN and followed the instructions from http://wiki.freeswitch.org/wiki/Tls I have installed libgnutls-dev befor running ./configure script. Then created a CA with default-values of "bin/gentls_cert setup" and "bin/gentls_cert create" The 2 pem files are in the default path conf/ssl. I receive the following in the log messages and no process is listening on port 5061 2008-08-02 17:38:06 [NOTICE] switch_loadable_module.c:237 switch_loadable_module_process() Adding Application 'socket' 2008-08-02 17:38:07 [DEBUG] sofia_glue.c:487 sofia_glue_ext_address_lookup() Stun Success [217.24.XXX.XXX]:[57331] 2008-08-02 17:38:07 [NOTICE] sofia.c:1873 config_sofia() Adding Alias [outbound] for profile [external] 2008-08-02 17:38:07 [NOTICE] sofia.c:1883 config_sofia() Started Profile external [sofia_reg_external] 2008-08-02 17:38:07 [DEBUG] sofia.c:522 sofia_profile_thread_run() Creating agent for external 2008-08-02 17:38:07 [NOTICE] sofia.c:1873 config_sofia() Adding Alias [192.168.178.31] for profile [internal] 2008-08-02 17:38:07 [NOTICE] sofia.c:1873 config_sofia() Adding Alias [default] for profile [internal] 2008-08-02 17:38:07 [NOTICE] sofia.c:1883 config_sofia() Started Profile internal [sofia_reg_internal] 2008-08-02 17:38:07 [DEBUG] sofia.c:522 sofia_profile_thread_run() Creating agent for internal 2008-08-02 17:38:07 [DEBUG] sofia.c:557 sofia_profile_thread_run() Created agent for external 2008-08-02 17:38:07 [DEBUG] sofia.c:585 sofia_profile_thread_run() Set params for external 2008-08-02 17:38:07 [DEBUG] sofia.c:606 sofia_profile_thread_run() activated db for external 2008-08-02 17:38:07 [DEBUG] sofia.c:633 sofia_profile_thread_run() Starting thread for external 2008-08-02 17:38:07 [ERR] sofia.c:552 sofia_profile_thread_run() Error Creating SIP UA for profile: internal 2008-08-02 17:38:07 [DEBUG] sofia_glue.c:487 sofia_glue_ext_address_lookup() Stun Success [217.24.XXX.XXX]:[57446] 2008-08-02 17:38:07 [NOTICE] sofia.c:1883 config_sofia() Started Profile nat [sofia_reg_nat] 2008-08-02 17:38:07 [DEBUG] sofia.c:522 sofia_profile_thread_run() Creating agent for nat 2008-08-02 17:38:07 [DEBUG] mod_sofia.c:2227 mod_sofia_load() Waiting for profiles to start 2008-08-02 17:38:07 [DEBUG] sofia.c:557 sofia_profile_thread_run() Created agent for nat 2008-08-02 17:38:07 [DEBUG] sofia.c:585 sofia_profile_thread_run() Set params for nat 2008-08-02 17:38:07 [DEBUG] sofia.c:606 sofia_profile_thread_run() activated db for nat 2008-08-02 17:38:07 [DEBUG] sofia.c:633 sofia_profile_thread_run() Starting thread for nat I checked with nmap and netstat -an but there are no processes listening on port 5061. Also gentls_cert with real values didn't work. Without TLS enabled it works well on port 5060. Any hints how to continue? Brian West schrieb:
This should get you started.
http://wiki.freeswitch.org/wiki/Tls
/b
On Jul 23, 2008, at 1:29 PM, Peter P GMX wrote:
Hello,
has anybody managed to setup TLS? When I change tls to "true" in internal.xml, then freeswitch doens't listen on any ports (5060 5061). I use freeswitch 1.0.0-0ubuntu1~ppa4
Is there any tutorial available (could not find it while googling)? I would like to set it up with Snom phones (Snom320)
Best regards Peter
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brian West sip:brian@freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
If have done this but again the same result. Is there any way to enhance the output in the log (currently loglevel is debug) or to determine if freeswitch was compiled correctly with TLS? At least if I grep the freeswitch binary with tls there is no occurence. Best regards Peter Brian West schrieb:
Make sure you install OpenSSL-Dev packages and ./configure again.
/b
On Aug 2, 2008, at 10:54 AM, Peter P GMX wrote:
Any hints how to continue?
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Did you turn tls on the profile on? /b Sent from my iPhone On Aug 3, 2008, at 6:44 AM, Peter P GMX <Prometheus001@gmx.net> wrote:
If have done this but again the same result.
Is there any way to enhance the output in the log (currently loglevel is debug) or to determine if freeswitch was compiled correctly with TLS? At least if I grep the freeswitch binary with tls there is no occurence.
Best regards Peter
Brian West schrieb:
Make sure you install OpenSSL-Dev packages and ./configure again.
/b
On Aug 2, 2008, at 10:54 AM, Peter P GMX wrote:
Any hints how to continue?
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hello Brian, Yes it's turned on: <!-- TLS: disabled by default, set to "true" to enable --> <param *name="tls" value="true"*/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> <param name="tls-version" value="tlsv1"/> I recompiled it and checked the output for warnings and errors. This is what I found: configure: WARNING: python2.5 is unusable configure: WARNING: Your python lacks threads support, can not build mod_python config.status: WARNING: Makefile.in seems to ignore the --datarootdir setting ./configure: line 4234: AX_COMPILER_VENDOR: command not found config.status: WARNING: apr-config.in seems to ignore the --datarootdir setting /bin/bash: /usr/src/freeswitch/libs/curl/missing: No such file or directory configure: WARNING: `missing' script is too old or missing configure: WARNING: dlfcn.h: present but cannot be compiled configure: WARNING: dlfcn.h: check for missing prerequisite headers? configure: WARNING: dlfcn.h: see the Autoconf documentation configure: WARNING: dlfcn.h: section "Present But Cannot Be Compiled" configure: WARNING: dlfcn.h: proceeding with the preprocessor's result configure: WARNING: dlfcn.h: in the future, the compiler will take precedence libtool: line 121: CC: command not found config.status: WARNING: config/autoconf.mk.in seems to ignore the --datarootdir setting ./configure: line 1908: /shtool: No such file or directory configure: WARNING: dlfcn.h: accepted by the compiler, rejected by the preprocessor! configure: WARNING: dlfcn.h: proceeding with the compiler's result configure: WARNING: Touching files in directory tests/. config.status: WARNING: packages/sofia-sip-ua.pc.in seems to ignore the --datarootdir setting mod_lua_wrap.cpp: In function ‘int _wrap_CoreSession_hangup__SWIG_1(lua_State*)’: mod_lua_wrap.cpp:4563: warning: deprecated conversion from string constant to ‘char*’ sndfile.c: In function ‘sf_error’: sndfile.c:491: warning: the address of ‘sf_error’ will never be NULL libtool: link: warning: `-version-info/-version-number' is ignored for convenience libraries quiet_libtool: install: warning: relinking `mod_sofia.la' ../../../../libs/xmlrpc-c/src/method.c: In function ‘xmlrpc_methodCreate’: ../../../../libs/xmlrpc-c/src/method.c:213: note: ‘signatureP’ was declared here ../../../../libs/xmlrpc-c/src/parse_value.c: In function ‘xmlrpc_parseValue’: ../../../../libs/xmlrpc-c/src/parse_value.c:199: note: ‘valueElemP’ was declared here ../../../../libs/xmlrpc-c/src/parse_value.c:191: note: ‘nameElemP’ was declared here ../../../../libs/xmlrpc-c/src/parse_value.c:245: note: ‘keyP’ was declared here ../../../../libs/xmlrpc-c/src/parse_value.c:420: note: ‘fractionEnd’ was declared here ../../../../libs/xmlrpc-c/src/parse_value.c:419: note: ‘fraction’ was declared here ../../../../libs/xmlrpc-c/src/parse_value.c:418: note: ‘mantissaEnd’ was declared here ../../../../libs/xmlrpc-c/src/parse_value.c:417: note: ‘mantissa’ was declared here ../../../../libs/xmlrpc-c/src/parse_value.c:503: note: ‘valueDouble’ was declared here ../../../../libs/xmlrpc-c/src/system_method.c: In function ‘system_methodSignature’: ../../../../libs/xmlrpc-c/src/system_method.c:455: note: ‘signatureVP’ was declared here ../../../../libs/xmlrpc-c/src/xmlrpc_server_abyss.c: In function ‘handleXmlrpcReq’: ../../../../libs/xmlrpc-c/src/xmlrpc_server_abyss.c:474: note: ‘body’ was declared here ../../../../libs/xmlrpc-c/src/xmlrpc_server_abyss.c: In function ‘xmlrpc_server_abyss_create’: ../../../../libs/xmlrpc-c/src/xmlrpc_server_abyss.c:894: note: ‘socketFd’ was declared here ../../../../libs/xmlrpc-c/src/xmlrpc_server_abyss.c:893: note: ‘portNumber’ was declared here Is there anything special I have to take care aout? I also grepped the ./configure and make output for "tls" and received the following: config.status: creating scripts/gentls_cert checking for libgnutls-config... /usr/bin/libgnutls-config checking for libgnutls - version >= 0.1.0... yes It also compiles tport_type_tls.o and tport_type_tls.o When I grep for "ssl" I received the following: checking for SSL_connect in -lssl... yes checking openssl/x509.h usability... yes checking openssl/x509.h presence... yes checking for openssl/x509.h... yes checking openssl/rsa.h usability... yes checking openssl/rsa.h presence... yes checking for openssl/rsa.h... yes checking openssl/crypto.h usability... yes checking openssl/crypto.h presence... yes checking for openssl/crypto.h... yes checking openssl/pem.h usability... yes checking openssl/pem.h presence... yes checking for openssl/pem.h... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking openssl/err.h usability... yes checking openssl/err.h presence... yes checking for openssl/err.h... yes checking openssl/pkcs12.h usability... yes checking openssl/pkcs12.h presence... yes checking for openssl/pkcs12.h... yes checking openssl/engine.h usability... yes checking openssl/engine.h presence... yes checking for openssl/engine.h... yes config.status: creating packages/Linux/RPM/curl-ssl.spec checking for openssl... yes checking openssl_CFLAGS... checking openssl_LIBS... -lssl -lcrypto gcc -Wall -DSU_DEBUG=0 -g -ggdb -o stunc stunc.o ./.libs/libstun.a ../sresolv/.libs/libsresolv.a ../su/.libs/libsu.a -lssl -lcrypto -lrt -lpthread gcc -Wall -DSU_DEBUG=0 -g -ggdb -o sip-options sip-options.o ../libsofia-sip-ua/.libs/libsofia-sip-ua.a -lssl -lcrypto -lrt -lpthread gcc -Wall -DSU_DEBUG=0 -g -ggdb -o sip-date sip-date.o ../libsofia-sip-ua/.libs/libsofia-sip-ua.a -lssl -lcrypto -lrt -lpthread gcc -Wall -DSU_DEBUG=0 -g -ggdb -o sip-dig sip-dig.o ../libsofia-sip-ua/.libs/libsofia-sip-ua.a -lssl -lcrypto -lrt -lpthread gcc -shared .libs/mod_sofia_la-mod_sofia.o .libs/mod_sofia_la-sofia.o .libs/mod_sofia_la-sofia_glue.o .libs/mod_sofia_la-sofia_presence.o .libs/mod_sofia_la-sofia_reg.o -Wl,--whole-archive /usr/src/freeswitch/libs/sofia-sip/libsofia-sip-ua/.libs/libsofia-sip-ua.a -Wl,--no-whole-archive -Wl,--rpath -Wl,/usr/local/freeswitch/lib -L/usr/local/freeswitch/lib -lfreeswitch -lssl -lcrypto -lrt -lpthread -lncurses -Wl,-soname -Wl,mod_sofia.so -o .libs/mod_sofia.so root@freeswitch:/var/log# So it seems that in fact he tries to use ssl. But I still receive 2008-08-03 18:57:32 [NOTICE] sofia.c:1883 config_sofia() Started Profile internal [sofia_reg_internal] 2008-08-03 18:57:32 [DEBUG] sofia.c:522 sofia_profile_thread_run() Creating agent for internal 2008-08-03 18:57:32 [*ERR] sofia.c:552 sofia_profile_thread_run() Error Creating SIP UA for profile: internal* Best regards Peter Brian West schrieb:
Did you turn tls on the profile on?
/b
Sent from my iPhone
On Aug 3, 2008, at 6:44 AM, Peter P GMX <Prometheus001@gmx.net> wrote:
If have done this but again the same result.
Is there any way to enhance the output in the log (currently loglevel is debug) or to determine if freeswitch was compiled correctly with TLS? At least if I grep the freeswitch binary with tls there is no occurence.
Best regards Peter
Brian West schrieb:
Make sure you install OpenSSL-Dev packages and ./configure again.
/b
On Aug 2, 2008, at 10:54 AM, Peter P GMX wrote:
Any hints how to continue?
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
And you have everything in conf/ssl right? /b On Aug 3, 2008, at 12:01 PM, Peter P GMX wrote:
Hello Brian,
Yes it's turned on: <!-- TLS: disabled by default, set to "true" to enable --> <param name="tls" value="true"/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> <param name="tls-version" value="tlsv1"/>
I got TLS working right now. It turned out that the modified start/stop script for freeswitch which I had from the Ubuntu package caused that problem. Starting freeswitch from the bin directory worked fine with TLS and unsecure RTP. Now I am stuck with SRTP. I followed http://wiki.freeswitch.org/wiki/SRTP . I could connect 2 Snom 320 phones with firmware 6.5.16 via TLS but could not hear anything. Then I upgraded the Snoms to 7.1.33 (as you suggsted here: http://www.mail-archive.com/freeswitch-users@lists.freeswitch.org/msg00836.h...) and now the other phone hangs up directly after pickup. Calling voicemail didn't work either. Here is a console output when calling voicemail (1002 calls 1002) 2008-08-03 21:03:25 [DEBUG] mod_dptools.c:683 set_function() SET [voicemail_authorized]=[true] 2008-08-03 21:03:25 [DEBUG] switch_core_state_machine.c:140 switch_core_standard_on_execute() sofia/internal/1002@192.168.178.31 Execute answer() 2008-08-03 21:03:25 [DEBUG] sofia_glue.c:1756 sofia_glue_activate_rtp() AUDIO RTP [sofia/internal/1002@192.168.178.31] 192.168.178.31 port 24278 -> 192.168.178.25 port 51322 codec: 0 ms: 20 2008-08-03 21:03:25 [DEBUG] switch_rtp.c:813 switch_rtp_create() Starting timer [soft] 160 bytes per 20000ms 2008-08-03 21:03:25 [INFO] switch_rtp.c:721 switch_rtp_add_crypto_key() Activating Secure RTP SEND 2008-08-03 21:03:25 [INFO] switch_rtp.c:701 switch_rtp_add_crypto_key() Activating Secure RTP RECV 2008-08-03 21:03:25 [DEBUG] mod_sofia.c:439 sofia_answer_channel() Local SDP sofia/internal/1002@192.168.178.31: v=0 o=FreeSWITCH 1217765927 1217765928 IN IP4 192.168.178.31 s=FreeSWITCH c=IN IP4 192.168.178.31 t=0 0 a=sendrecv m=audio 24278 RTP/SAVP 0 101 13 a=rtpmap:0 pcmu/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=rtpmap:13 CN/8000 a=ptime:20 a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:FG+lWx0snfbgUOMW6EqyPehCibrkSXrG1Y7qJldO 2008-08-03 21:03:25 [DEBUG] switch_core_session.c:430 switch_core_session_receive_message() Kill sofia/internal/1002@192.168.178.31 [BREAK] 2008-08-03 21:03:25 [DEBUG] sofia.c:2137 sofia_handle_sip_i_state() Channel sofia/internal/1002@192.168.178.31 entering state [completed] 2008-08-03 21:03:25 [NOTICE] mod_dptools.c:606 answer_function() Channel [sofia/internal/1002@192.168.178.31] has been answered 2008-08-03 21:03:25 [DEBUG] switch_core_state_machine.c:140 switch_core_standard_on_execute() sofia/internal/1002@192.168.178.31 Execute sleep(1000) 2008-08-03 21:03:25 [DEBUG] sofia.c:2137 sofia_handle_sip_i_state() Channel sofia/internal/1002@192.168.178.31 entering state [ready] 2008-08-03 21:03:25 [DEBUG] sofia.c:2137 sofia_handle_sip_i_state() Channel sofia/internal/1002@192.168.178.31 entering state [terminated] 2008-08-03 21:03:25 [NOTICE] sofia.c:2553 sofia_handle_sip_i_state() Hangup sofia/internal/1002@192.168.178.31 [CS_EXECUTE] [NORMAL_CLEARING] 2008-08-03 21:03:25 [DEBUG] switch_channel.c:1361 switch_channel_perform_hangup() Kill sofia/internal/1002@192.168.178.31 [KILL] 2008-08-03 21:03:25 [DEBUG] switch_core_session.c:722 switch_core_session_signal_state_change() Kill sofia/internal/1002@192.168.178.31 [BREAK] 2008-08-03 21:03:25 [DEBUG] switch_core_state_machine.c:430 switch_core_session_run() (sofia/internal/1002@192.168.178.31) State EXECUTE going to sleep 2008-08-03 21:03:25 [DEBUG] switch_core_state_machine.c:365 switch_core_session_run() sofia/internal/1002@192.168.178.31 Running State Change CS_HANGUP 2008-08-03 21:03:25 [DEBUG] switch_core_state_machine.c:393 switch_core_session_run() (sofia/internal/1002@192.168.178.31) State HANGUP 2008-08-03 21:03:25 [DEBUG] mod_sofia.c:264 sofia_on_hangup() Channel sofia/internal/1002@192.168.178.31 hanging up, cause: NORMAL_CLEARING 2008-08-03 21:03:25 [DEBUG] switch_core_state_machine.c:46 switch_core_standard_on_hangup() Standard HANGUP sofia/internal/1002@192.168.178.31, cause: NORMAL_CLEARING 2008-08-03 21:03:25 [DEBUG] switch_core_state_machine.c:393 switch_core_session_run() (sofia/internal/1002@192.168.178.31) State HANGUP going to sleep 2008-08-03 21:03:25 [DEBUG] switch_core_session.c:789 switch_core_session_thread() Session 21 (sofia/internal/1002@192.168.178.31) Locked, Waiting on external entities 2008-08-03 21:03:25 [NOTICE] switch_core_session.c:807 switch_core_session_thread() Session 21 (sofia/internal/1002@192.168.178.31) Ended 2008-08-03 21:03:25 [NOTICE] switch_core_session.c:809 switch_core_session_thread() Close Channel sofia/internal/1002@192.168.178.31 [CS_HANGUP] It looks like the call is setup correctly and then it hangs up. Did I miss something? Best regards Peter Brian West schrieb:
And you have everything in conf/ssl right?
/b
On Aug 3, 2008, at 12:01 PM, Peter P GMX wrote:
Hello Brian,
Yes it's turned on: <!-- TLS: disabled by default, set to "true" to enable --> <param *name="tls" value="true"*/> <!-- additional bind parameters for TLS --> <param name="tls-bind-params" value="transport=tls"/> <!-- Port to listen on for TLS requests. (5061 will be used if unspecified) --> <param name="tls-sip-port" value="5061"/> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --> <param name="tls-cert-dir" value="$${base_dir}/conf/ssl"/> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --> <param name="tls-version" value="tlsv1"/>
------------------------------------------------------------------------
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
OK you have to go to the RTP tab and make sure the Encryption is on.. then set it to optional or mandatory. Call 9999 if you hear the bong it works. Then in this condition <condition field="${sip_has_crypto}" expression="^(AES_CM_128_HMAC_SHA1_32|AES_CM_128_HMAC_SHA1_80)$" break="never"> You see that it has part of it commented out to secure the B-Leg also. Uncomment that. Since this is a variable you can also set this stuff on a user in the directory. Then new snom 7.3.7(beta) firmware has both AES_CM_128_HMAC_SHA1_32 and AES_CM_128_HMAC_SHA1_80. I highly recommend you only enable one cypher suite... /b On Aug 3, 2008, at 2:14 PM, Peter P GMX wrote:
I got TLS working right now. It turned out that the modified start/ stop script for freeswitch which I had from the Ubuntu package caused that problem. Starting freeswitch from the bin directory worked fine with TLS and unsecure RTP.
Now I am stuck with SRTP. I followed http://wiki.freeswitch.org/wiki/SRTP . I could connect 2 Snom 320 phones with firmware 6.5.16 via TLS but could not hear anything. Then I upgraded the Snoms to 7.1.33 (as you suggsted here: http://www.mail-archive.com/freeswitch-users@lists.freeswitch.org/msg00836.h...) and now the other phone hangs up directly after pickup. Calling voicemail didn't work either.
Hallo Brian, thank you for your hint for the Snom settings. SRTP works now, but I am not sure wether it's actually 100% safe. On the Snom phone I set RTP/SAVP to optional (was off before). Then it works. But if I set it to mandatory it doesn't work anymore. When set to optional it starts Invites with m=audio 49806 RTP/AVP 0 9 8 3 101 However after the OK message the SDP message contains RTP/SAVP as follows. m=audio 20260 RTP/SAVP 0 101 13 I checked with Wireshark and the RTP stream only contained noise. So it seems to be encrypted. Do you think there is still an security issue here? Best regards Peter Brian West schrieb:
OK you have to go to the RTP tab and make sure the Encryption is on.. then set it to optional or mandatory. Call 9999 if you hear the bong it works.
Then in this condition <condition field="${sip_has_crypto}" expression="^(AES_CM_128_HMAC_SHA1_32|AES_CM_128_HMAC_SHA1_80)$" break="never">
You see that it has part of it commented out to secure the B-Leg also. Uncomment that. Since this is a variable you can also set this stuff on a user in the directory.
Then new snom 7.3.7(beta) firmware has both AES_CM_128_HMAC_SHA1_32 and AES_CM_128_HMAC_SHA1_80. I highly recommend you only enable one cypher suite...
/b
On Aug 3, 2008, at 2:14 PM, Peter P GMX wrote:
I got TLS working right now. It turned out that the modified start/ stop script for freeswitch which I had from the Ubuntu package caused that problem. Starting freeswitch from the bin directory worked fine with TLS and unsecure RTP.
Now I am stuck with SRTP. I followed http://wiki.freeswitch.org/wiki/SRTP . I could connect 2 Snom 320 phones with firmware 6.5.16 via TLS but could not hear anything. Then I upgraded the Snoms to 7.1.33 (as you suggsted here: http://www.mail-archive.com/freeswitch-users@lists.freeswitch.org/msg00836.h...) and now the other phone hangs up directly after pickup. Calling voicemail didn't work either.
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (2)
-
Brian West
-
Peter P GMX