Hi all, The question is beyond the SIP SSL/TLS support, everything working perfectly fine with creating keys/certs, generating agent.pem and client with cafile.pem. I am looking for a way to use different Ciphers for encryption/decryption before keys get involved. I dont know if freeswitch could directly or indirectly help to acquire the desired results, but since FS is using openssl at TLS layer, it might have a link ! Ciphers are being traced out in wireshark packets and i can see ClientHello, sending some particular cipher, and Server respond with serverHello, deciding the Cipher from preferences... However, changing the Cipher from client creates issues at server end and normally, "Handshake failures" are returned, even though those offered ciphers are supported by Server. Please comments if any body have previously worked or dev guys could help so? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SIP-S-and-openssl-tp7591496.ht... Sent from the freeswitch-users mailing list archive at Nabble.com.
Moreover, there is a file in libs/sofia-sip/libsofia-sip-ua/tport/ as tport_tls.c. and a portion of fucntion: void tls_set_default(tls_issues_t *i) { i->verify_depth = i->verify_depth == 0 ? 2 : i->verify_depth; i->cert = i->cert ? i->cert : "agent.pem"; i->key = i->key ? i->key : i->cert; i->randFile = i->randFile ? i->randFile : "tls_seed.dat"; i->CAfile = i->CAfile ? i->CAfile : "cafile.pem"; i->cipher = i->cipher ? i->cipher : "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"; /* Default SIP cipher */ /* "RSA-WITH-AES-128-CBC-SHA"; */ /* RFC-2543-compatibility ciphersuite */ /* TLS_RSA_WITH_3DES_EDE_CBC_SHA; */ } seems to be a relevant approach. Cipher mentioned as default "RSA-WITH-AES-128-CBC-SHA" is returned in ServerHello in default configuration. Changing this cipher (replacing "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH" with "ECDHE-ECDSA-AES256-GCM-SHA384" ) according to my need i.e SUIT-B cipher and compiling FS again, results internal SIP profile not being loaded. Please comments if any body have previously worked or dev guys could help so? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SIP-S-and-openssl-tp7591496p75... Sent from the freeswitch-users mailing list archive at Nabble.com.
This is the right area, yes. I don't think we expose a way to configure this right now, but you can try just hacking the code here to confirm. On Jun 9, 2013, at 3:13 AM, mehroz <mehroz.ashraf85@gmail.com> wrote:
Moreover, there is a file in libs/sofia-sip/libsofia-sip-ua/tport/ as tport_tls.c. and a portion of fucntion: void tls_set_default(tls_issues_t *i) { i->verify_depth = i->verify_depth == 0 ? 2 : i->verify_depth; i->cert = i->cert ? i->cert : "agent.pem"; i->key = i->key ? i->key : i->cert; i->randFile = i->randFile ? i->randFile : "tls_seed.dat"; i->CAfile = i->CAfile ? i->CAfile : "cafile.pem"; i->cipher = i->cipher ? i->cipher : "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"; /* Default SIP cipher */ /* "RSA-WITH-AES-128-CBC-SHA"; */ /* RFC-2543-compatibility ciphersuite */ /* TLS_RSA_WITH_3DES_EDE_CBC_SHA; */ }
seems to be a relevant approach. Cipher mentioned as default "RSA-WITH-AES-128-CBC-SHA" is returned in ServerHello in default configuration. Changing this cipher (replacing "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH" with "ECDHE-ECDSA-AES256-GCM-SHA384" ) according to my need i.e SUIT-B cipher and compiling FS again, results internal SIP profile not being loaded.
Please comments if any body have previously worked or dev guys could help so?
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SIP-S-and-openssl-tp7591496p75... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Yes, seems relevant... but I am blind beyond this. It clearly mention the default cipher ,and indeed ,i do get this with default keys/certs generated by FS script Also, for ECDHE-ECDSA like ciphers, it is said , to create elliptic curved keys in Public n private keys, which is not the case with those of created with FS script. But lets say, i manage to create keys with elliptic curves algo, how could the mentioned C file be helpful for my approach. And what format of cipher it accepts (as it doesn't seems to work after just replacing the Default string with required cipher string ) -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SIP-S-and-openssl-tp7591496p75... Sent from the freeswitch-users mailing list archive at Nabble.com.
Well... i have changed FS gentls_cert script to generate elliptic curved keys. And FS just dont negotiate on those keys!!... I see... "TLS setup failed" in logs ..... -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SIP-S-and-openssl-tp7591496p75... Sent from the freeswitch-users mailing list archive at Nabble.com.
participants (2)
-
mehroz
-
Michael Jerris