Hi again. On my previous discussion on this list, i learned that RTP/AVP with a a=crypto attribute means optional SRTP. I suppose FS supports optional SRTP, but when i look at the sofia code, afaiu fs does not support it. Right ? A code snippet from sofia_glue.c if (m->m_proto != sdp_proto_srtp) { switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_ERROR, "a=crypto in RTP/AVP, refer to rfc3711\n"); match = 0; goto done; } -- _lvnd_ {^_^}
FreeSWITCH Support SIP/TLS, SRTP and ZRTP, the error message you are refering to below is where someone has improperly implemented SRTP and is sending the crypto headers in the wrong spots. See the Wiki for setting up secure calling. Also please note, if you are going to use SRTP, you _must_ use SIP/TLS as the keys for SRTP are passed in the SDP of the SIP messaging. You can use ZRTP without using SIP/TLS as the key exchange for ZRTP happens as a DH exchange in the ZRTP stream, but if you want to protect the contents of the SIP messaging you¹ll still want to use SIP/TLS. K On 2/22/13 9:36 AM, "Levend Sayar" <levend.sayar@karel.com.tr> wrote:
Hi again.
On my previous discussion on this list, i learned that RTP/AVP with a a=crypto attribute means optional SRTP.
I suppose FS supports optional SRTP, but when i look at the sofia code, afaiu fs does not support it.
Right ?
A code snippet from sofia_glue.c
if (m->m_proto != sdp_proto_srtp) { switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_ERROR, "a=crypto in RTP/AVP, refer to rfc3711\n"); match = 0; goto done; }
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
crypto in RTP/AVP is invalid per the spec. You are required to send two rtp profiles one with RTP/AVP or RTP/SAVP To get around this in your broken device you can set the variable sip_allow_crypto_in_avp or set profile param NDLB-allow-crypto-in-avp -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire T: +1.918.420.9266 | F: +1.918.420.9267 | M: +1.918.424.WEST iNUM: +883 5100 1420 9266 ISN: 410*543 On Feb 22, 2013, at 10:08 AM, Ken Rice <krice@freeswitch.org> wrote:
FreeSWITCH Support SIP/TLS, SRTP and ZRTP, the error message you are refering to below is where someone has improperly implemented SRTP and is sending the crypto headers in the wrong spots. See the Wiki for setting up secure calling.
Also please note, if you are going to use SRTP, you _must_ use SIP/TLS as the keys for SRTP are passed in the SDP of the SIP messaging. You can use ZRTP without using SIP/TLS as the key exchange for ZRTP happens as a DH exchange in the ZRTP stream, but if you want to protect the contents of the SIP messaging you’ll still want to use SIP/TLS.
K
The confusion was mine on an earlier thread. I said that, based on something on another mailing list that I can't find now (sip-implementors?). That post might have been inspired by this which states RTP/AVP with a=crypto allows SRTP desired but not required - but only because it 'deviates from the specification in RFC4568' http://msdn.microsoft.com/en-us/library/dd948772(v=office.12).aspx I guess such devices are what the NDLB parameter is for. The previous thread was 'SRTP disabling' where Levand has a phone that allows optional SRTP but only offers RTP/SAVP in its SDP with no RTP/AVP profile offered so FS cannot/won't send plain RTP to the SRTP port. Which I'd say is correct behaviour and a broken phone. Steve On 22 Feb 2013, at 17:27, Brian West <brian@freeswitch.org> wrote:
crypto in RTP/AVP is invalid per the spec.
You are required to send two rtp profiles one with RTP/AVP or RTP/SAVP
To get around this in your broken device you can set the variable sip_allow_crypto_in_avp or set profile param NDLB-allow-crypto-in-avp
-- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire T: +1.918.420.9266 | F: +1.918.420.9267 | M: +1.918.424.WEST iNUM: +883 5100 1420 9266 ISN: 410*543
On Feb 22, 2013, at 10:08 AM, Ken Rice <krice@freeswitch.org> wrote:
FreeSWITCH Support SIP/TLS, SRTP and ZRTP, the error message you are refering to below is where someone has improperly implemented SRTP and is sending the crypto headers in the wrong spots. See the Wiki for setting up secure calling.
Also please note, if you are going to use SRTP, you _must_ use SIP/TLS as the keys for SRTP are passed in the SDP of the SIP messaging. You can use ZRTP without using SIP/TLS as the key exchange for ZRTP happens as a DH exchange in the ZRTP stream, but if you want to protect the contents of the SIP messaging you’ll still want to use SIP/TLS.
K
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks for your responses. So afaiu m=audio RTP/AVP a=crypto Is invalid due to spec. What Steve pointed is a Microsoft deviation. So for optional RTP, SDP must look like something like this ? m=audio RTP/AVP a=blabla m=audio RTP/SAVP a=crypto Namely contain both RTP/AVP and RTP/SAVP profiles. And callee can choose whatever it prefers. RTP or SRTP. Brian, I will test the parameters you gave ASAP and say the result. I really appreciate your help guys. _lvnd_ {^_^} On 22 Şub 2013, at 19:09, "Steven Ayre" <steveayre@gmail.com<mailto:steveayre@gmail.com>> wrote: The confusion was mine on an earlier thread. I said that, based on something on another mailing list that I can't find now (sip-implementors?). That post might have been inspired by this which states RTP/AVP with a=crypto allows SRTP desired but not required - but only because it 'deviates from the specification in RFC4568' http://msdn.microsoft.com/en-us/library/dd948772(v=office.12).aspx I guess such devices are what the NDLB parameter is for. The previous thread was 'SRTP disabling' where Levand has a phone that allows optional SRTP but only offers RTP/SAVP in its SDP with no RTP/AVP profile offered so FS cannot/won't send plain RTP to the SRTP port. Which I'd say is correct behaviour and a broken phone. Steve On 22 Feb 2013, at 17:27, Brian West <brian@freeswitch.org<mailto:brian@freeswitch.org>> wrote: crypto in RTP/AVP is invalid per the spec. You are required to send two rtp profiles one with RTP/AVP or RTP/SAVP To get around this in your broken device you can set the variable sip_allow_crypto_in_avp or set profile param NDLB-allow-crypto-in-avp -- Brian West brian@freeswitch.org<mailto:brian@freeswitch.org> FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire T: +1.918.420.9266 | F: +1.918.420.9267 | M: +1.918.424.WEST iNUM: +883 5100 1420 9266 ISN: 410*543 On Feb 22, 2013, at 10:08 AM, Ken Rice <krice@freeswitch.org<mailto:krice@freeswitch.org>> wrote: FreeSWITCH Support SIP/TLS, SRTP and ZRTP, the error message you are refering to below is where someone has improperly implemented SRTP and is sending the crypto headers in the wrong spots. See the Wiki for setting up secure calling. Also please note, if you are going to use SRTP, you _must_ use SIP/TLS as the keys for SRTP are passed in the SDP of the SIP messaging. You can use ZRTP without using SIP/TLS as the key exchange for ZRTP happens as a DH exchange in the ZRTP stream, but if you want to protect the contents of the SIP messaging you’ll still want to use SIP/TLS. K _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users<http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users<http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org
Probably not only MS, but yes non-standard.
So for optional RTP, SDP must look like something like this ?
m=audio RTP/AVP a=blabla m=audio RTP/SAVP a=crypto
Correct. The callee can then pick which of the profiles to use. Steve On 22 Feb 2013, at 22:12, Levend Sayar <levend.sayar@karel.com.tr> wrote:
Thanks for your responses.
So afaiu
m=audio RTP/AVP a=crypto
Is invalid due to spec. What Steve pointed is a Microsoft deviation.
So for optional RTP, SDP must look like something like this ?
m=audio RTP/AVP a=blabla m=audio RTP/SAVP a=crypto
Namely contain both RTP/AVP and RTP/SAVP profiles. And callee can choose whatever it prefers. RTP or SRTP.
Brian, I will test the parameters you gave ASAP and say the result.
I really appreciate your help guys.
_lvnd_ {^_^}
On 22 Şub 2013, at 19:09, "Steven Ayre" <steveayre@gmail.com> wrote:
The confusion was mine on an earlier thread. I said that, based on something on another mailing list that I can't find now (sip-implementors?).
That post might have been inspired by this which states RTP/AVP with a=crypto allows SRTP desired but not required - but only because it 'deviates from the specification in RFC4568'
http://msdn.microsoft.com/en-us/library/dd948772(v=office.12).aspx
I guess such devices are what the NDLB parameter is for.
The previous thread was 'SRTP disabling' where Levand has a phone that allows optional SRTP but only offers RTP/SAVP in its SDP with no RTP/AVP profile offered so FS cannot/won't send plain RTP to the SRTP port. Which I'd say is correct behaviour and a broken phone.
Steve
On 22 Feb 2013, at 17:27, Brian West <brian@freeswitch.org> wrote:
crypto in RTP/AVP is invalid per the spec.
You are required to send two rtp profiles one with RTP/AVP or RTP/SAVP
To get around this in your broken device you can set the variable sip_allow_crypto_in_avp or set profile param NDLB-allow-crypto-in-avp
-- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire T: +1.918.420.9266 | F: +1.918.420.9267 | M: +1.918.424.WEST iNUM: +883 5100 1420 9266 ISN: 410*543
On Feb 22, 2013, at 10:08 AM, Ken Rice <krice@freeswitch.org> wrote:
FreeSWITCH Support SIP/TLS, SRTP and ZRTP, the error message you are refering to below is where someone has improperly implemented SRTP and is sending the crypto headers in the wrong spots. See the Wiki for setting up secure calling. Also please note, if you are going to use SRTP, you _must_ use SIP/TLS as the keys for SRTP are passed in the SDP of the SIP messaging. You can use ZRTP without using SIP/TLS as the key exchange for ZRTP happens as a DH exchange in the ZRTP stream, but if you want to protect the contents of the SIP messaging you’ll still want to use SIP/TLS. K
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
This is what Polycom and many others do. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire T: +1.918.420.9266 | F: +1.918.420.9267 | M: +1.918.424.WEST iNUM: +883 5100 1420 9266 ISN: 410*543 On Feb 22, 2013, at 3:12 PM, Levend Sayar <levend.sayar@karel.com.tr> wrote:
So for optional RTP, SDP must look like something like this ?
m=audio RTP/AVP a=blabla m=audio RTP/SAVP a=crypto
Ken you are right. But what i want to do is not securing all the conversation. I dont need that. What i want is FS to prefer RTP when an optional SRTP offer is received. In this list, it is mentioned that m=audio RTP/AVP a=crypto ... means optional SRTP. Namely caller prefers to talk with SRTP, but if calle prefers RTP, caller accept RTP too. First of all, the SDP I show is improper ? -- İyi çalışmalar. _lvnd_ {^_^} KAREL`UCAP On Fri, 2013-02-22 at 10:08 -0600, Ken Rice wrote: FreeSWITCH Support SIP/TLS, SRTP and ZRTP, the error message you are refering to below is where someone has improperly implemented SRTP and is sending the crypto headers in the wrong spots. See the Wiki for setting up secure calling. Also please note, if you are going to use SRTP, you _must_ use SIP/TLS as the keys for SRTP are passed in the SDP of the SIP messaging. You can use ZRTP without using SIP/TLS as the key exchange for ZRTP happens as a DH exchange in the ZRTP stream, but if you want to protect the contents of the SIP messaging you’ll still want to use SIP/TLS. K On 2/22/13 9:36 AM, "Levend Sayar" <levend.sayar@karel.com.tr> wrote: Hi again. On my previous discussion on this list, i learned that RTP/AVP with a a=crypto attribute means optional SRTP. I suppose FS supports optional SRTP, but when i look at the sofia code, afaiu fs does not support it. Right ? A code snippet from sofia_glue.c if (m->m_proto != sdp_proto_srtp) { switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_ERROR, "a=crypto in RTP/AVP, refer to rfc3711\n"); match = 0; goto done; } plain text document attachment (ATT00001) _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
See rfc3711 that describes how you are supposed to pass the crypto information. If you want to disable SRTP on all calls, that¹s a channel variable for that you just set <action application="set" data="sip_secure_media=false"/> Now you can use the dialplan to look at the SDP, and determine if you want to set if you want to have SRTP enabled or not See http://wiki.freeswitch.org/wiki/SRTP for more information K On 2/22/13 10:30 AM, "Levend Sayar" <levend.sayar@karel.com.tr> wrote:
Ken you are right. But what i want to do is not securing all the conversation. I dont need that. What i want is FS to prefer RTP when an optional SRTP offer is received.
In this list, it is mentioned that
m=audio RTP/AVP a=crypto ...
means optional SRTP. Namely caller prefers to talk with SRTP, but if calle prefers RTP, caller accept RTP too.
First of all, the SDP I show is improper ?
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
participants (4)
-
Brian West
-
Ken Rice
-
Levend Sayar
-
Steven Ayre