Hello all, I have some problems with proxying ZRTP streams trough Freeswitch. My setup is as follows: [FS-A]----[FS-B]----[FS-C] For End-to-end security, "A" should initiate a ZRTP session and "C" shall terminate it. What works: * With late negotiation, two ZRTP security associations (A,B) and (B,C) are established. Of course in that case there is no E2E encryption, so no real advantage over the usage of TLS/SAVP . According to the Wiki, it should be possible to use "proxy_media" with "inbound-zrtp-passthru". Only this does not work and the problem is this: ZRTP uses a slightly modified RTP header format with a CRC checksum that is calculated over the whole ZRTP header and payload (excluding the CRC field). Freeswitch ("FS-B" in my use-case) on the other hand exchanges the RTP "sequence numbers" and "syncronization source identifiers" (SSRC) (which in ZRTP become "Source Identifiers"). Which leads to the case that the checksums are valid on call leg (A,B) but invalid on leg (B,C). Accordingly, "FS-C" receives ZRTP hello packets from "FS-A", calculates the checksums, finds a mismatch and discards the packets. I have found a thread on [freeswitch-users] dated January 2013 and with a subject "problems with freeswitch + zrtp in proxy-media mode" which discusses exactly this problem. Within this thread was mentioned, that FS would change the proxy behaviour, if it encounters "zrtp-hash" attribute in the SDP and a quick test with SFLphone and w/o proxy_media seems to confirm this. So is there any possibility to originate this attribute, when FS originates the ZRTP? Regards, David -- David Dahlberg Fraunhofer FKIE, Dept. Communication Systems (KOM) | Tel: +49-228-9435-845 Fraunhoferstr. 20, 53343 Wachtberg, Germany | Fax: +49-228-856277
This specifically only works if your devices have the a-zrtp-hash attributes in the SDP, Otherwise you need to remove the libzrtp from FreeSWITCH. What endpoints are you testing with right now? -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Feb 5, 2014, at 6:03 AM, Dahlberg, David <david.dahlberg@fkie.fraunhofer.de> wrote:
According to the Wiki, it should be possible to use "proxy_media" with "inbound-zrtp-passthru". Only this does not work and the problem is this:
IIRC, Linphone doesn't send the ZRTP hash in SDP, so it wouldn't work properly with "inbound-zrtp-passthru" On Sat, Feb 8, 2014 at 2:01 AM, Brian West <brian@freeswitch.org> wrote:
This specifically only works if your devices have the a-zrtp-hash attributes in the SDP, Otherwise you need to remove the libzrtp from FreeSWITCH. What endpoints are you testing with right now? -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED)
On Feb 5, 2014, at 6:03 AM, Dahlberg, David < david.dahlberg@fkie.fraunhofer.de> wrote:
According to the Wiki, it should be possible to use "proxy_media" with "inbound-zrtp-passthru". Only this does not work and the problem is this:
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Exactly. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Feb 8, 2014, at 6:06 AM, Peter Villeneuve <petervnv1@gmail.com> wrote:
IIRC, Linphone doesn't send the ZRTP hash in SDP, so it wouldn't work properly with "inbound-zrtp-passthru"
Am Freitag, den 07.02.2014, 20:01 -0600 schrieb Brian West:
This specifically only works if your devices have the a-zrtp-hash attributes in the SDP, Otherwise you need to remove the libzrtp from FreeSWITCH. What endpoints are you testing with right now?
I saw already in the updated version of the ZRTP RFC, that it won't work without the hash. Well actually I am using FreeSWITCH as endpoints. So how may I enable the hashes? ;-) Regards, David -- David Dahlberg Fraunhofer FKIE, Dept. Communication Systems (KOM) | Tel: +49-228-9435-845 Fraunhoferstr. 20, 53343 Wachtberg, Germany | Fax: +49-228-856277
FreeSWITCH will need to be extended to offer the hash when zrtp mode is preferred. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Feb 11, 2014, at 9:22 AM, Dahlberg, David <david.dahlberg@fkie.fraunhofer.de> wrote:
I saw already in the updated version of the ZRTP RFC, that it won't work without the hash.
Well actually I am using FreeSWITCH as endpoints. So how may I enable the hashes? ;-)
Regards, David
-- David Dahlberg
Am Dienstag, den 11.02.2014, 09:52 -0600 schrieb Brian West:
FreeSWITCH will need to be extended to offer the hash when zrtp mode is preferred.
Okay, I understand. Thanks. Regards, David -- David Dahlberg Fraunhofer FKIE, Dept. Communication Systems (KOM) | Tel: +49-228-9435-845 Fraunhoferstr. 20, 53343 Wachtberg, Germany | Fax: +49-228-856277
participants (3)
-
Brian West
-
Dahlberg, David
-
Peter Villeneuve