Hi all While configuring FS with secure setup which includes SIP secure over SSL/TLS and RTP with ZRTP, yet i am still unable to get it done. I came across a question i.e, how do we tell FS to do Secure SIP signalling (SSL/TLS) with securing RTP as ZRTP (not SRTP). I am very confused as what comes first! ? If I have enabled ZRTP settings in profile and vars.xml, and if i configured SSL in SIP signalling, how to tell it to not to secure RTP with SRTP, but ZRTP. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-SRTP-VS-SSL-ZRTP-tp7588218... Sent from the freeswitch-users mailing list archive at Nabble.com.
So, are you saying that if you enable TLS that it automatically tries to use SRTP instead of just RTP? I don't believe that's the case. Look here: http://wiki.freeswitch.org/wiki/Tls#Step_5_-_Securing_the_RTP_Channels_.28op... You can enable TLS with ZRTP. In fact, Ken Rice was just telling me how he was testing it on the latest git HEAD not too long ago while prepping for 1.2.6. If you still have questions maybe you could join the community conference call tomorrow and we can go over it. I think it would be nice for people to have a refresher in TLS + ZRTP. -MC On Mon, Mar 4, 2013 at 8:42 AM, mehroz <mehroz.ashraf85@gmail.com> wrote:
Hi all
While configuring FS with secure setup which includes SIP secure over SSL/TLS and RTP with ZRTP, yet i am still unable to get it done.
I came across a question i.e, how do we tell FS to do Secure SIP signalling (SSL/TLS) with securing RTP as ZRTP (not SRTP).
I am very confused as what comes first! ? If I have enabled ZRTP settings in profile and vars.xml, and if i configured SSL in SIP signalling, how to tell it to not to secure RTP with SRTP, but ZRTP.
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-SRTP-VS-SSL-ZRTP-tp7588218... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org
Thanks MC, As far as my understanding, it means that FS enable SRTP only when /sip_secure_media=true/ in the dialplan? OR Setting /transport=tls/ in the dialstring? If i left both to false, and ZRTP to enabled, it should support ZRTP only? right? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-SRTP-VS-SSL-ZRTP-tp7588218... Sent from the freeswitch-users mailing list archive at Nabble.com.
TLS has nothing to do with the SRTP/ZRTP. It only secures the signalling, media is secured separately. It's possible to secure either one without the other. You should *always* use TLS with SRTP though since the keys are sent in the SIP layer, but that's as far as it goes. -Steve On 6 March 2013 06:00, mehroz <mehroz.ashraf85@gmail.com> wrote:
Thanks MC,
As far as my understanding, it means that FS enable SRTP only when /sip_secure_media=true/ in the dialplan?
OR
Setting /transport=tls/ in the dialstring?
If i left both to false, and ZRTP to enabled, it should support ZRTP only? right?
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-SRTP-VS-SSL-ZRTP-tp7588218... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Right! But lets say we have the requirement for Secure signalling along with only ZRTP! How would FS helps me in designing that scenario? Where to tell FS what to DO and what NOT to! 1) Initially i configured ZRTP with worked awesomely fine! 2) later i configured SSL (SIPS), which worked fine again but since then i feel like FS aint over ZRTP rather SRTP! Reason! I no more see logs of "ZRTP engine starting" and not even the ZRTP protocol on Wireshark!(Stops after some Hello exchange) -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-SRTP-VS-SSL-ZRTP-tp7588218... Sent from the freeswitch-users mailing list archive at Nabble.com.
ZRTP worked fine before setting up SSL/TLS SIP. Later after configuring SSL/TLS , i found zrtp not working as expected. My phone do send zrtp-hash, and i see... v=0 o=9999 0 0 IN IP4 192.168.15.3 s=- c=IN IP4 192.168.15.3 t=0 0 m=audio 5072 RTP/AVP 3 8 101 a=rtpmap:3 GSM/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:101 telephone-event/8000 a=extmap:1 urn:ietf:params:rtp-hdrext:csrc-audio-level *a=zrtp-hash:1.10 d4a3ad55fce2a0b7709a64b73e55cde31756ac5a4a261e50dafcad281bf3692a * and then..... /sofia_glue.c:4037 Found audio zrtp-hash; setting r_sdp_audio_zrtp_hash=1.10 d4a3ad55fce2a0b7709a64b73e55cde31756ac5a4a261e50dafcad281bf3692a/ and later in the logs i see..... /switch_channel.c:3100 sofia/internal/9999@198.84.61.52 ZRTP not negotiated on both sides; disabling ZRTP passthru mode. / Can any one help me out? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-SRTP-VS-SSL-ZRTP-tp7588218... Sent from the freeswitch-users mailing list archive at Nabble.com.
Well, follow the debug log and you shall see that srtp takes precedence over zrtp in negotiation and zrtp becomes disabled if srtp is configured and enabled. Work with the secure_media var in either dialplan or profiles. I don't remember what the vars for zrtp were, but a search in the wiki will help you with.that. On Mar 13, 2013 12:02 PM, "mehroz" <mehroz.ashraf85@gmail.com> wrote:
ZRTP worked fine before setting up SSL/TLS SIP.
Later after configuring SSL/TLS , i found zrtp not working as expected.
My phone do send zrtp-hash, and i see... v=0 o=9999 0 0 IN IP4 192.168.15.3 s=- c=IN IP4 192.168.15.3 t=0 0 m=audio 5072 RTP/AVP 3 8 101 a=rtpmap:3 GSM/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:101 telephone-event/8000 a=extmap:1 urn:ietf:params:rtp-hdrext:csrc-audio-level *a=zrtp-hash:1.10 d4a3ad55fce2a0b7709a64b73e55cde31756ac5a4a261e50dafcad281bf3692a *
and then..... /sofia_glue.c:4037 Found audio zrtp-hash; setting r_sdp_audio_zrtp_hash=1.10 d4a3ad55fce2a0b7709a64b73e55cde31756ac5a4a261e50dafcad281bf3692a/
and later in the logs i see..... /switch_channel.c:3100 sofia/internal/9999@198.84.61.52 ZRTP not negotiated on both sides; disabling ZRTP passthru mode. /
Can any one help me out?
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-SRTP-VS-SSL-ZRTP-tp7588218... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Daniel Ivanov
-
mehroz
-
Michael Collins
-
Steven Ayre