Hi I have 2 softphones PhonerLite (they support SRTP via SDES ) and the freeswitch (windows RC1 version) server and I wanted to make secure call between those two endpoints (SRTP). I spend whole day on testing this scenario and my conclusions are: - when the option: <action application="export" data="sip_secure_media=true"/> is uncommented, and both enpoints have enabled SRTP then: 1) Initiator of the session sends SIP Invite with a=crypto paramter and supported codecs 2) Freeswitch receives SIP Invite and sends SIP Invite to the receiver (also with the crypto) 3) Receiver receives the SIP Invite with the a=crypto parameter and he sends back supported codecs with 200 OK message (but without a=crypto parametr. Is that ok? I'm afraid not) 4) Freeswitch sends 200 OK message but witout any codecs: m=audio 0 RTP/AVP 19 and no a= parameters! 5) Final result is that the second leg of the session between Freeswitch and receiver has SRTP transport enbaled and the first leg (initiator- Freeswitch) doesn't hear anything - no codecs! However Freeswitch is sending RTP (not SRTP) pacekets to the initiator. Could someone explain to me, what is going on, and why freeswitch doesn't forward codecs accepted by the receiver to the initiator? Is it a PhonerLite's bug or freeswitch's? Maybe someone has tested SRTP with the PhonerLite softphone or any other free softphone with srtp support? When I uncommented: <param name="Inbound-no-media" value="true"> everything works fine. The parameter <action application="export" data="sip_secure_media=true"/> doesn't change anything then (but i cound miss something). Thanks for help Chris
Can you forward me the full invite coming in from the phone and I can tell you why... what It feels like is they are doing crypto lines in the RTP/AVP instead of RTP/SAVP as per the RFC says. /b On Apr 23, 2008, at 2:01 PM, Krzysiek wrote:
Hi I have 2 softphones PhonerLite (they support SRTP via SDES ) and the freeswitch (windows RC1 version) server and I wanted to make secure call between those two endpoints (SRTP). I spend whole day on testing this scenario and my conclusions are: - when the option: <action application="export" data="sip_secure_media=true"/> is uncommented, and both enpoints have enabled SRTP then: 1) Initiator of the session sends SIP Invite with a=crypto paramter and supported codecs 2) Freeswitch receives SIP Invite and sends SIP Invite to the receiver (also with the crypto) 3) Receiver receives the SIP Invite with the a=crypto parameter and he sends back supported codecs with 200 OK message (but without a=crypto parametr. Is that ok? I'm afraid not) 4) Freeswitch sends 200 OK message but witout any codecs: m=audio 0 RTP/AVP 19 and no a= parameters! 5) Final result is that the second leg of the session between Freeswitch and receiver has SRTP transport enbaled and the first leg (initiator- Freeswitch) doesn't hear anything - no codecs! However Freeswitch is sending RTP (not SRTP) pacekets to the initiator.
Could someone explain to me, what is going on, and why freeswitch doesn't forward codecs accepted by the receiver to the initiator? Is it a PhonerLite's bug or freeswitch's? Maybe someone has tested SRTP with the PhonerLite softphone or any other free softphone with srtp support?
When I uncommented: <param name="Inbound-no-media" value="true"> everything works fine. The parameter <action application="export" data="sip_secure_media=true"/> doesn't change anything then (but i cound miss something).
Thanks for help Chris _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brian West sip:brian@freeswitch.org
Can you post a sip trace of this entire call, the 19 means we are rejecting that m= line, are there 2 m lines, AVP and SAVP to indicate optional secure? Mike On Apr 23, 2008, at 3:01 PM, Krzysiek wrote:
Hi I have 2 softphones PhonerLite (they support SRTP via SDES ) and the freeswitch (windows RC1 version) server and I wanted to make secure call between those two endpoints (SRTP). I spend whole day on testing this scenario and my conclusions are: - when the option: <action application="export" data="sip_secure_media=true"/> is uncommented, and both enpoints have enabled SRTP then: 1) Initiator of the session sends SIP Invite with a=crypto paramter and supported codecs 2) Freeswitch receives SIP Invite and sends SIP Invite to the receiver (also with the crypto) 3) Receiver receives the SIP Invite with the a=crypto parameter and he sends back supported codecs with 200 OK message (but without a=crypto parametr. Is that ok? I'm afraid not) 4) Freeswitch sends 200 OK message but witout any codecs: m=audio 0 RTP/AVP 19 and no a= parameters! 5) Final result is that the second leg of the session between Freeswitch and receiver has SRTP transport enbaled and the first leg (initiator- Freeswitch) doesn't hear anything - no codecs! However Freeswitch is sending RTP (not SRTP) pacekets to the initiator.
Could someone explain to me, what is going on, and why freeswitch doesn't forward codecs accepted by the receiver to the initiator? Is it a PhonerLite's bug or freeswitch's? Maybe someone has tested SRTP with the PhonerLite softphone or any other free softphone with srtp support?
When I uncommented: <param name="Inbound-no-media" value="true"> everything works fine. The parameter <action application="export" data="sip_secure_media=true"/> doesn't change anything then (but i cound miss something).
Thanks for help Chris _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Sorry for such a long post here :). I was using wireshark and it looks like this (the 4 most important messages) : ============================================== Initiator (192.168.1.5) -> Freeswitch( 192.168.1.3): ---------------------------------------------- INVITE sip:1001@192.168.1.3 SIP/2.0 Via: SIP/2.0/UDP 192.168.1.5:5060;branch=z9hG4bK001834b8b20fdd11b704000fb0e3cf84;rport From: "Tosh" <sip:1002@192.168.1.3>;tag=370855464 To: <sip:1001@192.168.1.3> Call-ID: 001834B8-B20F-DD11-B702-000FB0E3CF84@192.168.1.5 CSeq: 98361155 INVITE Contact: <sip:1002@192.168.1.5:5060> Proxy-Authorization: (...) Content-Type: application/sdp Allow: INVITE, OPTIONS, ACK, BYE, CANCEL, INFO, NOTIFY, MESSAGE, UPDATE Max-Forwards: 70 Supported: 100rel, replaces User-Agent: SIPPER for PhonerLite Content-Length: 446 v=0 o=- 1232061542 0 IN IP4 192.168.1.5 s=SIPPER for PhonerLite c=IN IP4 192.168.1.5 t=0 0 m=audio 5062 RTP/AVP 0 8 2 3 97 110 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:2 G726-32/8000 a=rtpmap:3 GSM/8000 a=rtpmap:97 iLBC/8000 a=rtpmap:110 speex/8000 a=rtpmap:101 telephone-event/8000 a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:3dhne7Il7YqlVZAdnLVgdhngndKXXoNZm7v4/wwC a=encryption:optional a=fmtp:101 0-15 a=sendrecv ---------------------------------------------------- Freeswitch -> Receiver (192.168.1.4) INVITE sip:1001@192.168.1.4:5060 SIP/2.0 Via: SIP/2.0/UDP 192.168.1.3;rport;branch=z9hG4bKeeFDH2FB5j0Dj Max-Forwards: 69 From: "Extension 1002" <sip:1002@192.168.1.3>;tag=ND0tXZH5Qe0aD To: <sip:1001@192.168.1.4:5060> Call-ID: fa523794-8be7-122b-2780-39a48cb53b8d CSeq: 98362890 INVITE Contact: <sip:mod_sofia@192.168.1.3:5060> User-Agent: FreeSWITCH-mod_sofia/1.0.rc1-7946 Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, MESSAGE, SUBSCRIBE, NOTIFY, REFER, UPDATE, REGISTER, INFO, PUBLISH Supported: 100rel, precondition, timer Min-SE: 120 Content-Type: application/sdp Content-Disposition: session Content-Length: 428 Remote-Party-ID: "Extension 1002" <sip:1002@192.168.1.3>;screen=yes;privacy=off v=0 o=FreeSWITCH 5985117983522540515 5861368874018127564 IN IP4 192.168.1.3 s=FreeSWITCH c=IN IP4 192.168.1.3 t=0 0 a=sendrecv m=audio 26382 RTP/SAVP 0 9 8 3 101 13 a=rtpmap:0 PCMU/8000 a=rtpmap:9 G722/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:3 GSM/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=rtpmap:13 CN/8000 a=ptime:20 a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:C/XV148O1ZQ0V3LEpByfrFCRL7PGtFDJLcjTCwwV ------------------------------------------------ Receiver -> Freeswitch SIP/2.0 200 OK Via: SIP/2.0/UDP 192.168.1.3;rport=5060;branch=z9hG4bKeeFDH2FB5j0Dj From: "Extension 1002" <sip:1002@192.168.1.3>;tag=ND0tXZH5Qe0aD To: <sip:1001@192.168.1.4:5060>;tag=00c93cd1b20fdd11886f00b0d0b8ce20 Call-ID: fa523794-8be7-122b-2780-39a48cb53b8d CSeq: 98362890 INVITE Contact: <sip:1001@192.168.1.4:5060> Content-Type: application/sdp Allow: INVITE, OPTIONS, ACK, BYE, CANCEL, INFO, NOTIFY, MESSAGE, UPDATE Supported: replaces, timer User-Agent: SIPPER for PhonerLite Content-Length: 258 v=0 o=- 3139884392 1 IN IP4 192.168.1.4 s=SIPPER for PhonerLite c=IN IP4 192.168.1.4 t=0 0 m=audio 5062 RTP/SAVP 0 8 3 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:3 GSM/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=sendrecv ------------------------------------------------ Freeswitch -> Initiator SIP/2.0 200 OK Via: SIP/2.0/UDP 192.168.1.5:5060;branch=z9hG4bK001834b8b20fdd11b704000fb0e3cf84;rport=5060 From: "Tosh" <sip:1002@192.168.1.3>;tag=370855464 To: <sip:1001@192.168.1.3>;tag=m461U401t59QH Call-ID: 001834B8-B20F-DD11-B702-000FB0E3CF84@192.168.1.5 CSeq: 98361155 INVITE Contact: <sip:mod_sofia@192.168.1.3:5060;transport=udp> User-Agent: FreeSWITCH-mod_sofia/1.0.rc1-7946 Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, MESSAGE, SUBSCRIBE, NOTIFY, REFER, UPDATE, REGISTER, INFO, PUBLISH Supported: 100rel, precondition, timer Min-SE: 120 Content-Type: application/sdp Content-Disposition: session Content-Length: 155 v=0 o=FreeSWITCH 5425860535457980718 3341838566411422164 IN IP4 192.168.1.3 s=FreeSWITCH c=IN IP4 192.168.1.3 t=0 0 a=sendrecv m=audio 0 RTP/AVP 19 ================================================= And voice traffic looks like this: Reciever -> Freeswitch SRTP Freeswitch -> Initiator RTP I hope this will explain everything. I have also a wireshark pcap file from this call (but i don't know where and how to send it). Thanks for help Chris ----- Original Message ----- From: Michael Jerris To: freeswitch-users@lists.freeswitch.org Sent: Wednesday, April 23, 2008 9:11 PM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch Can you post a sip trace of this entire call, the 19 means we are rejecting that m= line, are there 2 m lines, AVP and SAVP to indicate optional secure? Mike On Apr 23, 2008, at 3:01 PM, Krzysiek wrote: Hi I have 2 softphones PhonerLite (they support SRTP via SDES ) and the freeswitch (windows RC1 version) server and I wanted to make secure call between those two endpoints (SRTP). I spend whole day on testing this scenario and my conclusions are: - when the option: <action application="export" data="sip_secure_media=true"/> is uncommented, and both enpoints have enabled SRTP then: 1) Initiator of the session sends SIP Invite with a=crypto paramter and supported codecs 2) Freeswitch receives SIP Invite and sends SIP Invite to the receiver (also with the crypto) 3) Receiver receives the SIP Invite with the a=crypto parameter and he sends back supported codecs with 200 OK message (but without a=crypto parametr. Is that ok? I'm afraid not) 4) Freeswitch sends 200 OK message but witout any codecs: m=audio 0 RTP/AVP 19 and no a= parameters! 5) Final result is that the second leg of the session between Freeswitch and receiver has SRTP transport enbaled and the first leg (initiator- Freeswitch) doesn't hear anything - no codecs! However Freeswitch is sending RTP (not SRTP) pacekets to the initiator. Could someone explain to me, what is going on, and why freeswitch doesn't forward codecs accepted by the receiver to the initiator? Is it a PhonerLite's bug or freeswitch's? Maybe someone has tested SRTP with the PhonerLite softphone or any other free softphone with srtp support? When I uncommented: <param name="Inbound-no-media" value="true"> everything works fine. The parameter <action application="export" data="sip_secure_media=true"/> doesn't change anything then (but i cound miss something). Thanks for help Chris _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ------------------------------------------------------------------------------ _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Yep this client is broken. You should NEVER offer crypto in the RTP/AVP. There are two ways to do this... Only offer RTP/SAVP or offer two m= lines. one with RTP/ AVP and one with RTP/SAVP. m=audio 0 RTP/AVP 19 indicates the stack rejected the offer because its invalid. RFC 3711 clearly states that SRTP is RTP/SAVP. If you have a contact at the company that makes the client maybe we can get them to fix it? The Polycom is the only phone that does this little tid bit correctly. Let me outline what it should look like and this is one people will argue about till the cows come home... On but optional/preferred: v=0 o=root 1130561626 1130561626 IN IP4 10.0.1.241 s=call c=IN IP4 10.0.1.241 t=0 0 m=audio 52970 RTP/SAVP 9 0 8 2 3 18 4 101 a=rtpmap:9 g722/8000 a=rtpmap:0 pcmu/8000 a=rtpmap:8 pcma/8000 a=rtpmap:2 g726-32/8000 a=rtpmap:3 gsm/8000 a=rtpmap:18 g729/8000 a=rtpmap:4 g723/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:WvPreyjK82pM0I5vtUY2zkpIKPbRVSKH1QcPrsWP a=ptime:60 m=audio 52970 RTP/AVP 9 0 8 2 3 18 4 101 a=rtpmap:9 g722/8000 a=rtpmap:0 pcmu/8000 a=rtpmap:8 pcma/8000 a=rtpmap:2 g726-32/8000 a=rtpmap:3 gsm/8000 a=rtpmap:18 g729/8000 a=rtpmap:4 g723/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=ptime:60 On Manditory: v=0 o=root 1130561626 1130561626 IN IP4 10.0.1.241 s=call c=IN IP4 10.0.1.241 t=0 0 m=audio 52970 RTP/SAVP 9 0 8 2 3 18 4 101 a=rtpmap:9 g722/8000 a=rtpmap:0 pcmu/8000 a=rtpmap:8 pcma/8000 a=rtpmap:2 g726-32/8000 a=rtpmap:3 gsm/8000 a=rtpmap:18 g729/8000 a=rtpmap:4 g723/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:WvPreyjK82pM0I5vtUY2zkpIKPbRVSKH1QcPrsWP a=ptime:60 Off not offered/Not Supported: v=0 o=root 1130561626 1130561626 IN IP4 10.0.1.241 s=call c=IN IP4 10.0.1.241 t=0 0 m=audio 52970 RTP/AVP 9 0 8 2 3 18 4 101 a=rtpmap:9 g722/8000 a=rtpmap:0 pcmu/8000 a=rtpmap:8 pcma/8000 a=rtpmap:2 g726-32/8000 a=rtpmap:3 gsm/8000 a=rtpmap:18 g729/8000 a=rtpmap:4 g723/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=ptime:60 /b On Apr 23, 2008, at 3:21 PM, Krzysiek wrote:
Sorry for such a long post here :). I was using wireshark and it looks like this (the 4 most important messages) : ============================================== Initiator (192.168.1.5) -> Freeswitch( 192.168.1.3): ---------------------------------------------- INVITE sip:1001@192.168.1.3 SIP/2.0 Via: SIP/2.0/UDP 192.168.1.5:5060;branch=z9hG4bK001834b8b20fdd11b704000fb0e3cf84;rport From: "Tosh" <sip:1002@192.168.1.3>;tag=370855464 To: <sip:1001@192.168.1.3> Call-ID: 001834B8-B20F-DD11-B702-000FB0E3CF84@192.168.1.5 CSeq: 98361155 INVITE Contact: <sip:1002@192.168.1.5:5060> Proxy-Authorization: (...) Content-Type: application/sdp Allow: INVITE, OPTIONS, ACK, BYE, CANCEL, INFO, NOTIFY, MESSAGE, UPDATE Max-Forwards: 70 Supported: 100rel, replaces User-Agent: SIPPER for PhonerLite Content-Length: 446
v=0 o=- 1232061542 0 IN IP4 192.168.1.5 s=SIPPER for PhonerLite c=IN IP4 192.168.1.5 t=0 0 m=audio 5062 RTP/AVP 0 8 2 3 97 110 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:2 G726-32/8000 a=rtpmap:3 GSM/8000 a=rtpmap:97 iLBC/8000 a=rtpmap:110 speex/8000 a=rtpmap:101 telephone-event/8000 a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline: 3dhne7Il7YqlVZAdnLVgdhngndKXXoNZm7v4/wwC a=encryption:optional a=fmtp:101 0-15 a=sendrecv ---------------------------------------------------- Freeswitch -> Receiver (192.168.1.4)
INVITE sip:1001@192.168.1.4:5060 SIP/2.0 Via: SIP/2.0/UDP 192.168.1.3;rport;branch=z9hG4bKeeFDH2FB5j0Dj Max-Forwards: 69 From: "Extension 1002" <sip:1002@192.168.1.3>;tag=ND0tXZH5Qe0aD To: <sip:1001@192.168.1.4:5060> Call-ID: fa523794-8be7-122b-2780-39a48cb53b8d CSeq: 98362890 INVITE Contact: <sip:mod_sofia@192.168.1.3:5060> User-Agent: FreeSWITCH-mod_sofia/1.0.rc1-7946 Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, MESSAGE, SUBSCRIBE, NOTIFY, REFER, UPDATE, REGISTER, INFO, PUBLISH Supported: 100rel, precondition, timer Min-SE: 120 Content-Type: application/sdp Content-Disposition: session Content-Length: 428 Remote-Party-ID: "Extension 1002" <sip: 1002@192.168.1.3>;screen=yes;privacy=off
v=0 o=FreeSWITCH 5985117983522540515 5861368874018127564 IN IP4 192.168.1.3 s=FreeSWITCH c=IN IP4 192.168.1.3 t=0 0 a=sendrecv m=audio 26382 RTP/SAVP 0 9 8 3 101 13 a=rtpmap:0 PCMU/8000 a=rtpmap:9 G722/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:3 GSM/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=rtpmap:13 CN/8000 a=ptime:20 a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:C/ XV148O1ZQ0V3LEpByfrFCRL7PGtFDJLcjTCwwV
------------------------------------------------ Receiver -> Freeswitch
SIP/2.0 200 OK Via: SIP/2.0/UDP 192.168.1.3;rport=5060;branch=z9hG4bKeeFDH2FB5j0Dj From: "Extension 1002" <sip:1002@192.168.1.3>;tag=ND0tXZH5Qe0aD To: <sip:1001@192.168.1.4:5060>;tag=00c93cd1b20fdd11886f00b0d0b8ce20 Call-ID: fa523794-8be7-122b-2780-39a48cb53b8d CSeq: 98362890 INVITE Contact: <sip:1001@192.168.1.4:5060> Content-Type: application/sdp Allow: INVITE, OPTIONS, ACK, BYE, CANCEL, INFO, NOTIFY, MESSAGE, UPDATE Supported: replaces, timer User-Agent: SIPPER for PhonerLite Content-Length: 258
v=0 o=- 3139884392 1 IN IP4 192.168.1.4 s=SIPPER for PhonerLite c=IN IP4 192.168.1.4 t=0 0 m=audio 5062 RTP/SAVP 0 8 3 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:3 GSM/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=sendrecv ------------------------------------------------ Freeswitch -> Initiator
SIP/2.0 200 OK Via: SIP/2.0/UDP 192.168.1.5 :5060;branch=z9hG4bK001834b8b20fdd11b704000fb0e3cf84;rport=5060 From: "Tosh" <sip:1002@192.168.1.3>;tag=370855464 To: <sip:1001@192.168.1.3>;tag=m461U401t59QH Call-ID: 001834B8-B20F-DD11-B702-000FB0E3CF84@192.168.1.5 CSeq: 98361155 INVITE Contact: <sip:mod_sofia@192.168.1.3:5060;transport=udp> User-Agent: FreeSWITCH-mod_sofia/1.0.rc1-7946 Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, MESSAGE, SUBSCRIBE, NOTIFY, REFER, UPDATE, REGISTER, INFO, PUBLISH Supported: 100rel, precondition, timer Min-SE: 120 Content-Type: application/sdp Content-Disposition: session Content-Length: 155
v=0 o=FreeSWITCH 5425860535457980718 3341838566411422164 IN IP4 192.168.1.3 s=FreeSWITCH c=IN IP4 192.168.1.3 t=0 0 a=sendrecv m=audio 0 RTP/AVP 19
=================================================
And voice traffic looks like this:
Reciever -> Freeswitch SRTP Freeswitch -> Initiator RTP
I hope this will explain everything. I have also a wireshark pcap file from this call (but i don't know where and how to send it). Thanks for help Chris ----- Original Message ----- From: Michael Jerris To: freeswitch-users@lists.freeswitch.org Sent: Wednesday, April 23, 2008 9:11 PM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch
Can you post a sip trace of this entire call, the 19 means we are rejecting that m= line, are there 2 m lines, AVP and SAVP to indicate optional secure?
Mike
On Apr 23, 2008, at 3:01 PM, Krzysiek wrote:
Hi I have 2 softphones PhonerLite (they support SRTP via SDES ) and the freeswitch (windows RC1 version) server and I wanted to make secure call between those two endpoints (SRTP). I spend whole day on testing this scenario and my conclusions are: - when the option: <action application="export" data="sip_secure_media=true"/> is uncommented, and both enpoints have enabled SRTP then: 1) Initiator of the session sends SIP Invite with a=crypto paramter and supported codecs 2) Freeswitch receives SIP Invite and sends SIP Invite to the receiver (also with the crypto) 3) Receiver receives the SIP Invite with the a=crypto parameter and he sends back supported codecs with 200 OK message (but without a=crypto parametr. Is that ok? I'm afraid not) 4) Freeswitch sends 200 OK message but witout any codecs: m=audio 0 RTP/AVP 19 and no a= parameters! 5) Final result is that the second leg of the session between Freeswitch and receiver has SRTP transport enbaled and the first leg (initiator- Freeswitch) doesn't hear anything - no codecs! However Freeswitch is sending RTP (not SRTP) pacekets to the initiator.
Could someone explain to me, what is going on, and why freeswitch doesn't forward codecs accepted by the receiver to the initiator? Is it a PhonerLite's bug or freeswitch's? Maybe someone has tested SRTP with the PhonerLite softphone or any other free softphone with srtp support?
When I uncommented: <param name="Inbound-no-media" value="true"> everything works fine. The parameter <action application="export" data="sip_secure_media=true"/> doesn't change anything then (but i cound miss something).
Thanks for help Chris _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brian West sip:brian@freeswitch.org
Oh I also must point out in this case SRTP is worthless for your client. You're not securing the signaling channel so why bother. This phone supports TLS and I recommend using it... but we need to get in touch with the author so they can fix this bug in their software. On Apr 23, 2008, at 3:21 PM, Krzysiek wrote:
PhonerLite
Brian West sip:brian@freeswitch.org
Thanks for help and explanation. Yes I know that I should use TLS. This was just a test. That's a pity, that this client is broken. I have just thought that I found nice and free sip client with srtp and tls support. I have found this client here: http://www.phonerlite.de/ , author Heiko Sommerfeldt. I hope, he corrects this bug.
The Polycom is the only phone that does this little tid bit correctly.
Do I understand this correctly that there aren't any softphone clients that support SRTP via SDES correctly ? I found few clients that support SRTP here http://en.wikipedia.org/wiki/Comparison_of_VoIP_software but I haven't tested them yet. Chris ----- Original Message ----- From: Brian West To: freeswitch-users@lists.freeswitch.org Sent: Wednesday, April 23, 2008 11:19 PM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch Oh I also must point out in this case SRTP is worthless for your client. You're not securing the signaling channel so why bother. This phone supports TLS and I recommend using it... but we need to get in touch with the author so they can fix this bug in their software. On Apr 23, 2008, at 3:21 PM, Krzysiek wrote: PhonerLite Brian West sip:brian@freeswitch.org ------------------------------------------------------------------------------ _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
If you have a contact at the company that makes the client maybe we can get them to fix it?
I e-mailed the author. I hope this could be fixed. Chris ----- Original Message ----- From: Krzysiek To: freeswitch-users@lists.freeswitch.org Sent: Thursday, April 24, 2008 12:31 AM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch Thanks for help and explanation. Yes I know that I should use TLS. This was just a test. That's a pity, that this client is broken. I have just thought that I found nice and free sip client with srtp and tls support. I have found this client here: http://www.phonerlite.de/ , author Heiko Sommerfeldt. I hope, he corrects this bug.
The Polycom is the only phone that does this little tid bit correctly.
Do I understand this correctly that there aren't any softphone clients that support SRTP via SDES correctly ? I found few clients that support SRTP here http://en.wikipedia.org/wiki/Comparison_of_VoIP_software but I haven't tested them yet. Chris ----- Original Message ----- From: Brian West To: freeswitch-users@lists.freeswitch.org Sent: Wednesday, April 23, 2008 11:19 PM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch Oh I also must point out in this case SRTP is worthless for your client. You're not securing the signaling channel so why bother. This phone supports TLS and I recommend using it... but we need to get in touch with the author so they can fix this bug in their software. On Apr 23, 2008, at 3:21 PM, Krzysiek wrote: PhonerLite Brian West sip:brian@freeswitch.org ---------------------------------------------------------------------------- _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ------------------------------------------------------------------------------ _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Well the snom on 7.1.33 will be correct... the Grandstream will work correctly also. /b On Apr 23, 2008, at 5:31 PM, Krzysiek wrote:
Thanks for help and explanation. Yes I know that I should use TLS. This was just a test. That's a pity, that this client is broken. I have just thought that I found nice and free sip client with srtp and tls support. I have found this client here: http://www.phonerlite.de/ , author Heiko Sommerfeldt. I hope, he corrects this bug.
The Polycom is the only phone that does this little tid bit correctly.
Do I understand this correctly that there aren't any softphone clients that support SRTP via SDES correctly ? I found few clients that support SRTP here http://en.wikipedia.org/wiki/Comparison_of_VoIP_software but I haven't tested them yet.
Brian West sip:brian@freeswitch.org
I have just received replay from the author of PhonerLite: "Hi Chris, I don't think it is a bug. I do it like others do too. For PhonerLite SRTP is optional (see: a=encryption:optional). So if Freeswitch doesn't support this, SRTP fails and RTP is unencrypted. This is exactly the the way like Snom and Grandstream offer SRTP in their SDP. I won't change this! Heiko INVITE sip:123@172.16.115.114 SIP/2.0 Via: SIP/2.0/UDP 172.16.115.114:5070;branch=z9hG4bK0014de144110dd118b3d00123fa91863;rport From: <sip:hs@172.16.115.114>;tag=3538012975 To: <sip:123@172.16.115.114> Call-ID: 0014DE14-4110-DD11-8B3C-00123FA91863@172.16.115.114 CSeq: 1 INVITE Contact: <sip:hs@172.16.115.114:5070> Content-Type: application/sdp Allow: INVITE, OPTIONS, ACK, BYE, CANCEL, INFO, NOTIFY, MESSAGE, UPDATE Max-Forwards: 70 Supported: 100rel, replaces User-Agent: SIPPER for PhonerLite Content-Length: 506 v=0 o=- 2350732611 0 IN IP4 172.16.115.114 s=SIPPER for PhonerLite c=IN IP4 172.16.115.114 t=0 0 m=audio 5072 RTP/AVP 0 8 2 3 97 110 111 9 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:2 G726-32/8000 a=rtpmap:3 GSM/8000 a=rtpmap:97 iLBC/8000 a=rtpmap:110 speex/8000 a=rtpmap:111 speex/16000 a=rtpmap:9 G722/8000 a=rtpmap:101 telephone-event/8000 a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:PYoCXAWH4BjD/tmuK+Ww5/pIa9MIBT424Judwmty a=encryption:optional a=fmtp:101 0-15 a=sendrecv " :( Chris ----- Original Message ----- From: Brian West To: freeswitch-users@lists.freeswitch.org Sent: Thursday, April 24, 2008 1:17 AM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch Well the snom on 7.1.33 will be correct... the Grandstream will work correctly also. /b On Apr 23, 2008, at 5:31 PM, Krzysiek wrote: Thanks for help and explanation. Yes I know that I should use TLS. This was just a test. That's a pity, that this client is broken. I have just thought that I found nice and free sip client with srtp and tls support. I have found this client here: http://www.phonerlite.de/ , author Heiko Sommerfeldt. I hope, he corrects this bug. >The Polycom is the only phone that does this little tid bit correctly. Do I understand this correctly that there aren't any softphone clients that support SRTP via SDES correctly ? I found few clients that support SRTP here http://en.wikipedia.org/wiki/Comparison_of_VoIP_software but I haven't tested them yet. Brian West sip:brian@freeswitch.org ------------------------------------------------------------------------------ _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Chris, The a=encryption:optional tag is a Microsoft extension held over (Snom has removed it in recent beta builds I have). We do not support it and will not. Grandstream uses RTP/SAVP, Snom will be doing RTP/ SAVP in 7.1.33 (in beta), Polycom does the dual m= line for RTP/SAVP and RTP/AVP. Offering crypto in an RTP/AVP is wrong please refer to RFC3711 where it clearly states "The RTP specification establishes a registry of profile names for use by higher-level control protocols, such as the Session Description Protocol (SDP), to refer to transport methods. This profile registers the name "RTP/SAVP"." If he wishes to see the most recent Snom beta where they are now doing it correctly please have him contact me. /b PS RFC3711 section 12 On Apr 24, 2008, at 4:35 AM, Krzysiek wrote:
I have just received replay from the author of PhonerLite:
"Hi Chris, I don't think it is a bug. I do it like others do too. For PhonerLite SRTP is optional (see: a=encryption:optional). So if Freeswitch doesn't support this, SRTP fails and RTP is unencrypted. This is exactly the the way like Snom and Grandstream offer SRTP in their SDP.
I won't change this!
Heiko
INVITE sip:123@172.16.115.114 SIP/2.0 Via: SIP/2.0/UDP 172.16.115.114 :5070;branch=z9hG4bK0014de144110dd118b3d00123fa91863;rport From: <sip:hs@172.16.115.114>;tag=3538012975 To: <sip:123@172.16.115.114> Call-ID: 0014DE14-4110-DD11-8B3C-00123FA91863@172.16.115.114 CSeq: 1 INVITE Contact: <sip:hs@172.16.115.114:5070> Content-Type: application/sdp Allow: INVITE, OPTIONS, ACK, BYE, CANCEL, INFO, NOTIFY, MESSAGE, UPDATE Max-Forwards: 70 Supported: 100rel, replaces User-Agent: SIPPER for PhonerLite Content-Length: 506
v=0 o=- 2350732611 0 IN IP4 172.16.115.114 s=SIPPER for PhonerLite c=IN IP4 172.16.115.114 t=0 0 m=audio 5072 RTP/AVP 0 8 2 3 97 110 111 9 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:2 G726-32/8000 a=rtpmap:3 GSM/8000 a=rtpmap:97 iLBC/8000 a=rtpmap:110 speex/8000 a=rtpmap:111 speex/16000 a=rtpmap:9 G722/8000 a=rtpmap:101 telephone-event/8000 a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:PYoCXAWH4BjD/tmuK+Ww5/ pIa9MIBT424Judwmty a=encryption:optional a=fmtp:101 0-15 a=sendrecv "
:( Chris ----- Original Message ----- From: Brian West To: freeswitch-users@lists.freeswitch.org Sent: Thursday, April 24, 2008 1:17 AM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch
Well the snom on 7.1.33 will be correct... the Grandstream will work correctly also.
/b
On Apr 23, 2008, at 5:31 PM, Krzysiek wrote:
Thanks for help and explanation. Yes I know that I should use TLS. This was just a test. That's a pity, that this client is broken. I have just thought that I found nice and free sip client with srtp and tls support. I have found this client here: http://www.phonerlite.de/ , author Heiko Sommerfeldt. I hope, he corrects this bug.
The Polycom is the only phone that does this little tid bit correctly.
Do I understand this correctly that there aren't any softphone clients that support SRTP via SDES correctly ? I found few clients that support SRTP here http://en.wikipedia.org/wiki/Comparison_of_VoIP_software but I haven't tested them yet.
Brian West sip:brian@freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brian West sip:brian@freeswitch.org
Chris, Heiko and I have had a few exchanges in email... He's a very nice guy very preceptive to the changes required to support this properly. He said he'll be trying out the two m-line method soon. /b On Apr 24, 2008, at 4:35 AM, Krzysiek wrote:
I have just received replay from the author of PhonerLite:
"Hi Chris, I don't think it is a bug. I do it like others do too. For PhonerLite SRTP is optional (see: a=encryption:optional). So if Freeswitch doesn't support this, SRTP fails and RTP is unencrypted. This is exactly the the way like Snom and Grandstream offer SRTP in their SDP.
I won't change this!
Heiko
INVITE sip:123@172.16.115.114 SIP/2.0 Via: SIP/2.0/UDP 172.16.115.114 :5070;branch=z9hG4bK0014de144110dd118b3d00123fa91863;rport From: <sip:hs@172.16.115.114>;tag=3538012975 To: <sip:123@172.16.115.114> Call-ID: 0014DE14-4110-DD11-8B3C-00123FA91863@172.16.115.114 CSeq: 1 INVITE Contact: <sip:hs@172.16.115.114:5070> Content-Type: application/sdp Allow: INVITE, OPTIONS, ACK, BYE, CANCEL, INFO, NOTIFY, MESSAGE, UPDATE Max-Forwards: 70 Supported: 100rel, replaces User-Agent: SIPPER for PhonerLite Content-Length: 506
v=0 o=- 2350732611 0 IN IP4 172.16.115.114 s=SIPPER for PhonerLite c=IN IP4 172.16.115.114 t=0 0 m=audio 5072 RTP/AVP 0 8 2 3 97 110 111 9 101 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:2 G726-32/8000 a=rtpmap:3 GSM/8000 a=rtpmap:97 iLBC/8000 a=rtpmap:110 speex/8000 a=rtpmap:111 speex/16000 a=rtpmap:9 G722/8000 a=rtpmap:101 telephone-event/8000 a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:PYoCXAWH4BjD/tmuK+Ww5/ pIa9MIBT424Judwmty a=encryption:optional a=fmtp:101 0-15 a=sendrecv "
:( Chris ----- Original Message ----- From: Brian West To: freeswitch-users@lists.freeswitch.org Sent: Thursday, April 24, 2008 1:17 AM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch
Well the snom on 7.1.33 will be correct... the Grandstream will work correctly also.
/b
On Apr 23, 2008, at 5:31 PM, Krzysiek wrote:
Thanks for help and explanation. Yes I know that I should use TLS. This was just a test. That's a pity, that this client is broken. I have just thought that I found nice and free sip client with srtp and tls support. I have found this client here: http://www.phonerlite.de/ , author Heiko Sommerfeldt. I hope, he corrects this bug.
The Polycom is the only phone that does this little tid bit correctly.
Do I understand this correctly that there aren't any softphone clients that support SRTP via SDES correctly ? I found few clients that support SRTP here http://en.wikipedia.org/wiki/Comparison_of_VoIP_software but I haven't tested them yet.
Brian West sip:brian@freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brian West sip:brian@freeswitch.org
The a=encryption:optional tag is a Microsoft extension held over(Snom has removed it in recent beta builds I have). We do not support it and will not. Grandstream uses RTP/SAVP, Snom will be doing RTP/SAVP in 7.1.33 (in beta), Polycom does the dual m= line for RTP/SAVP and RTP/AVP. Offering crypto in an RTP/AVP is wrong please refer to RFC3711 where it clearly states "The RTP specification establishes a registry of profile names for use by higher-level control protocols, such as the Session Description Protocol (SDP), to refer to transport methods. This profile registers the name "RTP/SAVP"."
I understand. It is clear for me.
Chris,Heiko and I have had a few exchanges in email... He's a verynice guy very preceptive to the changes required to support this properly. He said he'll be trying out the two m-linemethod soon.
Great news :) Chris
What else is great is his phone does G722 wideband. w00t! /b On Apr 24, 2008, at 10:22 AM, Krzysiek wrote:
The a=encryption:optional tag is a Microsoft extension held over(Snom has removed it in recent beta builds I have). We do not support it and will not. Grandstream uses RTP/SAVP, Snom will be doing RTP/SAVP in 7.1.33 (in beta), Polycom does the dual m= line for RTP/SAVP and RTP/AVP. Offering crypto in an RTP/AVP is wrong please refer to RFC3711 where it clearly states "The RTP specification establishes a registry of profile names for use by higher-level control protocols, such as the Session Description Protocol (SDP), to refer to transport methods. This profile registers the name "RTP/SAVP"."
I understand. It is clear for me.
Chris,Heiko and I have had a few exchanges in email... He's a verynice guy very preceptive to the changes required to support this properly. He said he'll be trying out the two m-linemethod soon.
Great news :)
Chris _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brian West sip:brian@freeswitch.org
Brian West wrote:
What else is great is his phone does G722 wideband. w00t!
btw, what kind of G.722 wideband codec do you support? I see that you are using G.722 implementation from the "voipcodecs" library, and that you are using different samplerates, one signalled in SDP (8000 Hz) and 16000Hz as the actual DSP samplerate. Is this correct? From RFC 3551: 4.5.2 G722 G722 is specified in ITU-T Recommendation G.722, "7 kHz audio-coding within 64 kbit/s". The G.722 encoder produces a stream of octets, each of which SHALL be octet-aligned in an RTP packet. The first bit transmitted in the G.722 octet, which is the most significant bit of the higher sub-band sample, SHALL correspond to the most significant bit of the octet in the RTP packet. Even though the actual sampling rate for G.722 audio is 16,000 Hz, the RTP clock rate for the G722 payload format is 8,000 Hz because that value was erroneously assigned in RFC 1890 and must remain unchanged for backward compatibility. The octet rate or sample-pair rate is 8,000 Hz. ... are you planning to add G.722.1 support at some point? I guess there are no free implementations of this codec, yet.. Thanx /alfred
Hello, have you heard of Minisip? It is a free softphone which concentrates on security. It is developed by the Royal Institute of Technology (KTH, Stockholm, Sweden). I have tested to place encrypted calls with the commercial versions of X-Lite (called eyeBeam) and Zoiper (ZoiperBiz). While there were problems with eyeBeam I managed to place encrypted calls (signalling AND media) with ZoiperBiz via FreeSWITCH. Meanwhile there's an update available for eyeBeam which I have not tested. Maybe it works now, too. .
Do I understand this correctly that there aren't any softphone clients that support SRTP via SDES correctly ? I found few clients that support SRTP here <http://en.wikipedia.org/wiki/Comparison_of_VoIP_software> http://en.wikipedia.org/wiki/Comparison_of_VoIP_software but I haven't tested them yet.
-- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
I may be wrong but as far as I know Minisip supports SRTP via MIKEY not SDES (and Freeswitch doesn't support MIKEY). And what about NadizPhone or Linux KPhone, PJSIP. Have sameone tested them with Freeswitch? Chris ----- Original Message ----- From: Alois Komenda To: freeswitch-users@lists.freeswitch.org Sent: Thursday, April 24, 2008 8:49 AM Subject: Re: [Freeswitch-users] SRTP in PhonerLite and Freeswitch Hello, have you heard of Minisip? It is a free softphone which concentrates on security. It is developed by the Royal Institute of Technology (KTH, Stockholm, Sweden). I have tested to place encrypted calls with the commercial versions of X-Lite (called eyeBeam) and Zoiper (ZoiperBiz). While there were problems with eyeBeam I managed to place encrypted calls (signalling AND media) with ZoiperBiz via FreeSWITCH. Meanwhile there's an update available for eyeBeam which I have not tested. Maybe it works now, too. .
Do I understand this correctly that there aren't any softphone clients that support SRTP via SDES correctly ? I found few clients that support SRTP here http://en.wikipedia.org/wiki/Comparison_of_VoIP_software but I haven't tested them yet. -- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
------------------------------------------------------------------------------ _______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (5)
-
Alfred E. Heggestad
-
Alois Komenda
-
Brian West
-
Krzysiek
-
Michael Jerris