Re: [Freeswitch-users] problems with freeswitch + zrtp in proxy-media mode
Yes, inbound-zrtp-passthru is true. I think it gets set automatically when you turn on ZRTP. The config I'm testing with is a stock 'enable_zrtp=yes' build of HEAD circa last week, with proxy-media=true added to Local_Extension in the default dial plan. -Eli On Feb 1, 2013, at 6:00 AM, royj@yandex.ru wrote:
Is there <param name="inbound-zrtp-passthru" value="true"/> in profile
On Thu, 31 Jan 2013 17:43:34 -0500 Eli Burke <eburke@edge-net.net> wrote:
I'm trying to use Freeswitch with an open source voip client called Linphone, but cannot manage to establish functioning ZRTP sessions. The problem *seems* to be related to the RTP stream's SSRC. I'm trying to conclusively determine if the problem lies with Linphone, Freeswitch, or one of the underlying zrtp implementations (libzrtp and zrtpcpp).
Here's what I've determined so far: 1) ZRTP support is compiled and functioning. I can establish ZRTP sessions between two iPhones running Groundwire. 2) linphone + ZRTP works correctly if I make a one legged call to a Freeswitch echo extension 3) linphone + ZRTP works correctly if I turn on bypass-media 4) linphone gets a CRC error when trying to verify the ZRTP packet on any two-legged call 5) disabling the CRC check results in a successful ZRTP session, but the audio is extremely garbled
Is Freeswitch modifying the ZRTP packets when running in proxy mode? If so, how is it that some clients are able to handle this situation?
Is there a reason you're using proxy media mode? Does it work in normal media handling mode? (ie not proxy and not bypass) -Steve On 1 February 2013 14:15, Eli Burke <eburke@edge-net.net> wrote:
Yes, inbound-zrtp-passthru is true. I think it gets set automatically when you turn on ZRTP.
The config I'm testing with is a stock 'enable_zrtp=yes' build of HEAD circa last week, with proxy-media=true added to Local_Extension in the default dial plan.
-Eli
On Feb 1, 2013, at 6:00 AM, royj@yandex.ru wrote:
Is there <param name="inbound-zrtp-passthru" value="true"/> in profile
On Thu, 31 Jan 2013 17:43:34 -0500 Eli Burke <eburke@edge-net.net> wrote:
I'm trying to use Freeswitch with an open source voip client called Linphone, but cannot manage to establish functioning ZRTP sessions. The problem *seems* to be related to the RTP stream's SSRC. I'm trying to conclusively determine if the problem lies with Linphone, Freeswitch, or one of the underlying zrtp implementations (libzrtp and zrtpcpp).
Here's what I've determined so far: 1) ZRTP support is compiled and functioning. I can establish ZRTP sessions between two iPhones running Groundwire. 2) linphone + ZRTP works correctly if I make a one legged call to a Freeswitch echo extension 3) linphone + ZRTP works correctly if I turn on bypass-media 4) linphone gets a CRC error when trying to verify the ZRTP packet on any two-legged call 5) disabling the CRC check results in a successful ZRTP session, but the audio is extremely garbled
Is Freeswitch modifying the ZRTP packets when running in proxy mode? If so, how is it that some clients are able to handle this situation?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi, I have exactly the same problem as Eli described below. Eli, I'm glad too that finally not I'm the only guy in this situation. In my case the proxy media mode is required for end-to-end security but bypass-media is not an option because the endpoints are in different subnets. The normal media handling mode (not proxy and not bypass) works well however in this case there are different SAS on the two endpoints. Probably it's normal because FS opens a new session and the first SAS is not transferred to the other side automatically. But what I'm more interested in what "inbound-zrtp-passthru" is actually doing? I couldn't find proper docs only the codebase at http://fisheye.freeswitch.org/changelog/freeswitch.git?cs=23f8967c32e63050af... I can see two entries in my logs relating to this: 2013-02-02 18:26:14.925953 [DEBUG] mod_sofia.c:5031 [zrtp_passthru] Setting a-leg inherit_codec=true 2013-02-02 18:26:14.925953 [DEBUG] mod_sofia.c:5034 [zrtp_passthru] Setting b-leg absolute_codec_string='PCMU@8000h@20i@64000b' Meanwhile someone on the linphone dev mailing list said that linphone does not support "zrtp-hash" attribute in SIP/SDP. May it has any effect in FS media proxy with zrtp? -Peter On Fri, Feb 1, 2013 at 9:33 PM, Steven Ayre <steveayre@gmail.com> wrote:
Is there a reason you're using proxy media mode?
Does it work in normal media handling mode? (ie not proxy and not bypass)
-Steve
On 1 February 2013 14:15, Eli Burke <eburke@edge-net.net> wrote:
Yes, inbound-zrtp-passthru is true. I think it gets set automatically when you turn on ZRTP.
The config I'm testing with is a stock 'enable_zrtp=yes' build of HEAD circa last week, with proxy-media=true added to Local_Extension in the default dial plan.
-Eli
On Feb 1, 2013, at 6:00 AM, royj@yandex.ru wrote:
Is there <param name="inbound-zrtp-passthru" value="true"/> in profile
On Thu, 31 Jan 2013 17:43:34 -0500 Eli Burke <eburke@edge-net.net> wrote:
I'm trying to use Freeswitch with an open source voip client called Linphone, but cannot manage to establish functioning ZRTP sessions. The problem *seems* to be related to the RTP stream's SSRC. I'm trying to conclusively determine if the problem lies with Linphone, Freeswitch, or one of the underlying zrtp implementations (libzrtp and zrtpcpp).
Here's what I've determined so far: 1) ZRTP support is compiled and functioning. I can establish ZRTP sessions between two iPhones running Groundwire. 2) linphone + ZRTP works correctly if I make a one legged call to a Freeswitch echo extension 3) linphone + ZRTP works correctly if I turn on bypass-media 4) linphone gets a CRC error when trying to verify the ZRTP packet on any two-legged call 5) disabling the CRC check results in a successful ZRTP session, but the audio is extremely garbled
Is Freeswitch modifying the ZRTP packets when running in proxy mode? If so, how is it that some clients are able to handle this situation?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Any luck with this issue? I am having the same configurations, FS acting as normal mode i.e bypass and proxy on default(commented) Clients are Linphone, and SAS does not match...... Over jitsi ... SAS are identical ONLY IF IF linphone does not support "zrtp-hash" attribute in SIP/SDP, what is the next possible solution? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... Sent from the freeswitch-users mailing list archive at Nabble.com.
Also, keep in mind that FS in a mode other then proxy or bypass media, when you have a ZRTP call is kind of pointless, that leads to a vector for a man in the middle attack which is also the reason the SASs don't match is you have 2 different ZRTP legs with FS in the middle decrypting and re-encrypting the conversation... There is a way to do Trusted MITM I believe there is a setting for that On 4/9/13 4:57 AM, "mehroz" <mehroz.ashraf85@gmail.com> wrote:
Any luck with this issue?
I am having the same configurations, FS acting as normal mode i.e bypass and proxy on default(commented)
Clients are Linphone, and SAS does not match......
Over jitsi ... SAS are identical ONLY IF
IF linphone does not support "zrtp-hash" attribute in SIP/SDP, what is the next possible solution?
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... -proxy-media-mode-tp7586936p7589541.html Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
There is a way to do Trusted MITM I believe there is a setting for that
<action application="set" data="zrtp_enrollment=true"/> On 9 April 2013 16:11, Ken Rice <krice@freeswitch.org> wrote:
Also, keep in mind that FS in a mode other then proxy or bypass media, when you have a ZRTP call is kind of pointless, that leads to a vector for a man in the middle attack which is also the reason the SASs don't match is you have 2 different ZRTP legs with FS in the middle decrypting and re-encrypting the conversation...
There is a way to do Trusted MITM I believe there is a setting for that
On 4/9/13 4:57 AM, "mehroz" <mehroz.ashraf85@gmail.com> wrote:
Any luck with this issue?
I am having the same configurations, FS acting as normal mode i.e bypass and proxy on default(commented)
Clients are Linphone, and SAS does not match......
Over jitsi ... SAS are identical ONLY IF
IF linphone does not support "zrtp-hash" attribute in SIP/SDP, what is the next possible solution?
-- View this message in context:
http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-...
-proxy-media-mode-tp7586936p7589541.html Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (5)
-
Eli Burke
-
Ken Rice
-
Kosztolányi Péter
-
mehroz
-
Steven Ayre