Re: [Freeswitch-users] problems with freeswitch + zrtp in proxy-media mode
We were never able to get Trusted MITM working, but ZRTP can work in proxy-media mode as long as your client sends the zrtp-hash attribute in its SDP. When Freeswitch sees the zrtp-hash attribute it enables logic to pass the zrtp packets through unmolested (using the same SSRC for each call leg). As Mehroz noted in his original question, Linphone does not currently support zrtp-hash so this can't work. However, Mehroz, if you look in the Feb 2013 archives of the linphone-developers mailing list you can find a patch that adds zrtp-hash support to Linphone. It was recently rejected because it causes side-effects when video is enabled, but you can test it out and see if it fixes the your problem. -Eli On Apr 9, 2013, at 12:01 PM, freeswitch-users-request@lists.freeswitch.org wrote:
From: Steven Ayre <steveayre@gmail.com> Subject: Re: [Freeswitch-users] problems with freeswitch + zrtp in proxy-media mode Date: April 9, 2013 12:00:21 PM EDT To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Reply-To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org>
There is a way to do Trusted MITM I believe there is a setting for that
<action application="set" data="zrtp_enrollment=true"/>
On 9 April 2013 16:11, Ken Rice <krice@freeswitch.org> wrote: Also, keep in mind that FS in a mode other then proxy or bypass media, when you have a ZRTP call is kind of pointless, that leads to a vector for a man in the middle attack which is also the reason the SASs don't match is you have 2 different ZRTP legs with FS in the middle decrypting and re-encrypting the conversation...
There is a way to do Trusted MITM I believe there is a setting for that
On 4/9/13 4:57 AM, "mehroz" <mehroz.ashraf85@gmail.com> wrote:
Any luck with this issue?
I am having the same configurations, FS acting as normal mode i.e bypass and proxy on default(commented)
Clients are Linphone, and SAS does not match......
Over jitsi ... SAS are identical ONLY IF
IF linphone does not support "zrtp-hash" attribute in SIP/SDP, what is the next possible solution?
Thanks Everyone for your feedback! 1) ZRTP SAS exchange works flawlessly using with jitsi when proxy is turned ON (with and without FS as MITM) 2) Works with bypass media BUT only on the same network at client side (Very Strange, why is that so?) Regarding linphone patch, yes it was tested today (thanks Eli) but Video call is troublesome. Can you give me any idea about the reason of this issue, we might fight with it! and the final words........ What could be done to make everything working? FS development or changing SIP stack to PJSIP/CSIPSIMPLE? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... Sent from the freeswitch-users mailing list archive at Nabble.com.
I am testing the csipsimple client with zrtp and FS and am having sporadic success. I don't have enough time to run the full config tests. On Apr 10, 2013 2:18 PM, "mehroz" <mehroz.ashraf85@gmail.com> wrote:
Thanks Everyone for your feedback!
1) ZRTP SAS exchange works flawlessly using with jitsi when proxy is turned ON (with and without FS as MITM) 2) Works with bypass media BUT only on the same network at client side (Very Strange, why is that so?)
Regarding linphone patch, yes it was tested today (thanks Eli) but Video call is troublesome. Can you give me any idea about the reason of this issue, we might fight with it!
and the final words........ What could be done to make everything working? FS development or changing SIP stack to PJSIP/CSIPSIMPLE?
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
mehroz, You wrote: "1) ZRTP SAS exchange works flawlessly using with jitsi when proxy is turned ON (with and without FS as MITM) " Were you able to get identical SAS with jitsi over PROXY_MEDIA mode? In my case jitsi complains with 'ZRTP internal checksum mismatch' whenever I'm trying to set PROXY_MODE and bridge CSimpleSip with Jitsi - No ZRTP! It works on Bypass_mode on same net (as u mentioned). Regards Assaf -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... Sent from the freeswitch-users mailing list archive at Nabble.com.
Yes exactly, i got identical SAS with proxy media . Make sure you have stable release of FS. I am currently using 1.3.17 and there were some issues with ZRTP support in previous releases , which were resolved in 1.3.17 . Also check the logs of FS and see the initial INVITE message. does it offer ZRTP hash? Make sure you have ZRTP enabled on jitsi as well. On Tue, Jun 25, 2013 at 6:55 PM, adahary <adahary@gmail.com> wrote:
mehroz,
You wrote: "1) ZRTP SAS exchange works flawlessly using with jitsi when proxy is turned ON (with and without FS as MITM) "
Were you able to get identical SAS with jitsi over PROXY_MEDIA mode?
In my case jitsi complains with 'ZRTP internal checksum mismatch' whenever I'm trying to set PROXY_MODE and bridge CSimpleSip with Jitsi - No ZRTP! It works on Bypass_mode on same net (as u mentioned).
Regards
Assaf
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I'm currently using FreeSWITCH Version 1.5.1b+git~20130429T141947Z~fe3bbb3431 which, I suppose, should include all bugs fix that in your stable 1.3.17. I do see the zrtp hash in the INVITE and Jitsi is setup for ZRTP (it works on bypass-mode). Just on proxy-mode, when calling from/to client with ZRTP enabled, the Jitsi (on my pc) start displaying the 'ZRTP internal mismatch...' message at the begining (when ZRTP is being negotiated) and after few sec it disapears and call is ON without ZRTP. Have you ever experienced this Jitsi 'ZRTP internal mismatch...' error message? thanks Assaf -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... Sent from the freeswitch-users mailing list archive at Nabble.com.
Keep in mind that there are big media changes between 1.3 and 1.5 code branches... You should try the latest 1.2.x (or checkout from the v1.2.stable branch on git) and try there that code is newer then 1.3.17... If you are still having issues with the master branch, open a jira with all the proper traces etc attached as a .txt file K On 6/26/13 2:20 AM, "adahary" <adahary@gmail.com> wrote:
I'm currently using FreeSWITCH Version 1.5.1b+git~20130429T141947Z~fe3bbb3431 which, I suppose, should include all bugs fix that in your stable 1.3.17.
I do see the zrtp hash in the INVITE and Jitsi is setup for ZRTP (it works on bypass-mode).
Just on proxy-mode, when calling from/to client with ZRTP enabled, the Jitsi (on my pc) start displaying the 'ZRTP internal mismatch...' message at the begining (when ZRTP is being negotiated) and after few sec it disapears and call is ON without ZRTP.
Have you ever experienced this Jitsi 'ZRTP internal mismatch...' error message?
thanks
Assaf
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... -proxy-media-mode-tp7586936p7592237.html Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
Here are my findings for Jitsi & FS ZRTP PROXY-MEDIA: FS tested versions: 1.2.10, 1.3.17, 1.5 (tested on two different linux machines). Jitsi 2.2 on win7 (two different PCs). VARS.xml: <X-PRE-PROCESS cmd="set" data="zrtp_secure_media=true"/> Internal.xml (profile): Dialplan: <action application="set" data="zrtp_secure_media=true" /> 1. When Jitsi sends INVITE there is NO a=zrtp-hash in the SDP (I do not think it is a problem becuase it still works fine on none PROXY-MEDIA modes). 2. Jitsi send ZRTP HELLO with NO CRC error. 3. FS with PROXY-MEDIA=true (and inbound-zrtp-passthru=true) always sends ZRTP HELLO with CRC error (can be seen on wireshark capture). 4. Jitsi (and also Linphone) complains with 'ZRTP internal mismatch - chekcsum) and breaks the ZRTP session. CSimpleSip/Android ignores it and keep up with the ZRTP session. I've opened a jiira case and uploaded a detailed log file and a wireshark capture. Hopfully this issue will be resolved soon as it very essential to have a good working ZRTP client for desktops like Jitsi. Assaf -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/problems-with-freeswitch-zrtp-... Sent from the freeswitch-users mailing list archive at Nabble.com.
participants (6)
-
adahary
-
Daniel Ivanov
-
Eli Burke
-
Ken Rice
-
mehroz
-
Mehroz Ashraf