VoIP Mailing List Archives

[Prometheus001 at gmx.net]

Did you add
<action application="export" data="sip_secure_media=true"/>
into youy dialplan before bridging that call. How is your internal.conf,
is TLS enabled there?

Best regards
Peter

matrim schrieb:

[brian at freeswitch.org]

sip_secure_media only activates SRTP.

/b

On Dec 1, 2008, at 9:47 AM, Peter P GMX wrote:

[brian at freeswitch.org]

Please tell that to everyone out there in the REAL world. It was my
understanding that sips: was the one that went away in favor of
transport= which is what everyone uses.

/b

On Dec 1, 2008, at 7:09 AM, matrim wrote:

[ttroy50 at gmail.com]

I don't have that set however I'm not trying to use SRTP yet. At the moment I'm just trying to use Secure SIP.

That section of my dial plan is

<condition field="${sip_has_crypto}" expression="^(AES_CM_128_HMAC_SHA1_32|AES_CM_128_HMAC_SHA1_80)$" break="never">
<action application="set" data="sip_secure_media=true"/>
<!-- Offer SRTP on outbound legs if we have it on inbound. -->
<!-- <action application="export" data="sip_secure_media=true"/> -->
</condition>

The TLS part of my internal.xml is now

<!-- TLS: disabled by default, set to "true" to enable -->
<param name="tls" value="true"/>
<!-- additional bind parameters for TLS -->
<param name="tls-bind-params" value=""/>
<!-- Port to listen on for TLS requests. (5061 will be used if unspecified) -->
<param name="tls-sip-port" value="$${internal_tls_port}"/>
<!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) -->
<param name="tls-cert-dir" value="$${internal_ssl_dir}"/>
<!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 -->
<param name="tls-version" value="$${sip_tls_version}"/>


I also tried with

<!-- additional bind parameters for TLS -->
<param name="tls-bind-params" value="transport=tls"/>

On Mon, Dec 1, 2008 at 3:47 PM, Peter P GMX <Prometheus001@gmx.net (Prometheus001@gmx.net)> wrote:

[ttroy50 at gmail.com]

I'm not sure about current implementations that servers are using. I'm used to using sip over UDP and TCP but this is my first time testing SIP over TLS. So I'm just going by what's in the specification and what's implemented on the devices I'm trying to test against, which are Nokia S60 devices (e.g. Nokia N95, E66).

Out of interest do you have any links to anywhere this is discussed in terms of general sip implementations?

On Mon, Dec 1, 2008 at 4:00 PM, Brian West <brian@freeswitch.org (brian@freeswitch.org)> wrote:

[kkielhofner at star2st...]

On 12/1/08, Thomas Troy <ttroy50@gmail.com> wrote:
..snip..

[anthony.minessale at g...]

Naturally, either way is stupid.

The whole idea of putting the transport in a uri param is equally stupid to using 2 different protocol names but since SIP is the descendant of http it they decided to stick with the stupidity of http/https and have sip/sips which is almost as if it was designed to break all software trying to keep up with url syntax.

If they are going to insist on using text params you'd think something like transport=foo;security=tls would be even *more* flexable in case alternate methods to encrypt crop up.

This is, of course, the first step into a lengthy 12 hour discussion on how stupid SIP and url/text based
protocols are.

I dare someone to crank up the pcap on a box doing SIP presence for 20 phones and "read"
the 1200 byte messages with all kinds of hyeroglyphic url syntax and embedded xml payloads and write
up a paper on how much "sense" it makes to have it be "readable".

PS

supposedly sofia can support sctp,
someone should try it.



On Mon, Dec 1, 2008 at 9:43 PM, Kristian Kielhofner <kkielhofner@star2star.com (kkielhofner@star2star.com)> wrote:

[kkielhofner at star2st...]

On 12/2/08, Anthony Minessale <anthony.minessale@gmail.com> wrote:

[anthony.minessale at g...]

We'll schedule a round table with the topic

SIP OMFG STFU

At the next ClueCon aug 4th-6th 2009 to stir things up a bit =D


On Tue, Dec 2, 2008 at 1:03 PM, Kristian Kielhofner <kkielhofner@star2star.com (kkielhofner@star2star.com)> wrote:

[msc at freeswitch.org]

Bring on SNAP, baby!

On Tue, Dec 2, 2008 at 11:03 AM, Kristian Kielhofner <kkielhofner@star2star.com (kkielhofner@star2star.com)> wrote:

[kkielhofner at star2st...]

On 12/2/08, Anthony Minessale <anthony.minessale@gmail.com> wrote: