14 Dec
2019
14 Dec
'19
3:19 a.m.
Hi,
I use Kamailio 5.3.1 with rtpengine to offer an siptrunk endpoint for my
customers.
I observe that someone of them use tls to encrypt signaling but forgotten
to encrypt rtp.
I want to reject this invites.
Are there any hints how to do this?
Thought about reading the sdp and search for a=crypto line and if not send
reply with (what code ever will be good for that).
Cheers
Karsten
14 Dec
14 Dec
5:34 a.m.
Well, you could simply use
if ( has_body("application/sdp") ) {
if ( !search_body("a=crypto") ) {
... reject here ...
}
}
though there's probably a better way...
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
On Sat, Dec 14, 2019 at 8:20 AM Karsten Horsmann <khorsmann(a)gmail.com>
wrote:
Hi,
I use Kamailio 5.3.1 with rtpengine to offer an siptrunk endpoint for my
customers.
I observe that someone of them use tls to encrypt signaling but forgotten
to encrypt rtp.
I want to reject this invites.
Are there any hints how to do this?
Thought about reading the sdp and search for a=crypto line and if not send
reply with (what code ever will be good for that).
Cheers
Karsten
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
6:11 a.m.
Hi David,
That's looks good. It's a bit to greedy cos I translate SRTP from internet
to RTP to inside.
Maybe an AND with
If proto==TLS would be an good idea.
Cheers.
Karsten
David Villasmil <david.villasmil.work(a)gmail.com> schrieb am Sa., 14. Dez.
2019, 11:35:
Well, you could simply use
if ( has_body("application/sdp") ) {
if ( !search_body("a=crypto") ) {
... reject here ...
}
}
though there's probably a better way...
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
On Sat, Dec 14, 2019 at 8:20 AM Karsten Horsmann <khorsmann(a)gmail.com>
wrote:
Hi,
I use Kamailio 5.3.1 with rtpengine to offer an siptrunk endpoint for my
customers.
I observe that someone of them use tls to encrypt signaling but forgotten
to encrypt rtp.
I want to reject this invites.
Are there any hints how to do this?
Thought about reading the sdp and search for a=crypto line and if not
send reply with (what code ever will be good for that).
Cheers
Karsten
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
8:53 a.m.
Sure, only if it's tls ;)
Regards,
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
On Sat, Dec 14, 2019 at 11:12 AM Karsten Horsmann <khorsmann(a)gmail.com>
wrote:
Hi David,
That's looks good. It's a bit to greedy cos I translate SRTP from internet
to RTP to inside.
Maybe an AND with
If proto==TLS would be an good idea.
Cheers.
Karsten
David Villasmil <david.villasmil.work(a)gmail.com> schrieb am Sa., 14. Dez.
2019, 11:35:
Well, you could simply use
if ( has_body("application/sdp") ) {
if ( !search_body("a=crypto") ) {
... reject here ...
}
}
though there's probably a better way...
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
On Sat, Dec 14, 2019 at 8:20 AM Karsten Horsmann <khorsmann(a)gmail.com>
wrote:
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
Hi,
I use Kamailio 5.3.1 with rtpengine to offer an siptrunk endpoint for my
customers.
I observe that someone of them use tls to encrypt signaling but
forgotten to encrypt rtp.
I want to reject this invites.
Are there any hints how to do this?
Thought about reading the sdp and search for a=crypto line and if not
send reply with (what code ever will be good for that).
Cheers
Karsten
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
16 Dec
16 Dec
6:56 a.m.
Hi David and List,
i end up with an route like this:
route[CHECK_CRYPTO] {
if ( has_body("application/sdp") && $proto =~ "tls" )
{
if ( !search_body("a=crypto") ) {
xlog("[CHECK_ACRYPTO] IP not sending crypto Src: [$si] to
IP:[$Ri]:[$Rp] \n");
append_to_reply("P-SBC-Error: SdpParsingFailure\r\n");
sl_send_reply("488", "Not Acceptable Here");
exit;
}
}
return;
}
that i call from my invite checking block.
Cheers
Karsten
Am Sa., 14. Dez. 2019 um 14:54 Uhr schrieb David Villasmil <
david.villasmil.work(a)gmail.com>gt;:
Sure, only if it's tls ;)
Regards,
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
On Sat, Dec 14, 2019 at 11:12 AM Karsten Horsmann <khorsmann(a)gmail.com>
wrote:
--
Mit freundlichen Grüßen
*Karsten Horsmann*
Hi David,
That's looks good. It's a bit to greedy cos I translate SRTP from
internet to RTP to inside.
Maybe an AND with
If proto==TLS would be an good idea.
Cheers.
Karsten
David Villasmil <david.villasmil.work(a)gmail.com> schrieb am Sa., 14.
Dez. 2019, 11:35:
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
Well, you could simply use
if ( has_body("application/sdp") ) {
if ( !search_body("a=crypto") ) {
... reject here ...
}
}
though there's probably a better way...
David Villasmil
email: david.villasmil.work(a)gmail.com
phone: +34669448337
On Sat, Dec 14, 2019 at 8:20 AM Karsten Horsmann <khorsmann(a)gmail.com>
wrote:
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
Hi,
I use Kamailio 5.3.1 with rtpengine to offer an siptrunk endpoint for
my customers.
I observe that someone of them use tls to encrypt signaling but
forgotten to encrypt rtp.
I want to reject this invites.
Are there any hints how to do this?
Thought about reading the sdp and search for a=crypto line and if not
send reply with (what code ever will be good for that).
Cheers
Karsten
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
1839
days inactive
1841
days old
4 comments
2 participants
participants (2)
-
David Villasmil -
Karsten Horsmann