Go easy... first post. ![:slight_smile: :slight_smile:]()
I'm looking to make calls via the Linphone app over the internet and need to verify if/how encrypted it is. I've been testing with TLS and SRTP with a letsencrypt cert, though calls either hang up or have one-way audio with TLS. Calling via UDP with SRTP enabled appears to work fine, though I'm concerned about the lack of tls.
Does this mean the headers are simply not encrypted but the payload is? What are the real-world risks with that?
Linphone lists the call as encrypted fwiw.
The infrastructure looks like:
iPhone > internet > FortiGate firewall (using SIP ALG) > DNAT to FreePBX VM > Internal SIP trunk to Mitel System.
Mitel then rings internally or out the PRI if necessary.
A snippet of the debug:
<--- SIP read from UDP:x.x.x.x:10038 --->
INVITE sip:11355 (at) pbx.example.com SIP/2.0
Via: SIP/2.0/UDP x.x.x.x:10038;rport;branch=z9hG4bK+234f5a05e4a47dfcc27e5876b56efe0f1+s676+1
From: ;tag=s676+1+41400001+5ee7f7b6
To: "11355"
Call-ID: ESLYjb3nw8-S
CSeq: 20 INVITE
Max-Forwards: 70
Supported: replaces, outbound
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO, UPDATE
Content-Type: application/sdp
Content-Length: 694
Contact: ;+sip.instance=""
User-Agent: Linphone_iPhone.6_iOS10.3.2/3.16.3 (belle-sip/1.6.1)
v=0
o=1901 1782 4007 IN IP4 x.x.x.x
s=Talk
c=IN IP4 x.x.x.x
b=AS:380
t=0 0
a=rtcp-xr:rcvr-rtt=all:10000 stat-summary=loss,dup,jitt,TTL voip-metrics
m=audio 10031 RTP/SAVP 0 8 9 18 101
a=fmtp:18 annexb=yes
a=rtpmap:101 telephone-event/8000
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:oYEUJUe+U2JygsOg4JT3k8ysyj4Sxffm84/gsodH
a=crypto:2 AES_CM_128_HMAC_SHA1_32 inline:8dU4z4Wk9Pl+LdhWAmU0BJiVRlIa4bbKdmY8jrAk
a=crypto:3 AES_256_CM_HMAC_SHA1_80 inline:ymNIvIUHt4vkLOEfNttpZQ/ef0gPt69Q2uQ+e8qn6UEL6mdgbjXlylo40rr1Ng==
a=crypto:4 AES_256_CM_HMAC_SHA1_32 inline:8My2B4d8P6pD7+CMBT/xZ3YhwH2IULHDMwNppr1P6lP3rGtAJm05V+WFVVvwWQ==
a=rtcp-fb:* trr-int 5000
a=rtcp-fb:* ccm tmmbr
<------------->
--- (13 headers 16 lines) ---
Sending to x.x.x.x:10038 (no NAT)
Sending to x.x.x.x:10038 (no NAT)
Using INVITE request as basis request - ESLYjb3nw8-S
Found peer '1901' for '1901' from x.x.x.x:10038
<--- Reliably Transmitting (no NAT) to x.x.x.x:10038 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP x.x.x.x:10038;branch=z9hG4bK+234f5a05e4a47dfcc27e5876b56efe0f1+s676+1;received=x.x.x.x;rport=10038
From: ;tag=s676+1+41400001+5ee7f7b6
To: "11355" ;tag=as1131dd4e
Call-ID: ESLYjb3nw8-S
CSeq: 20 INVITE
Server: FPBX-13.0.192.8(11.25.1)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="4dc244ac"
Content-Length: 0
<------------>
Scheduling destruction of SIP dialog 'ESLYjb3nw8-S' in 88448 ms (Method: INVITE)
<--- SIP read from UDP:x.x.x.x:10038 --->
ACK sip:11355 (at) pbx.example.com SIP/2.0
Via: SIP/2.0/UDP x.x.x.x:10038;rport;branch=z9hG4bK+234f5a05e4a47dfcc27e5876b56efe0f1+s676+1
From: ;tag=s676+1+41400001+5ee7f7b6
To: "11355" ;tag=as1131dd4e
Call-ID: ESLYjb3nw8-S
CSeq: 20 ACK
Max-Forwards: 70
Content-Length: 0
<------------->
--- (8 headers 0 lines) ---
<--- SIP read from UDP:x.x.x.x:10038 --->
INVITE sip:11355 (at) pbx.example.com SIP/2.0
Via: SIP/2.0/UDP x.x.x.x:10038;rport;branch=z9hG4bK+26425e614990def04ddef93c5ce0af8d1+s676+1
From: ;tag=s676+1+41400001+70a5dfdf
To: "11355"
Call-ID: ESLYjb3nw8-S
CSeq: 21 INVITE
Max-Forwards: 70
Supported: replaces, outbound
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO, UPDATE
Content-Type: application/sdp
Content-Length: 694
Contact: ;+sip.instance=""
User-Agent: Linphone_iPhone.6_iOS10.3.2/3.16.3 (belle-sip/1.6.1)
Authorization: Digest realm="asterisk", nonce="4dc244ac", algorithm=MD5, username="1901", uri="sip:11355 (at) pbx.example.com", response="abc809463b8e0bb858edc5fc862686d6"
v=0
o=1901 1782 4007 IN IP4 x.x.x.x
s=Talk
c=IN IP4 x.x.x.x
b=AS:380
t=0 0
a=rtcp-xr:rcvr-rtt=all:10000 stat-summary=loss,dup,jitt,TTL voip-metrics
m=audio 10034 RTP/SAVP 0 8 9 18 101
a=fmtp:18 annexb=yes
a=rtpmap:101 telephone-event/8000
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:oYEUJUe+U2JygsOg4JT3k8ysyj4Sxffm84/gsodH
a=crypto:2 AES_CM_128_HMAC_SHA1_32 inline:8dU4z4Wk9Pl+LdhWAmU0BJiVRlIa4bbKdmY8jrAk
a=crypto:3 AES_256_CM_HMAC_SHA1_80 inline:ymNIvIUHt4vkLOEfNttpZQ/ef0gPt69Q2uQ+e8qn6UEL6mdgbjXlylo40rr1Ng==
a=crypto:4 AES_256_CM_HMAC_SHA1_32 inline:8My2B4d8P6pD7+CMBT/xZ3YhwH2IULHDMwNppr1P6lP3rGtAJm05V+WFVVvwWQ==
a=rtcp-fb:* trr-int 5000
a=rtcp-fb:* ccm tmmbr
<------------->