libsrtp needs to be installed. You might have it in your distro, or you can get the source from sourceforge.net. However, when you have installed that library, I don’t think the implementation is currently complete.

configure reports ‘yes’ to those after installing libsrtp, so try again. we should fix autocrap so that if—enable-srtp is given, it should fail if libsrtp isn’t found

what is with this two years old work on srtp?: http://www.callweaver.org/changeset/1256

I seems ready to use, but i cant compile it, because i needs spandsp-0.3.0pre5 wich is not longer available.

hello, this is the first part of the cw modification for the ast_srtp6.patch (this one is for *1.2) from http://bugs.digium.com/view.php?id=5413

ups…, use this :)

Hello, this patch is ported from the ast_srtp6.patch. I does work 50%. The phone and callweaver does the key negotiate, and the srtp audio from the phone can be decrypted by CW. (For test i do Record(/tmp/test.wav)) But the srtp audio CW->Phone is not ok. On the phone you get white noise. There must be one silly detail i haved found yet.

Ok, it’s working now.

Thanks to Kristijan, his last patch is almost sane. But RTP is encrypted only from caller to callweaver; the called side RTP data is not encrypted.

Hello Andrey, to make outgoing SIP calls with srtp add Set(_SIP_SRTP_SDES=1) to your dialplan before Dial.

Please use the srtp_tls branch to test srtp: http://www.callweaver.org/browse/callweaver/branches/srtp_tls/

Branch does not compile correctly on my machine: Ubuntu Hardy Heron 8.04 LTS 32-bits. svn co http://svn.callweaver.org/callweaver/branches/srtp_tls/ callweaver-srtp

Here is the detailed error:

make³: Entering directory `/usr/src/callweaver-srtp/corelib’ /bin/bash ../libtool—tag=CC —mode=compile gcc -DHAVE_CONFIG_H -include ../include/confdefs.h -I. -I../include -fomit-frame-pointer -D_REENTRANT -Wall -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -DTEMP_STORE=2 -DTHREADSAFE=1 -DSQLITE_OMIT_CURSOR -DNO_TCL -I../sqlite3-embedded -I../sqlite3-embedded -DOS_UNIX -I.. -I../include -g -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/openssl -DHAVE_SSL -g -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -MT libcallweaver_la-callerid.lo -MD -MP -MF .deps/libcallweaver_la-callerid.Tpo -c -o libcallweaver_la-callerid.lo `test -f ‘callerid.c’ || echo ’./’`callerid.c gcc -DHAVE_CONFIG_H -include ../include/confdefs.h -I. -I../include -fomit-frame-pointer -D_REENTRANT -Wall -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -DTEMP_STORE=2 -DTHREADSAFE=1 -DSQLITE_OMIT_CURSOR -DNO_TCL -I../sqlite3-embedded -I../sqlite3-embedded -DOS_UNIX -I.. -I../include -g -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/openssl -DHAVE_SSL -g -O2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -MT libcallweaver_la-callerid.lo -MD -MP -MF .deps/libcallweaver_la-callerid.Tpo -c callerid.c -fPIC -DPIC -o .libs/libcallweaver_la-callerid.o callerid.c:65: error: field ‘rx’ has incomplete type callerid.c: In function ‘mate_generate’: callerid.c:154: error: storage size of ‘adsi’ isn’t known callerid.c:154: warning: unused variable ‘adsi’ callerid.c: In function ‘vmwi_generate’: callerid.c:173: error: storage size of ‘adsi’ isn’t known callerid.c:173: warning: unused variable ‘adsi’ callerid.c: In function ‘callerid_get’: callerid.c:207: error: dereferencing pointer to incomplete type callerid.c:282: error: dereferencing pointer to incomplete type callerid.c:286: error: dereferencing pointer to incomplete type callerid.c: In function ‘cw_callerid_generate’: callerid.c:392: error: storage size of ‘adsi’ isn’t known callerid.c:392: warning: unused variable ‘adsi’ callerid.c: In function ‘tdd_generate’: callerid.c:500: error: storage size of ‘adsi’ isn’t known callerid.c:500: warning: unused variable ‘adsi’ make<sup>3</sup>: * [libcallweaver_la-callerid.lo] Error 1 make<sup>3</sup>: Leaving directory `/usr/src/callweaver-srtp/corelib’ make²: [all-recursive] Error 1 make²: Leaving directory `/usr/src/callweaver-srtp/corelib’ make<sup>1</sup>: [all] Error 2 make<sup>1</sup>: Leaving directory `/usr/src/callweaver-srtp/corelib’ make: * [all-recursive] Error 1

I will try the branch on a previous date instead of trunk and let you know how it works.

Here is the error output in file-attach.

Sorry about my building issues, you can ignore them. They were related to spandsp 0.0.6 (see other ticket #468).

Please note that res/res_srtp.c needs in include if building against 1.4.4 (at least on my ubuntu 8.04 installation).

root@buildbox:/usr/src/callweaver-srtp# svn diff
Index: res/res_srtp.c
===================================================================
--- res/res_srtp.c    (revision 5209)
+++ res/res_srtp.c    (working copy)
@@ -27,6 +27,7 @@
  */

 #include <srtp/srtp.h>
+#include <srtp/srtp_priv.h>
 #include "callweaver.h" 

 #include "callweaver/lock.h" 
root@buildbox:/usr/src/callweaver-srtp# dpkg -l | grep srtp
ii  libsrtp1-dev                      1.4.4~dfsg-1                Secure RTP (SRTP) and UST Reference Implemen
root@buildbox:/usr/src/callweaver-srtp# 

If not included, make complains about missing structures.

Tested and working correctly with SRTP enabled and forced with a Grandstream GXP-2000 phone, firmware 1.1.6.16. Attached is a tcpdump of a call to the sample extension 1000.

As I tested, you should also add

Set(_SIP_SRTP_SDES=1)

to your dialplan before Dial AND Answer command if you want your calls to be encrypted both ways. I tested the echo application and Wireshark could not correctly decode the SRTP data from both sides meaning it is correctly encrypted as opposed to orrectly decoding plain RTP data.

I will test outbound calls, bridging and more devices inter-operatibility later this week at work.

all this srtp matters are fixed in 1.2

REOPEN: Incomplete handshake for peers which do not announce SAVP and buggy:

Set(_SIP_SRTP_SDES=1) leads to initial INVITE with broken SRTP sdp announce to peer:

m=audio 10192 RTP/AVP 
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:...

Please fix for supporting remote peers not announcing SRTP by default, or the SRTP feature is only half-implemented, thx.

y tom

INVITE to local net peer Twinkle/1.4.2 looks OK but it doesn’t like it but claims ZRTP/SRTP support:

m=audio 10116 RTP/SAVP 8 110 2 4 3 0 10 7
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:......

<-- Sip read from 192.168.0.101:5085:UDP 
SIP/2.0 488 Not Acceptable Here
Via: SIP/2.0/UDP 192.168.0.1:5060;received=192.168.0.1;rport=5060;branch=z9hG4bK28952349
To: <sip:210@192.168.0.101:5085>;tag=uajbe
From: "201" <sip:201@192.168.0.1>;tag=as413b457b
Call-ID: 19d2cdb92808b50c6e9321d07e7c1366@192.168.0.1
CSeq: 102 INVITE
Server: Twinkle/1.4.2
Warning: 302 tom2 "Incompatible transport protocol" 
Content-Length: 0

OK, Twinkle has got ZRTP support, but not SRTP.

And this occurs only on outgoing calls over NAT:

m=audio 10300 RTP/AVP 
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:Qsn/rCju0dGPZu2Ukt1jBly63rFnRJ7OxtEulLRg

So it’s likely the SDP rewrite by STUN not handled for SRTP ;)

Please check this patch (late night quick hack, don’t expect working).

Not working, applied to the wrong fucntion().

CLI sip no debug:

    -- Executing [510000@meine-telefone:2] Dial("SIP/xxxxx-e2a4", "SIP/10000@sipgate-de,,WTr")
add_sdp:SRTP ON
add_sdp:a_crypto OFF
add_sdp:SAVP ON
    -- Called 10000@sipgate-de
add_sdp:SRTP ON
add_sdp:a_crypto OFF
add_sdp:SAVP ON
    -- Got SIP response 488 "Not acceptable here" back from 217.10.79.9

CLI sip debug peer sipgate-de:

Non-codec capabilities: us - 0x1 (telephone-event), peer - 0x0 (nothing), combined - 0x0 (nothing)
    -- SIP/sipgate-de-0556 answered SIP/xxxxx-b260
add_sdp:SAVP OFF

Hmm, no, the first INVITE’s sdp is still broken:

    m=audio 10256 RTP/AVP 
    a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:aQAuKiMGfwj1HW4LQyJVi7J/C+uriWBJBYWznSrs

The second INVITE after proxy auth is ok:

    m=audio 10256 RTP/SAVP 8
    a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:aQAuKiMGfwj1HW4LQyJVi7J/C+uriWBJBYWznSrs

Seems to work ok with one of the DE providers supporting it, anyway.