ExternalVendorCode/serval-dna
1
0
Fork 0
mirror of https://github.com/servalproject/serval-dna.git synced 2025-02-22 18:12:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Remove README.WHYNOTSIPS

Browse Source 
The text of this historical note has been transplanted in slightly improved
form into the Serval wiki VoMP page:

http://developer.servalproject.org/dokuwiki/doku.php?id=content:technologies:vomp
This commit is contained in:
Andrew Bettison 2012-10-31 10:14:58 +10:30
parent 3c7eb7b058
commit aba7e417c4
1 changed files with 0 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
README.WHYNOTSIPS
View File

@ -1,21 +0,0 @@
When we were looking at implementing secure calls for OpenBTS it was suggested
that we configure Asterisk to use SIPS/ZRTP. This would have been relatively
easy to setup, however there are a few problems.
Number one is that when Asterisk checks the certificates it will either
validate the certificate (checking the chain of trust and so on) and then
check that the common name attribute on the certificate matches the hostname
of the peer, or it will do none of these checks. This code is in main/tcptls.c
line 206 (in version 1.8.14.1).
This is undesirable in a setup where there is limited or no infrastructure as
there is not likely to be a DNS server setup, or even rigid IP assignments
that would allow a static hosts file based setup. This situation would force
the administrator to disable the checks completely which would allow a trivial
man in the middle attack.
It would be possible to modify Asterisk to have a third way where it validates
the certificate and checks the chain of trust but does not look at the common
name. We decided against this approach as the VOMP channel driver was written
in time to avoid it.