Hello, I tried using SFLphone with the SIPS port at ostel.me. While it works flawlessly with "CSipSimple" on my Android device it is failing in SFLPhone.
Looking at the capture file of the failing attempt I can see that the server immediately returns a handshake failure after the first TLSv1 client hello. So I compared the two TLS client hellos and can see a differences in the different set of TLS extensions being used: CSipSimple: - server_name - ec_point_formats - elliptic_curves - SessionTicket TLS SFLphone: - ec_point_formats - elliptic_curves - SessionTicket TLS - heartbeat The other difference and probably more important is the very limited list of algorithms offered by SFLphone: - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) - TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) With CSipSimple the server choses TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) and continues without error. References: - http://tools.ietf.org/html/rfc5246#page-37 - http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xml How do I extend the list of algorithms and/or limit the list of TLS extensions? The extended TLS settings in SFLphone seem to offer something in that way but I don't know what format this configuration field expects. Or is my build somewhat limited (0.9.12-1build1) and it really should support more methods? Simon _______________________________________________ SFLphone mailing list [email protected] http://lists.savoirfairelinux.net/mailman/listinfo/sflphone
