< Previous by Date	Date Index	Next by Date >
< Previous in Thread	Thread Index	Next in Thread >

Re: [reSIProcate] reSIProcate and LCS?

From: Chris Rigg <cdrigg@xxxxxxxxxxx>
Date: Tue, 16 Aug 2005 15:47:46 -0600

Hi Scott,

Thanks for your quick response.

Yes, you are right -- to talk to LCS in Federation mode you MUST use TLStransport. And in fact, I have tried this out. I am able to establish aTLS session underneath me when the resip stack is a client and the LCS'saccess proxy is the server. To do this, I had to do a bunch of cert/pemstuff (as you might imagine). Essentially, I copied the root_cert that Iused on the LCS to sign the AP's to my linux machine into$HOME/.sipCerts/. Then, of course, I had to also copy the root_cert thatI created on my Linux machine (that was used to sign my domain_key formy resip stack) over to the AP's list of trusted certificateauthorities. And this worked! I was able to establish a TLS session withLCS's AP w/out code modifications to the stack (although as I stated inmy previous mail, this inital excitement quickly wore off once I startedtrying to reverse engineer the MSFT SIP message extensions).

However, in the reverse direction (where resip is the server and LCS'sAP is the client) resip doesn't like something in the TLS "compatibleclient hello" message and resip immediately sends a TCP RST.

So, any idea why resip would respond w/ a TCP RST? Is it just simplythat resip doesn't support any of their cipher suites?? The resip logsseem to indicate a "version error" (I've included those below too). Hereis the ssldump of the messaging:


New TCP connection #1: lcs-im.com(1127) <-> bldr-ccm51.resip.com(5061)
1 1  0.0005 (0.0005)  C>S SSLv2 compatible client hello
 Version 3.1
 cipher suites
 TLS_RSA_WITH_RC4_128_MD5
 TLS_RSA_WITH_RC4_128_SHA
 TLS_RSA_WITH_3DES_EDE_CBC_SHA
 SSL2_CK_RC4
 SSL2_CK_3DES
 SSL2_CK_RC2
 TLS_RSA_WITH_DES_CBC_SHA
 SSL2_CK_DES
 TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
 TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
 TLS_RSA_EXPORT_WITH_RC4_40_MD5
 TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
 SSL2_CK_RC4_EXPORT40
 SSL2_CK_RC2_EXPORT40
 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
 TLS_DHE_DSS_WITH_DES_CBC_SHA
 TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA
1    0.0088 (0.0083)  S>C  TCP RST


Thanks,
Chris

Scott Godin wrote:

Apparently to use "Federation Mode" you must use the TLS transport.  As
far as I know - no one has tried this with resip yet.  Although it is on
my list of things to try out.  : )

On the other hand - I have used resip to communicate with LCS by setting
up the resip endpoint as a trusted node.  Note:  LCS does not support
UDP - so you must use a TCP transport.  Don't expect to be able to
register with LCS though - since you need to implement those Microsoft
extensions that you mentioned (ie. Kerberos/NTLM Authentication instead
of Digest).

Scott

-----Original Message-----
From: resiprocate-devel-bounces@xxxxxxxxxxxxxxxxxxx
[mailto:resiprocate-devel-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of
Chris Rigg
Sent: Tuesday, August 16, 2005 5:21 PM
To: resiprocate-devel@xxxxxxxxxxxxxxxxxxx
Subject: [reSIProcate] reSIProcate and LCS?

Hello,
I am trying to connect reSIProcate to Microsoft's LCS (LiveCommunications Server) in Federation mode (i.e. Public IM). In thismode, instant messenger users (i.e. MOC clients) can communicate OUTSIDE
of their domain. For example, with Federation mode a user namedjohn@xxxxxxx (that uses LCS as their enterprise IM server) can IM withsam@xxxxxxxx The inter-domain protocol that is used to make this happenis called "Federation". The protocol is basically just some MSFTextensions onto standard SIP/SIMPLE messages. However, I'm running intoplenty of problems when trying to interoperate between reSIProcate and
LCS.
Has anyone tried to do something similar?? If so, was there a detailedMicrosoft Federation mode interface spec that you followed or something?
Thanks,
Chris
_______________________________________________
resiprocate-devel mailing list
resiprocate-devel@xxxxxxxxxxxxxxxxxxx
https://list.sipfoundry.org/mailman/listinfo/resiprocate-devel

Follow-Ups:
- Re: [reSIProcate] reSIProcate and LCS?
  - From: Chris Rigg

References:
- RE: [reSIProcate] reSIProcate and LCS?
  - From: Scott Godin

Prev by Date: Re: [reSIProcate] epid parameter?
Next by Date: Re: [reSIProcate] reSIProcate and LCS?
Previous by thread: Re: [reSIProcate] reSIProcate and LCS?
Next by thread: Re: [reSIProcate] reSIProcate and LCS?
Index(es):
- Date
- Thread