| Summary: | ASTERISK-25642: res_rtp_asterisk: SRTCP broken with DTLS - bad video is one of the consequences | ||
| Reporter: | Stefan Engström (StefanEng86) | Labels: | dtls encryption rtcp video |
| Date Opened: | 2015-12-22 04:47:43.000-0600 | Date Closed: | 2016-09-23 14:27:42 |
| Priority: | Major | Regression? | |
| Status: | Closed/Complete | Components: | Resources/res_rtp_asterisk Resources/res_srtp |
| Versions: | 13.5.0 | Frequency of Occurrence | |
| Related Issues: | |||
| Environment: | fedora20.x86_64 , libsrtp 1.4.4 , chan_sip webrtc peers | Attachments: | |
| Description: | symtoms: When dialing webrtc peers, asterisk gets lots warning logs SRTP unprotect failed with: authentication failure 110 upon receiving rtcp and the webrtc client also gets unprotect failures - in particular when trying to unprotect RTCP FIR which asterisk send on vp8-capable channels. This means bad video.
When dialing sipml chan_sip chrome webrtc peers, we do not mux rtcp and rtp, so there is a seperate dtls handshake for rtcp and rtp for both audio and video. In res_rtp_asterisk.c we extract keying materials from the rtp-dtls-session (to be used for srtp) when the handshake is complete, but we do nothing with the results of the rtcp->dtls handshake. The extracted key from rtp->dtls is passed to libsrtp in res_srtp.c via the srtp_policy_t struct but from the struct reference for that in http://srtp.sourceforge.net/libsrtp.pdf it looks like it is not possible to supply different keys for rtp and rtcp? So, can anyone think of a solution or work-around? | ||
| Comments: | By: Asterisk Team (asteriskteam) 2015-12-22 04:47:45.638-0600 Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution. A good first step is for you to review the [Asterisk Issue Guidelines|https://wiki.asterisk.org/wiki/display/AST/Asterisk+Issue+Guidelines] if you haven't already. The guidelines detail what is expected from an Asterisk issue report. Then, if you are submitting a patch, please review the [Patch Contribution Process|https://wiki.asterisk.org/wiki/display/AST/Patch+Contribution+Process]. By: Jacek Konieczny (jkonieczny) 2016-03-25 11:02:26.235-0500 I have made a patch to fix this: https://gerrit.asterisk.org/2468 It changes rtp_engine API and ABI a bit, I am not sure how much it matters. | ||