Summary:ASTERISK-25642: res_rtp_asterisk: SRTCP broken with DTLS - bad video is one of the consequences
Reporter:Stefan Engström (StefanEng86)Labels:dtls encryption rtcp video
Date Opened:2015-12-22 04:47:43.000-0600Date Closed:2016-09-23 14:27:42
Status:Closed/CompleteComponents:Resources/res_rtp_asterisk Resources/res_srtp
Versions:13.5.0 Frequency of
Environment:fedora20.x86_64 , libsrtp 1.4.4 , chan_sip webrtc peers Attachments:
Description:symtoms: When dialing webrtc peers, asterisk gets lots  warning logs SRTP unprotect failed with: authentication failure 110 upon receiving rtcp and the webrtc client also gets unprotect failures - in particular when trying to unprotect RTCP FIR which asterisk send on vp8-capable channels. This means bad video.

When dialing sipml chan_sip chrome webrtc peers, we do not mux rtcp and rtp, so there is a seperate dtls handshake for rtcp and rtp for both audio and video. In res_rtp_asterisk.c we extract keying materials from the rtp-dtls-session (to be used for srtp) when the handshake is complete, but we do nothing with the results of the rtcp->dtls handshake. The extracted key from rtp->dtls is passed to libsrtp in res_srtp.c via the srtp_policy_t struct but from the struct reference for that in http://srtp.sourceforge.net/libsrtp.pdf it looks like it is not possible to supply different keys for rtp and rtcp?

So, can anyone think of a solution or work-around?
Comments:By: Asterisk Team (asteriskteam) 2015-12-22 04:47:45.638-0600

Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution.

A good first step is for you to review the [Asterisk Issue Guidelines|https://wiki.asterisk.org/wiki/display/AST/Asterisk+Issue+Guidelines] if you haven't already. The guidelines detail what is expected from an Asterisk issue report.

Then, if you are submitting a patch, please review the [Patch Contribution Process|https://wiki.asterisk.org/wiki/display/AST/Patch+Contribution+Process].

By: Jacek Konieczny (jkonieczny) 2016-03-25 11:02:26.235-0500

I have made a patch to fix this: https://gerrit.asterisk.org/2468

It changes rtp_engine API and ABI a bit, I am not sure how much it matters.