|ASTERISK-25642: res_rtp_asterisk: SRTCP broken with DTLS - bad video is one of the consequences
|Stefan Engström (StefanEng86)
|dtls encryption rtcp video
|fedora20.x86_64 , libsrtp 1.4.4 , chan_sip webrtc peers
|symtoms: When dialing webrtc peers, asterisk gets lots warning logs SRTP unprotect failed with: authentication failure 110 upon receiving rtcp and the webrtc client also gets unprotect failures - in particular when trying to unprotect RTCP FIR which asterisk send on vp8-capable channels. This means bad video.
When dialing sipml chan_sip chrome webrtc peers, we do not mux rtcp and rtp, so there is a seperate dtls handshake for rtcp and rtp for both audio and video. In res_rtp_asterisk.c we extract keying materials from the rtp-dtls-session (to be used for srtp) when the handshake is complete, but we do nothing with the results of the rtcp->dtls handshake. The extracted key from rtp->dtls is passed to libsrtp in res_srtp.c via the srtp_policy_t struct but from the struct reference for that in http://srtp.sourceforge.net/libsrtp.pdf it looks like it is not possible to supply different keys for rtp and rtcp?
So, can anyone think of a solution or work-around?
|By: Asterisk Team (asteriskteam) 2015-12-22 04:47:45.638-0600
Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution.
A good first step is for you to review the [Asterisk Issue Guidelines|https://wiki.asterisk.org/wiki/display/AST/Asterisk+Issue+Guidelines] if you haven't already. The guidelines detail what is expected from an Asterisk issue report.
Then, if you are submitting a patch, please review the [Patch Contribution Process|https://wiki.asterisk.org/wiki/display/AST/Patch+Contribution+Process].
By: Jacek Konieczny (jkonieczny) 2016-03-25 11:02:26.235-0500
I have made a patch to fix this: https://gerrit.asterisk.org/2468
It changes rtp_engine API and ABI a bit, I am not sure how much it matters.