Reg: Problem in transmitting an secure audio stream

spartan · April 29, 2013, 4:19am

Hi Friends,
I am using a web phone, i have done the extensions(i.e. 1060,1061) registration with asterisk 11.0 in two different computer where asterisk is within the network, after registering it showing as successfully registered, But the problem is, while i try to call one extension from the other(i.e. from 1060 to 1061) i am not getting any call to destination extension, but getting the error as
"CLI> == Using SIP RTP CoS mark 5
[Apr 26 17:18:51] WARNING[19101][C-0000000e]: chan_sip.c:10454 process_sdp:
Rejecting secure audio stream without encryption details:
audio 5354 RTP/SAVPF 103 104 111 0 8 107 106 105 13 126"
In the users.conf file the configuration for 1060 and 1061 are like
[1060]
encryption = yes
avpf = yes
insecure = no

[1061]
encryption = yes
avpf = yes
insecure = no

Could someone please assist me on this.

Thanks
Vijay

david55 · April 29, 2013, 8:23am

You have registered devices, not extensions.

You will need to provide sip set debug on output, showing the the SDP exchange.

spartan · April 29, 2013, 9:10am

Thanks for the reply david,
Yes, for registered devices. Thanks again for correcting me.

I have done the changes as you mentioned(i.e. executed sip set debug on command) and then tried making a call from device 1061 to 1060 and get a set debug logs as follows,

[i]Call-ID: 38b41457-3945-9f1b-2572-93597e6fe74b
CSeq: 58099 INVITE
Content-Type: application/sdp
Content-Length: 2326
Route: sip:192.168.3.33:5060;lr;sipml5-outbound;transport=udp
Max-Forwards: 70
Authorization: Digest username=“1060”,realm=“asterisk”,nonce=“73738116”,uri="sip:1061@192.168.3.33",response=“697d561d392f1b8c1f91a5a5eb9fab47”,algorithm=MD5
User-Agent: IM-client/OMA1.0 sipML5-v1.2013.03.27
Organization: Doubango Telecom

v=0
o=- 1323806560 2 IN IP4 127.0.0.1
s=Doubango Telecom - chrome
t=0 0
a=group:BUNDLE audio
a=msid-semantic: WMS shkJgnZNUtYssjBXVWRkEJgzSDsMrZTZ72Ej
m=audio 1148 RTP/SAVPF 103 104 111 0 8 107 106 105 13 126
c=IN IP4 182.72.70.194
a=rtcp:1148 IN IP4 182.72.70.194
a=candidate:2318809477 1 udp 2113937151 10.0.0.1 55585 typ host generation 0
a=candidate:2318809477 2 udp 2113937151 10.0.0.1 55585 typ host generation 0
a=candidate:558486734 1 udp 2113937151 192.168.3.122 55586 typ host generation 0
a=candidate:558486734 2 udp 2113937151 192.168.3.122 55586 typ host generation 0
a=candidate:2999745851 1 udp 2113937151 192.168.56.1 55587 typ host generation 0
a=candidate:2999745851 2 udp 2113937151 192.168.56.1 55587 typ host generation 0
a=candidate:2684473978 1 udp 1845501695 182.72.70.194 1148 typ srflx raddr 192.168.3.122 rport 55586 generation 0
a=candidate:2684473978 2 udp 1845501695 182.72.70.194 1148 typ srflx raddr 192.168.3.122 rport 55586 generation 0
a=candidate:3300246901 1 tcp 1509957375 10.0.0.1 52913 typ host generation 0
a=candidate:3300246901 2 tcp 1509957375 10.0.0.1 52913 typ host generation 0
a=candidate:1875519550 1 tcp 1509957375 192.168.3.122 52914 typ host generation 0
a=candidate:1875519550 2 tcp 1509957375 192.168.3.122 52914 typ host generation 0
a=candidate:4233069003 1 tcp 1509957375 192.168.56.1 52915 typ host generation 0
a=candidate:4233069003 2 tcp 1509957375 192.168.56.1 52915 typ host generation 0
a=ice-ufrag:KHvvf7lF0ioPFlya
a=ice-pwd:FoVlgI1o8Wpc02peQay6aKSb
a=ice-options:google-ice
a=sendrecv
a=mid:audio
a=rtcp-mux
a=crypto:0 AES_CM_128_HMAC_SHA1_32 inline:BTQsZnNPzCSRwzS+ZWgRgtkUGurV2PSITy8eZwms
a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:bdYDwpVnoAyGGS1mpuRnPTB257RTkhhEWMvtH6wY
a=rtpmap:103 ISAC/16000
a=rtpmap:104 ISAC/32000
a=rtpmap:111 opus/48000/2
a=fmtp:111 minptime=10
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:107 CN/48000
a=rtpmap:106 CN/32000
a=rtpmap:105 CN/16000
a=rtpmap:13 CN/8000
a=rtpmap:126 telephone-event/8000
a=maxptime:60
a=ssrc:2603323793 cname:bZchOou9bcjftKk6
a=ssrc:2603323793 msid:shkJgnZNUtYssjBXVWRkEJgzSDsMrZTZ72Ej shkJgnZNUtYssjBXVWRkEJgzSDsMrZTZ72Eja0
a=ssrc:2603323793 mslabel:shkJgnZNUtYssjBXVWRkEJgzSDsMrZTZ72Ej
a=ssrc:2603323793 label:shkJgnZNUtYssjBXVWRkEJgzSDsMrZTZ72Eja0

<------------->
— (14 headers 47 lines) —
Using INVITE request as basis request - 38b41457-3945-9f1b-2572-93597e6fe74b
Found peer ‘1060’ for ‘1060’ from 192.168.3.122:52911
== Using SIP RTP CoS mark 5
Found RTP audio format 103
Found RTP audio format 104
Found RTP audio format 111
Found RTP audio format 0
Found RTP audio format 8
Found RTP audio format 107
Found RTP audio format 106
Found RTP audio format 105
Found RTP audio format 13
Found RTP audio format 126
Found unknown media description format ISAC for ID 103
Found unknown media description format ISAC for ID 104
Found unknown media description format opus for ID 111
Found audio description format PCMU for ID 0
Found audio description format PCMA for ID 8
Found unknown media description format CN for ID 107
Found unknown media description format CN for ID 106
Found unknown media description format CN for ID 105
Found audio description format CN for ID 13
Found audio description format telephone-event for ID 126
[Apr 29 14:20:26] WARNING[30600][C-00000000]: chan_sip.c:10454 process_sdp: Rejecting secure audio stream without encryption details: audio 1148 RTP/SAVPF 103 104 111 0 8 107 106 105 13 126

<— Reliably Transmitting (NAT) to 192.168.3.122:52911 —>
SIP/2.0 488 Not acceptable here
Via: SIP/2.0/WS df7jal23ls0d.invalid;branch=z9hG4bKymFuAvIhT1dqmMvXXvNShfDIzH4T74vb;received=192.168.3.122;rport=52911
From: "1060"sip:1060@192.168.3.33;tag=NrTP5wcu7BEvHHoHga9i
To: sip:1061@192.168.3.33;tag=as611896f8
Call-ID: 38b41457-3945-9f1b-2572-93597e6fe74b
CSeq: 58099 INVITE
Server: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘38b41457-3945-9f1b-2572-93597e6fe74b’ in 32000 ms (Method: INVITE)

<— SIP read from WS:192.168.3.122:52911 —>
ACK sip:1061@192.168.3.33 SIP/2.0
Via: SIP/2.0/WS df7jal23ls0d.invalid;branch=z9hG4bKymFuAvIhT1dqmMvXXvNShfDIzH4T74vb;rport
From: "1060"sip:1060@192.168.3.33;tag=NrTP5wcu7BEvHHoHga9i
To: sip:1061@192.168.3.33;tag=as611896f8
Call-ID: 38b41457-3945-9f1b-2572-93597e6fe74b
CSeq: 58099 ACK
Content-Length: 0
Route: sip:192.168.3.33:5060;lr;sipml5-outbound;transport=udp
Max-Forwards: 70

<------------->
— (9 headers 0 lines) —
Really destroying SIP dialog ‘4363f128-57d8-596d-55db-a006f9991fb3’ Method: REGISTER

<— SIP read from UDP:192.168.3.128:48108 —>
SUBSCRIBE sip:6006@192.168.3.33 SIP/2.0
Via: SIP/2.0/UDP 192.168.3.128:48108;branch=z9hG4bK-d87543-c92c543446188d33-1–d87543-;rport
Max-Forwards: 70
Contact: sip:6006@192.168.3.128:48108
To: "6006"sip:6006@192.168.3.33
From: "6006"sip:6006@192.168.3.33;tag=734c4f2e
Call-ID: ZDY5MThhM2ZjM2M5NmE5OTM2NjVkMDUzMTIzMmU4MTI.
CSeq: 1 SUBSCRIBE
Expires: 300
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
User-Agent: X-Lite release 1011s stamp 41150
Event: message-summary
Content-Length: 0

<------------->
— (13 headers 0 lines) —
Sending to 192.168.3.128:48108 (no NAT)
Creating new subscription
Sending to 192.168.3.128:48108 (no NAT)
list_route: route/path hop: sip:6006@192.168.3.128:48108
Found peer ‘6006’ for ‘6006’ from 192.168.3.128:48108

<— Transmitting (NAT) to 192.168.3.128:48108 —>
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.3.128:48108;branch=z9hG4bK-d87543-c92c543446188d33-1–d87543-;received=192.168.3.128;rport=48108
From: "6006"sip:6006@192.168.3.33;tag=734c4f2e
To: "6006"sip:6006@192.168.3.33;tag=as559528e2
Call-ID: ZDY5MThhM2ZjM2M5NmE5OTM2NjVkMDUzMTIzMmU4MTI.
CSeq: 1 SUBSCRIBE
Server: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="3c125abc"
Content-Length: 0

<------------>
Scheduling destruction of SIP dialog ‘ZDY5MThhM2ZjM2M5NmE5OTM2NjVkMDUzMTIzMmU4MTI.’ in 32000 ms (Method: SUBSCRIBE)

<— SIP read from UDP:192.168.3.128:48108 —>
SUBSCRIBE sip:6006@192.168.3.33 SIP/2.0
Via: SIP/2.0/UDP 192.168.3.128:48108;branch=z9hG4bK-d87543-7c3641368846a652-1–d87543-;rport
Max-Forwards: 70
Contact: sip:6006@192.168.3.128:48108
To: "6006"sip:6006@192.168.3.33
From: “6006"sip:6006@192.168.3.33;tag=734c4f2e
Call-ID: ZDY5MThhM2ZjM2M5NmE5OTM2NjVkMDUzMTIzMmU4MTI.
CSeq: 2 SUBSCRIBE
Expires: 300
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
User-Agent: X-Lite release 1011s stamp 41150
Authorization: Digest username=“6006”,realm=“asterisk”,nonce=“3c125abc”,uri="sip:6006@192.168.3.33”,response=“57b161ff47f27daa508017cfe8462714”,algorithm=MD5
Event: message-summary
Content-Length: 0

<------------->
— (14 headers 0 lines) —
Creating new subscription
Sending to 192.168.3.128:48108 (NAT)
Found peer ‘6006’ for ‘6006’ from 192.168.3.128:48108
Scheduling destruction of SIP dialog ‘ZDY5MThhM2ZjM2M5NmE5OTM2NjVkMDUzMTIzMmU4MTI.’ in 310000 ms (Method: SUBSCRIBE)

<— Transmitting (NAT) to 192.168.3.128:48108 —>
SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.168.3.128:48108;branch=z9hG4bK-d87543-7c3641368846a652-1–d87543-;received=192.168.3.128;rport=48108
From: "6006"sip:6006@192.168.3.33;tag=734c4f2e
To: "6006"sip:6006@192.168.3.33;tag=as559528e2
Call-ID: ZDY5MThhM2ZjM2M5NmE5OTM2NjVkMDUzMTIzMmU4MTI.
CSeq: 2 SUBSCRIBE
Server: Asterisk PBX
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Expires: 300
Contact: sip:6006@192.168.3.33:5060;expires=300
Content-Length: 0

<------------>
Reliably Transmitting (NAT) to 192.168.3.128:48108:
NOTIFY sip:6006@192.168.3.128:48108 SIP/2.0
Via: SIP/2.0/UDP 192.168.3.33:5060;branch=z9hG4bK5de2aac1;rport
Max-Forwards: 70
Route: sip:6006@192.168.3.128:48108
From: “asterisk” sip:asterisk@192.168.3.33;tag=as559528e2
To: sip:6006@192.168.3.128:48108;tag=734c4f2e
Contact: sip:asterisk@192.168.3.33:5060
Call-ID: ZDY5MThhM2ZjM2M5NmE5OTM2NjVkMDUzMTIzMmU4MTI.
CSeq: 102 NOTIFY
User-Agent: Asterisk PBX
Event: message-summary
Content-Type: application/simple-message-summary
Subscription-State: active
Content-Length: 93

Messages-Waiting: yes
Message-Account: sip:asterisk@192.168.3.33
Voice-Message: 2/0 (0/0)

<— SIP read from UDP:192.168.3.128:48108 —>
SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.168.3.33:5060;branch=z9hG4bK5de2aac1;rport=5060
Contact: sip:6006@192.168.3.128:48108
To: sip:6006@192.168.3.128:48108;tag=734c4f2e
From: "asterisk"sip:asterisk@192.168.3.33;tag=as559528e2
Call-ID: ZDY5MThhM2ZjM2M5NmE5OTM2NjVkMDUzMTIzMmU4MTI.
CSeq: 102 NOTIFY
User-Agent: X-Lite release 1011s stamp 41150
Content-Length: 0[/i]

Please search for the following pattern “Using SIP RTP CoS mark 5” and it seems the error reside here, Need assistance in correcting. Please give you suggestion regarding this.

Regards
Vijay

david55 · April 29, 2013, 9:48am

The Class of Service is irrelevant, except in confirming the use of UDP.

There is no point at all in encrypting the media, if you have sent the session keys in the clear, in a UDP SIP packet. Although I can’t be sure that this is the only problem, Asterisk requires the use of SIPS: URIs and therefore SIP over TLS, to ensure that the session keys are secure.