Re: [Linphone-users] SRTP troubles between Asterisk and sip.linphone.org

[Andrej Mikus]

Some additional info

I am trying to reach other SIP servers now and have somehow different 
result when trying to reach iptel.org. SRTP works fine, as long as SIP 
is made over UDP or TCP. With TLS, the connection drops and there is no 
response on the INVITE call.


> <--- Transmitting SIP request (1159 bytes) to TLS:212.79.111.155:5061 --->
> INVITE sip:thetestcall@iptel.org SIP/2.0
> Via: SIP/2.0/TLS 
> 192.168.5.5:5061;rport;branch=z9hG4bKPj28e24b20-44ea-4f85-9d5c-87c839c47a67;alias
> From: 
> <sip:my_account_id@sip.linphone.org>;tag=659e27d0-84cf-42db-bdc3-f10c2c04166b
> To: <sip:thetestcall@iptel.org>
> Contact: <sip:my_account_id@192.168.5.5:5061;transport=TLS>
> Call-ID: 1897cda2-f6a4-4cfc-a9b2-9e144479f2b0
> CSeq: 15543 INVITE
> Allow: OPTIONS, REGISTER, SUBSCRIBE, NOTIFY, PUBLISH, INVITE, ACK, BYE, CANCEL, 
> UPDATE, PRACK, REFER, MESSAGE
> Supported: 100rel, timer, replaces, norefersub
> Session-Expires: 1800
> Min-SE: 90
> Max-Forwards: 70
> User-Agent: Asterisk PBX 16.2.1~dfsg-1+deb10u2
> Content-Type: application/sdp
> Content-Length:   469
>
> v=0
> o=- 1670905169 1670905169 IN IP4 192.168.5.5
> s=Asterisk
> c=IN IP4 192.168.5.5
> t=0 0
> m=audio 14448 RTP/SAVP 0 8 18 3 111 9 101
> a=crypto:1 AES_CM_128_HMAC_SHA1_80 
> inline:9APNmW+ULy9+OhauxkABQ0y3Zha9juJam098sox+
> a=rtpmap:0 PCMU/8000
> a=rtpmap:8 PCMA/8000
> a=rtpmap:18 G729/8000
> a=fmtp:18 annexb=no
> a=rtpmap:3 GSM/8000
> a=rtpmap:111 G726-32/8000
> a=rtpmap:9 G722/8000
> a=rtpmap:101 telephone-event/8000
> a=fmtp:101 0-16
> a=ptime:20
> a=maxptime:150
> a=sendrecv
>
>   == Everyone is busy/congested at this time (1:0/1/0)

At this point the tcp connection is reset, so I do not even get a server 
response.

I see internal addresses in the communication, but these are there also 
with UDP/TCP and the NAT router has all SIP ALG disabled.

It looks like the situation varies between servers, and I do not expect 
to get advice about iptel.org here. But hopefully there could be someone 
with more details about Linphone server?

Thanks in advance
Andrej



On 04/02/2021 02:38, Andrej Mikus wrote:
> Team,
>
> I am trying to dig deep into SIP and VoIP, and I think I have certain 
> progress. My Linphone clients in desktops and Android call register 
> happily to my Asterisk/Freepbx server and call between each other, and 
> also with native Android SIP client or Cisco IP Phones.
>
> I have setup an account at sip.linphone.org and made it a trunk in the 
> PBX, using pjsip channel. This also works well with UDP, TCP, TLS, as 
> long as I do not try to encrypt the call itself. As soon as I do that,
> the Linphone server responds with SIP/2.0 488 Not acceptable here
>
> I am failing to figure out what could be wrong in my client side config. 
> Is there any documentation of the sip service I could check to figure 
> out more? Ideally with use of asterisk and pjsip channel as a client?
>
> Below is my session recorded with detail logging. Is the offer of 
> RTP/SAVP explicitly rejected or my client is missing something?
>
> I will be thankful for any pointer or hint.
>
> Regards
> Andrej Mikus
>
>
> <--- Transmitting SIP request (1476 bytes) to TLS:54.37.202.229:5223 --->
> INVITE sip:thetestcall@sip.linphone.org SIP/2.0
> Via: SIP/2.0/TLS 
> 192.168.5.5:5061;rport;branch=z9hG4bKPjfd76bc45-7c48-4ae9-9d3b-10742999e572;alias 
>
> From: 
> <sip:my_account_id@sip.linphone.org>;tag=41661d8f-40da-4ffd-860e-cc677748893a 
>
> To: <sip:thetestcall@sip.linphone.org>
> Contact: <sip:my_account_id@192.168.5.5:5061;transport=TLS>
> Call-ID: ffc1cc2c-d6ea-49e3-8194-da228e619aa8
> CSeq: 2282 INVITE
> Allow: OPTIONS, REGISTER, SUBSCRIBE, NOTIFY, PUBLISH, INVITE, ACK, BYE, 
> CANCEL, UPDATE, PRACK, REFER, MESSAGE
> Supported: 100rel, timer, replaces, norefersub
> Session-Expires: 1800
> Min-SE: 90
> Max-Forwards: 70
> User-Agent: Asterisk PBX 16.2.1~dfsg-1+deb10u2
> Proxy-Authorization: Digest username="my_account_id", 
> realm="sip.linphone.org", nonce="LMbF4wAAAADIJv2mAAD0xo5BVewAAAAA", 
> uri="sip:thetestcall@sip.linphone.org", 
> response="b252c4e5f71f3609cc6706d5c0d49b2a", algorithm=MD5, 
> cnonce="45300d44-f971-40d7-bd70-e24a8cc2cdcb", opaque="+GNywA==", 
> qop=auth, nc=00000001
> Content-Type: application/sdp
> Content-Length:   469
>
> v=0
> o=- 1731182403 1731182403 IN IP4 192.168.5.5
> s=Asterisk
> c=IN IP4 192.168.5.5
> t=0 0
> m=audio 12672 RTP/SAVP 0 8 18 3 111 9 101
> a=crypto:1 AES_CM_128_HMAC_SHA1_80 
> inline:+Jg5tuIPuxtZQ4xtMGLF+XHvV0EEuAhjc6WvySvi
> a=rtpmap:0 PCMU/8000
> a=rtpmap:8 PCMA/8000
> a=rtpmap:18 G729/8000
> a=fmtp:18 annexb=no
> a=rtpmap:3 GSM/8000
> a=rtpmap:111 G726-32/8000
> a=rtpmap:9 G722/8000
> a=rtpmap:101 telephone-event/8000
> a=fmtp:101 0-16
> a=ptime:20
> a=maxptime:150
> a=sendrecv
>
> <--- Received SIP response (458 bytes) from TLS:54.37.202.229:5223 --->
> SIP/2.0 100 Trying
> Via: SIP/2.0/TLS 
> 192.168.5.5:5061;rport=45281;branch=z9hG4bKPjfd76bc45-7c48-4ae9-9d3b-10742999e572;alias;received=84.192.184.58 
>
> Record-Route: <sips:sip6.linphone.org:5223;lr>
> From: 
> <sip:my_account_id@sip.linphone.org>;tag=41661d8f-40da-4ffd-860e-cc677748893a 
>
> To: <sip:thetestcall@sip.linphone.org>
> Call-ID: ffc1cc2c-d6ea-49e3-8194-da228e619aa8
> CSeq: 2282 INVITE
> Server: Flexisip/2.0.3-9-g60ae233c (sofia-sip-nta/2.0)
> Content-Length: 0
>
>
> <--- Received SIP response (531 bytes) from TLS:54.37.202.229:5223 --->
> SIP/2.0 488 Not acceptable here
> Via: SIP/2.0/TLS 
> 192.168.5.5:5061;rport=45281;branch=z9hG4bKPjfd76bc45-7c48-4ae9-9d3b-10742999e572;alias;received=84.192.184.58 
>
> From: 
> <sip:my_account_id@sip.linphone.org>;tag=41661d8f-40da-4ffd-860e-cc677748893a 
>
> To: <sip:thetestcall@sip.linphone.org>;tag=as0aa55d55
> Call-ID: ffc1cc2c-d6ea-49e3-8194-da228e619aa8
> CSeq: 2282 INVITE
> Server: Asterisk PBX 16.5.0
> Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, 
> INFO, PUBLISH, MESSAGE
> Supported: replaces, timer
> Content-Length: 0
>
>
> <--- Transmitting SIP request (430 bytes) to TLS:54.37.202.229:5223 --->
> ACK sip:thetestcall@sip.linphone.org SIP/2.0
> Via: SIP/2.0/TLS 
> 192.168.5.5:5061;rport;branch=z9hG4bKPjfd76bc45-7c48-4ae9-9d3b-10742999e572;alias 
>
> From: 
> <sip:my_account_id@sip.linphone.org>;tag=41661d8f-40da-4ffd-860e-cc677748893a 
>
> To: <sip:thetestcall@sip.linphone.org>;tag=as0aa55d55
> Call-ID: ffc1cc2c-d6ea-49e3-8194-da228e619aa8
> CSeq: 2282 ACK
> Max-Forwards: 70
> User-Agent: Asterisk PBX 16.2.1~dfsg-1+deb10u2
> Content-Length:  0
>
>
>    == Everyone is busy/congested at this time (1:0/0/1)