VoIP Mailing List Archives

[ohjelmistoarkkitehti a...]

Hello,


I'm trying to get calls working between websocket clients and sip clients. For clients I have sip.js based clients on chrome, Zoipers and a Grandstream phone. Challenge here is I'd like to have Kamailio and rtpengine to handle the bridging between different rtp profiles but Asterisk changes them in the sdp bodies along the way. I'm using Asterisk 11.11.0.


Is there a way to configure Asterisk to ignore the rtp profile but allow calls to pass with either of those profiles (even though clients might answer with 488 which would be caught and handled by Kamailio and rtpengine)? In my setup I have Asterisk Kamailio realtime integration, and the second goal is to be able to add peers to the db table with similar data, as in no different values based on what kind of client wants to register. I'd like to allow the user to register using which ever client they choose (in this case one of the 3 I mentioned). 


Previously I had problems like 'rejecting secure audio stream without encryption details', no audio or BYE messages sent immediately after call has begun etc, but according to sip.js documentation (http://sipjs.com/guides/server-configuration/asterisk/) the settings avpf and force_avp affect the way Asterisk handles the rtp profiles and now my calls do work ok but I'd need to move the rtp profile handling to rtpengine.


Here's my sip.conf:


bindport = 5070 ;Kamailio is at port 5060, and it's always used as outbound proxy
bindaddr = PU.BL.IC.IP
tcpenable = yes
limitonpeers = yes
rtcachefriends = yes
rtupdate=yes
tos_sip=cs3
tos_audio=ef
realm = testers.com
autodomain=no
domain=testers.com


allowexternaldomains=no
allowguest=no
;avpf=yes ;
encryption=yes
transport=ws,wss,udp
icesupport=yes
srvlookup=yes
nat=force_rport,comedia
videosupport=yes
directmedia=no




And here's the way I've defined my websocket peer to my sippeers table:


            id: 4
          name: 660
        ipaddr: PU.BL.IC.IP
          port: 5060
    regseconds: 1407744248
   defaultuser: 660
   fullcontact: sip:660@PU.BL.IC.IP:5060
     regserver:
     useragent:
        lastms: 0
          host: dynamic
          type: friend
       context: default
          deny: 0.0.0.0/0.0.0.0
        permit: PU.BL.IC.IP
        secret: NULL
     md5secret: NULL
          avpf: yes
     force_avp: yes
    icesupport: yes
   directmedia: yes
    encryption: yes
           nat: force_rport,comedia
     callgroup: NULL
   pickupgroup: NULL
      language: NULL
      disallow: NULL
         allow: NULL
        setvar: NULL
      callerid: NULL
      amaflags: NULL
  videosupport: no
maxcallbitrate: NULL
       mailbox: NULL
      regexten: NULL
    fromdomain: testers.com
      fromuser: NULL
       qualify: NULL
     defaultip: NULL
 outboundproxy: PU.BL.IC.IP
 contactpermit: NULL
   contactdeny: NULL
      fullname: NULL
    cid_number: NULL
   callingpres: NULL
  mohinterpret: NULL
    mohsuggest: NULL
  hasvoicemail: NULL
  subscribemwi: NULL
       vmexten: NULL
  rtpkeepalive: NULL
directrtpsetup: yes
    dtlsenable: yes
    dtlsverify: no
dtlsprivatekey: /etc/asterisk/keys/asterisk.pem
     dtlssetup: actpass
  dtlscertfile: /etc/asterisk/keys/asterisk.pem
    dtlscafile: /etc/asterisk/keys/ca.crt
     sippasswd: md5ofmypwd
          rpid: NULL
        domain: testers.com
    sippasswd2: NULL






This is how all other clients are currently defined:


            id: 7
          name: 771
        ipaddr: PU.BL.IC.IP
          port: 5060
    regseconds: 1407748788
   defaultuser: 771
   fullcontact: sip:771@PU.BL.IC.IP:5060
     regserver:
     useragent:
        lastms: 0
          host: dynamic
          type: friend
       context: default
          deny: 0.0.0.0/0.0.0.0
        permit: PU.BL.IC.IP
        secret: NULL
     md5secret: NULL
          avpf: no
     force_avp: NULL
    icesupport: NULL
   directmedia: yes
    encryption: NULL
           nat: force_rport,comedia
     callgroup: NULL
   pickupgroup: NULL
      language: NULL
      disallow: NULL
         allow: NULL
        setvar: NULL
      callerid: NULL
      amaflags: NULL
  videosupport: NULL
maxcallbitrate: NULL
       mailbox: NULL
      regexten: NULL
    fromdomain: testers.com
      fromuser: NULL
       qualify: NULL
     defaultip: NULL
 outboundproxy: PU.BL.IC.IP
 contactpermit: NULL
   contactdeny: NULL
      fullname: NULL
    cid_number: NULL
   callingpres: NULL
  mohinterpret: NULL
    mohsuggest: NULL
  hasvoicemail: NULL
  subscribemwi: NULL
       vmexten: NULL
  rtpkeepalive: NULL
directrtpsetup: NULL
    dtlsenable: NULL
    dtlsverify: NULL
dtlsprivatekey: NULL
     dtlssetup: NULL
  dtlscertfile: NULL
    dtlscafile: NULL
     sippasswd: 27e13af7c596313350986c58c9d24946
          rpid: NULL
        domain: testers.com
    sippasswd2: NULL




cheers,
Olli

[paul.belanger at polyb...]

On Mon, Aug 11, 2014 at 4:45 AM, Olli Heiskanen
<ohjelmistoarkkitehti@gmail.com> wrote:

[ohjelmistoarkkitehti a...]

Hello,

Thank You Paul for your reply,


The registrations in my setup are not duplicated, the 'secret' field in the realtime table is empty, which causes Asterisk to not authenticate requests from my Kamailio. Kamailio handles registrations, and also routes the traffic to Asterisk using dispatcher. Also, all peers have the Kamailio ip:port as outbound proxy so all traffic goes through Kamailio.


Looks like version 11.11 works differently, I'll try to revert back to a previous version, and see if that works. I know at least the 'force_avp' field is new to 11.11 so it's safe to assume there's some difference between versions in rtp profile handling. 


It would be good to know how to handle this scenario in the new versions as well, I'll probably need to upgrade ahead anyway.


Thanks,
Olli





2014-08-12 1:56 GMT+03:00 Paul Belanger <paul.belanger@polybeacon.com (paul.belanger@polybeacon.com)>:

[ohjelmistoarkkitehti a...]

Okay, tried reverting to Asterisk 11.10.2. I didn't change the realtime table yet, but now when calling from websocket client to another websocket client, cli says:


WARNING[30620][C-00000000]: chan_sip.c:11056 process_sdp_a_dtls: Unsupported fingerprint hash type 'sha-2' received on dialog '36ns50nk1fo04pu3m7lf'

WARNING[30620][C-00000000]: chan_sip.c:10509 process_sdp: Rejecting secure audio stream without encryption details: audio 10640 RTP/SAVPF 111 103 104 0 8 106 105 13 126



This many times, until the forking capacity of Kamailio has been reached and call fails. The clients are running on chrome, and calls have worked before... I wonder if I should revert further back and/or change or remove some realtime table fields?


cheers,
Olli



2014-08-12 11:17 GMT+03:00 Olli Heiskanen <ohjelmistoarkkitehti@gmail.com (ohjelmistoarkkitehti@gmail.com)>:

[paul.belanger at polyb...]

On Tue, Aug 12, 2014 at 4:17 AM, Olli Heiskanen
<ohjelmistoarkkitehti@gmail.com> wrote:

[ohjelmistoarkkitehti a...]

Hi,

Wow, thanks Paul, realizing the problem makes a lot of sense. 


So I setup Kamailio as a peer, but if I disable chan_sip module completely, I can't do it in sip.conf like I'd otherwise assume to do. I tried to rebuild Asterisk without chan_sip, but I guess that's not quite the way to go? Asterisk stopped sending back any sip messages so either there is a configuration means on how to do this or I'm doing something wrong with my current setup. My next thought was to compile Asterisk normally and set rtcachefriends to no, that did not work either, when dialing the cli stated:
app_dial.c:2437 dial_exec_full: Unable to create channel of type 'SIP' (cause 20 - Subscriber absent) 
which I guess says Asterisk does not know where to send the message. 


The inner workings of Asterisk is a bit beyond me, if you don't mind giving advice on how to proceed I'd be most grateful.


cheers,
Olli



2014-08-12 17:40 GMT+03:00 Paul Belanger <paul.belanger@polybeacon.com (paul.belanger@polybeacon.com)>:

[paul.belanger at polyb...]

On Wed, Aug 13, 2014 at 4:35 AM, Olli Heiskanen
<ohjelmistoarkkitehti@gmail.com> wrote:

[ohjelmistoarkkitehti a...]

Aaa now I understood better, thanks! 


That's the instruction I used originally to write my Kamailio config, but I wasn't sure on how the sdp was supposed to be altered at which places in the whole SIP flow. I was thinking the original INVITE with the original sdp would go all the way to the receiving client, which return 488, which Kamailio would pick up and use rtpengine to alter the sdp at that point. 


So I'll need to alter the sdp every time before sending it to the Asterisk servers altogether and so avoid all the hassle I've been having with Asterisk.


cheers,
Olli



2014-08-13 20:07 GMT+03:00 Paul Belanger <paul.belanger@polybeacon.com (paul.belanger@polybeacon.com)>:

[ohjelmistoarkkitehti a...]

Hello,

After having thought this through a bit I have some thoughts I'd like to share.


In this case where the rtp profile is RTP/AVP Asterisk accepts and handles the call normally. If a webrtc client calls a sip client, or even another webrtc client, rtpengine is needed to step in (in my setup most of the clients would indeed be webrtc, but some of them might be sip). I think it would be better to use RTP/SAVPF throughout the process if both clients are webrtc (or otherwise speak RTP/SAVPF), but currently there is no way to accomplish this? 


Is it possible to configure Asterisk to only accept the RTP/SAVPF profile, and send 488 to all others? If it's not possible to force Asterisk to ignore rtp profiles (thus allowing the sdp be handled by rtpengine entirely), I'd prefer to use RTP/SAVPF or RTP/SAVP in the communication between Kamailio and Asterisk servers and use rtpengine to bridge to RTP/AVP and RTP/AVPF only if the client cannot speak securely. 


I'd very much like to hear opinions and thoughts on these. 


cheers,
Olli













2014-08-13 20:39 GMT+03:00 Olli Heiskanen <ohjelmistoarkkitehti@gmail.com (ohjelmistoarkkitehti@gmail.com)>:

[paul.belanger at polyb...]

On Fri, Aug 15, 2014 at 10:41 AM, Olli Heiskanen
<ohjelmistoarkkitehti@gmail.com> wrote:

[ohjelmistoarkkitehti a...]

Thanks Paul, I appreciate your thoughts.

I understand your way, it's logical in your environment. I prefer to use LTS versions of Asterisk so I'm guessing what I want to do is not quite possible with Asterisk 11.


I'd prefer my setup to work like this in different cases.


webrtc (rtp/savpf) -- kamailio -- asterisk -- kamailio -- webrtc (rtp/savpf)
sip (rtp/avp) -- kamailio -- rtpengine (rtp/savpf) -- asterisk -- kamailio -- rtpengine (rtp/avp) -- sip (rtp/avp)
webrtc (rtp/savpf) -- kamailio -- asterisk -- kamailio -- rtpengine (rtp/avp) -- sip (rtp/avp)


... essentially, using RTP/AVP only when the client does not speak securely.


It appears I'll have to try out the RTP/AVP way until there is an Asterisk that can accomplish this without having to use peer-specific settings. Down-side to this is that rtpengine needs resources from the server for webrtc clients even though both ends speak the same profile.


It's not so complicated now that I know more on what Asterisk supports and how it handles the sdp, I just needed to learn by doing, testing and asking. I must be a bit ahead of my time for going for a RTP/SAVPF within my architecture, but using RTP/AVP is not such a bad option as srtp is on its way anyway in future Asterisk versions and the rtp flowing between Kamailio and users' networks are far more important than internal rtp traffic.


cheers,
Olli









2014-08-15 18:48 GMT+03:00 Paul Belanger <paul.belanger@polybeacon.com (paul.belanger@polybeacon.com)>:

[paul.belanger at polyb...]

On Fri, Aug 15, 2014 at 12:17 PM, Olli Heiskanen
<ohjelmistoarkkitehti@gmail.com> wrote: