[asterisk-bugs] [JIRA] (ASTERISK-25659) res_rtp_asterisk: ECDH not negotiated causing DTLS failure occurred on RTP instance

[Edwin Vandamme (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-25659?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=231317#comment-231317 ] 

Edwin Vandamme commented on ASTERISK-25659:
-------------------------------------------

At time of writing it is still CentOS 7.2 (1511) with the earlier mentioned openssl upgrade v1.0.1e-51.
After installing _step_1.patch and then _step_2.patch I get the following error in the Asterisk log.
{color:red}chan_sip.c: Got SIP response 603 "Failed to get local SDP" back from 11.22.33.44:38731{color}
I did not install the OpenSSL patch as I tried the patches on my production system and I am trying the out-of-the-box experience.

{code}
[Jul  7 06:52:50] VERBOSE[60744][C-00000002] pbx.c: Executing [C at C-Node:77] Dial("SIP/1-00000000", "SIP/id-to-call,20,gm(SIP/1-00000000-1)U(H-CALLED^SIP/1-00000000^1020^/files/moh.wav)") in new stack
[Jul  7 06:52:50] VERBOSE[60744][C-00000002] res_rtp_asterisk.c: DTLS ECDH initialized (automatic), faster PFS enabled
[Jul  7 06:52:50] VERBOSE[60744][C-00000002] netsock2.c: Using SIP RTP TOS bits 184
[Jul  7 06:52:50] VERBOSE[60744][C-00000002] netsock2.c: Using SIP RTP CoS mark 5
[Jul  7 06:52:50] VERBOSE[60744][C-00000002] app_dial.c: Called SIP/id-to-call
[Jul  7 06:52:50] VERBOSE[60744][C-00000002] res_musiconhold.c: Started music on hold, class 'SIP/1-00000000-1', on channel 'SIP/1-00000000'
[Jul  7 06:52:51] VERBOSE[60744][C-00000002] app_dial.c: SIP/id-to-call-00000001 is ringing
[Jul  7 06:52:51] VERBOSE[60733][C-00000002] chan_sip.c: Got SIP response 603 "Failed to get local SDP" back from 11.22.33.44:38731
[Jul  7 06:52:51] VERBOSE[60744][C-00000002] app_dial.c: SIP/id-to-call-00000001 is busy
[Jul  7 06:52:51] VERBOSE[60744][C-00000002] app_dial.c: Everyone is busy/congested at this time (1:1/0/0)
[Jul  7 06:52:51] VERBOSE[60744][C-00000002] res_musiconhold.c: Stopped music on hold on SIP/1-00000000
{code}

> res_rtp_asterisk: ECDH not negotiated causing DTLS failure occurred on RTP instance
> -----------------------------------------------------------------------------------
>
>                 Key: ASTERISK-25659
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-25659
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_rtp_asterisk
>    Affects Versions: 11.22.0, 13.9.1
>         Environment: Using the following on the server :
> CentOS	  	  	7.2	  	2015-11
> Asterisk	  	  	13.6	  	2015-10
> jansson  	  	  	2.7	  	2014-10-02
> PJSIP (pjproject)	2.4.5	2015-08-12
> sipML5  	  		2.0.2	2015-12
> Using the following on the client :
> CentOS  	  	  	7.2 KDE desktop
> Chrome Version  	47.0.2526.106 (64-bit) 
>            Reporter: Edwin Vandamme
>            Assignee: Alexander Traud
>            Severity: Minor
>         Attachments: asterisk.log, dtls_centos_step_1.patch, dtls_centos_step_2.patch, ecdh.patch, openssl-1.0.1e-ecdh-auto-dtls.patch, openssl.spec.patch
>
>
> This issue has been on the forum for over a week, but I did not get any feedback, http://forums.asterisk.org/viewtopic.php?f=1&t=96461&sid=528c724d236a38e60e868817462c6f26, so I have now escalated this as a bug report.
> Using the described environment, I get the following error in my Asterisk log :
> res_rtp_asterisk.c: DTLS failure occurred on RTP instance '0x7fe8c8024178' due to reason 'missing tmp ecdh key', terminating
> res_rtp_asterisk.c: RTP Read error: Unspecified. Hanging up.
> An earlier bug report listed this as a problem on FireFox : ASTERISK-25265
> It is said to be fixed in 13.6
> WebRTC is not yet in production on my system, due to the constant changes, but in earlier tests everything worked fine. As far as I can tell, it all started when Chrome forced the usage of https over http.
> Dialing from a WebRTC peer to Asterisks works just fine.
> For various reasons I use sip.conf, not pjsip.conf.
> Certificates used are propper certificates, not self signed versions.
> I attached (asterisk.log) part of the Asterisk log file with "sip debug on", start of call till failure.



--
This message was sent by Atlassian JIRA
(v6.2#6252)