[asterisk-dev] Suspected chan_sip regression bug, when re-invite occurs from IPv4 to IPv6 (IPv6 is da-shit! giving us the da-shit!)

Thu Jan 4 00:36:02 CST 2018

Hi All,

  We've recently encountered an interesting bug with Asterisk 13 (the
version we are testing with), but I believe
as this is a fairly crazy (although reasonable) test scenario - the issue
may still be there.

  The scenario is the following:

UAC A ---- IPv4 + SIP + RTP ----> Asterisk --- IPv4 + SIP + RTP ---> UA B

  When the following happens, we all know that this is working correctly,
no problem there. However, during the
call, the network condition changes, namely in our case: Transit from UAC A
to Asterisk changes from IPv4 to
IPv6, thus the following happens:

UAC A ---- IPv6 + SIP + RTP ----> Asterisk --- IPv4 + SIP + RTP ---> UA B

  The SDP response in the 200 OK coming back from Asterisk is malformed,
and contains IPv4 addresses in the
SDP, although it shouldn't. For example (pay attention to the bolded
section):

INVITE sip:4015@[2a03:b0c0:1:d0::176b:1001]:5090 SIP/2.0
Via: SIP/2.0/UDP
[2001:470:1f06:404:8562:7dba:63c9:3986]:5090;rport;branch=z9hG4bKPj.gYD2Pm-L3SCeUUj8Ne69O7AjM27TNq1

Max-Forwards: 70
From: sip:4015 at xxxxxx.dev.greenfieldtech.net;tag=7lAWRIh6cVthKG-XFN-bCRvGnlBRG6Gq

To: sip:600 at xxxxxx.dev.greenfieldtech.net;tag=as4b993656
Contact: <sip:4015@[2001:470:1f06:404:8562:7dba:63c9:3986]:5090;ob>
Call-ID: RqxyicrI6s6vrih1XJMU-GvHFeo9x3IE
CSeq: 18030 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY,
REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800;refresher=uas
Min-SE: 90
Content-Type: application/sdp
Content-Length: 584

v=0
o=- 3723897380 3723897382 IN IP4 100.101.10.126
s=pjmedia
b=AS:117
t=0 0
a=X-nat:0
m=audio 4002 RTP/AVP 98 97 99 104 3 0 8 9 120 96
c=IN IP6 2001:470:1f06:404:8562:7dba:63c9:3986
b=TIAS:96000
a=rtcp:4003 IN IP6 2001:470:1f06:404:8562:7dba:63c9:3986
a=sendrecv
a=rtpmap:98 speex/16000
a=rtpmap:97 speex/8000
a=rtpmap:99 speex/32000
a=rtpmap:104 iLBC/8000
a=fmtp:104 mode=30
a=rtpmap:3 GSM/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:9 G722/8000
a=rtpmap:120 opus/48000/2
a=fmtp:120 useinbandfec=1
a=rtpmap:96 telephone-event/8000
a=fmtp:96 0-16

INVITE sip:4015@[2a03:b0c0:1:d0::176b:1001]:5090 SIP/2.0
Via: SIP/2.0/UDP
[2001:470:1f06:404:8562:7dba:63c9:3986]:5090;rport;branch=z9hG4bKPj.gYD2Pm-L3SCeUUj8Ne69O7AjM27TNq1

Max-Forwards: 70
From: sip:4015 at xxxxxx.dev.greenfieldtech.net;tag=7lAWRIh6cVthKG-XFN-bCRvGnlBRG6Gq

To: sip:600 at xxxxxx.dev.greenfieldtech.net;tag=as4b993656
Contact: <sip:4015@[2001:470:1f06:404:8562:7dba:63c9:3986]:5090;ob>
Call-ID: RqxyicrI6s6vrih1XJMU-GvHFeo9x3IE
CSeq: 18030 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY,
REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub
Session-Expires: 1800;refresher=uas
Min-SE: 90
Content-Type: application/sdp
Content-Length: 584

v=0
o=- 3723897380 3723897382 IN IP4 100.101.10.126
s=pjmedia
b=AS:117
t=0 0
a=X-nat:0
m=audio 4002 RTP/AVP 98 97 99 104 3 0 8 9 120 96
c=IN IP6 2001:470:1f06:404:8562:7dba:63c9:3986
b=TIAS:96000
a=rtcp:4003 IN IP6 2001:470:1f06:404:8562:7dba:63c9:3986
a=sendrecv
a=rtpmap:98 speex/16000
a=rtpmap:97 speex/8000
a=rtpmap:99 speex/32000
a=rtpmap:104 iLBC/8000
a=fmtp:104 mode=30
a=rtpmap:3 GSM/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:9 G722/8000
a=rtpmap:120 opus/48000/2
a=fmtp:120 useinbandfec=1
a=rtpmap:96 telephone-event/8000
a=fmtp:96 0-16

SIP/2.0 100 Trying
Via: SIP/2.0/UDP
[2001:470:1f06:404:8562:7dba:63c9:3986]:5090;branch=z9hG4bKPj.gYD2Pm-L3SCeUUj8Ne69O7AjM27TNq1;received=2001:470:1f06:404:8562:7dba:63c9:3986;rport=5090

From: sip:4015 at xxxxxx.dev.greenfieldtech.net;tag=7lAWRIh6cVthKG-XFN-bCRvGnlBRG6Gq

To: sip:600 at xxxxxx.dev.greenfieldtech.net;tag=as4b993656
Call-ID: RqxyicrI6s6vrih1XJMU-GvHFeo9x3IE
CSeq: 18030 INVITE
Server: Asterisk PBX 14.7.0-rc2
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO,
PUBLISH, MESSAGE
Supported: replaces, timer
Session-Expires: 1800;refresher=uas
Contact: <sip:600 at 178.yyy.zzz.231:5090>
Content-Length: 0

*SIP/2.0 200 OK Via: SIP/2.0/UDP
[2001:470:1f06:404:8562:7dba:63c9:3986]:5090;branch=z9hG4bKPj.gYD2Pm-L3SCeUUj8Ne69O7AjM27TNq1;received=2001:470:1f06:404:8562:7dba:63c9:3986;rport=5090
From: sip:4015@*xxxxxx
*.dev.greenfieldtech.net
<http://dev.greenfieldtech.net>;tag=7lAWRIh6cVthKG-XFN-bCRvGnlBRG6Gq To:
sip:600@*xxxxxx

*.dev.greenfieldtech.net <http://dev.greenfieldtech.net>;tag=as4b993656
Call-ID: RqxyicrI6s6vrih1XJMU-GvHFeo9x3IE CSeq: 18030 INVITE Server:
Asterisk PBX 14.7.0-rc2 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER,
SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE Supported: replaces, timer
Session-Expires: 1800;refresher=uas Contact: <sip:600 at 178.*yyy.zzz

*.231:5090> Content-Type: application/sdp Require: timer Content-Length:
914 *

*v=0 o=root 676069009 676069011 IN IP4 178.*yyy.zzz

*.231 s=- c=IN IP4 178.*yyy.zzz

*.231 t=0 0 m=audio 15862 RTP/AVP 120 9 8 0 104 96 a=rtpmap:120
opus/48000/2 a=rtpmap:9 G722/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:0 PCMU/8000
a=rtpmap:104 iLBC/8000 a=fmtp:104 mode=30 a=rtpmap:96 telephone-event/8000
a=fmtp:96 0-16 a=ptime:20 a=maxptime:20
a=ice-ufrag:1f57c2824b8b0c3c5a72ee310fea06d9
a=ice-pwd:6353c06e7d9dfc7810554560071162a0 a=candidate:H58842ba1 1 UDP
2130706431 [2a03:b0c0:1:d0::176b:1001] 15862 typ host a=candidate:H37d51abe
1 UDP 2130706431 [fe80::601:3dff:fe3a:a401] 15862 typ host
a=candidate:Hb23e31e7 1 UDP 2130706431 178.*yyy.zzz

*.231 15862 typ host a=candidate:H58842ba1 2 UDP 2130706430
[2a03:b0c0:1:d0::176b:1001] 15863 typ host a=candidate:H37d51abe 2 UDP
2130706430 [fe80::601:3dff:fe3a:a401] 15863 typ host a=candidate:Hb23e31e7
2 UDP 2130706430 178.*yyy.zzz

*.231 15863 typ host a=sendrecv *
ACK sip:4015@[2a03:b0c0:1:d0::176b:1001]:5090 SIP/2.0
Via: SIP/2.0/UDP
[2001:470:1f06:404:8562:7dba:63c9:3986]:5090;rport;branch=z9hG4bKPj4FSKjJqd4rqQv5cxcwWJU1D8YlXVJZj9

Max-Forwards: 70
From: sip:4015 at xxxxxx.dev.greenfieldtech.net;tag=7lAWRIh6cVthKG-XFN-bCRvGnlBRG6Gq

To: sip:600 at xxxxxx.dev.greenfieldtech.net;tag=as4b993656
Call-ID: RqxyicrI6s6vrih1XJMU-GvHFeo9x3IE
CSeq: 18030 ACK
Content-Length: 0

Now, we resolved the issue by enabling ICE at the client side, but again,
this is a workaround, not a solution.
In addition, the ICE candidates reported by Asterisk, when IPv6 is used
includes the "fe80:" subnet, which is the
link local interface, which should not be reported back as an ICE
candidate. I see no problem with reporting
an ICE candidate that is IPv4, as in this case, CGNAT can take care of that
one. However, the "c=" line, i believe,
should include the IPv6 address, not the IPv4 address of Asterisk - in
order to facilitate proper media negotiations.

This issue should also be tested for correctness with chan_pjsip. We are
using PJSIP on our mobile client, which has
a fairly different state machine than the one implemented with PJSUA or
Asterisk, but again, still needs a regression
test for verification.

Please find attached a pcap file including the complete trace of the above
issue.

Regards,
  Nir Simionovich

-- 

Kind Regards,

  Nir Simionovich

  GreenfieldTech

  (schedule) http://nirsimionovich.appointy.com/

  (w) http://www.greenfieldtech.net

  (p) +972-73-2557799        (MSN): nirs at greenfieldtech.net

  (m) +972-54-6982826      (GTALK): nir.simionovich at gmail.com

  (f) +972-73-2557202      (SKYPE): greenfieldtech.nir

----------------------------------------------------------

               Zero Your Inbox <https://mailstrom.co/referral/ARZJE> | Cloud
Servers <https://www.digitalocean.com/?refcode=97eeea09917a>

----------------------------------------------------------

*Disclaimer:*

This e-mail is intended solely for the person to whom it is addressed and
may contain confidential or legally privileged information. Access to this
e-mail by anyone else is unauthorized. If an addressing or transmission
error has misdirected this e-mail, please notify the author by replying to
this e-mail and destroy this e-mail and any attachments.
E-mail may be susceptible to data corruption, interception, unauthorized
amendment, viruses and delays or the consequences thereof. If you are not
the intended recipient, be advised that you have received this email in
error and that any use, dissemination, forwarding, printing or copying of
this email is strictly prohibited.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20180104/7db0753f/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Asterisk_ipv4_reinvite_ipv6_transition_issue.pcapng
Type: application/octet-stream
Size: 465200 bytes
Desc: not available
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20180104/7db0753f/attachment-0001.obj>