[asterisk-users] SRTP unprotect: authentication failure

[Nick Ustinov]

Hello! 
Ater several successful SRTP-enabled calls with SRTP set to Mandatory, asterisk starts to give the following warnings in Log: 

WARNING[13714] res_srtp.c: SRTP unprotect: authentication failure  (continiously)

and client hears no sound. After i restart the client program it works fine again for a while. Then the same warning again. 

Asterisk 1.8.1.1, RealTime engine, sip peer has encrytion->yes
The client program is CSipSimple on Android 


Here are some log file traces:
Peer 0010101 is calling some number that is routed to context a2billing


[2010-12-23 11:06:22] DEBUG[5941] sip/sdp_crypto.c: local_key64 3gWGFJAffj4Pn393BUPwe3/wOMx5/ndZyPtfno7L len 40
[2010-12-23 11:06:22] DEBUG[5941] sip/sdp_crypto.c: SRTP policy activated
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: Processing media-level (audio) SDP a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:0VyG/fnup0U9qDoTGlWvVuE5yAef5MfYU6F67oI+... OK.
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: We've already processed a crypto attribute, skipping 'crypto:2 AES_CM_128_HMAC_SHA1_32 inline:5X/Zqep5tNdDGFhOY1//VFQ7diCCH1Y1FUKgYXLp'
...
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: *** Our native formats are 0x100 (g729) 
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: *** Joint capabilities are 0x100 (g729) 
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: *** Our capabilities are 0x10e (gsm|ulaw|alaw|g729) 
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: *** AST_CODEC_CHOOSE formats are 0x100 (g729) 
...
010-12-23 11:06:22] DEBUG[5941] chan_sip.c: build_route: Contact hop: <sip:0010101 at 78.84.207.114:5060;transport=UDP;ob>
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: Incoming INVITE with 'timer' option supported and "Session-Expires" header.
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: Session-Expires: 1800
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: Received Min-SE: 90
...
[2010-12-23 11:06:22] DEBUG[5931] chan_sip.c: -REALTIME- peer built. Name: 0010101. Peer objects: 660
[2010-12-23 11:06:22] DEBUG[5931] netsock2.c: Splitting '78.84.207.114' gives...
[2010-12-23 11:06:22] DEBUG[5931] netsock2.c: ...host '78.84.207.114' and port '(null)'.
[2010-12-23 11:06:22] DEBUG[5931] chan_sip.c: Not an IPv4 nor IPv6 address, cannot get port.
[2010-12-23 11:06:22] DEBUG[5931] chan_sip.c: Not an IPv4 nor IPv6 address, cannot set port.
[2010-12-23 11:06:22] DEBUG[5931] chan_sip.c: -REALTIME- loading peer from database to memory. Name: 0010101. Peer objects: 660
[2010-12-23 11:06:22] DEBUG[5931] chan_sip.c: Destroying SIP peer 0010101
[2010-12-23 11:06:22] DEBUG[5931] chan_sip.c: -REALTIME- peer Destroyed. Name: 0010101. Realtime Peer objects: 659
[2010-12-23 11:06:22] DEBUG[5931] devicestate.c: Changing state for SIP/0010101 - state 1 (Not in use)

is this normal here? peer destroyed?

[2010-12-23 11:06:22] DEBUG[5931] devicestate.c: device 'SIP/0010101' state '1'
[2010-12-23 11:06:22] WARNING[8264] res_srtp.c: SRTP unprotect: authentication failure
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: = Looking for  Call ID: 2WZXYS-qTPPfXylUor4tckg25TetmIVP (Checking From) --From tag 50FYKcXAUIrUwsIpR5xm9pjrSrMaDglb --To-tag as46be1cdb  
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: **** Received ACK (6) - Command in SIP ACK
[2010-12-23 11:06:22] DEBUG[5941] chan_sip.c: Stopping retransmission on '2WZXYS-qTPPfXylUor4tckg25TetmIVP' of Response 20465: Match Found
[2010-12-23 11:06:22] WARNING[8264] res_srtp.c: SRTP unprotect: authentication failure
[2010-12-23 11:06:22] WARNING[8264] res_srtp.c: SRTP unprotect: authentication failure
[2010-12-23 11:06:22] WARNING[8264] res_srtp.c: SRTP unprotect: authentication failure
[2010-12-23 11:06:22] WARNING[8264] res_srtp.c: SRTP unprotect: authentication failure
[2010-12-23 11:06:22] WARNING[8264] res_srtp.c: SRTP unprotect: authentication failure
[2010-12-23 11:06:22] WARNING[8264] res_srtp.c: SRTP unprotect: authentication failure