SRTP: Crypto line UNENCRYPTED_SRTCP and FEC_ORDER=FEC_SRTP_BEFORE_SRTCP

Telephony
1

Hi everyone,

We want to add a Cisco SBC to the SIP bridge and secure SIP and SRTP. The SBC currently offers the following crypto attributes:

a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:VmzmISmJO70Qntt3ZNqw4od6XHk6m9/kD/8Qeaum|2^48
a=crypto:2 AES_CM_128_HMAC_SHA1_80 inline:j/azhfJjX2cv+xwOOH8W7aks30PDRN7MzyRML7UX|2^48 UNENCRYPTED_SRTCP
a=crypto:3 AES_CM_128_HMAC_SHA1_32 inline:5o4Q3F/jy8IqOAJggwf2gaSx/dKBhq6XeH8tnh1b|2^48
a=crypto:4 AES_CM_128_HMAC_SHA1_32 inline:ab8ZeQ4oNJpe2ORlf4zszeomouaCfCWJdJ7LV2cm|2^48 UNENCRYPTED_SRTCP

Now the SDP parser for the media packet has a problem with the session‑parameter UNENCRYPTED_SRTCP. The parser thinks that everything after the ‘|’ is part of the lifetime value, so it throws a parsing error:

“invalid lifetime parameter “2^48 UNENCRYPTED_SRTCP”: invalid exponent in 2^48 UNENCRYPTED_SRTCP: strconv.ParseUint: parsing “48 UNENCRYPTED_SRTCP”: invalid syntax”

Does anyone have an idea how to handle this?

2

I haven’t come across this before, so others may have different advice.

As far as I can see, LiveKit do not support UNENCRYPTED_SRTCP, you would need to adjust the Cisco SBC to offer standard SRTP crypto lines without UNENCRYPTED_SRTCP.

And, enable secure trunking as detailed here:

3

I have created a pull request for the livekit media kit, that such crypto lines are ignored. If the SBC sends no suitable crypto line, there will be no connection, but if there is one, we get a connection.