rtpbench 0.3.0__py3-none-any.whl

rtpbench/targets/ava/http.conf

@@ -0,0 +1,4 @@
+[general]
+enabled=yes
+bindaddr=127.0.0.1
+bindport=8088

rtpbench/targets/ava/pjsip.conf

@@ -0,0 +1,19 @@
+; Asterisk for rtpbench: plain SIP over UDP and TCP, any caller, G.711 only
+[udp]
+type=transport
+protocol=udp
+bind=0.0.0.0:5060
+
+[tcp]
+type=transport
+protocol=tcp
+bind=0.0.0.0:5060
+
+[anonymous]
+type=endpoint
+context=from-caller
+disallow=all
+allow=ulaw,alaw
+direct_media=no
+rtp_symmetric=yes
+dtmf_mode=rfc4733

rtpbench/targets/ava/websocket_client.conf

@@ -0,0 +1,15 @@
+; AVA_TRANSPORT=websocket: for each call, AVA asks ARI for a WebSocket media channel on this
+; client and Asterisk connects to the engine's listener, on loopback as they share a network
+; namespace (stanza as in AVA's docs/WebSocket-Transport.md; the password is the engine's
+; ASTERISK_MEDIA_WS_PASSWORD, a test value like ARI's)
+[aava_media]
+type = websocket_client
+uri = ws://127.0.0.1:8787/media
+protocols = media
+username = aava_media
+password = asterisk
+connection_type = per_call_config
+connection_timeout = 500
+reconnect_interval = 500
+reconnect_attempts = 5
+tls_enabled = no

rtpbench/targets/livekit/agent.py

@@ -0,0 +1,111 @@
+"""rtpbench's LiveKit target: a LiveKit Agents worker on the OpenAI Realtime model through Azure
+OpenAI (`RealtimeModel.with_azure`, as LiveKit's Azure docs set it), on the structure of LiveKit's
+starter agent, set up as targets/aivc sets AI Voice Connector CE: the same instructions, welcome
+message, voice and tool descriptions, transfers to TRANSFER_TO (LiveKit's documented cold
+transfer, a SIP REFER). Before the worker starts, an inbound trunk for the number rtpbench
+dials (from any address, no auth: LiveKit wants a number, addresses or auth) and a dispatch rule
+that puts each call in its own room, as LiveKit's SIP docs create them.
+
+Env: AZURE_OPENAI_ENDPOINT, AZURE_OPENAI_API_KEY, AZURE_OPENAI_DEPLOYMENT, TRANSFER_TO,
+LIVEKIT_URL, LIVEKIT_API_KEY, LIVEKIT_API_SECRET.
+"""
+
+import asyncio
+import os
+import sys
+from pathlib import Path
+
+from livekit import api, rtc
+from livekit.agents import (
+    Agent,
+    AgentServer,
+    AgentSession,
+    JobContext,
+    RunContext,
+    cli,
+    function_tool,
+    get_job_context,
+)
+from livekit.agents.beta import EndCallTool
+from livekit.plugins import openai
+
+NUMBER = "agent"  # the Request-URI user rtpbench calls (bench.TARGETS)
+# the compose healthcheck's: the server can dispatch to this worker. Its own health check answers
+# once its HTTP server is up, seconds before it registers; a call in between gets a room no
+# worker ever joins, and rings unanswered
+REGISTERED = Path("/tmp/registered")
+
+
+class Assistant(Agent):
+    def __init__(self) -> None:
+        super().__init__(instructions="You are a helpful assistant.", tools=[EndCallTool()])
+
+    async def on_enter(self) -> None:
+        self.session.generate_reply(
+            instructions="Please greet the user with the following: Hello! How can I help you?"
+        )
+
+    @function_tool()
+    async def transfer_call(self, context: RunContext) -> str:
+        """call the function if a request was received to transfer a call with an operator, a
+        person"""
+        job = get_job_context()
+        caller = next(
+            p
+            for p in job.room.remote_participants.values()
+            if p.kind == rtc.ParticipantKind.PARTICIPANT_KIND_SIP
+        )
+        request = api.TransferSIPParticipantRequest(
+            room_name=job.room.name,
+            participant_identity=caller.identity,
+            transfer_to=os.environ["TRANSFER_TO"],
+        )
+        try:
+            await job.api.sip.transfer_sip_participant(request)
+        except Exception as e:
+            return f"transfer failed: {e}"
+        return "transferred"
+
+
+server = AgentServer()
+
+
+@server.on("worker_registered")
+def registered(worker_id: str, info: object) -> None:
+    REGISTERED.touch()
+
+
+@server.rtc_session()
+async def entrypoint(ctx: JobContext) -> None:
+    session: AgentSession = AgentSession(
+        llm=openai.realtime.RealtimeModel.with_azure(
+            azure_deployment=os.environ["AZURE_OPENAI_DEPLOYMENT"], voice="alloy"
+        )
+    )
+    await session.start(room=ctx.room, agent=Assistant())
+
+
+async def setup() -> None:
+    async with api.LiveKitAPI() as lk:
+        for _ in range(60):  # the server may still be starting
+            try:
+                await lk.sip.list_inbound_trunk(api.ListSIPInboundTrunkRequest())
+                break
+            except Exception:
+                await asyncio.sleep(1)
+        await lk.sip.create_inbound_trunk(
+            api.CreateSIPInboundTrunkRequest(
+                trunk=api.SIPInboundTrunkInfo(name="rtpbench", numbers=[NUMBER])
+            )
+        )
+        rule = api.SIPDispatchRule(
+            dispatch_rule_individual=api.SIPDispatchRuleIndividual(room_prefix="call-")
+        )
+        await lk.sip.create_dispatch_rule(api.CreateSIPDispatchRuleRequest(rule=rule))
+
+
+if __name__ == "__main__":
+    if sys.argv[1:] == ["setup"]:
+        asyncio.run(setup())
+    else:
+        cli.run_app(server)

rtpbench/targets/livekit/compose.yaml

@@ -0,0 +1,86 @@
+# LiveKit (server, SIP bridge, an Agents worker on the OpenAI Realtime model) as a target, merged
+# over ../../compose.yaml. As livekit/sip's docker-compose.yaml runs it (redis, livekit-server
+# --dev, sip; host networking there), but in the network namespace of `target` (agentnet, plus
+# egress to the AI engine), so everything is on 127.0.0.1 as upstream's is. rtpbench routes the
+# caller via the router, so SIP and RTP cross netem. Needs AZURE_OPENAI_ENDPOINT
+# (https://<resource>.openai.azure.com) and AZURE_OPENAI_API_KEY. Paths are relative to the first
+# compose file's directory.
+services:
+  target:
+    image: ${RTPBENCH_IMAGE:?}
+    cap_add: [NET_ADMIN]
+    init: true
+    depends_on: [router]
+    networks: [agentnet, egress]
+    volumes: ["livekit-sip:/sip"]
+    # upstream's SIP config, except the address in the SDP: the one facing the caller (the
+    # router's side), not one found by STUN (use_external_ip: true there)
+    command:
+      - sh
+      - -c
+      - >-
+        python3 -c 'import socket as s; u = s.socket(2, 2);
+        u.connect((s.gethostbyname("router"), 9)); ip = u.getsockname()[0];
+        open("/sip/config.yaml", "w").write("api_key: devkey\napi_secret: secret\n"
+        "ws_url: ws://localhost:7880\nredis:\n  address: localhost:6379\nsip_port: 5060\n"
+        "rtp_port: 10000-20000\nnat_1_to_1_ip: " + ip + "\nlogging:\n  level: debug\n")'
+        && exec sleep infinity
+    healthcheck:
+      test: test -e /sip/config.yaml
+      interval: 1s
+      retries: 20
+
+  redis:
+    image: redis:8.2-alpine@sha256:b51665e66f00759be7c3152ad5ac3c66fb2f619c13ef62dea7cc1f9914524635
+    network_mode: service:target
+    depends_on: [target]
+
+  livekit:
+    image: livekit/livekit-server:v1.13.9@sha256:d0c04791bf63ca8dcea123571827d56ba9504bd57c8d5de60ee03b5408cc3154
+    network_mode: service:target
+    depends_on: [redis]
+    command: --dev --redis-host localhost:6379
+
+  sip:
+    image: livekit/sip:v1.19.0@sha256:4398c3794cfb0c62fd118ffa8fec42f386bf906106e656da011e0961223cb8b8
+    network_mode: service:target
+    depends_on:
+      target: { condition: service_healthy }
+      livekit: { condition: service_started }
+    volumes: ["livekit-sip:/sip:ro"]
+
+  agent-worker:
+    build:
+      context: ./targets/livekit
+      dockerfile_inline: |
+        FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f
+        COPY constraints.txt /tmp/constraints.txt
+        RUN pip install --no-cache-dir "livekit-agents[openai]==1.8.7" -c /tmp/constraints.txt
+        WORKDIR /app
+        COPY agent.py .
+    image: ${RTPBENCH_REGISTRY:?}/rtpbench-livekit-agent:1.8.7${RTPBENCH_BUILD_AGENT_WORKER:-}
+    network_mode: service:target
+    depends_on: [livekit, sip]
+    environment:
+      LIVEKIT_URL: ws://localhost:7880
+      LIVEKIT_API_KEY: devkey
+      LIVEKIT_API_SECRET: secret
+      AZURE_OPENAI_ENDPOINT: ${AZURE_OPENAI_ENDPOINT:?set AZURE_OPENAI_ENDPOINT}
+      AZURE_OPENAI_API_KEY: ${AZURE_OPENAI_API_KEY:?set AZURE_OPENAI_API_KEY}
+      AZURE_OPENAI_DEPLOYMENT: ${AZURE_OPENAI_DEPLOYMENT:-gpt-realtime-2.1}
+      TRANSFER_TO: sip:operator@operator
+    command: sh -c 'python agent.py setup && exec python agent.py start'
+    # ready once the worker has registered with the server (agent.py REGISTERED), while its own
+    # health check passes (it fails once the worker has lost the server for good)
+    healthcheck:
+      test: >-
+        test -e /tmp/registered &&
+        python -c 'import urllib.request as u; u.urlopen("http://127.0.0.1:8081")'
+      interval: 1s
+      retries: 60
+
+networks:
+  egress:
+
+volumes:
+  livekit-sip:

rtpbench/targets/livekit/constraints.txt

@@ -0,0 +1,72 @@
+aiofiles==25.1.0
+aiohappyeyeballs==2.7.1
+aiohttp==3.14.5
+aiosignal==1.4.0
+annotated-doc==0.0.5
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+av==19.0.1
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.2
+click==8.5.0
+colorama==0.4.6
+docstring_parser==0.18.0
+eval_type_backport==0.4.0
+frozenlist==1.8.0
+googleapis-common-protos==1.75.5
+grpcio==1.84.0
+h11==0.16.0
+httpcore2==2.13.1
+httpx2==2.13.1
+idna==3.20
+jiter==0.17.0
+json_repair==0.63.5
+livekit==1.1.20
+livekit-agents==1.8.7
+livekit-api==1.2.2
+livekit-blingfire==1.2.0
+livekit-local-inference==0.2.7
+livekit-plugins-openai==1.8.7
+livekit-protocol==1.1.27
+markdown-it-py==4.2.0
+mdurl==0.1.2
+multidict==7.1.0
+nest-asyncio==1.6.0
+numpy==2.5.4
+openai==3.33.0
+opentelemetry-api==1.45.1
+opentelemetry-exporter-http-transport==0.66b1
+opentelemetry-exporter-otlp==1.45.1
+opentelemetry-exporter-otlp-common==0.66b1
+opentelemetry-exporter-otlp-proto-common==1.45.1
+opentelemetry-exporter-otlp-proto-grpc==1.45.1
+opentelemetry-exporter-otlp-proto-http==1.45.1
+opentelemetry-proto==1.45.1
+opentelemetry-sdk==1.45.1
+opentelemetry-semantic-conventions==0.66b1
+pillow==13.0.0
+prometheus_client==0.26.0
+propcache==0.5.4
+protobuf==7.36.2
+psutil==7.2.2
+pycparser==3.11
+pydantic==2.14.1
+pydantic_core==2.50.1
+Pygments==2.21.0
+PyJWT==2.15.1
+PyYAML==6.0.3
+requests==2.34.2
+rich==15.0.0
+shellingham==1.5.4
+sniffio==1.3.1
+sounddevice==0.5.6
+truststore==0.10.5
+typer==0.27.3
+types-protobuf==7.35.1.20260906
+typing-inspection==0.4.4
+typing_extensions==4.16.0
+urllib3==2.8.0
+watchfiles==1.3.0
+yarl==1.25.1

rtpbench/tls.py

@@ -0,0 +1,284 @@
+"""SIP over TLS read back from a capture: TLS connections in the TCP streams decrypted with the
+caller's key log (the SSLKEYLOGFILE format OpenSSL and Wireshark use), so judging reads the
+messages that crossed the wire at the times they crossed it. TLS 1.3, and TLS 1.2 with the
+AEAD suites the caller offers. Also the stack's test certificates."""
+
+import bisect
+import datetime
+import hmac
+import struct
+from pathlib import Path
+
+from cryptography import x509
+from cryptography.exceptions import InvalidTag
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM, ChaCha20Poly1305
+from cryptography.hazmat.primitives.kdf.hkdf import HKDFExpand
+from cryptography.x509.oid import ExtendedKeyUsageOID, NameOID
+
+from rtpbench import pcap
+
+Aead = type[AESGCM] | type[ChaCha20Poly1305]
+# cipher suite: AEAD, key length, hash
+TLS13: dict[int, tuple[Aead, int, str]] = {
+    0x1301: (AESGCM, 16, "sha256"),
+    0x1302: (AESGCM, 32, "sha384"),
+    0x1303: (ChaCha20Poly1305, 32, "sha256"),
+}
+TLS12: dict[int, tuple[Aead, int, str]] = {
+    0xC02B: (AESGCM, 16, "sha256"),  # ECDHE-ECDSA-AES128-GCM-SHA256
+    0xC02F: (AESGCM, 16, "sha256"),  # ECDHE-RSA-AES128-GCM-SHA256
+    0xC02C: (AESGCM, 32, "sha384"),  # ECDHE-ECDSA-AES256-GCM-SHA384
+    0xC030: (AESGCM, 32, "sha384"),  # ECDHE-RSA-AES256-GCM-SHA384
+    0xCCA8: (ChaCha20Poly1305, 32, "sha256"),  # ECDHE-RSA-CHACHA20-POLY1305
+    0xCCA9: (ChaCha20Poly1305, 32, "sha256"),  # ECDHE-ECDSA-CHACHA20-POLY1305
+}
+CIPHERS_12 = "ECDHE+AESGCM:ECDHE+CHACHA20"  # what the caller offers below TLS 1.3: AEAD only
+_HASHES = {"sha256": hashes.SHA256, "sha384": hashes.SHA384}
+_HANDSHAKE, _CHANGE_CIPHER_SPEC, _APPLICATION_DATA, _KEY_UPDATE = 22, 20, 23, 24
+
+Flow = tuple[str, int, str, int]
+Records = list[tuple[int, int, bytes, bytes]]  # offset in the stream, type, header, fragment
+
+
+def keylog(path: Path) -> dict[tuple[str, bytes], bytes]:
+    """(label, client random) -> secret, from a key log."""
+    out = {}
+    for line in path.read_text().splitlines():
+        fields = line.split()
+        if len(fields) == 3 and not line.startswith("#"):
+            out[fields[0], bytes.fromhex(fields[1])] = bytes.fromhex(fields[2])
+    return out
+
+
+def streams(grams: list[pcap.Datagram], keys: Path | None) -> list[pcap.Datagram]:
+    """`pcap.streams(grams)`, but each TLS connection's application data in its place,
+    decrypted with the key log `keys`: one piece per record, at the capture time of the
+    segment that brought the record's first byte."""
+    segs = pcap.streams(grams)
+    flows: dict[Flow, tuple[bytearray, list[int], list[int]]] = {}  # stream, offsets, times
+    for g in segs:
+        data, offs, times = flows.setdefault(
+            (g.src, g.sport, g.dst, g.dport), (bytearray(), [], [])
+        )
+        offs.append(len(data))
+        times.append(g.t_ns)
+        data += g.payload
+    clients = [f for f, (data, _, _) in flows.items() if _hello(data)]
+    tls = {*clients, *map(_back, clients)}
+    out = [g for g in segs if (g.src, g.sport, g.dst, g.dport) not in tls]
+    secrets = keylog(keys) if keys and keys.exists() else {}
+    for flow in clients:
+        back = _back(flow)
+        server = bytes(flows[back][0]) if back in flows else b""
+        sides = _connection(bytes(flows[flow][0]), server, secrets, flow)
+        for f, pieces in zip((flow, back), sides, strict=True):
+            for off, plain in pieces:
+                _, offs, times = flows[f]
+                t = times[bisect.bisect_right(offs, off) - 1]
+                out.append(pcap.Datagram(t, *f, plain, True))
+    return sorted(out, key=lambda g: g.t_ns)
+
+
+def _back(flow: Flow) -> Flow:
+    return flow[2], flow[3], flow[0], flow[1]
+
+
+def _hello(data: bytes | bytearray) -> bool:
+    """The stream opens with a TLS ClientHello."""
+    return len(data) > 5 and data[0] == _HANDSHAKE and data[1] == 3 and data[5] == 1
+
+
+def _records(data: bytes) -> Records:
+    out, pos = [], 0
+    while pos + 5 <= len(data):
+        length = struct.unpack_from("!H", data, pos + 3)[0]
+        if pos + 5 + length > len(data):  # cut short: the capture ended inside it
+            break
+        out.append((pos, data[pos], data[pos : pos + 5], data[pos + 5 : pos + 5 + length]))
+        pos += 5 + length
+    return out
+
+
+def _connection(
+    client: bytes, server: bytes, secrets: dict[tuple[str, bytes], bytes], flow: Flow
+) -> tuple[list[tuple[int, bytes]], list[tuple[int, bytes]]]:
+    """Application data of each side (stream offset of its record, plaintext)."""
+    sent, got = _records(client), _records(server)
+    hello = got[0][3] if got and got[0][1] == _HANDSHAKE else b""
+    if len(hello) < 39 or hello[0] != 2 or len(hello) < 41 + hello[38]:
+        return [], []  # no ServerHello (an alert, or nothing): nothing was ever encrypted
+    random = sent[0][3][6:38]  # ClientHello: type, length (3), version (2), random
+    # ServerHello (`hello`): likewise, then the session id and the cipher suite
+    suite = struct.unpack_from("!H", hello, 39 + hello[38])[0]
+    where = f"TLS {flow[0]}:{flow[1]} -> {flow[2]}:{flow[3]}"
+    if ("CLIENT_TRAFFIC_SECRET_0", random) in secrets:
+        if suite not in TLS13:
+            raise ValueError(f"{where}: TLS 1.3 cipher suite {suite:#06x} not supported")
+
+        def side(name: str, records: Records) -> list[tuple[int, bytes]]:
+            hs, app = (
+                secrets[f"{name}_{s}", random]
+                for s in ("HANDSHAKE_TRAFFIC_SECRET", "TRAFFIC_SECRET_0")
+            )
+            return _open13(records, suite, hs, app, where)
+
+        return side("CLIENT", sent), side("SERVER", got)
+    if (master := secrets.get(("CLIENT_RANDOM", random))) is None:
+        raise ValueError(f"{where}: no keys for it in the key log")
+    if suite not in TLS12:
+        raise ValueError(f"{where}: TLS 1.2 cipher suite {suite:#06x} not supported")
+    aead, size, h = TLS12[suite]
+    iv = 4 if aead is AESGCM else 12
+    block = _prf(h, master, b"key expansion", hello[6:38] + random, 2 * (size + iv))
+    keys = block[: 2 * size]
+    ivs = block[2 * size :]
+    return (
+        _open12(sent, aead, keys[:size], ivs[:iv], where),
+        _open12(got, aead, keys[size:], ivs[iv:], where),
+    )
+
+
+def _expand(h: str, secret: bytes, label: bytes, length: int) -> bytes:
+    """HKDF-Expand-Label (RFC 8446 7.1), with an empty context."""
+    full = b"tls13 " + label
+    info = struct.pack("!HB", length, len(full)) + full + b"\x00"
+    return HKDFExpand(_HASHES[h](), length, info).derive(secret)
+
+
+def _open13(
+    records: Records, suite: int, handshake: bytes, application: bytes, where: str
+) -> list[tuple[int, bytes]]:
+    """One side's records of a TLS 1.3 connection: handshake keys first, then the application
+    keys (whichever opens the record; AEAD tags make the choice unambiguous), following any
+    KeyUpdate (RFC 8446 7.2)."""
+    aead, size, h = TLS13[suite]
+
+    def keys(secret: bytes) -> tuple[AESGCM | ChaCha20Poly1305, int]:
+        return aead(_expand(h, secret, b"key", size)), int.from_bytes(_expand(h, secret, b"iv", 12))
+
+    (cipher, iv), secret, seq, stage = keys(handshake), handshake, 0, 0
+    out = []
+    for off, kind, head, frag in records:
+        if kind != _APPLICATION_DATA:  # hellos and change_cipher_spec, in the clear
+            continue
+        while True:
+            try:
+                plain = cipher.decrypt((iv ^ seq).to_bytes(12), frag, head)
+                break
+            except InvalidTag:
+                if stage:
+                    raise ValueError(f"{where}: a record does not decrypt") from None
+                (cipher, iv), secret, seq, stage = keys(application), application, 0, 1
+        seq += 1
+        plain = plain.rstrip(b"\x00")  # padding, then the real content type
+        inner, plain = plain[-1], plain[:-1]
+        if inner == _APPLICATION_DATA:
+            out.append((off, plain))
+        elif inner == _HANDSHAKE and stage and plain[:1] == bytes([_KEY_UPDATE]):
+            secret = _expand(h, secret, b"traffic upd", _HASHES[h]().digest_size)
+            (cipher, iv), seq = keys(secret), 0
+    return out
+
+
+def _prf(h: str, secret: bytes, label: bytes, seed: bytes, length: int) -> bytes:
+    """The TLS 1.2 PRF (RFC 5246 5)."""
+    seed, a, out = label + seed, label + seed, b""
+    while len(out) < length:
+        a = hmac.digest(secret, a, h)
+        out += hmac.digest(secret, a + seed, h)
+    return out[:length]
+
+
+def _open12(
+    records: Records, aead: Aead, key: bytes, iv: bytes, where: str
+) -> list[tuple[int, bytes]]:
+    """One side's records of a TLS 1.2 connection, encrypted from its ChangeCipherSpec on."""
+    cipher, seq, on, out = aead(key), 0, False, []
+    for off, kind, head, frag in records:
+        if kind == _CHANGE_CIPHER_SPEC:
+            on = True
+            continue
+        if not on:
+            continue
+        if aead is AESGCM:  # RFC 5288: 4 bytes of the key block, 8 sent with each record
+            nonce, body = iv + frag[:8], frag[8:]
+        else:  # RFC 7905
+            nonce, body = (int.from_bytes(iv) ^ seq).to_bytes(12), frag
+        aad = struct.pack("!QB", seq, kind) + head[1:3] + struct.pack("!H", len(body) - 16)
+        try:
+            plain = cipher.decrypt(nonce, body, aad)
+        except InvalidTag:
+            raise ValueError(f"{where}: a record does not decrypt") from None
+        seq += 1
+        if kind == _APPLICATION_DATA:
+            out.append((off, plain))
+    return out
+
+
+def certificates(directory: Path, names: list[str]) -> None:
+    """A test CA (stack-ca.pem) and one certificate it signs for every name (server.crt, with
+    the CA, and server.key), valid for two days: the stack's TLS servers present it."""
+    directory.mkdir(parents=True, exist_ok=True)
+    now = datetime.datetime.now(datetime.UTC)
+    ca_key, key = ec.generate_private_key(ec.SECP256R1()), ec.generate_private_key(ec.SECP256R1())
+    ca_name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "rtpbench test CA")])
+    ski = x509.SubjectKeyIdentifier.from_public_key(ca_key.public_key())
+
+    def cert(subject: x509.Name, public: ec.EllipticCurvePublicKey) -> x509.CertificateBuilder:
+        return (
+            x509.CertificateBuilder()
+            .subject_name(subject)
+            .issuer_name(ca_name)
+            .public_key(public)
+            .serial_number(x509.random_serial_number())
+            .not_valid_before(now - datetime.timedelta(minutes=5))
+            .not_valid_after(now + datetime.timedelta(days=2))
+            .add_extension(x509.SubjectKeyIdentifier.from_public_key(public), critical=False)
+        )
+
+    ca = (
+        cert(ca_name, ca_key.public_key())
+        .add_extension(x509.BasicConstraints(ca=True, path_length=0), critical=True)
+        .add_extension(_usage(cert_sign=True), critical=True)
+        .sign(ca_key, hashes.SHA256())
+    )
+    leaf = (
+        cert(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, names[0])]), key.public_key())
+        .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)
+        .add_extension(_usage(cert_sign=False), critical=True)
+        .add_extension(
+            x509.ExtendedKeyUsage(
+                [ExtendedKeyUsageOID.SERVER_AUTH, ExtendedKeyUsageOID.CLIENT_AUTH]
+            ),
+            critical=False,
+        )
+        .add_extension(
+            x509.SubjectAlternativeName([x509.DNSName(n) for n in names]), critical=False
+        )
+        .add_extension(
+            x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski), critical=False
+        )
+        .sign(ca_key, hashes.SHA256())
+    )
+    pem = serialization.Encoding.PEM
+    (directory / "stack-ca.pem").write_bytes(ca.public_bytes(pem))
+    (directory / "server.crt").write_bytes(leaf.public_bytes(pem) + ca.public_bytes(pem))
+    (directory / "server.key").write_bytes(
+        key.private_bytes(pem, serialization.PrivateFormat.PKCS8, serialization.NoEncryption())
+    )
+
+
+def _usage(cert_sign: bool) -> x509.KeyUsage:
+    return x509.KeyUsage(
+        digital_signature=not cert_sign,
+        content_commitment=False,
+        key_encipherment=False,
+        data_encipherment=False,
+        key_agreement=False,
+        key_cert_sign=cert_sign,
+        crl_sign=cert_sign,
+        encipher_only=False,
+        decipher_only=False,
+    )

rtpbench/uri/advertise.yaml

@@ -0,0 +1,7 @@
+# `rtpbench target URI --advertise HOST:PORT`, merged over ../compose.yaml: the host publishes the
+# caller's port range on the router, which forwards it to the caller (RTPBENCH_PORTS: first-last).
+services:
+  router:
+    ports:
+      - "${RTPBENCH_PORTS:?}:${RTPBENCH_PORTS:?}/udp"
+      - "${RTPBENCH_PORTS:?}:${RTPBENCH_PORTS:?}/tcp"

rtpbench/uri/network.yaml

@@ -0,0 +1,14 @@
+# `rtpbench target URI --network NAME`, merged over ../compose.yaml: the router also joins an
+# existing Docker network, where the agent runs (Docker drops traffic between its networks
+# otherwise). agentnet stays the router's way out whatever the networks are called.
+services:
+  router:
+    networks:
+      callnet: {}
+      agentnet: {gw_priority: 1}
+      user: {}
+
+networks:
+  user:
+    external: true
+    name: ${RTPBENCH_NETWORK:?}

rtpbench/voice.py

@@ -0,0 +1,18 @@
+"""Synthetic voiced audio with a crisp onset, and the energy gate both ends agree on."""
+
+import math
+
+RATE = 8000
+GATE = 1000  # |sample| on the 16-bit scale; the synthetic voice never dips below it for 20 ms
+
+
+def voice(seconds: float, f0: float, amplitude: int = 12000) -> list[int]:
+    """Eight cosine harmonics under a 4 Hz syllable envelope; sample 0 is the waveform's peak."""
+    norm = sum(1 / h for h in range(1, 9))
+    out = []
+    for i in range(round(seconds * RATE)):
+        t = i / RATE
+        env = 0.6 + 0.4 * math.cos(2 * math.pi * 4 * t)
+        x = sum(math.cos(2 * math.pi * h * f0 * t) / h for h in range(1, 9)) / norm
+        out.append(round(amplitude * env * x))
+    return out