rtpbench 0.3.0__py3-none-any.whl

rtpbench/capture.py

@@ -0,0 +1,33 @@
+"""tcpdump as a context manager: the pcap is the timing source of truth."""
+
+import signal
+import subprocess
+import sys
+import time
+from collections.abc import Iterator
+from contextlib import contextmanager
+from pathlib import Path
+
+
+@contextmanager
+def capture(path: Path, iface: str = "eth0", bpf: str = "udp or tcp") -> Iterator[None]:
+    # Immediate mode: without it libpcap hands packets over in blocks of up to a second, and
+    # stopping tcpdump right after a BYE loses the end of the call. 32 MiB of kernel buffer
+    # (default 2): a busy host once starved a capture of four streams into a drop.
+    cmd = ["tcpdump", "-i", iface, "-n", "-Z", "root", "--immediate-mode", "-B", "32768"]
+    cmd += ["--time-stamp-precision=nano", "-w", str(path), bpf]
+    proc = subprocess.Popen(cmd, stderr=subprocess.PIPE, text=True)
+    assert proc.stderr is not None
+    line = proc.stderr.readline()
+    if "listening on" not in line:
+        proc.kill()
+        raise RuntimeError(f"tcpdump did not start: {line.strip()}")
+    try:
+        yield
+    finally:
+        time.sleep(0.2)
+        proc.send_signal(signal.SIGINT)
+        _, err = proc.communicate(timeout=10)
+        print(f"{path.name}: " + "; ".join(err.split("\n")[:3]).strip("; "), file=sys.stderr)
+        if "\n0 packets dropped by kernel" not in err:
+            raise RuntimeError(f"tcpdump dropped packets writing {path}:\n{err}")

rtpbench/carrier/compose.yaml

@@ -0,0 +1,68 @@
+# A carrier between the router and the agent (the reference agent or a target), merged over
+# ../compose.yaml: OpenSIPS as an SBC (stateful proxy with topology hiding) and rtpengine
+# anchoring the media, as real trunks put in front of a PBX. `carrier` owns the network namespace
+# on agentnet, so caller <-> carrier crosses the netem router and carrier <-> agent does not.
+# rtpbench sets RTPBENCH_CARRIER_NEXT to the agent's host (and RTPBENCH_CARRIER_PORT, its SIP
+# port, for an agent outside the stack, which the carrier reaches through Docker's gateway).
+# Paths are relative to the first compose file's directory.
+services:
+  carrier:
+    image: ${RTPBENCH_IMAGE:?}
+    cap_add: [NET_ADMIN]
+    init: true
+    depends_on: [router]
+    networks: [agentnet]
+    volumes: ["${RTPBENCH_OUT:?}:/out"]
+    command: sh -c 'ip route replace default via $$(getent hosts router | cut -d" " -f1) && exec sleep infinity'
+
+  carrier-media:
+    build:
+      # neither build copies a file, but the tag hashes the context's: not the whole repository
+      context: ./carrier
+      dockerfile_inline: |
+        FROM debian:trixie@sha256:913f6706df59a68922d1dd08f78c2476560a8d367897200a6005b00e5f67c2d5
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends rtpengine-daemon=12.5.1.31-1 \
+            && rm -rf /var/lib/apt/lists/*
+    image: ${RTPBENCH_REGISTRY:?}/rtpbench-rtpengine:12.5.1.31${RTPBENCH_BUILD_CARRIER_MEDIA:-}
+    network_mode: service:carrier
+    depends_on: [carrier]
+    # userspace forwarding (no kernel module in a container), media on the agentnet address
+    command: >-
+      rtpengine --foreground --log-stderr --table=-1 --interface=eth0
+      --listen-ng=127.0.0.1:2223 --port-min=30000 --port-max=30999
+    healthcheck:  # its control socket (127.0.0.1:2223) bound; OpenSIPS disables a relay that
+      # does not answer its first ping, for a minute, and calls then bypass it
+      test: grep -q ' 0100007F:08AF 00000000:0000 07 ' /proc/net/udp
+      interval: 1s
+      retries: 20
+
+  carrier-sip:
+    build:  # the same OpenSIPS, with its digest authentication and TLS modules (not in the image)
+      context: ./carrier
+      dockerfile_inline: |
+        FROM opensips/opensips:3.6@sha256:81a7fa3c7bdbceaadb7cb869ff7ac3f34efb2d95cd7fecb3b689d7b6b1eb0672
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends opensips-auth-modules=3.6.9-1 \
+                opensips-tls-module=3.6.9-1 opensips-tls-openssl-module=3.6.9-1 \
+                opensips-tlsmgm-module=3.6.9-1 \
+            && rm -rf /var/lib/apt/lists/*
+    image: ${RTPBENCH_REGISTRY:?}/rtpbench-opensips:3.6.9-1-tls${RTPBENCH_BUILD_CARRIER_SIP:-}
+    network_mode: service:carrier
+    depends_on:
+      carrier-media: {condition: service_healthy}
+    volumes: ["./carrier/opensips.cfg:/etc/opensips/opensips.cfg:ro"]
+    environment:
+      CARRIER_NEXT: ${RTPBENCH_CARRIER_NEXT:?}
+      CARRIER_NEXT_PORT: ${RTPBENCH_CARRIER_PORT:-5060}
+      CARRIER_NEXT_TRANSPORT: ${RTPBENCH_CARRIER_TRANSPORT:-udp}
+      # set, the carrier demands these credentials of the caller, as a trunk may
+      CARRIER_AUTH_USER: ${RTPBENCH_CARRIER_AUTH_USER:-}
+      CARRIER_AUTH_PASSWORD: ${RTPBENCH_CARRIER_AUTH_PASSWORD:-}
+      # set, it answers the agent's challenge with these
+      CARRIER_UAC_USER: ${RTPBENCH_CARRIER_UAC_USER:-}
+      CARRIER_UAC_PASSWORD: ${RTPBENCH_CARRIER_UAC_PASSWORD:-}
+    healthcheck:
+      test: opensips-cli -x mi sr_get_status core | grep -q running
+      interval: 1s
+      retries: 20

rtpbench/carrier/opensips.cfg

@@ -0,0 +1,226 @@
+# rtpbench carrier: an SBC in front of the agent, as trunks put one. A stateful proxy that keeps
+# a dialog per call, hides the topology (the agent sees the carrier as the far end: its Via,
+# Contact and Call-ID side only) and anchors the media of both legs in rtpengine. Every request
+# goes to the host in CARRIER_NEXT, port CARRIER_NEXT_PORT, with the caller's Request-URI user,
+# over TCP if CARRIER_NEXT_TRANSPORT is tcp, except calls to the user `operator` (a transfer's
+# target), which go to the host of that name.
+#
+# A call can ask for one mutation in an X-Mutation header (removed here), applied to what goes
+# to the agent:
+#   compact-headers  From, To, Call-ID, Content-Type in compact form (RFC 3261 7.3.3)
+#   sdp-ssrc         the offer carries `a=ssrc:<id>` without an attribute (AIVC CE #27)
+#   late-offer       the INVITE carries no SDP: the agent offers in its 2xx, the ACK answers
+#                    (RFC 3261 13.2.1); the caller's leg stays early offer
+#   ptime-30         rtpengine repacketises the caller's audio to 30 ms (a=ptime:30)
+#
+# With CARRIER_AUTH_USER set, the caller must authenticate (digest, CARRIER_AUTH_PASSWORD) every
+# request it sends but ACK and CANCEL (RFC 3261 22.1): the initial INVITE is challenged with
+# MD5, requests in the dialog with SHA-256 (RFC 8760), the algorithms agents ask for. With
+# CARRIER_UAC_USER set instead, the carrier answers the agent's challenge to the INVITE, once,
+# with CARRIER_UAC_PASSWORD, as a trunk does.
+#
+# The caller's leg may be secure, as trunks offer it: SIP over TLS (tls.cfg loads it) and SRTP
+# keyed in the SDP, which rtpengine terminates. The agent's leg is plain SIP (UDP or TCP) and RTP.
+
+log_level=2
+xlog_level=2
+stderror_enabled=yes
+syslog_enabled=no
+
+socket=udp:*:5060
+socket=tcp:*:5060
+
+mpath="/usr/lib/x86_64-linux-gnu/opensips/modules/"
+
+loadmodule "proto_udp.so"
+loadmodule "proto_tcp.so"
+loadmodule "tm.so"
+loadmodule "sl.so"
+loadmodule "rr.so"
+loadmodule "maxfwd.so"
+loadmodule "sipmsgops.so"
+loadmodule "textops.so"
+loadmodule "signaling.so"
+loadmodule "cfgutils.so"
+loadmodule "mi_fifo.so"
+loadmodule "dialog.so"
+loadmodule "topology_hiding.so"
+loadmodule "rtpengine.so"
+loadmodule "auth.so"
+loadmodule "uac_auth.so"
+loadmodule "uac.so"
+
+modparam("mi_fifo", "fifo_name", "/tmp/opensips_fifo")
+modparam("rtpengine", "rtpengine_sock", "udp:127.0.0.1:2223")
+modparam("auth", "calculate_ha1", 1)
+modparam("auth", "username_spec", "$var(username)")
+modparam("auth", "password_spec", "$var(password)")
+modparam("uac_auth", "auth_username_avp", "$avp(uac_user)")
+modparam("uac_auth", "auth_password_avp", "$avp(uac_password)")
+modparam("uac_auth", "auth_realm_avp", "$avp(uac_realm)")
+
+route {
+	if (!mf_process_maxfwd_header(10)) {
+		send_reply(483, "Too Many Hops");
+		exit;
+	}
+
+	if (has_totag()) {
+		# before matching: the dialog module ends a dialog when it matches its BYE, challenged
+		# or not. Requests from the agent's side (the next hop, the transfer target) pass.
+		# Each address copied before comparing: $si and {ip.resolve} print into one buffer.
+		$var(next) = $env(CARRIER_NEXT);
+		$var(next) = $(var(next){ip.resolve});
+		$var(operator) = "operator";
+		$var(operator) = $(var(operator){ip.resolve});
+		$var(si) = $si;
+		if ($var(si) != $var(next) && $var(si) != $var(operator))
+			route(auth, "sha-256");
+		if (topology_hiding_match()) {
+			if ($DLG_dir == "downstream")
+				route(mutate);
+			if (is_method("INVITE") && !has_body("application/sdp"))
+				$dlg_val(reoffer) = "1";  # a re-INVITE without SDP: the 2xx offers
+			if (is_method("BYE")) {
+				rtpengine_delete();
+			} else if (is_method("ACK") && $dlg_val(offer) != NULL) {
+				# late offer: the caller's offer, as rtpengine gave it, answers the agent's
+				add_body_part($dlg_val(offer), "application/sdp");
+				$dlg_val(offer) = NULL;
+			} else if (is_method("ACK") && has_body("application/sdp")) {
+				rtpengine_answer("replace-origin");
+				$dlg_val(reoffer) = NULL;
+			} else {
+				route(media_offer);
+			}
+			t_on_reply("media_answer");
+			t_relay();
+		} else if (is_method("ACK") && t_check_trans()) {
+			t_relay();
+		} else if (!is_method("ACK")) {
+			send_reply(481, "Call/Transaction Does Not Exist");
+		}
+		exit;
+	}
+
+	if (is_method("CANCEL")) {
+		if (t_check_trans())
+			t_relay();
+		exit;
+	}
+
+	t_check_trans();
+
+	if (!is_method("INVITE")) {
+		send_reply(405, "Method Not Allowed");
+		exit;
+	}
+
+	route(auth, "md5");
+	create_dialog();
+	if (has_body("application/sdp") && search_body("RTP/SAVP"))
+		$dlg_val(srtp) = "1";
+	if ($hdr(X-Mutation) != NULL) {
+		$dlg_val(mutation) = $hdr(X-Mutation);
+		remove_hf("X-Mutation");
+		xlog("L_NOTICE", "carrier: $ci gets $dlg_val(mutation)\n");
+	}
+	$var(host) = $env(CARRIER_NEXT) + ":" + $env(CARRIER_NEXT_PORT);
+	if ($rU == "operator")  # a transferee calling the transfer target
+		$var(host) = "operator:5060";
+	# whatever the caller's leg was (TLS: sips: or transport=tls), without its params
+	if ($rU == NULL)
+		$ru = "sip:" + $var(host);
+	else
+		$ru = "sip:" + $rU + "@" + $var(host);
+	if ($rU != "operator" && $env(CARRIER_NEXT_TRANSPORT) == "tcp")
+		$ru = $ru + ";transport=tcp";
+	topology_hiding("C");
+	route(mutate);
+	route(media_offer);
+	t_on_reply("media_answer");
+	t_on_failure("media_end");
+	t_relay();
+}
+
+route[auth] {  # $param(1): the algorithm to challenge with
+	$var(username) = $env(CARRIER_AUTH_USER);  # compose passes it empty when unset
+	if ($(var(username){s.len}) == 0 || is_method("ACK|CANCEL"))
+		return;
+	$var(password) = $env(CARRIER_AUTH_PASSWORD);
+	if (!pv_proxy_authorize("carrier")) {
+		proxy_challenge("carrier", "auth", $param(1));
+		exit;
+	}
+	consume_credentials();
+}
+
+route[mutate] {
+	if ($dlg_val(mutation) == "compact-headers") {
+		subst('/^From:/f:/');
+		subst('/^To:/t:/');
+		subst('/^Call-ID:/i:/');
+		subst('/^Content-Type:/c:/');
+	}
+}
+
+route[media_offer] {
+	if (!has_body("application/sdp"))
+		return;
+	$var(flags) = "replace-origin";
+	if ($dlg_val(mutation) == "ptime-30")
+		$var(flags) = $var(flags) + " ptime=30";
+	if ($dlg_val(mutation) == "sdp-ssrc")
+		$var(flags) = $var(flags) + " sdp-attr-add-audio-ssrc:2330119309";
+	if ($dlg_val(srtp) == "1" && (!has_totag() || $DLG_dir == "downstream"))
+		$var(flags) = $var(flags) + " RTP/AVP";  # to the agent: plain RTP
+	else if ($dlg_val(srtp) == "1")
+		$var(flags) = $var(flags) + " RTP/SAVP";  # to the caller: SRTP, rtpengine's keys
+	if ($dlg_val(mutation) == "late-offer" && !has_totag()) {
+		rtpengine_offer($var(flags), , $var(sdp));
+		$var(ok) = $rc;
+		$dlg_val(offer) = $var(sdp);
+		remove_body_part();
+	} else {
+		rtpengine_offer($var(flags));
+		$var(ok) = $rc;
+	}
+	if ($var(ok) < 0) {  # never let media bypass the carrier
+		sl_send_reply(503, "Media relay unavailable");
+		exit;
+	}
+}
+
+onreply_route[media_answer] {
+	if (!has_body("application/sdp"))
+		return;
+	if ($dlg_val(reoffer) == "1" && is_method("INVITE") && $dlg_val(srtp) == "1")
+		rtpengine_offer("replace-origin RTP/SAVP");  # the agent's offer, to the caller
+	else if ($dlg_val(reoffer) == "1" && is_method("INVITE"))
+		rtpengine_offer("replace-origin");
+	else
+		rtpengine_answer("replace-origin");
+}
+
+failure_route[media_end] {
+	route(uac);
+	rtpengine_delete();
+}
+
+route[uac] {  # the agent's challenge to the INVITE, answered once (CARRIER_UAC_USER)
+	$var(user) = $env(CARRIER_UAC_USER);  # compose passes it empty when unset
+	if ($(var(user){s.len}) == 0 || $avp(uac_tried) != NULL || !t_check_status("401|407"))
+		return;
+	$avp(uac_tried) = "1";
+	$var(challenge) = $(<reply>hdr(Proxy-Authenticate));
+	if ($var(challenge) == NULL)
+		$var(challenge) = $(<reply>hdr(WWW-Authenticate));
+	$avp(uac_realm) = $(var(challenge){re.subst,/.*realm="([^"]*)".*/\1/});
+	$avp(uac_user) = $var(user);
+	$avp(uac_password) = $env(CARRIER_UAC_PASSWORD);
+	if (uac_auth()) {
+		t_on_failure("media_end");
+		t_relay();
+		exit;
+	}
+}

rtpbench/carrier/tls.cfg

@@ -0,0 +1,25 @@
+# rtpbench carrier with SIP over TLS on the caller's leg (5061), as a trunk takes it: the
+# certificate is the stack's test one; nothing checks the caller's. Everything else is
+# opensips.cfg, included below; the agent's leg stays on UDP.
+
+mpath="/usr/lib/x86_64-linux-gnu/opensips/modules/"
+
+socket=tls:*:5061
+
+loadmodule "tls_openssl.so"
+loadmodule "tls_mgm.so"
+loadmodule "proto_tls.so"
+
+modparam("tls_mgm", "server_domain", "carrier")
+modparam("tls_mgm", "certificate", "[carrier]/tls/server.crt")
+modparam("tls_mgm", "private_key", "[carrier]/tls/server.key")
+modparam("tls_mgm", "ca_list", "[carrier]/tls/stack-ca.pem")
+modparam("tls_mgm", "tls_method", "[carrier]TLSv1_2-")
+modparam("tls_mgm", "verify_cert", "[carrier]0")
+modparam("tls_mgm", "require_cert", "[carrier]0")
+# should a request to the caller need a connection of its own (the caller's is reused)
+modparam("tls_mgm", "client_domain", "caller")
+modparam("tls_mgm", "match_ip_address", "[caller]*")
+modparam("tls_mgm", "verify_cert", "[caller]0")
+
+include_file "/etc/opensips/opensips.cfg"

rtpbench/carrier/tls.yaml

@@ -0,0 +1,9 @@
+# The carrier with SIP over TLS on the caller's leg (carrier/tls.cfg), merged over
+# compose.yaml: the stack's test certificate from the results' tls/ directory.
+services:
+  carrier-sip:
+    entrypoint: [/usr/sbin/opensips, -F, -f, /etc/opensips/tls.cfg]
+    volumes:
+      - ./carrier/opensips.cfg:/etc/opensips/opensips.cfg:ro
+      - ./carrier/tls.cfg:/etc/opensips/tls.cfg:ro
+      - ${RTPBENCH_OUT:?}/tls:/tls:ro