Unable to unprotect buffer (unprotect failed code 9)

[Ayaan]

Anyone know what this error means in kurento logs?

2018-04-08 09:18:58,831453 16733 [0x00007f94f4b5c700] warning srtpdec                   gstsrtpdec.c:1149 gst_srtp_dec_decode_buffer() <srtp-decoder:rtp_sink>  Unable to unprotect buffer (unprotect failed code 9)

This error seem to come from gst-plugins-bad - https://code.cablelabs.com/DLNA-RUI/gst-plugins-bad/blob/87243e9c6ec8e4de4342edd866afbb40e09080a3/ext/srtp/gstsrtpdec.c

GST_OBJECT_UNLOCK (filter);

  if (err != err_status_ok) {

    GST_WARNING_OBJECT (pad,

        "Unable to unprotect buffer (unprotect failed code %d)", err);

    /* Signal user depending on type of error */

    switch (err) {

      case err_status_key_expired:

        GST_OBJECT_LOCK (filter);

[Juan Navarro]

Yes, we're having lots of those lately and it's been a recurring problem but we don't have enough information about _why_ it happens so I haven't been able to advance much in this regard.
SRTP error code 9 comes from the inner libSRTP library (https://github.com/cisco/libsrtp/blob/master/include/srtp.h#L175) and it means that the automatic detection (and prevention) mechanism for Replay attacks has been activated and discarded the packet.

I think that this has been raised more frequently since last year because something must have changed in the way SRTP streams are handled by latest versions of the browser. But that is only a wild guess. Hopefully with the planned upgrade of our GStreamer libraries this issue gets fixed.

[Ayaan]

Thanks Juan. May I know from which kurento version libSRTP library was introduced? If so, can we revert that patch and rebuild?

[Juan Navarro]

Hi,
not sure, that is one of the legacy libraries that the new team has inherited from the previous one (https://www.kurento.org/blog/kurento-67-moving-forward). I would guess the reason for having this library in our repos is to provide a more up-to-date version that the one provided by Ubuntu. However, it may be worth to check if reverting back to the default Ubuntu version, which has probably received patches and updates, might work better.

Sadly that would require extensively testing at the platform and integration levels, but we are still slowly reworking our testing infrastructures so right now it would not be possible to automatically test it.


> Sent: Wednesday, April 11, 2018 at 8:12 PM
> From: Ayaan <yasm...@gmail.com>
> To: kurento <kur...@googlegroups.com>
> Subject: [kurento-public] Re: Unable to unprotect buffer (unprotect failed code 9)

> --
> You received this message because you are subscribed to a topic in the Google Groups "kurento" group.
> To unsubscribe from this topic, visit https://groups.google.com/d/topic/kurento/0b7QUJV26c0/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to kurento+u...@googlegroups.com.
> To post to this group, send email to kur...@googlegroups.com.
> Visit this group at https://groups.google.com/group/kurento.
> To view this discussion on the web visit https://groups.google.com/d/msgid/kurento/817635a4-ad11-4a20-8521-68cbeff64764%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
>

[Juan Navarro]

"srtpdec unprotect failed code 9" has been appearing in logs everywhere for a while already, so I've created an issue to track progress when we get some time to work on it:
https://github.com/Kurento/bugtracker/issues/246

On Sunday, April 8, 2018 at 3:21:53 PM UTC+2, Ayaan wrote:

[Ayaan]

Awesome, thanks.