Duplicate Identity: Headers on outgoing INVITE

[xrobau]

After this patch was applied, setting sip_h_identity on a call results in the INVITE packet containing TWO identical Identity headers.

4398da8

Changing the SIP_HEADER_CLASS(identity, "Identity", "", id_common, non_compact_append, identity); line back to single fixes it, and only one Identity header is added.

[andywolk]

@hnimminh

[xrobau]

tcpdump captures!

Before:

        INVITE sip:+61402077155@103.82.124.10 SIP/2.0
        Via: SIP/2.0/UDP 103.160.116.38;rport;branch=z9hG4bKyHQ1DUUFZH7Hg
        Max-Forwards: 68
        From: "61749722157 " <sip:+61749722157@103.160.116.38>;tag=ZKar560gveH7F
        To: <sip:+61402077155@103.82.124.10>
        Call-ID: 5cdd8a5b-e6d7-4377-9452-1148d29d0dcd
        CSeq: 64275108 INVITE
        Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InNoYWtlbiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly9yLnN0aXIudGVsLzcwNEovMjMwNTMxMTU0MjE4Wi9jZXJ0LnBlbSJ9.eyJhdHRlc3QiOiJCIiwiZGVzdCI6eyJ0biI6WyI2MTQwMjA3NzE1NSJdfSwiaWF0IjoxNjc3NjU3ODAwLCJvcmlnIjp7InRuIjoiNjE3NDk3MjIxNTcifSwib3JpZ2lkIjoiMTlhYTBiZDItN2RhMS00ZjI2LTlmZjctZTdhOWVhMTVjMGI4IiwicmNkIjp7Im5hbSI6IjYxNzQ5NzIyMTU3In19.yXlfqFLjwqR3rY4Q27zlHzSSfZo5Fpb7JnyVqAOYnVeHRaRoYhbOSCZVrek9Ibng6kiPRuOUJbsBnU9m5fH0DA;info=<https://r.stir.tel/704J/230531154218Z/cert.pem>;alg=ES256;ppt=shaken
        Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InNoYWtlbiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly9yLnN0aXIudGVsLzcwNEovMjMwNTMxMTU0MjE4Wi9jZXJ0LnBlbSJ9.eyJhdHRlc3QiOiJCIiwiZGVzdCI6eyJ0biI6WyI2MTQwMjA3NzE1NSJdfSwiaWF0IjoxNjc3NjU3ODAwLCJvcmlnIjp7InRuIjoiNjE3NDk3MjIxNTcifSwib3JpZ2lkIjoiMTlhYTBiZDItN2RhMS00ZjI2LTlmZjctZTdhOWVhMTVjMGI4IiwicmNkIjp7Im5hbSI6IjYxNzQ5NzIyMTU3In19.yXlfqFLjwqR3rY4Q27zlHzSSfZo5Fpb7JnyVqAOYnVeHRaRoYhbOSCZVrek9Ibng6kiPRuOUJbsBnU9m5fH0DA;info=<https://r.stir.tel/704J/230531154218Z/cert.pem>;alg=ES256;ppt=shaken
        Contact: <sip:CIPVoiceHubAUNorth@103.160.116.38:5060;transport=udp;gw=VoiceHubAUNorth>
        Date: We [|sip]

After:

        INVITE sip:+61402077155@103.92.94.10 SIP/2.0
        Via: SIP/2.0/UDP 103.160.116.38;rport;branch=z9hG4bKpScymvH70H5HN
        Max-Forwards: 68
        From: "61749722157 " <sip:+61749722157@103.160.116.38>;tag=rvpeNUNm4eU9r
        To: <sip:+61402077155@103.92.94.10>
        Call-ID: 77460d05-0b0f-4bd9-8bb4-142e7d7578ca
        CSeq: 64276446 INVITE
        Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InNoYWtlbiIsInR5cCI6InBhc3Nwb3J0IiwieDV1IjoiaHR0cHM6Ly9yLnN0aXIudGVsLzcwNEovMjMwNTMxMTU0MjE4Wi9jZXJ0LnBlbSJ9.eyJhdHRlc3QiOiJCIiwiZGVzdCI6eyJ0biI6WyI2MTQwMjA3NzE1NSJdfSwiaWF0IjoxNjc3NjYwNDc2LCJvcmlnIjp7InRuIjoiNjE3NDk3MjIxNTcifSwib3JpZ2lkIjoiMThhMWRmN2UtZTAzYy00MTQ3LTg2NjQtMDI4MDFhNjg1OTFjIiwicmNkIjp7Im5hbSI6IjYxNzQ5NzIyMTU3In19.1fll1uTaBynN-qiCR_N3aT8IUgfSqBZ2dPmOdU6XHGwuOYgEFtgcf48BzjQSoSTLxhai_NGwjy-swZlEl92S6w;info=<https://r.stir.tel/704J/230531154218Z/cert.pem>;alg=ES256;ppt=shaken
        Contact: <sip:CIPVoiceHubAUSouth@103.160.116.38:5060;transport=udp;gw=VoiceHubAUSouth>
        Date: Wed, 01 Mar 2023 08:47:56 GMT

[hnimminh]

Hi @xrobau,
the above pcap is outbound traffic (from freeswitch to outside)?

[xrobau]

Correct. Outgoing invite.

[mbrooks]

Confirming that I am seeing the duplicate Identity behavior as well. I don't know if @xrobau 's patch will resolve the issue as we decided to work around it.

[xrobau]

My patch simply sets it back to a single header, it doesn't fix the actual problem of two being added. It was the simplest change without having to revert the whole thing, which was not just here 8-(

[xrobau]

As an aside, I'm not actually sure how we're going to be able to set/read two headers ANYWAY. But I was too busy fixing the actual main problem to look into the other ones 8)

[mbrooks]

Interesting, we're only forwarding an Identity header and something in FreeSwitch is duplicating it. We're not trying to set an Identity in FreeSwitch.

[xrobau]

@mbrooks the patch from freeswitch-builder will fix it, both setting and forwarding, as it puts it back to Highlander-style "There can be only one" 8)

xrobau/freeswitch-ubuntubuilder@addb1ce#diff-aed20d0adb97d5527f344c58d2a04b5b91de5523f151d6c06c1fa23c91418813

[pennytone]

I'm getting the same problem... will attempt the patch. This essentially breaks stir/shaken attestation to STI-SA service providers. Hopefully Freeswitch devs can commit a permanent fix.

[andywolk]

Anyone has a PCAP of this misbehaving?

[mjerris]

note sending multiple is 100% legal, reverting back to single is the wrong fix. we need to undrestand why its sending twice, not make it impossible to set 2

[lazedo]

check mod_sofia on freeswitch repo. sofia_handle_sip_i_invite , sip_h_identity is added and sofia_glue_do_invite will add this to outbound via sofia_glue_get_extra_headers and will also check/add sip identity, that's how you end up with 2 headers.

		if (sip->sip_identity && sip->sip_identity->id_value) {
			switch_channel_set_variable(channel, "sip_h_identity", sip->sip_identity->id_value);
		}

[Mickaelh51]

Hi @lazedo thanks for your answer.
I'm faced on the same issue and, I'm sorry, I don't understand your previous post.
for examplen when I add:

<condition field="${sip_h_Identity}" expression="." break="never">
        <action application="log" data="INFO LOG: copy Identity" />
        <action application="export" data="sip_h_Identity=${sip_h_Identity}" />
</condition>

I have 2 identical Identity headers,
When I delete my previous code, I have no Identity header at allon B leg.

Please, can you explain if there is a specific conf to have only 1 Identity header (when we have only 1 identity header in A leg) ?

thanks in advance

[Mickaelh51]

OK, I found a solution....
If we see here: https://github.com/traviscross/freeswitch/blob/6261e5ae48c0eadb26b0f168aceb05a20582c19d/src/mod/endpoints/mod_sofia/sofia_glue.c#L588

I use exclude_outgoing_extra_header to excluse sip_h_Identity:

<action application="bridge" data="
{
  sip_invite_params=user=phone,
  sip_cid_type=none,
  ignore_display_updates=true,
  sip_renegotiate_codec_on_reinvite=true,
  sip_contact_user=${caller_id_number},
  exclude_outgoing_extra_header=sip_h_Identity ==> HERE
}
sofia/gateway/${distributor LISTPRIVATE ${sofia profile INTERNAL gwlist down}}/${number_dest}"/>

and add code:

<condition field="${sip_h_Identity}" expression="." break="never">
        <action application="log" data="INFO LOG: copy Identity" />
        <action application="export" data="sip_h_Identity=${sip_h_Identity}" />
</condition>

And I can see only 1 identity header on B leg !
and in debug I can see:

2023-08-02 14:34:38.866129 99.00% [DEBUG] sofia_glue.c:929 Ignoring Extra Header [sip_h_Identity] , matches exclude_outgoing_extra_header [sip_h_Identity]

cc @xrobau

Answer of Freeswitch on forum: https://forum.signalwire.community/t/problem-with-double-identity-headers-on-b-leg-stir-and-shaken/693