NAT-PMP and UPnP IGDv2 do not work, UPnP IGDv1 created incorrect port mappings

UPnP bug was reported previously https://git.jami.net/savoirfairelinux/ring-client-android/issues/735

This report contains additional information after some experimentation

• Ring version: 20200501-01
• Device model: CyanogenMod 12.1
• Android version: 5.1.1
• What build you are using: F-droid (https://f-droid.org/repo/cx.ring_238.apk)

Steps to reproduce

• Can you reproduce the bug: at will

  0. Add a SIP account with UPnP enabled

• Steps:

  1. Force stop Jami (kill process)
  2. On the router, run miniupnpd with force_igd_desc_v1=no (i.e. IGD v2)
  3. Start Jami

• Actual result: port 5060 mapping not created

• Expected result: port 5060 mapping created

• Steps:

  1. Force stop Jami (kill process)
  2. On the router, run miniupnpd with force_igd_desc_v1=yes (i.e. IGD v1)
  3. Start Jami

• Actual result: port 5060 mapping created

• Expected result: port 5060 mapping created

  4. Make a SIP call

• Actual result: port mappings for media (RTP/RTCP) did not match ports in SDP, no audio

• Expected result: port mappings for media (RTP/RTCP) matched ports in SDP, audio worked

• Steps:

  1. Force stop Jami (kill process)
  2. On the router, run miniupnpd with enable_upnp=no (i.e. UPnP disabled), enable_natpmp=yes (i.e. NAT-PMP enabled which is the default option)
  3. Start Jami

• Actual result: port 5060 mapping not created

• Expected result: port 5060 mapping created

Additional information

Is it possible to allow users to choose preferred port mapping protocol e.g. an option to make Jami try NAT-PMP first, then fallback to UPnP (or vice versa)?

Some UPnP clients work fine with IGDv2, some don't, I tried this tool https://github.com/kaklakariada/portmapper and found that weupnp worked fine with IGDv2 while others didn't. http://miniupnp.free.fr/ provides both NAT-PMP and UPnP libraries which most likely would work with IGDv2 given that miniupnpd is IGDv2.

When using UPnP IGDv1, Jami seems to use port 0 causing the server to log errors like below

Sun May 17 18:51:08 2020 daemon.warn miniupnpd[18096]: upnp_event_process_notify: connect(192.168.1.197:0): Connection refused
Sun May 17 18:51:08 2020 daemon.err miniupnpd[18096]: upnpevents_processfds: 0x428660, remove subscriber uuid:10c4cddd-e822-40f6-9825-e5e7a04b59fe after an ERROR cb: http://192.168.1.197:0/
Sun May 17 18:51:55 2020 daemon.warn miniupnpd[18096]: upnp_event_process_notify: connect([fde3:a08b:5361:0000:5919:8ce4:538d:d8dd]:0): Connection refused
Sun May 17 18:51:55 2020 daemon.err miniupnpd[18096]: upnpevents_processfds: 0x4286e0, remove subscriber uuid:d8561f30-967b-47d8-921c-9a54f37b57e2 after an ERROR cb: http://[fde3:a08b:5361:0000:5919:8ce4:538d:d8dd]:0/

changed milestone to %Iteration 19

PCP/NAT-PMP

I had a quick look at the build script, it looks like PCP/NAT-PMP isn't supported. libnatpmp has Java bindings, but it seemingly only supports IPv4, it's still better than nothing https://framagit.org/miniupnp/miniupnp/-/issues/314 Code example: https://github.com/miniupnp/libnatpmp/blob/master/JavaTest.java

Edit: libpcp is probably better than libnatpmp as PCP is required to handle IPv6, and it could switch to NAT-PMP automatically by version negotiation.

UPnP

Code examples how to create mappings and add IPv6 pinholes can be found in the links below, but they're for miniupnpc library.

• https://framagit.org/miniupnp/miniupnp/-/blob/master/miniupnpc/java/JavaBridgeTest.java
• https://framagit.org/miniupnp/miniupnp/-/blob/master/miniupnpc/upnpc.c#L646-670

If port mapping protocol preference is implemented, and if an address family isn't supported by one of the libraries, is it possible to honour the preference as much as possible? e.g. try PCP for both IPv4 and IPv6 first, and fall back to UPnP only for the unsupported address family (e.g. IPv6)?

assigned to @sblin

PCP server could be discovered using DHCP if DHCP server is configured to support it - rfc7291

rfc7488 could be useful if PCP is provided by ISP (e.g. LSN/CGN), it's probably not as useful for a home network.

rfc6887 10.3 is quite useful for mobile devices.

PCP is designed to work in both large-scale networks and small home networks. I suspect pjsip would be more willing to accept a PR for PCP than UPnP IGD.

assigned to @aberaud

@wnd thank you for the feedback. It will be taken into account and I will develop there

So to summarize:

• Check why so much TCP mapping timeouts
• Check mapped port for medias (upnp) with SIP accounts

Note for me:

[1593721125.807|35687|pupnp.cpp         :379  ] PUPnP: Opened port 54986:54986 UDP
[1593721125.807|35687|sip_utils.cpp     :203  ] Registered thread 0x7fffdeffd500 (0x2E885C)
[1593721125.808|35687|ice_transport.cpp :774  ] [ice:0x2ea8c40] succeed to add candidate for comp_id=2 : 172.16.21.26 : 104.163.149.147
[1593721125.808|35687|upnp_context.cpp  :499  ] [upnp:controller@48887648] unregistering cb for mapping 54986:54986 UDP

• Check if natpmp creates the port 5060 (I think it's the case, will try to check this afternoon)
• Verify pupnp IGDv2 support
• Support libpcp and remove libnatpmp to get support for IPv6+PCP+NATPMP (libpcp does the job)

• Verify pupnp IGDv2 support
• Support libpcp and remove libnatpmp to get support for IPv6+PCP+NATPMP (libpcp does the job)

If IGDv2 is supported. It would be good to make use of WANIPv6FirewallControl AddPinhole() to open IPv6 firewall port http://upnp.org/specs/gw/UPnP-gw-WANIPv6FirewallControl-v1-Service.pdf

miniupnpc example - line 654

This probably corresponds to PCP IPv6 firewall scenario in the rfc6887 page-32 table

@wnd

Is it possible to allow users to choose preferred port mapping protocol e.g. an option to make Jami try NAT-PMP first, then fallback to UPnP (or vice versa)?

The jami daemon launch async operations on all protocols detected from your router, so the order doesn't have any importance at this point

The jami daemon launch async operations on all protocols detected from your router, so the order doesn't have any importance at this point

Does jami later send port mapping requests using all detected protocols or does it pick one protocol? If it uses all protocols, I think that might cause multiple mappings to be created as PCP and UPnP have different behaviour when a matching external port isn't available.

mmh last commit for libpcp is from Jan 5, 2018. I don't think it's a good idea to use a library which is not developped anymore. Anyway every pcp/natpmp/upnp lib are generally old

removed milestone

mentioned in epic &22

I don't know how UPNP works, but noticed an option in my router (set by default) to allow UPNP only to be used for informational purposes of the clients, but not to accept any configuration changes.

Could that possibly complicate things, and cause connection failures, if clients could think they configured a port but it isn't effective?

I mean symptoms like these: https://git.jami.net/savoirfairelinux/ring-client-android/-/issues/846 https://git.jami.net/savoirfairelinux/ring-client-android/-/issues/920

mentioned in issue #1171

closed

moved to jami-daemon#1004