Incorrect Re-INVITE SDP handling when payload type changes

[rafaltelaczynski]

Describe the bug

• FreeSWITCH receives INVITE without SDP
• FreeSWITCH answers with the offer in 200OK
• ACK is received with single codec selected
• Re-INVITE message is received with exactly the same codec definition but using different payload type
• this results in FreeSWITCH ignoring new payload type and answering with the same payload type that was used in initial offer

E.g.:
Initial offer generated by FreeSWITCH in 200OK:

Message Body
    Session Description Protocol
        Session Description Protocol Version (v): 0
        Owner/Creator, Session Id (o): FreeSWITCH 1728449501 1728449502 IN IP4 172.240.0.1
        Session Name (s): FreeSWITCH
        Connection Information (c): IN IP4 127.0.0.1
        Time Description, active time (t): 0 0
        Media Description, name and address (m): audio 17010 RTP/AVP 102 103 0 8 104 105 101 13
        Media Attribute (a): rtpmap:102 AMR-WB/16000
        Media Attribute (a): fmtp:102 octet-align=0; mode-set=0,1,2; max-red=0; mode-change-capability=2
        Media Attribute (a): rtpmap:103 AMR/8000
        Media Attribute (a): fmtp:103 octet-align=0; mode-set=0,1,2
        Media Attribute (a): rtpmap:0 PCMU/8000
        Media Attribute (a): rtpmap:8 PCMA/8000
        Media Attribute (a): rtpmap:104 telephone-event/16000
        Media Attribute (a): fmtp:104 0-15
        Media Attribute (a): rtpmap:105 CN/16000
        Media Attribute (a): rtpmap:101 telephone-event/8000
        Media Attribute (a): fmtp:101 0-15
        Media Attribute (a): rtpmap:13 CN/8000
        Media Attribute (a): ptime:20

Initial answer in ACK:

Message Body
    Session Description Protocol
        Session Description Protocol Version (v): 0
        Owner/Creator, Session Id (o): - 3769329783 3769329783 IN IP4 127.0.0.1
        Session Name (s): test-session
        Connection Information (c): IN IP4 127.0.0.1
        Time Description, active time (t): 0 0
        Media Description, name and address (m): audio 8904 RTP/AVP 0
        Media Attribute (a): rtpmap:0 PCMU/8000

Re-INVITE offer(exactly the same as initial answer, only payload type is different):

Message Body
    Session Description Protocol
        Session Description Protocol Version (v): 0
        Owner/Creator, Session Id (o): - 3769329783 3769329783 IN IP4 127.0.0.1
        Session Name (s): test-session
        Connection Information (c): IN IP4 127.0.0.1
        Time Description, active time (t): 0 0
        Media Description, name and address (m): audio 8904 RTP/AVP 10
        Media Attribute (a): rtpmap:10 PCMU/8000

FreeSWITCH answer to Re-INVITE offer(new payload type ignored, using initial value):

Message Body
    Session Description Protocol
        Session Description Protocol Version (v): 0
        Owner/Creator, Session Id (o): FreeSWITCH 1728449501 1728449502 IN IP4 172.240.0.1
        Session Name (s): FreeSWITCH
        Connection Information (c): IN IP4 127.0.0.1
        Time Description, active time (t): 0 0
        Media Description, name and address (m): audio 17010 RTP/AVP 0 104 105 101 13
        Media Attribute (a): rtpmap:0 PCMU/8000
        Media Attribute (a): rtpmap:104 telephone-event/16000
        Media Attribute (a): fmtp:104 0-15
        Media Attribute (a): rtpmap:105 CN/16000
        Media Attribute (a): rtpmap:101 telephone-event/8000
        Media Attribute (a): fmtp:101 0-15
        Media Attribute (a): rtpmap:13 CN/8000
        Media Attribute (a): ptime:20

Intrestingly, FreeSWITCH respects new payload type and uses it while sending RTP packets. This issue here is that the other party either rejects this answer as it is invalid, or accepts it and starts sending RTP packets for this invalid payload type which is rejected by FreeSWITCH.

According to RFC 3264 8.3.2 this should be allowed:

The list of media formats used in the session MAY be changed.  To do
   this, the offerer creates a new media description, with the list of
   media formats in the "m=" line different from the corresponding media
   stream in the previous SDP.  This list MAY include new formats, and
   MAY remove formats present from the previous SDP.  However, in the
   case of RTP, the mapping from a particular dynamic payload type
   number to a particular codec within that media stream MUST NOT change
   for the duration of a session.  For example, if A generates an offer
   with G.711 assigned to dynamic payload type number 46, payload type
   number 46 MUST refer to G.711 from that point forward in any offers
   or answers for that media stream within the session.  However, it is
   acceptable for multiple payload type numbers to be mapped to the same
   codec, so that an updated offer could also use payload type number 72
   for G.711.

and it is working well in exactly the same scenario but when there is SDP present in initial INVITE. So the only difference between the two is that FreeSWITCH is the offerer.

To Reproduce
Steps to reproduce the behavior:

1. Plain call with no SDP in initial INVITE
2. Call answered
3. Re-INVITE from originating party with SDP using different payload

Expected behavior
FreeSWITCH to answer Re-INVITE with 200OK with valid payload type, e.g. 10 in the example

Package version or git hash

• Version v1.10.12

Trace logs
freeswitch_invalid_payload_type.log

[rafaltelaczynski]

Any idea what might be wrong in this case?