[Galene] ANNOUNCE: galene-sip, a bridge between Galene and SIP

[Galene] ANNOUNCE: galene-sip, a bridge between Galene and SIP

[Juliusz Chroboczek]

Hi,

I've just published a work-in-progress bridge between Galene and the SIP
protocol.  In short, it allows users to join a Galene discussion group
just by making a phone call to a SIP provider.

  git clone https://github.com/jech/galene-sip

This is a work in progress, and you might not find it usable in production
yet.  In particular, it has had very little testing, and I've omitted
large parts of the SIP protocol.  However, it appears to work fine with at
least three SIP implementations (my self-hosted Asterisk, linphone.org,
and OVH).

The main issues with my SIP implementation are the following:

  - only server offers are supported (both server and client offers are
    mandatory in SIP, but I haven't yet found a server that didn't offer);

  - only SIP/UDP is supported (SIP/TCP is a mandatory part of the spec,
    and SIP/TLS is strongly recommended);

  - NAT traversal is fragmentary: I implement RFC 3581, but I don't do
    keepalives, and I don't do STUN; it turns out that this is good
    enough to work behind NAT, as long as the server does keepalives.

SIP is a big, messy protocol (RFC 3261 is 268 pages long, but that doesn't
even tell you how to find a SIP server, RFC 3263, how to behave behind
NAT, RFC 5626, or to negotiate SDP, RFC 3262).  For example, it takes me
almost 80 lines of code to determine where to send the reply to a request
(see the function "tweakVia" in sip.go).  I've certainly gotten some
things wrong, please let me know if you see issues.

A note about privacy.  SIP is an insecure protocol.  While galene-sip
won't leak your password, it is trivially easy to eavesdrop or to hijack
a session.  There are solutions (SIP/TLS and SRTP), but they are not
implemented by the providers I've tested against.  Please only use SIP for
public meetings, and use a secure protocol (such as Galene's native
protocol) for anything that's even remotely private.

Please test, and let me know how it goes.

-- Juliusz