Add media encryption options.

.changeset/healthy-poets-tan.md

@@ -0,0 +1,6 @@
+---
+"@livekit/protocol": minor
+"github.com/livekit/protocol": minor
+---
+
+Add media encryption options for SIP.

protobufs/livekit_sip.proto

@@ -111,6 +111,12 @@ enum SIPTransport {
   SIP_TRANSPORT_TLS = 3;
 }
 
+enum SIPMediaEncryption {
+  SIP_MEDIA_ENCRYPT_DISABLE = 0; // do not enable encryption
+  SIP_MEDIA_ENCRYPT_ALLOW = 1; // use encryption if available
+  SIP_MEDIA_ENCRYPT_REQUIRE = 2; // require encryption
+}
+
 message SIPTrunkInfo {
   option deprecated = true;
 
@@ -201,8 +207,9 @@ message SIPInboundTrunkInfo {
   google.protobuf.Duration max_call_duration = 12;
 
   bool krisp_enabled = 13;
+  SIPMediaEncryption media_encryption = 15;
 
-  // NEXT ID: 15
+  // NEXT ID: 16
 }
 
 message CreateSIPOutboundTrunkRequest {
@@ -242,7 +249,8 @@ message SIPOutboundTrunkInfo {
   // Keys are the names of attributes and values are the names of X-* headers they will be mapped to.
   map<string, string> attributes_to_headers = 11;
 
-  // NEXT ID: 12
+  SIPMediaEncryption media_encryption = 12;
+  // NEXT ID: 13
 }
 
 message GetSIPInboundTrunkRequest {
@@ -385,7 +393,10 @@ message SIPDispatchRuleInfo {
   // Participants created by this rule will inherit these attributes.
   map<string, string> attributes = 8;
 
-  // NEXT ID: 9
+  bool krisp_enabled = 9;
+  SIPMediaEncryption media_encryption = 10;
+
+  // NEXT ID: 11
 }
 
 // ListSIPDispatchRuleRequest lists dispatch rules for given filters. If no filters are set, all rules are listed.
@@ -452,8 +463,10 @@ message CreateSIPParticipantRequest {
   google.protobuf.Duration max_call_duration = 12;
 
   // Enable voice isolation for the callee.
-  bool enable_krisp = 14;
-  // NEXT ID: 17
+  bool krisp_enabled = 14;
+  SIPMediaEncryption media_encryption = 17;
+
+  // NEXT ID: 18
 }
 
 message SIPParticipantInfo {

protobufs/rpc/io.proto

@@ -179,7 +179,9 @@ message EvaluateSIPDispatchRulesResponse {
   // Max call duration.
   google.protobuf.Duration max_call_duration = 17;
 
-  // NEXT ID: 19
+  livekit.SIPMediaEncryption media_encryption = 19;
+
+  // NEXT ID: 20
 }
 
 message UpdateSIPCallStateRequest {

protobufs/rpc/sip.proto

@@ -92,7 +92,9 @@ message InternalCreateSIPParticipantRequest {
   // Max call duration.
   google.protobuf.Duration max_call_duration = 24;
 
-  // NEXT ID: 27
+  livekit.SIPMediaEncryption media_encryption = 27;
+
+  // NEXT ID: 28
 }
 
 message InternalCreateSIPParticipantResponse {

rpc/sip.go

@@ -50,9 +50,13 @@ func NewCreateSIPParticipantRequest(
 	}
 
 	var features []livekit.SIPFeature
-	if req.EnableKrisp {
+	if req.KrispEnabled {
 		features = append(features, livekit.SIPFeature_KRISP_ENABLED)
 	}
+	enc := trunk.MediaEncryption
+	if req.MediaEncryption != 0 {
+		enc = req.MediaEncryption
+	}
 
 	headers := trunk.Headers
 	if len(req.Headers) != 0 {
@@ -91,5 +95,6 @@ func NewCreateSIPParticipantRequest(
 		EnabledFeatures:       features,
 		RingingTimeout:        req.RingingTimeout,
 		MaxCallDuration:       req.MaxCallDuration,
+		MediaEncryption:       enc,
 	}, nil
 }

sip/sip.go

@@ -25,7 +25,6 @@ import (
 	"strings"
 
 	"github.com/twitchtv/twirp"
-
 	"golang.org/x/exp/slices"
 
 	"github.com/livekit/protocol/livekit"
@@ -435,6 +434,10 @@ func EvaluateDispatchRule(projectID string, trunk *livekit.SIPInboundTrunkInfo,
 	if trunk != nil {
 		trunkID = trunk.SipTrunkId
 	}
+	enc := livekit.SIPMediaEncryption_SIP_MEDIA_ENCRYPT_DISABLE
+	if trunk != nil {
+		enc = trunk.MediaEncryption
+	}
 	attrs := maps.Clone(rule.Attributes)
 	if attrs == nil {
 		attrs = make(map[string]string)
@@ -476,6 +479,7 @@ func EvaluateDispatchRule(projectID string, trunk *livekit.SIPInboundTrunkInfo,
 				SipTrunkId:        trunkID,
 				SipDispatchRuleId: rule.SipDispatchRuleId,
 				Result:            rpc.SIPDispatchResult_REQUEST_PIN,
+				MediaEncryption:   enc,
 				RequestPin:        true,
 			}, nil
 		}
@@ -512,16 +516,25 @@ func EvaluateDispatchRule(projectID string, trunk *livekit.SIPInboundTrunkInfo,
 		ParticipantName:       fromName,
 		ParticipantMetadata:   rule.Metadata,
 		ParticipantAttributes: attrs,
+		MediaEncryption:       enc,
 	}
+	krispEnabled := false
 	if trunk != nil {
 		resp.Headers = trunk.Headers
 		resp.HeadersToAttributes = trunk.HeadersToAttributes
 		resp.AttributesToHeaders = trunk.AttributesToHeaders
 		resp.RingingTimeout = trunk.RingingTimeout
 		resp.MaxCallDuration = trunk.MaxCallDuration
-		if trunk.KrispEnabled {
-			resp.EnabledFeatures = append(resp.EnabledFeatures, livekit.SIPFeature_KRISP_ENABLED)
+		krispEnabled = krispEnabled || trunk.KrispEnabled
+	}
+	if rule != nil {
+		krispEnabled = krispEnabled || rule.KrispEnabled
+		if rule.MediaEncryption != 0 {
+			resp.MediaEncryption = rule.MediaEncryption
 		}
 	}
+	if krispEnabled {
+		resp.EnabledFeatures = append(resp.EnabledFeatures, livekit.SIPFeature_KRISP_ENABLED)
+	}
 	return resp, nil
 }