Fix for Reported Bug #3119

[weic-harding]

Description

freeSwitch was not handling Encoding/Decoding key properly when SIP Bypass mode set to Proxy_Media

Type of Change

• [ X] Bug fix
• New feature
• Breaking change
• Documentation update
• Code cleanup / refactor

Related Issues

#3119

Testing

• Added/updated unit tests
• Tested manually
• Tested with live SignalWire credentials (if applicable)

Checklist

• I have read the CONTRIBUTING guidelines
• My code follows the project's style guidelines
• I have added tests for my changes (if applicable)
• I have updated documentation (if applicable)
• All existing tests pass

Additional Notes

[weic-harding]

Partial Fix, an expanded summary:

Issue 1 (fixed): The SDP identity leak — a Proxy Media leg's hold-related SDP refresh skipped the o=/c=/s= normalization entirely, shipping the other leg's raw SDP (including its origin/IP) verbatim. This is a real behavioral fix: adding !switch_channel_test_flag(session->channel, CF_PROXY_MEDIA) to the hold-skip condition in switch_core_media_patch_sdp() changes what the code does — proxy-media legs no longer take that early return.

Issue 2 (not fixed, diagnosed logging only): The SRTP crypto suite mismatch between bridge legs (one negotiating AES_CM_128_HMAC_SHA1_80, the other AES_CM_128_NULL_AUTH), found in the 2026-08-24 pcap/key verification pass. switch_core_media_check_proxy_crypto_mismatch() is static void, does nothing but call switch_log_printf(..., SWITCH_LOG_ERROR, ...) when it detects differing crypto_type values across the two legs — it doesn't change negotiation, doesn't reject or renegotiate, doesn't touch switch_core_media_build_crypto()'s suite offer/answer logic at all. It converts a failure that previously required an offline pcap decrypt to notice into a loud log line, nothing more.

So: one behavioral fix, one logging-only diagnostic for a still-open root cause.