bugfix: connection to drachtio was not closed on non-success response to invite (#27)

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN11-GNUTLS28-2419151
- https://snyk.io/vuln/SNYK-DEBIAN11-OPENSSL-2388380
- https://snyk.io/vuln/SNYK-DEBIAN11-OPENSSL-2426309
- https://snyk.io/vuln/SNYK-DEBIAN11-UTILLINUX-2401081
- https://snyk.io/vuln/SNYK-DEBIAN11-UTILLINUX-2401081

.husky/pre-commit

@@ -0,0 +1,4 @@
+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+
+npm run jslint

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:17.4-slim
+FROM node:17.7.1-slim
 WORKDIR /opt/app/
 COPY package.json ./
 RUN npm install

lib/call-session.js

@@ -204,7 +204,7 @@ class CallSession extends Emitter {
         const tags = ['accepted:no', `sipStatus:${err.status}`, `originator:${this.req.locals.originator}`];
         this.stats.increment('sbc.terminations', tags);
         this.logger.info(`call failed to connect to feature server with ${err.status}`);
-        return this.emit('failed');
+        this.emit('failed');
       }
       else if (err.message !== 'call canceled') {
         this.logger.error(err, 'unexpected error routing inbound call');
@@ -618,8 +618,20 @@ Duration=${payload.duration} `
       }
     }
     else {
-      // TODO: forward on to feature server
-      res.send(501);
+      /* REFER coming in from a sip device, forward to feature server */
+      try {
+        const response = await dlg.other.request({
+          method: 'REFER',
+          headers: {
+            'Refer-To': req.get('Refer-To'),
+            'Referred-By': req.get('Referred-By'),
+            'User-Agent': req.get('User-Agent')
+          }
+        });
+        res.send(response.status, response.reason);
+      } catch (err) {
+        this.logger.error({err}, 'CallSession:_onRefer: error handling incoming REFER');
+      }
     }
   }
 

package-lock.json

@@ -1,15 +1,15 @@
 {
   "name": "sbc-inbound",
-  "version": "v0.7.3",
+  "version": "v0.7.4",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "sbc-inbound",
-      "version": "v0.7.3",
+      "version": "v0.7.4",
       "license": "MIT",
       "dependencies": {
-        "@jambonz/db-helpers": "^0.6.16",
+        "@jambonz/db-helpers": "^0.6.17",
         "@jambonz/http-authenticator": "^0.2.0",
         "@jambonz/http-health-check": "^0.0.1",
         "@jambonz/realtimedb-helpers": "^0.4.24",
@@ -23,6 +23,7 @@
         "drachtio-fn-b2b-sugar": "0.0.12",
         "drachtio-srf": "^4.4.59",
         "express": "^4.17.1",
+        "husky": "^7.0.4",
         "pino": "^7.4.1",
         "rtpengine-client": "^0.2.0",
         "verify-aws-sns-signature": "^0.0.6",
@@ -1391,9 +1392,9 @@
       }
     },
     "node_modules/@jambonz/db-helpers": {
-      "version": "0.6.16",
-      "resolved": "https://registry.npmjs.org/@jambonz/db-helpers/-/db-helpers-0.6.16.tgz",
-      "integrity": "sha512-jvQULOgoRorevFoZ4RbKIF7QvswSor5sk+THigEId7uPAlaq/GRKCWdEA1rxEizzhfOAiRT6Qg2tyisZ9eg3aA==",
+      "version": "0.6.17",
+      "resolved": "https://registry.npmjs.org/@jambonz/db-helpers/-/db-helpers-0.6.17.tgz",
+      "integrity": "sha512-3L5F6SFVpjn59CO23MpqMydTy1ox2FRe/kry9Zfv8kjTNTSMmfn01c51hjoXcX1v2kdx61qkGvCN6pHlc2LoSQ==",
       "dependencies": {
         "cidr-matcher": "^2.1.1",
         "debug": "^4.3.3",
@@ -3512,6 +3513,20 @@
         "node": ">= 6"
       }
     },
+    "node_modules/husky": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/husky/-/husky-7.0.4.tgz",
+      "integrity": "sha512-vbaCKN2QLtP/vD4yvs6iz6hBEo6wkSzs8HpRah1Z6aGmF2KW5PdYuAd7uX5a+OyBZHBhd+TFLqgjUgytQr4RvQ==",
+      "bin": {
+        "husky": "lib/bin.js"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/typicode"
+      }
+    },
     "node_modules/iconv-lite": {
       "version": "0.6.3",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
@@ -5755,9 +5770,9 @@
       }
     },
     "node_modules/url-parse": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz",
-      "integrity": "sha512-ITeAByWWoqutFClc/lRZnFplgXgEZr3WJ6XngMM/N9DMIm4K8zXPCZ1Jdu0rERwO84w1WC5wkle2ubwTA4NTBg==",
+      "version": "1.5.10",
+      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
       "dependencies": {
         "querystringify": "^2.1.1",
         "requires-port": "^1.0.0"
@@ -7165,9 +7180,9 @@
       "dev": true
     },
     "@jambonz/db-helpers": {
-      "version": "0.6.16",
-      "resolved": "https://registry.npmjs.org/@jambonz/db-helpers/-/db-helpers-0.6.16.tgz",
-      "integrity": "sha512-jvQULOgoRorevFoZ4RbKIF7QvswSor5sk+THigEId7uPAlaq/GRKCWdEA1rxEizzhfOAiRT6Qg2tyisZ9eg3aA==",
+      "version": "0.6.17",
+      "resolved": "https://registry.npmjs.org/@jambonz/db-helpers/-/db-helpers-0.6.17.tgz",
+      "integrity": "sha512-3L5F6SFVpjn59CO23MpqMydTy1ox2FRe/kry9Zfv8kjTNTSMmfn01c51hjoXcX1v2kdx61qkGvCN6pHlc2LoSQ==",
       "requires": {
         "cidr-matcher": "^2.1.1",
         "debug": "^4.3.3",
@@ -8811,6 +8826,11 @@
         "debug": "4"
       }
     },
+    "husky": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/husky/-/husky-7.0.4.tgz",
+      "integrity": "sha512-vbaCKN2QLtP/vD4yvs6iz6hBEo6wkSzs8HpRah1Z6aGmF2KW5PdYuAd7uX5a+OyBZHBhd+TFLqgjUgytQr4RvQ=="
+    },
     "iconv-lite": {
       "version": "0.6.3",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
@@ -10532,9 +10552,9 @@
       }
     },
     "url-parse": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz",
-      "integrity": "sha512-ITeAByWWoqutFClc/lRZnFplgXgEZr3WJ6XngMM/N9DMIm4K8zXPCZ1Jdu0rERwO84w1WC5wkle2ubwTA4NTBg==",
+      "version": "1.5.10",
+      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
       "requires": {
         "querystringify": "^2.1.1",
         "requires-port": "^1.0.0"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbc-inbound",
-  "version": "v0.7.3",
+  "version": "v0.7.4",
   "main": "app.js",
   "engines": {
     "node": ">= 12.0.0"
@@ -25,7 +25,7 @@
     "jslint": "eslint app.js lib"
   },
   "dependencies": {
-    "@jambonz/db-helpers": "^0.6.16",
+    "@jambonz/db-helpers": "^0.6.17",
     "@jambonz/http-authenticator": "^0.2.0",
     "@jambonz/http-health-check": "^0.0.1",
     "@jambonz/realtimedb-helpers": "^0.4.24",
@@ -39,6 +39,7 @@
     "drachtio-fn-b2b-sugar": "0.0.12",
     "drachtio-srf": "^4.4.59",
     "express": "^4.17.1",
+    "husky": "^7.0.4",
     "pino": "^7.4.1",
     "rtpengine-client": "^0.2.0",
     "verify-aws-sns-signature": "^0.0.6",