bugfix: connection to drachtio was not closed on non-success response to invite (#27)

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN11-GNUTLS28-2419151
- https://snyk.io/vuln/SNYK-DEBIAN11-OPENSSL-2388380
- https://snyk.io/vuln/SNYK-DEBIAN11-OPENSSL-2426309
- https://snyk.io/vuln/SNYK-DEBIAN11-UTILLINUX-2401081
- https://snyk.io/vuln/SNYK-DEBIAN11-UTILLINUX-2401081

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:17.4-slim
+FROM node:17.7.1-slim
 WORKDIR /opt/app/
 COPY package.json ./
 RUN npm install

lib/call-session.js

@@ -204,7 +204,7 @@ class CallSession extends Emitter {
         const tags = ['accepted:no', `sipStatus:${err.status}`, `originator:${this.req.locals.originator}`];
         this.stats.increment('sbc.terminations', tags);
         this.logger.info(`call failed to connect to feature server with ${err.status}`);
-        return this.emit('failed');
+        this.emit('failed');
       }
       else if (err.message !== 'call canceled') {
         this.logger.error(err, 'unexpected error routing inbound call');
@@ -618,8 +618,20 @@ Duration=${payload.duration} `
       }
     }
     else {
-      // TODO: forward on to feature server
-      res.send(501);
+      /* REFER coming in from a sip device, forward to feature server */
+      try {
+        const response = await dlg.other.request({
+          method: 'REFER',
+          headers: {
+            'Refer-To': req.get('Refer-To'),
+            'Referred-By': req.get('Referred-By'),
+            'User-Agent': req.get('User-Agent')
+          }
+        });
+        res.send(response.status, response.reason);
+      } catch (err) {
+        this.logger.error({err}, 'CallSession:_onRefer: error handling incoming REFER');
+      }
     }
   }
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "sbc-inbound",
-  "version": "v0.7.3",
+  "version": "v0.7.4",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "sbc-inbound",
-      "version": "v0.7.3",
+      "version": "v0.7.4",
       "license": "MIT",
       "dependencies": {
         "@jambonz/db-helpers": "^0.6.17",
@@ -5770,9 +5770,9 @@
       }
     },
     "node_modules/url-parse": {
-      "version": "1.5.7",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.7.tgz",
-      "integrity": "sha512-HxWkieX+STA38EDk7CE9MEryFeHCKzgagxlGvsdS7WBImq9Mk+PGwiT56w82WI3aicwJA8REp42Cxo98c8FZMA==",
+      "version": "1.5.10",
+      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
       "dependencies": {
         "querystringify": "^2.1.1",
         "requires-port": "^1.0.0"
@@ -10552,9 +10552,9 @@
       }
     },
     "url-parse": {
-      "version": "1.5.7",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.7.tgz",
-      "integrity": "sha512-HxWkieX+STA38EDk7CE9MEryFeHCKzgagxlGvsdS7WBImq9Mk+PGwiT56w82WI3aicwJA8REp42Cxo98c8FZMA==",
+      "version": "1.5.10",
+      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
       "requires": {
         "querystringify": "^2.1.1",
         "requires-port": "^1.0.0"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbc-inbound",
-  "version": "v0.7.3",
+  "version": "v0.7.4",
   "main": "app.js",
   "engines": {
     "node": ">= 12.0.0"