Set strict source on rtpengine (#210 )

* Set strict source on rtpengine RTPBleed * use env var for strict source * lint * Update utils.js * arghhhh * clarification * change
bump version
2026-10-04 02:04:22 +00:00 · 2025-08-03 19:44:47 -04:00 · 2025-07-15 11:46:09 -04:00 · 2025-07-09 08:23:17 -04:00 · 2025-06-27 08:14:26 -04:00 · 2025-06-18 21:11:05 +02:00
25 changed files with 5764 additions and 3909 deletions
@@ -6,12 +6,15 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
-          node-version: 18.x
-      - run: npm ci
+          node-version: 20.x
+      - run: npm install
      - run: npm run jslint
-      - run: npm test
-
- 
+      - name: Install Docker Compose
+        run: |
+          sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+          sudo chmod +x /usr/local/bin/docker-compose
+          docker-compose --version
+      - run: npm test
@@ -1,4 +1,5 @@
 #!/bin/sh
 . "$(dirname "$0")/_/husky.sh"

-npm run jslint
+# npm audit fix || true
+# npm run jslint
@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 node:18.15-alpine3.16 as base
+FROM --platform=linux/amd64 node:20.13.0-alpine3.18 as base

 RUN apk --update --no-cache add --virtual .builds-deps build-base python3

@@ -14,28 +14,6 @@ assert.ok(process.env.DRACHTIO_SECRET, 'missing DRACHTIO_SECRET env var');
 assert.ok(process.env.JAMBONES_TIME_SERIES_HOST, 'missing JAMBONES_TIME_SERIES_HOST env var');
 assert.ok(process.env.JAMBONES_NETWORK_CIDR || process.env.K8S, 'missing JAMBONES_NETWORK_CIDR env var');

-
-const JAMBONES_REDIS_SENTINELS = process.env.JAMBONES_REDIS_SENTINELS ? {
-  sentinels: process.env.JAMBONES_REDIS_SENTINELS.split(',').map((sentinel) => {
-    let host, port = 26379;
-    if (sentinel.includes(':')) {
-      const arr = sentinel.split(':');
-      host = arr[0];
-      port = parseInt(arr[1], 10);
-    } else {
-      host = sentinel;
-    }
-    return {host, port};
-  }),
-  name: process.env.JAMBONES_REDIS_SENTINEL_MASTER_NAME,
-  ...(process.env.JAMBONES_REDIS_SENTINEL_PASSWORD && {
-    password: process.env.JAMBONES_REDIS_SENTINEL_PASSWORD
-  }),
-  ...(process.env.JAMBONES_REDIS_SENTINEL_USERNAME && {
-    username: process.env.JAMBONES_REDIS_SENTINEL_USERNAME
-  })
-} : null;
-
 const Srf = require('drachtio-srf');
 const srf = new Srf('sbc-inbound');
 const opts = Object.assign({
@@ -59,7 +37,7 @@ const {
 const StatsCollector = require('@jambonz/stats-collector');
 const CIDRMatcher = require('cidr-matcher');
 const stats = new StatsCollector(logger);
-const {equalsIgnoreOrder, createHealthCheckApp, systemHealth} = require('./lib/utils');
+const {equalsIgnoreOrder, createHealthCheckApp, systemHealth, parseHostPorts} = require('./lib/utils');
 const {LifeCycleEvents} = require('./lib/constants');
 const setNameRtp = `${(process.env.JAMBONES_CLUSTER_ID || 'default')}:active-rtp`;
 const rtpServers = [];
@@ -77,7 +55,8 @@ const {
  lookupAccountBySid,
  lookupAccountCapacitiesBySid,
  queryCallLimits,
-  lookupClientByAccountAndUsername
+  lookupClientByAccountAndUsername,
+  lookupSystemInformation
 } = require('@jambonz/db-helpers')({
  host: process.env.JAMBONES_MYSQL_HOST,
  port: process.env.JAMBONES_MYSQL_PORT || 3306,
@@ -88,15 +67,15 @@ const {
 }, logger);
 const {
  client: redisClient,
+  addKey,
+  deleteKey,
+  retrieveKey,
  createSet,
  retrieveSet,
  addToSet,
  removeFromSet,
  incrKey,
-  decrKey} = require('@jambonz/realtimedb-helpers')(JAMBONES_REDIS_SENTINELS || {
-  host: process.env.JAMBONES_REDIS_HOST,
-  port: process.env.JAMBONES_REDIS_PORT || 6379
-}, logger);
+  decrKey} = require('@jambonz/realtimedb-helpers')({}, logger);

 const ngProtocol = process.env.JAMBONES_NG_PROTOCOL || 'udp';
 const ngPort = process.env.RTPENGINE_PORT || ('udp' === ngProtocol ? 22222 : 8080);
@@ -116,6 +95,7 @@ srf.locals = {...srf.locals,
  AlertType,
  activeCallIds: new Map(),
  getRtpEngine,
+  privateNetworkCidr: process.env.PRIVATE_VOIP_NETWORK_CIDR || null,
  dbHelpers: {
    pool,
    ping,
@@ -127,9 +107,13 @@ srf.locals = {...srf.locals,
    lookupAccountBySipRealm,
    lookupAccountCapacitiesBySid,
    queryCallLimits,
-    lookupClientByAccountAndUsername
+    lookupClientByAccountAndUsername,
+    lookupSystemInformation
  },
  realtimeDbHelpers: {
+    addKey,
+    deleteKey,
+    retrieveKey,
    createSet,
    incrKey,
    decrKey,
@@ -170,11 +154,28 @@ if (process.env.DRACHTIO_HOST && !process.env.K8S) {
  const matcher = new CIDRMatcher(cidrs);

  srf.connect({host: process.env.DRACHTIO_HOST, port: process.env.DRACHTIO_PORT, secret: process.env.DRACHTIO_SECRET });
-  srf.on('connect', (err, hp) => {
+  srf.on('connect', (err, hp, version, localHostports) => {
    if (err) return this.logger.error({err}, 'Error connecting to drachtio server');
-    logger.info(`connected to drachtio listening on ${hp}`);
+    let addedPrivateIp = false;
+    logger.info(`connected to drachtio ${version} listening on ${hp}, local hostports: ${localHostports}`);

    const hostports = hp.split(',');
+
+    if (localHostports) {
+      const locals = localHostports.split(',');
+      for (const hp of locals) {
+        const arr = /^(.*)\/(.*):(\d+)$/.exec(hp);
+        if (arr && 'tcp' === arr[1] && matcher.contains(arr[2])) {
+          const hostport = `${arr[2]}:${arr[3]}`;
+          logger.info(`adding sbc private address to redis: ${hostport}`);
+          srf.locals.privateSipAddress = hostport;
+          srf.locals.addToRedis = () => addToSet(setName, hostport);
+          srf.locals.removeFromRedis = () => removeFromSet(setName, hostport);
+          srf.locals.addToRedis();
+          addedPrivateIp = true;
+        }
+      }
+    }
    for (const hp of hostports) {
      const arr = /^(.*)\/(.*):(\d+)$/.exec(hp);
      if (arr && 'udp' === arr[1] && !matcher.contains(arr[2])) {
@@ -182,7 +183,7 @@ if (process.env.DRACHTIO_HOST && !process.env.K8S) {
        srf.locals.sipAddress = arr[2];
        if (!process.env.SBC_ACCOUNT_SID) addSbcAddress(arr[2]);
      }
-      else if (arr && 'tcp' === arr[1] && matcher.contains(arr[2])) {
+      else if (!addedPrivateIp && arr && 'tcp' === arr[1] && matcher.contains(arr[2])) {
        const hostport = `${arr[2]}:${arr[3]}`;
        logger.info(`adding sbc private address to redis: ${hostport}`);
        srf.locals.privateSipAddress = hostport;
@@ -191,6 +192,7 @@ if (process.env.DRACHTIO_HOST && !process.env.K8S) {
        srf.locals.addToRedis();
      }
    }
+    srf.locals.sbcPublicIpAddress = parseHostPorts(logger, hostports, srf);
  });
 }
 else {
@@ -198,13 +200,13 @@ else {
    logger.info(`listening in outbound mode on port ${process.env.DRACHTIO_PORT}`);
  });
  srf.listen({port: process.env.DRACHTIO_PORT, secret: process.env.DRACHTIO_SECRET});
-  srf.on('connect', (err, hp) => {
+  srf.on('connect', (err, hp, version, localHostports) => {
    if (err) return this.logger.error({err}, 'Error connecting to drachtio server');
-    logger.info(`connected to drachtio listening on ${hp}`);
+    logger.info(`connected to drachtio ${version} listening on ${hp}, local hostports: ${localHostports}`);

    if (process.env.K8S_FEATURE_SERVER_TRANSPORT === 'tcp') {
      const matcher = new CIDRMatcher(['192.168.0.0/24', '172.16.0.0/16', '10.0.0.0/8']);
-      const hostports = hp.split(',');
+      const hostports = localHostports ? localHostports.split(',') : hp.split(',');
      for (const hp of hostports) {
        const arr = /^(.*)\/(.*):(\d+)$/.exec(hp);
        if (arr && matcher.contains(arr[2])) {
@@ -214,6 +216,7 @@ else {
        }
      }
    }
+    srf.locals.sbcPublicIpAddress = parseHostPorts(logger, hp, srf);
  });
 }
 if (process.env.NODE_ENV === 'test') {
@@ -279,10 +282,21 @@ if (process.env.K8S || process.env.HTTP_PORT) {
    });
 }
 if ('test' !== process.env.NODE_ENV) {
-  /* update call stats periodically */
-  setInterval(() => {
+  /* update call stats periodically as well as definition of private network cidr */
+  setInterval(async() => {
    stats.gauge('sbc.sip.calls.count', activeCallIds.size,
      ['direction:inbound', `instance_id:${process.env.INSTANCE_ID || 0}`]);
+
+    const r = await lookupSystemInformation();
+    if (r) {
+      if (r.private_network_cidr !== srf.locals.privateNetworkCidr) {
+        logger.info(`updating private network cidr from ${srf.locals.privateNetworkCidr} to ${r.private_network_cidr}`);
+        srf.locals.privateNetworkCidr = r.private_network_cidr;
+      }
+      if (r.log_level) {
+        logger.level = r.log_level;
+      }
+    }
  }, 20000);
 }

@@ -3,6 +3,6 @@
  "DTLS": "off",
  "SDES": "off",
  "ICE": "remove",
-  "flags": ["media handover", "port latching"],
+  "flags": ["port latching"],
  "rtcp-mux": ["accept"]
 }
@@ -3,14 +3,14 @@
    "transport-protocol": "UDP/TLS/RTP/SAVPF",
    "ICE": "default",
    "SDES": "off",
-    "flags": ["generate mid", "SDES-no", "media handover", "port latching"],
+    "flags": ["generate mid", "SDES-no", "port latching"],
    "rtcp-mux": ["require"]  
  },
  "teams": {
    "transport-protocol": "RTP/SAVP",
    "ICE": "default",
    "SDES": "off",
-    "flags": ["generate mid", "SDES-no", "media handover", "port latching"],
+    "flags": ["generate mid", "SDES-no", "port latching"],
    "rtcp-mux": ["accept"]
  }
 }
@@ -8,7 +8,7 @@ module.exports = (logger) => {
  // listen for SNS lifecycle changes
  let lifecycleEmitter = new Emitter();
  lifecycleEmitter.dryUpCalls = false;
-  if (process.env.AWS_SNS_TOPIC_ARM) {
+  if (process.env.AWS_SNS_TOPIC_ARN) {

    (async function() {
      try {
@@ -69,7 +69,17 @@ class SnsNotifier extends Emitter {
            subscriptionRequestId: this.subscriptionRequestId
          }, 'response from SNS SubscribeURL');
          const data = await this.describeInstance();
-          this.lifecycleState = data.AutoScalingGroups[0].Instances[0].LifecycleState;
+
+          const group = data.AutoScalingGroups.find((group) =>
+            group.Instances && group.Instances.some((instance) => instance.InstanceId === this.instanceId)
+          );
+          if (!group) {
+            this.logger.error('Current instance not found in any Auto Scaling group', data);
+          } else {
+            const instance = group.Instances.find((instance) => instance.InstanceId === this.instanceId);
+            this.lifecycleState = instance.LifecycleState;
+          }
+
          this.emit('SubscriptionConfirmation', {publicIp: this.publicIp});
          break;

@@ -137,13 +147,13 @@ class SnsNotifier extends Emitter {
    try {
      const params = {
        Protocol: 'http',
-        TopicArn: process.env.AWS_SNS_TOPIC_ARM,
+        TopicArn: process.env.AWS_SNS_TOPIC_ARN,
        Endpoint: this.snsEndpoint
      };
      const response = await snsClient.send(new SubscribeCommand(params));
-      this.logger.info({response}, `response to SNS subscribe to ${process.env.AWS_SNS_TOPIC_ARM}`);
+      this.logger.info({response}, `response to SNS subscribe to ${process.env.AWS_SNS_TOPIC_ARN}`);
    } catch (err) {
-      this.logger.error({err}, `Error subscribing to SNS topic arn ${process.env.AWS_SNS_TOPIC_ARM}`);
+      this.logger.error({err}, `Error subscribing to SNS topic arn ${process.env.AWS_SNS_TOPIC_ARN}`);
    }
  }

@@ -154,9 +164,9 @@ class SnsNotifier extends Emitter {
        SubscriptionArn: this.subscriptionArn
      };
      const response = await snsClient.send(new UnsubscribeCommand(params));
-      this.logger.info({response}, `response to SNS unsubscribe to ${process.env.AWS_SNS_TOPIC_ARM}`);
+      this.logger.info({response}, `response to SNS unsubscribe to ${process.env.AWS_SNS_TOPIC_ARN}`);
    } catch (err) {
-      this.logger.error({err}, `Error unsubscribing to SNS topic arn ${process.env.AWS_SNS_TOPIC_ARM}`);
+      this.logger.error({err}, `Error unsubscribing to SNS topic arn ${process.env.AWS_SNS_TOPIC_ARN}`);
    }
  }

@@ -6,14 +6,19 @@ const {
  SdpWantsSDES,
  nudgeCallCounts,
  roundTripTime,
-  parseConnectionIp
+  parseConnectionIp,
+  isPrivateVoipNetwork,
+  makeFullMediaReleaseKey,
+  makePartnerFullMediaReleaseKey
 } = require('./utils');
+const { MediaPath } = require('./constants.json');

 const {forwardInDialogRequests} = require('drachtio-fn-b2b-sugar');
 const {parseUri, stringifyUri, SipError} = require('drachtio-srf');
 const debug = require('debug')('jambonz:sbc-inbound');
 const MS_TEAMS_USER_AGENT = 'Microsoft.PSTNHub.SIPProxy';
 const MS_TEAMS_SIP_ENDPOINT = 'sip.pstnhub.microsoft.com';
+const IMMUTABLE_HEADERS = ['via', 'from', 'to', 'call-id', 'cseq', 'max-forwards', 'content-length'];

 /**
 * this is to make sure the outgoing From has the number in the incoming From
@@ -59,11 +64,16 @@ class CallSession extends Emitter {
    this.activeCallIds = this.srf.locals.activeCallIds;

    this.decrKey = req.srf.locals.realtimeDbHelpers.decrKey;
-    this._mediaReleased = false;
+    this.addKey = req.srf.locals.realtimeDbHelpers.addKey;
+    this.retrieveKey = req.srf.locals.realtimeDbHelpers.retrieveKey;
+
+    this._mediaPath = MediaPath.FullMedia;

    this.application_sid = req.locals.application_sid;
    this.account_sid = req.locals.account_sid;
    this.service_provider_sid = req.locals.service_provider_sid;
+    this.srsClients = [];
+    this.recordingNoAnswerTimeout = (process.env.JAMBONES_RECORDING_NO_ANSWER_TIMEOUT || 2) * 1000;
  }

  get isFromMSTeams() {
@@ -75,12 +85,7 @@ class CallSession extends Emitter {
  }

  get isMediaReleased() {
-    return this._mediaReleased;
-  }
-
-  get callerIsUsingSrtp() {
-    const tp = this.rtpEngineOpts?.uas?.mediaOpts['transport-protocol'];
-    return tp && -1 !== tp.indexOf('SAVP');
+    return this._mediaPath !== MediaPath.FullMedia;
  }

  get isFive9VoiceStream() {
@@ -103,7 +108,8 @@ class CallSession extends Emitter {

  async connect() {
    const {sdp} = this.req.locals;
-    this.logger.info('inbound call accepted for routing');
+    const is3pcc = this.req.body?.length === 0;
+    this.logger.info(`inbound ${is3pcc ? '3pcc ' : ''}call accepted for routing`);
    const engine = this.getRtpEngine();
    if (!engine) {
      this.logger.info('No available rtpengines, rejecting call!');
@@ -116,6 +122,7 @@ class CallSession extends Emitter {
      offer,
      answer,
      del,
+      query,
      blockMedia,
      unblockMedia,
      blockDTMF,
@@ -130,6 +137,7 @@ class CallSession extends Emitter {
    this.offer = offer;
    this.answer = answer;
    this.del = del;
+    this.query = query;
    this.blockMedia = blockMedia;
    this.unblockMedia = unblockMedia;
    this.blockDTMF = blockDTMF;
@@ -153,10 +161,15 @@ class CallSession extends Emitter {
    const wantsSrtp = this.req.locals.possibleWebRtcClient = SdpWantsSrtp(sdp);
    const wantsSDES = SdpWantsSDES(sdp);
    this.rtpEngineOpts = makeRtpEngineOpts(this.req, wantsSrtp, false, this.isFromMSTeams || wantsSDES);
-    this.rtpEngineResource = {destroy: this.del.bind(null, this.rtpEngineOpts.common)};
+    this.rtpEngineResource = {
+      destroy: this.del.bind(null, this.rtpEngineOpts.common),
+      query: this.query.bind(null, this.rtpEngineOpts.common),
+    };
    const obj = parseUri(this.req.uri);
    let proxy, host, uri;

+    const scheme = obj.scheme;
+
    // replace host part of uri if its an ipv4 address, leave it otherwise
    if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(obj.host)) {
      debug(`replacing host: was ${obj.host} is ${featureServer}`);
@@ -167,17 +180,17 @@ class CallSession extends Emitter {
      host = obj.host;
      proxy = `sip:${featureServer}`;
    }
-    if (obj.user) uri = `${obj.scheme}:${obj.user}@${host}`;
-    else uri = `${obj.scheme}:${host}`;
+    if (obj.user) uri = `sip:${obj.user}@${host}`;
+    else uri = `sip:${host}`;
    this.logger.info(`uri will be: ${uri}, proxy ${proxy}`);

-    try {
+    const sendOfferToRtpEngine = async(remoteSdp) => {
      const opts = {
        ...this.rtpEngineOpts.common,
        ...this.rtpEngineOpts.uac.mediaOpts,
        'from-tag': this.rtpEngineOpts.uas.tag,
-        direction:  ['public', 'private'],
-        sdp
+        direction:  [isPrivateVoipNetwork(this.req.source_address) ? 'private' : 'public', 'private'],
+        sdp: remoteSdp
      };
      const startAt = process.hrtime();
      const response = await this.offer(opts);
@@ -190,7 +203,11 @@ class CallSession extends Emitter {
        this.logger.error({}, `rtpengine offer failed with ${JSON.stringify(response)}`);
        throw new Error('rtpengine failed: answer');
      }
+      return response;
+    };

+    try {
+      const response = await sendOfferToRtpEngine(sdp);
      let headers = {
        'From': createBLegFromHeader(this.req),
        'To': this.req.get('To'),
@@ -200,25 +217,47 @@ class CallSession extends Emitter {
      };
      if (this.privateSipAddress) headers = {...headers, Contact: `<sip:${this.privateSipAddress}>`};

-      const spdOfferB = this.siprec && this.xml ?
-        createSiprecBody(headers, response.sdp, this.xml.type, this.xml.content) :
-        response.sdp;
+      let spdOfferB;
+      if (this.siprec && this.xml) {
+        spdOfferB = createSiprecBody(headers, response.sdp, this.xml.type, this.xml.content);
+      }
+      else if (!is3pcc) {
+        spdOfferB = response.sdp;
+      }

-      const responseHeaders = {};
      if (this.req.locals.carrier) {
        Object.assign(headers, {
          'X-Originating-Carrier': this.req.locals.carrier,
          'X-Voip-Carrier-Sid': this.req.locals.voip_carrier_sid
        });
      }
-      if (this.req.locals.msTeamsTenantFqdn) {
+
+      // set Contact header based on scenario, and transport protocol
+      let responseHeaders = {};
+      if (isPrivateVoipNetwork(this.req.source_address)) {
+        this.contactHeader = `<${scheme}:${this.privateSipAddress};transport=${this.req.protocol}>`;
+        responseHeaders = {
+          ...responseHeaders,
+          'Contact': this.contactHeader
+        };
+      } else if (this.req.locals.msTeamsTenantFqdn) {
        Object.assign(headers, {'X-MS-Teams-Tenant-FQDN': this.req.locals.msTeamsTenantFqdn});

        // for Microsoft Teams the Contact header must include the tenant FQDN
-        Object.assign(responseHeaders, {
+        this.contactHeader = `sip:${this.req.locals.msTeamsTenantFqdn}`;
+        responseHeaders = {
+          ...responseHeaders,
          Allow: 'INVITE, ACK, OPTIONS, CANCEL, BYE, NOTIFY, UPDATE, PRACK',
-          Contact: `sip:${this.req.locals.msTeamsTenantFqdn}`
-        });
+          Contact: this.contactHeader
+        };
+      }
+      else {
+        const hostport = this.srf.locals.sbcPublicIpAddress[this.req.protocol];
+        this.contactHeader = `<${scheme}:${hostport};transport=${this.req.protocol}>`;
+        responseHeaders = {
+          ...responseHeaders,
+          'Contact': this.contactHeader
+        };
      }
      if (this.req.locals.application_sid) {
        Object.assign(headers, {'X-Application-Sid': this.req.locals.application_sid});
@@ -247,10 +286,14 @@ class CallSession extends Emitter {
          '-Max-Forwards',
          '-Record-Route',
          '-Session-Expires',
-          '-X-Subspace-Forwarded-For'
+          '-X-Application-Sid',
+          '-X-Authenticated-User'
        ],
        proxyResponseHeaders: ['all', '-X-Trace-ID'],
-        localSdpB: spdOfferB,
+        localSdpB: spdOfferB ? spdOfferB : async(ackBody) => {
+          const response = await sendOfferToRtpEngine(ackBody);
+          return response.sdp;
+        },
        localSdpA: async(sdp, res) => {
          this.rtpEngineOpts.uac.tag = res.getParsedHeader('To').params.tag;
          const opts = {
@@ -261,8 +304,12 @@ class CallSession extends Emitter {
            sdp
          };
          const startAt = process.hrtime();
-          const response = await this.answer(opts);
-          this.logger.debug({response, opts}, 'response from rtpengine to answer');
+          const aOpts = {
+            ...opts,
+            ...(is3pcc && {direction: ['private', 'public']})
+          };
+          const response = await this.answer(aOpts);
+          this.logger.debug({response, opts: aOpts}, 'response from rtpengine to answer');
          const rtt = roundTripTime(startAt);
          this.stats.histogram('app.rtpengine.response_time', rtt, [
            'direction:inbound', 'command:answer', `rtpengine:${this.rtpengineIp}`]);
@@ -282,7 +329,7 @@ class CallSession extends Emitter {
          }

          return response.sdp;
-        }
+        },
      });

      // successfully connected
@@ -300,7 +347,16 @@ class CallSession extends Emitter {
        this.emit('failed');
      }
      else if (err.message !== 'call canceled') {
+        const {writeCallCount, writeCallCountSP, writeCallCountApp} = this.req.srf.locals;
        this.logger.error(err, 'unexpected error routing inbound call');
+        nudgeCallCounts(this.req, 'failure', {
+          service_provider_sid: this.service_provider_sid,
+          account_sid: this.account_sid,
+          application_sid: this.application_sid,
+          callId: this.req.locals.callId
+        }, this.decrKey, {writeCallCountSP, writeCallCount, writeCallCountApp})
+          .catch((err) => this.logger.error(err, 'Error decrementing call counts'));
+
      }
      this.srf.endSession(this.req);
    }
@@ -317,10 +373,7 @@ class CallSession extends Emitter {
      this.activeCallIds.delete(callId);
      if (dlg.other && dlg.other.connected) dlg.other.destroy().catch((e) => {});

-      if (this.srsClient) {
-        this.srsClient.stop();
-        this.srsClient = null;
-      }
+      this._stopRecording();

      this.srf.endSession(this.req);
    });
@@ -329,6 +382,29 @@ class CallSession extends Emitter {
    dlg.on('modify', this._onReinvite.bind(this, dlg));
  }

+  _startRecordingNoAnswerTimer(res) {
+    this._clearRecordingNoAnswerTimer();
+    this.recordingNoAnswerTimer = setTimeout(() => {
+      this.logger.info('No response from SipRec server, return error to feature server');
+      this.isRecordingNoAnswerResponded = true;
+      res.send(400);
+    }, this.recordingNoAnswerTimeout);
+  }
+
+  _clearRecordingNoAnswerTimer() {
+    if (this.recordingNoAnswerTimer) {
+      clearTimeout(this.recordingNoAnswerTimer);
+      this.recordingNoAnswerTimer = null;
+    }
+  }
+
+  _stopRecording() {
+    if (this.srsClients.length) {
+      this.srsClients.forEach((c) => c.stop());
+      this.srsClients = [];
+    }
+  }
+
  _setHandlers({uas, uac}) {
    this.emit('connected');
    const callStart = Date.now();
@@ -347,15 +423,35 @@ class CallSession extends Emitter {
        trace_id: uac.res?.get('X-Trace-ID') || '00000000000000000000000000000000'
      };
    }
+
+    /* save far end SDP for later use if we do a full media release */
+    if (process.env.JAMBONES_ENABLE_FULL_MEDIA_RELEASE) {
+      const key = makeFullMediaReleaseKey(this.req.get('Call-ID'));
+      const sdp = this.req.body;
+      this.logger.info({key, sdp}, 'saving far end sdp for full media release feature');
+      this.addKey(key, sdp, 3600).catch((err) => this.logger.error(err, 'Error saving far end sdp'));
+    }
    this.uas = uas;
    this.uac = uac;
    [uas, uac].forEach((dlg) => {
-      dlg.on('destroy', async() => {
+      dlg.on('destroy', async(bye) => {
        const other = dlg.other;
        this.rtpEngineResource.destroy().catch((err) => {});
+        /* DH: need a better understanding of why query before delete is a good idea
+        this.rtpEngineResource.query()
+          .then((results) => {
+            this.logger.info({results}, 'rtpengine query results');
+            return this.rtpEngineResource.destroy();
+          })
+          .catch((err) => {});
+        */
        this.activeCallIds.delete(this.req.get('Call-ID'));
        try {
-          await other.destroy();
+          const headers = {};
+          Object.keys(bye.headers).forEach((h) => {
+            if (!IMMUTABLE_HEADERS.includes(h)) headers[h] = bye.headers[h];
+          });
+          await other.destroy({headers});
        } catch (err) {}
        this.unsubscribeForDTMF();

@@ -366,12 +462,17 @@ class CallSession extends Emitter {

        if (process.env.JAMBONES_HOSTING || trackingOn) {
          const {writeCallCount, writeCallCountSP, writeCallCountApp} = this.req.srf.locals;
-          await nudgeCallCounts(this.logger, {
-            service_provider_sid: this.service_provider_sid,
-            account_sid: this.account_sid,
-            application_sid: this.application_sid
-          }, this.decrKey, {writeCallCountSP, writeCallCount, writeCallCountApp})
-            .catch((err) => this.logger.error(err, 'Error decrementing call counts'));
+          if (!this.req.locals.callCountNudged) {
+            this.req.locals.callCountNudged = true;
+            this.logger.debug('decrementing call count at end of call');
+            await nudgeCallCounts(this.req, 'complete', {
+              service_provider_sid: this.service_provider_sid,
+              account_sid: this.account_sid,
+              application_sid: this.application_sid,
+              callId: this.req.locals.callId
+            }, this.decrKey, {writeCallCountSP, writeCallCount, writeCallCountApp})
+              .catch((err) => this.logger.error(err, 'Error decrementing call counts'));
+          }
        }

        /* write cdr for connected call */
@@ -412,10 +513,7 @@ class CallSession extends Emitter {
        dlg.other = null;
        other.other = null;

-        if (this.srsClient) {
-          this.srsClient.stop();
-          this.srsClient = null;
-        }
+        this._stopRecording();

        this.logger.info(`call ended with normal termination, there are ${this.activeCallIds.size} active`);
        this.srf.endSession(this.req);
@@ -547,6 +645,7 @@ Duration=${payload.duration} `
    const toTag = dlg.type === 'uas' ? this.rtpEngineOpts.uac.tag : this.rtpEngineOpts.uas.tag;
    const reason = req.get('X-Reason');
    const isReleasingMedia = reason && dlg.type === 'uac' && ['release-media', 'anchor-media'].includes(reason);
+    const isFullMediaRelease = reason === 'release-media-entirely' && process.env.JAMBONES_ENABLE_FULL_MEDIA_RELEASE;
    const offerMedia = dlg.type === 'uas' ? this.rtpEngineOpts.uac.mediaOpts : this.rtpEngineOpts.uas.mediaOpts;
    const answerMedia = dlg.type === 'uas' ? this.rtpEngineOpts.uas.mediaOpts : this.rtpEngineOpts.uac.mediaOpts;
    const direction =  dlg.type === 'uas' ? ['public', 'private'] : ['private', 'public'];
@@ -599,10 +698,35 @@ Duration=${payload.duration} `
        }
        else {
          this.logger.info('got a reINVITE with no SDP; just respond with our current offer');
-          res.send(200, {body: dlg.local.sdp});
+          res.send(200, {
+            headers: {
+              'Contact': this.contactHeader
+            },
+            body: dlg.local.sdp
+          });
        }
        return;
      }
+
+      if (isFullMediaRelease) {
+        const b_sdp = await this.retrieveKey(makePartnerFullMediaReleaseKey(this.req.get('Call-ID')));
+        this.logger.info({b_sdp}, 'reinvite ourselves out of the media path with this reinvite offer');
+        const answerSdp = await dlg.other.modify(b_sdp);
+        this.logger.info({answerSdp}, 'far end response to full media release');
+        res.send(200, {
+          body: dlg.local.sdp,
+          headers: {
+            'Contact': this.contactHeader
+          }
+        });
+        /* no media going through us now we can destroy the rtpengine resource */
+        this.rtpEngineResource.destroy().catch((err) => {
+          this.logger.info({err}, 'Error destroying rtpengine resource after full media release');
+        });
+        this._mediaPath = MediaPath.NoMedia;
+        return;
+      }
+
      const offeredSdp = Array.isArray(req.payload) && req.payload.length > 1 ?
        req.payload.find((p) => p.type === 'application/sdp').content :
        req.body;
@@ -630,12 +754,16 @@ Duration=${payload.duration} `

      /* if this is a re-invite from the FS to change media anchoring, avoid sending the reinvite out */
      let sdp;
-      if (isReleasingMedia && !this.callerIsUsingSrtp) {
-        this.logger.info({response}, `got a reinvite from FS to ${reason}`);
+      //HL 2024-11-13: previously forwarded re-invites to webrtc clients but further testing has shown to be unnecessary
+      //if (isReleasingMedia && !this.callerIsUsingSrtp) {
+
+      //DH 2024-11- 18: if we are going from no-media to either partial or full media, we need reinvite the far end
+      if (isReleasingMedia && this._mediaPath !== MediaPath.NoMedia) {
        sdp = dlg.other.remote.sdp;
        if (!answerMedia.flags.includes('asymmetric')) answerMedia.flags.push('asymmetric');
        answerMedia.flags = answerMedia.flags.filter((f) => f !== 'media handover');
-        this._mediaReleased = 'release-media' === reason;
+        this._mediaPath = 'release-media' === reason ? MediaPath.PartialMedia : MediaPath.FullMedia;
+        this.logger.debug(`media path is now ${this._mediaPath}`);
      }
      else {
        sdp = await dlg.other.modify(response.sdp);
@@ -652,8 +780,14 @@ Duration=${payload.duration} `
        res.send(488);
        throw new Error(`_onReinvite: rtpengine failed: ${JSON.stringify(response)}`);
      }
-      res.send(200, {body: response.sdp});
+      res.send(200, {
+        headers: {
+          'Contact': this.contactHeader
+        },
+        body: response.sdp
+      });
    } catch (err) {
+      res.send(err.status || 500);
      this.logger.error(err, 'Error handling reinvite');
    }
  }
@@ -684,6 +818,7 @@ Duration=${payload.duration} `
        }
        else if (reason.includes('CallRecording')) {
          let succeeded = false;
+          const headers = contentType === 'application/json' && req.body ? JSON.parse(req.body) : {};
          if (reason === 'startCallRecording') {
            const from = this.req.getParsedHeader('From');
            const to = this.req.getParsedHeader('To');
@@ -696,7 +831,7 @@ Duration=${payload.duration} `
            const callSid = req.get('X-Call-Sid');
            const accountSid = req.get('X-Account-Sid');
            const applicationSid = req.get('X-Application-Sid');
-            if (this.srsClient) {
+            if (this.srsClients.length) {
              res.send(400);
              this.logger.info('discarding duplicate startCallRecording request for a call');
              return;
@@ -706,13 +841,14 @@ Duration=${payload.duration} `
              res.send(400);
              return;
            }
-            this.srsClient = new SrsClient(this.logger, {
+            const arr = srsUrl.split(',');
+            this.srsClients = arr.map((url) => new SrsClient(this.logger, {
              srf: dlg.srf,
              direction: 'inbound',
              originalInvite: this.req,
              callingNumber: this.req.callingNumber,
              calledNumber: this.req.calledNumber,
-              srsUrl,
+              srsUrl: url,
              srsRecordingId,
              callSid,
              accountSid,
@@ -727,44 +863,104 @@ Duration=${payload.duration} `
              del: this.del,
              blockMedia: this.blockMedia,
              unblockMedia: this.unblockMedia,
-              unsubscribe: this.unsubscribe
-            });
+              unsubscribe: this.unsubscribe,
+              headers,
+              isSipRecCall: Array.isArray(this.req.payload) && this.req.payload.length > 1
+            }));
            try {
-              succeeded = await this.srsClient.start();
+              this._startRecordingNoAnswerTimer(res);
+              await Promise.any(this.srsClients.map((c) => c.start()));
+              succeeded = true;
            } catch (err) {
              this.logger.error({err}, 'Error starting SipRec call recording');
+              succeeded = false;
            }
          }
          else if (reason === 'stopCallRecording') {
-            if (!this.srsClient) {
+            if (!this.srsClients.length || !this.srsClients.some((c) => c.activated)) {
              res.send(400);
              this.logger.info('discarding stopCallRecording request because we are not recording');
              return;
            }
            try {
-              succeeded = await this.srsClient.stop();
+              this._startRecordingNoAnswerTimer(res);
+              await Promise.any(this.srsClients.map((c) => {
+                if (c.activated) {
+                  c.stop();
+                }
+              }));
+              succeeded = true;
            } catch (err) {
              this.logger.error({err}, 'Error stopping SipRec call recording');
+              succeeded = false;
            }
-            this.srsClient = null;
+            this.srsClients = [];
          }
          else if (reason === 'pauseCallRecording') {
-            if (!this.srsClient || this.srsClient.paused) {
+            if (!this.srsClients.length || !this.srsClients.some((c) => c.activated && !c.paused)) {
              this.logger.info('discarding invalid pauseCallRecording request');
              res.send(400);
              return;
            }
-            succeeded = await this.srsClient.pause();
+            try {
+              this._startRecordingNoAnswerTimer(res);
+              await Promise.any(this.srsClients.map((c) => {
+                if (c.activated && !c.paused) {
+                  c.pause({headers});
+                }
+              }));
+              succeeded = true;
+            } catch (err) {
+              this.logger.error({err}, 'Error pausing SipRec call recording');
+              succeeded = false;
+            }
          }
          else if (reason === 'resumeCallRecording') {
-            if (!this.srsClient || !this.srsClient.paused) {
+            if (!this.srsClients.length || !this.srsClients.some((c) => c.activated && c.paused)) {
              res.send(400);
              this.logger.info('discarding invalid resumeCallRecording request');
              return;
            }
-            succeeded = await this.srsClient.resume();
+            try {
+              this._startRecordingNoAnswerTimer(res);
+              await Promise.any(this.srsClients.map((c) => {
+                if (c.activated && c.paused) {
+                  c.resume({headers});
+                }
+              }));
+              succeeded = true;
+            } catch (err) {
+              this.logger.error({err}, 'Error resuming SipRec call recording');
+              succeeded = false;
+            }
          }
-          res.send(succeeded ? 200 : 503);
+          if (!this.isRecordingNoAnswerResponded) {
+            this._clearRecordingNoAnswerTimer();
+            res.send(succeeded ? 200 : 503);
+          }
+        } else if (reason.includes('Dtmf')) {
+          const arr = /Signal=\s*([0-9#*])/.exec(req.body);
+          if (!arr) {
+            this.logger.info({body: req.body}, '_onInfo: invalid INFO Dtmf');
+            throw new Error(`_onInfo: no dtmf in body for ${contentType}`);
+          }
+          const code = arr[1];
+          const arr2 = /Duration=\s*(\d+)/.exec(req.body);
+          const duration = arr2 ? arr2[1] : 250;
+          const volume = 13;
+          const dtmfOpts = {
+            ...this.rtpEngineOpts.common,
+            'from-tag': this.rtpEngineOpts.uac.tag,
+            code,
+            duration,
+            volume
+          };
+          const response = await this.playDTMF(dtmfOpts);
+          if ('ok' !== response.result) {
+            this.logger.info({response}, `rtpengine play Dtmf failed with ${JSON.stringify(response)}`);
+            throw new Error('rtpengine failed: answer');
+          }
+          res.send(200);
        }
      }
      else if (dlg.type === 'uas' && ['application/dtmf-relay', 'application/dtmf'].includes(contentType)) {
@@ -802,10 +998,9 @@ Duration=${payload.duration} `
        }
      }
      else {
-        const immutableHdrs = ['via', 'from', 'to', 'call-id', 'cseq', 'max-forwards', 'content-length'];
        const headers = {};
        Object.keys(req.headers).forEach((h) => {
-          if (!immutableHdrs.includes(h)) headers[h] = req.headers[h];
+          if (!IMMUTABLE_HEADERS.includes(h)) headers[h] = req.headers[h];
        });
        const response = await dlg.other.request({method: 'INFO', headers, body: req.body});
        const responseHeaders = {};
@@ -815,8 +1010,8 @@ Duration=${payload.duration} `
        res.send(response.status, {headers: responseHeaders, body: response.body});
      }
    } catch (err) {
-      if (this.srsClient) {
-        this.srsClient = null;
+      if (this.srsClients.length) {
+        this.srsClients = [];
      }
      res.send(500);
      this.logger.info({err}, `Error handing INFO request on ${dlg.type} leg`);
@@ -832,9 +1027,7 @@ Duration=${payload.duration} `
      if (!arr) {
        /* call transfer requested */
        const {gateway} = this.req.locals;
-        const referredBy = req.getParsedHeader('Referred-By');
-        if (!referredBy) return res.send(400);
-        const u = parseUri(referredBy.uri);
+        if (!req.has('Referred-By')) return res.send(400);
        const leaveReferToAlone = req.has('X-Refer-To-Leave-Untouched');
        if (leaveReferToAlone) {
          this.logger.debug({referTo}, 'passing Refer-To header through untouched');
@@ -864,17 +1057,18 @@ Duration=${payload.duration} `
        // eslint-disable-next-line no-unused-vars
        const {via, from, to, 'call-id':callid, cseq, 'max-forwards':maxforwards,
          // eslint-disable-next-line no-unused-vars
-          'content-length':contentlength, 'refer-to':_referto, 'referred-by':_referredby,
+          'content-length':contentlength, 'refer-to':_referto, 'referred-by': referredby,
          // eslint-disable-next-line no-unused-vars
-          'X-Refer-To-Leave-Untouched': _leave,
+          'X-Refer-To-Leave-Untouched': _leave, contact: _contact,
          ...customHeaders
        } = req.headers;

        const response = await this.uas.request({
          method: 'REFER',
          headers: {
-            'Refer-To': stringifyUri(uri),
-            'Referred-By': stringifyUri(u),
+            'Refer-To': `<${stringifyUri(uri)}>`,
+            'Referred-By': referredby,
+            'Contact': this.contactHeader,
            ...customHeaders
          }
        });
@@ -891,6 +1085,7 @@ Duration=${payload.duration} `
      this.uac = uac;
      uac.other = this.uas;
      this.uas.other = uac;
+      uac.on('info', this._onInfo.bind(this, uac));
      uac.on('modify', this._onReinvite.bind(this, uac));
      uac.on('refer', this._onFeatureServerTransfer.bind(this, uac));
      uac.on('destroy', () => {
@@ -900,19 +1095,22 @@ Duration=${payload.duration} `
        uac.other.destroy();
        this.srf.endSession(this.req);
      });
-      // now we can destroy the old dialog
-      dlg.destroy().catch(() => {});

-      // modify rtpengine to stream to new feature server
-      const opts = Object.assign({sdp: uac.remote.sdp, 'to-tag': res.getParsedHeader('To').params.tag},
-        this.rtpEngineOpts.answer);
+      const opts = {
+        ...this.rtpEngineOpts.common,
+        'from-tag': this.rtpEngineOpts.uas.tag,
+        'to-tag': this.rtpEngineOpts.uac.tag,
+        sdp: uac.remote.sdp,
+        flags: ['port latching']
+      };
      const response = await this.answer(opts);
      if ('ok' !== response.result) {
-        res.send(488);
-        throw new Error(`_onFeatureServerTransfer: rtpengine failed: ${JSON.stringify(response)}`);
+        throw new Error(`_onFeatureServerTransfer: rtpengine answer failed: ${JSON.stringify(response)}`);
      }
+      dlg.destroy().catch(() => {});
      this.logger.info('successfully moved call to new feature server');
    } catch (err) {
+      res.send(488);
      this.logger.error(err, 'Error handling refer from feature server');
    }
  }
@@ -3,5 +3,10 @@
    "ScaleIn": "scale-in",
    "StandbyEnter": "standby-enter",
    "StandbyExit": "standby-exit"
+  },
+  "MediaPath": {
+    "NoMedia": "no-media",
+    "PartialMedia": "partial-media",
+    "FullMedia": "full-media"
  }
 }
@@ -7,7 +7,7 @@ const sqlSelectSPForAccount = 'SELECT service_provider_sid FROM accounts WHERE a

 const sqlSelectAllCarriersForAccountByRealm =
 `SELECT sg.sip_gateway_sid, sg.voip_carrier_sid, vc.name, vc.account_sid,  
-vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask  
+vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask, sg.pad_crypto
 FROM sip_gateways sg, voip_carriers vc, accounts acc 
 WHERE acc.sip_realm = ? 
 AND vc.account_sid = acc.account_sid 
@@ -17,7 +17,7 @@ AND sg.voip_carrier_sid = vc.voip_carrier_sid`;

 const sqlSelectAllCarriersForSPByRealm =
 `SELECT sg.sip_gateway_sid, sg.voip_carrier_sid, vc.name, vc.account_sid,  
-vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask  
+vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask, sg.pad_crypto
 FROM sip_gateways sg, voip_carriers vc, accounts acc 
 WHERE acc.sip_realm = ? 
 AND vc.service_provider_sid = acc.service_provider_sid  
@@ -28,24 +28,14 @@ AND sg.voip_carrier_sid = vc.voip_carrier_sid`;

 const sqlSelectAllGatewaysForSP =
 `SELECT sg.sip_gateway_sid, sg.voip_carrier_sid, vc.name, vc.service_provider_sid,  
-vc.account_sid, vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask  
+vc.account_sid, vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask, sg.pad_crypto
 FROM sip_gateways sg, voip_carriers vc
 WHERE sg.voip_carrier_sid = vc.voip_carrier_sid 
 AND vc.service_provider_sid IS NOT NULL 
 AND vc.is_active = 1 
 AND sg.inbound = 1`;

-const sqlCarriersForAccountBySid =
-`SELECT sg.sip_gateway_sid, sg.voip_carrier_sid, vc.name, vc.account_sid,  
-vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask  
-FROM sip_gateways sg, voip_carriers vc, accounts acc 
-WHERE acc.account_sid = ? 
-AND vc.account_sid = acc.account_sid 
-AND vc.is_active = 1 
-AND sg.inbound = 1 
-AND sg.voip_carrier_sid = vc.voip_carrier_sid`;
-
-const sqlAccountByRealm = 'SELECT * from accounts WHERE sip_realm = ?';
+const sqlAccountByRealm = 'SELECT * from accounts WHERE sip_realm = ? AND is_active = 1';
 const sqlAccountBySid = 'SELECT * from accounts WHERE account_sid = ?';
 const sqlApplicationBySid = 'SELECT * from applications WHERE application_sid = ?';

@@ -67,7 +57,7 @@ AND outbound = 1`;

 const sqlSelectCarrierRequiringRegistration = `
 SELECT sg.sip_gateway_sid, sg.voip_carrier_sid, vc.name, vc.service_provider_sid, vc.account_sid, 
-vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask  
+vc.application_sid, sg.inbound, sg.outbound, sg.is_active, sg.ipv4, sg.netmask, sg.pad_crypto
 FROM sip_gateways sg, voip_carriers vc 
 WHERE sg.voip_carrier_sid = vc.voip_carrier_sid 
 AND vc.requires_register = 1 
@@ -117,6 +107,22 @@ module.exports = (srf, logger) => {
    }
  };

+  /**
+   * Retrieves the application for a given DID (phone number) and carrier combination.
+   * First attempts an exact DID match, then falls back to pattern/wildcard matching
+   * if no exact match is found. Pattern matching is done in order of pattern length
+   * (longest/most specific first) and handles both regex and wildcard (*) patterns.
+   *
+   * @param {Object} req - The request object containing the called number
+   * @param {string} voip_carrier_sid - The SID of the VoIP carrier
+   * @returns {Promise<(string|Object|null)>} Returns either:
+   *   - application_sid (string) if appObject is false
+   *   - full application object if appObject is true
+   *   - null if no matching application is found
+   * @throws {Error} Database errors or other unexpected errors
+   */
+  // Refactored to handle invalid regular expressions gracefully as part of
+  // https://github.com/jambonz/sbc-inbound/issues/201
  const getApplicationForDidAndCarrier = async(req, voip_carrier_sid) => {
    const did = normalizeDID(req.calledNumber) || 'anonymous';

@@ -127,22 +133,80 @@ module.exports = (srf, logger) => {

      /* wildcard / regex match */
      const [r2] = await pp.query(sqlQueryAllDidsForCarrier, [voip_carrier_sid]);
-      const match = r2
+      const patterns = r2
        .filter((o) => o.number.match(/\D/))                  // look at anything with non-digit characters
-        .sort((a, b) => b.number.length - a.number.length)    // prefer longest match
-        .find((o) => did.match(new RegExp(o.number.endsWith('*') ? `${o.number.slice(0, -1)}\\d*` : o.number)));
-      if (match) return match.application_sid;
+        .sort((a, b) => b.number.length - a.number.length);
+      for (const pattern of patterns) {
+        try {
+          const regexPattern = pattern.number.endsWith('*') ?
+            `${pattern.number.slice(0, -1)}\\d*` :
+            pattern.number;
+          if (did.match(new RegExp(regexPattern))) {
+            logger.debug({voip_carrier_sid, 'pattern':pattern.number, 'did':did}, 'Found a matching pattern');
+            return pattern.application_sid;
+          }
+        } catch (err) {
+          logger.warn({err, voip_carrier_sid, pattern: pattern.number}, 'Invalid regex pattern encountered - skipping');
+          continue;
+        }
+      }
+      logger.debug({voip_carrier_sid, did}, 'No matching pattern found');
      return null;
    } catch (err) {
      logger.error({err}, 'getApplicationForDidAndCarrier');
    }
  };

+  /**
+   * Searches for a matching application across multiple carriers using pattern/wildcard matching.
+   * This function is similar to getApplicationForDidAndCarrier but operates on multiple carriers
+   * simultaneously for better performance. It searches through all patterns from the specified
+   * carriers, ordered by pattern length (longest/most specific first).
+   *
+   * @param {Object} req - The request object containing the called number
+   * @param {string} voip_carrier_sids - Comma-separated string of carrier SIDs, formatted for SQL IN clause
+   *                                     (e.g., "'carrier1','carrier2'")
+   * @returns {Promise<Object|null>} Returns either:
+   *   - The matching phone_numbers record containing application_sid, voip_carrier_sid, and account_sid
+   *   - null if no matching pattern is found
+   * @throws {Error} Database errors or other unexpected errors
+   */
+  const getApplicationForDidAndCarriers = async(req, voip_carrier_sids) => {
+    const did = normalizeDID(req.calledNumber) || 'anonymous';
+    const sql = `SELECT * FROM phone_numbers WHERE voip_carrier_sid IN (${voip_carrier_sids})`;
+
+    try {
+      /* wildcard / regex match */
+      const [r2] = await pp.query(sql);
+      const patterns = r2
+        .filter((o) => o.number.match(/\D/))                  // look at anything with non-digit characters
+        .sort((a, b) => b.number.length - a.number.length);
+      for (const pattern of patterns) {
+        try {
+          const regexPattern = pattern.number.endsWith('*') ?
+            `${pattern.number.slice(0, -1)}\\d*` :
+            pattern.number;
+          if (did.match(new RegExp(regexPattern))) {
+            logger.debug({'pattern':pattern.number, 'did':did}, 'Found a matching pattern');
+            return pattern;
+          }
+        } catch (err) {
+          logger.warn({err, pattern: pattern.number}, 'Invalid regex pattern encountered - skipping');
+          continue;
+        }
+      }
+      logger.debug('No matching pattern found');
+      return null;
+    } catch (err) {
+      logger.error({err}, 'getApplicationForDidAndCarriers');
+    }
+  };
+
  const wasOriginatedFromCarrier = async(req) => {
    const failure = {fromCarrier: false};
    const uri = parseUri(req.uri);
    const isDotDecimal = /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/.test(uri.host);
-
+    const did = normalizeDID(req.calledNumber) || 'anonymous';
    if (!isDotDecimal) {
      /**
       * The host part of the SIP URI is not a dot-decimal IP address,
@@ -153,24 +217,100 @@ module.exports = (srf, logger) => {
       * Let's look for case #1 first...
       */

-      /* get all the carriers and gateways for the account owning this sip realm */
-      const [gwAcc] = await pp.query(sqlSelectAllCarriersForAccountByRealm, [uri.host]);
-      const [gwSP] = gwAcc.length ? [[]] : await pp.query(sqlSelectAllCarriersForSPByRealm, uri.host);
-      const gw = gwAcc.concat(gwSP);
-      const selected = gw.find(gatewayMatchesSourceAddress.bind(null, logger, req.source_address));
-      if (selected) {
-        const [a] = await pp.query(sqlAccountByRealm, [uri.host]);
-        if (0 === a.length) return failure;
-        return {
-          fromCarrier: true,
-          gateway: selected,
-          service_provider_sid: a[0].service_provider_sid,
-          account_sid: a[0].account_sid,
-          application_sid: selected.application_sid,
-          account: a[0]
-        };
+      /* does anyone own this sip realm? */
+      const [a] = await pp.query(sqlAccountByRealm, [uri.host]);
+      if (a.length) {
+        assert(a.length === 1);
+
+        /* yes they do */
+        logger.debug(`sip realm is associated with account_sid: ${a[0].account_sid}`);
+
+        /**
+         * We have one of two cases:
+         * (1a). The user configured his or her carrier to send to their sip realm, or
+         * (1b). The user is making a call from a sip device.
+         */
+
+        /* get all the carriers and gateways for the account owning this sip realm */
+        const [gwAcc] = await pp.query(sqlSelectAllCarriersForAccountByRealm, [uri.host]);
+        const [gwSP] = gwAcc.length ? [[]] : await pp.query(sqlSelectAllCarriersForSPByRealm, uri.host);
+        const gw = gwAcc
+          .concat(gwSP)
+          .sort((a, b) => b.netmask - a.netmask);
+        const gateways = gw.filter(gatewayMatchesSourceAddress.bind(null, logger, req.source_address));
+        let voip_carriers = gateways.map((gw) => {
+          return {
+            voip_carrier_sid: gw.voip_carrier_sid,
+            name: gw.name,
+            service_provider_sid: gw.service_provider_sid,
+            account_sid: gw.account_sid,
+            application_sid: gw.application_sid
+          };
+        });
+        /* remove duplicates, winnow down to voip_carriers, not gateways */
+        if (voip_carriers.length > 1) {
+          voip_carriers = [...new Set(voip_carriers.map(JSON.stringify))].map(JSON.parse);
+        }
+        if (voip_carriers.length) {
+          /* we have one or more matches.  Now check for one with a provisioned phone number matching the DID */
+          const vc_sids = voip_carriers.map((m) => `'${m.voip_carrier_sid}'`).join(',');
+          const sql =
+            `SELECT * FROM phone_numbers WHERE number = '${did}'
+            AND voip_carrier_sid IN (${vc_sids})
+            AND account_sid = '${a[0].account_sid}'`;
+          logger.debug({voip_carriers, sql, did}, 'looking up DID');
+
+          const [r] = await pp.query(sql);
+          if (r.length === 0) {
+            // if no matching phone number is found, find whether there are any applications having phone numbers
+            // matching the regex pattern or wild card
+            logger.debug({isDotDecimal},
+              'Did not find a matching phone number, checking for applications with Regex or wildcard');
+            const vc_sids = voip_carriers.map((m) => `'${m.voip_carrier_sid}'`).join(',');
+            const application = await getApplicationForDidAndCarriers(req, vc_sids);
+            if (application) {
+              logger.debug({application}, 'sip_realm looking up DID: found application with Regex or wildcard ');
+              const gateway = gateways.find((m) => m.voip_carrier_sid === application.voip_carrier_sid);
+              // the gateway may belong to "all accounts", so we need to use the account_sid of the application
+              gateway.account_sid = gateway.account_sid ? gateway.account_sid : application.account_sid;
+              return {
+                fromCarrier: true,
+                gateway: gateway,
+                service_provider_sid: a[0].service_provider_sid,
+                account_sid: gateway.account_sid,
+                application_sid: application.application_sid,
+                account: a[0]
+              };
+            }
+          }
+          if (r.length > 1) {
+            logger.info({r},
+              'multiple carriers with the same gateway have the same number provisioned for the same account'
+              + ' -- cannot determine which one to use');
+            return {
+              fromCarrier: true,
+              error: 'Multiple carriers with the same gateway are attempting to route the same number for this account'
+            };
+          }
+
+          /**
+           * We have one or no routes for this phone number, carrier and account combination
+           * Either take the matching gateway, or if no route has matched, the first gateway of the ones available.
+          */
+          const gateway = r[0] ? gateways.find((m) => m.voip_carrier_sid === r[0]?.voip_carrier_sid) : gateways[0];
+          return {
+            fromCarrier: true,
+            gateway: gateway,
+            service_provider_sid: a[0].service_provider_sid,
+            account_sid: a[0].account_sid,
+            application_sid: r[0]?.application_sid || gateway.application_sid,
+            account: a[0]
+          };
+        }
+        return failure;
      }

+
      /* no match, so let's look for case #2 */
      try {
        logger.info({
@@ -178,7 +318,9 @@ module.exports = (srf, logger) => {
          user: uri.user
        }, 'sip realm is not associated with an account, checking carriers');
        const [gw] = await pp.query(sqlSelectCarrierRequiringRegistration, [uri.host, uri.user]);
-        const matches = gw.filter(gatewayMatchesSourceAddress.bind(null, logger, req.source_address));
+        const matches = gw
+          .sort((a, b) => b.netmask - a.netmask)
+          .filter(gatewayMatchesSourceAddress.bind(null, logger, req.source_address));
        if (1 === matches.length) {
          // bingo
          //TODO: this assumes the carrier is associate to an account, not an SP
@@ -188,12 +330,19 @@ module.exports = (srf, logger) => {
          const [a] = await pp.query(sqlAccountBySid, [[matches[0].account_sid]]);
          if (0 === a.length) return failure;
          logger.debug({matches}, `found registration carrier using ${uri.host} and ${uri.user}`);
+          const sql =
+            `SELECT application_sid FROM phone_numbers WHERE number = '${did}'
+            AND voip_carrier_sid = '${matches[0].voip_carrier_sid}'
+            AND account_sid = '${matches[0].account_sid}'`;
+          logger.debug({matches: matches[0], sql, did}, 'looking up DID');
+
+          const [r] = await pp.query(sql);
          return {
            fromCarrier: true,
            gateway: matches[0],
            service_provider_sid: a[0].service_provider_sid,
            account_sid: a[0].account_sid,
-            application_sid: matches[0].application_sid,
+            application_sid: r[0]?.application_sid || matches[0].application_sid,
            account: a[0]
          };
        }
@@ -210,112 +359,120 @@ module.exports = (srf, logger) => {
      /* no match, so fall through  */
    }

-    if (isDotDecimal && process.env.JAMBONES_HOSTING) {
-      if (!process.env.SBC_ACCOUNT_SID) return failure;
-
-      /* look for carrier only within that account */
-      const [r] = await pp.query(sqlCarriersForAccountBySid,
-        [process.env.SBC_ACCOUNT_SID, req.source_address, req.source_port]);
-      if (0 === r.length) return failure;
-      const service_provider_sid = await getSPForAccount(process.env.SBC_ACCOUNT_SID);
-      return {
-        fromCarrier: true,
-        gateway: r[0],
-        account_sid: process.env.SBC_ACCOUNT_SID,
-        service_provider_sid
-      };
-    }
-    else {
-      /* find all carrier entries that have an inbound gateway matching the source IP */
-      const [gw] = await pp.query(sqlSelectAllGatewaysForSP);
-      let matches = gw
-        .filter(gatewayMatchesSourceAddress.bind(null, logger, req.source_address))
-        .map((gw) => {
-          return {
-            voip_carrier_sid: gw.voip_carrier_sid,
-            name: gw.name,
-            service_provider_sid: gw.service_provider_sid,
-            account_sid: gw.account_sid,
-            application_sid: gw.application_sid
-          };
-        });
-      /* remove duplicates, winnow down to voip_carriers, not gateways */
+    /* find all carrier entries that have an inbound gateway matching the source IP */
+    const [gw] = await pp.query(sqlSelectAllGatewaysForSP);
+    //logger.debug({gw}, `checking gateways for source address ${req.source_address}`);
+    let matches = gw
+      .sort((a, b) => b.netmask - a.netmask)
+      .filter(gatewayMatchesSourceAddress.bind(null, logger, req.source_address))
+      .map((gw) => {
+        return {
+          voip_carrier_sid: gw.voip_carrier_sid,
+          name: gw.name,
+          service_provider_sid: gw.service_provider_sid,
+          account_sid: gw.account_sid,
+          application_sid: gw.application_sid,
+          pad_crypto: gw.pad_crypto
+        };
+      });
+    /* remove duplicates, winnow down to voip_carriers, not gateways */
+    if (matches.length > 1) {
      matches = [...new Set(matches.map(JSON.stringify))].map(JSON.parse);
-      if (matches.length) {
-        /* we have one or more matches.  Now check for one with a provisioned phone number matching the DID */
+    }
+    //logger.debug({matches}, `matches for source address ${req.source_address}`);
+    if (matches.length) {
+      /* we have one or more matches.  Now check for one with a provisioned phone number matching the DID */
+      const vc_sids = matches.map((m) => `'${m.voip_carrier_sid}'`).join(',');
+      const sql =  `SELECT * FROM phone_numbers WHERE number = '${did}' AND voip_carrier_sid IN (${vc_sids})`;
+      logger.debug({matches, sql, did, vc_sids}, 'looking up DID');
+      const [r] = await pp.query(sql);
+      if (0 === r.length) {
+        // if no matching phone number is found, find whether there are any applications having phone numbers
+        // matching the regex pattern or wild card
+        logger.debug({isDotDecimal},
+          'Did not find a matching phone number, checking for applications with Regex or wildcard');
        const vc_sids = matches.map((m) => `'${m.voip_carrier_sid}'`).join(',');
-        const did = normalizeDID(req.calledNumber) || 'anonymous';
-        const sql =  `SELECT * FROM phone_numbers WHERE number = '${did}' AND voip_carrier_sid IN (${vc_sids})`;
-        logger.debug({matches, sql, did, vc_sids}, 'looking up DID');
-
-        const [r] = await pp.query(sql);
-        if (0 === r.length) {
-          /* came from a provisioned carrier, but the dialed number is not provisioned.
-              check if we have an account with default routing of that carrier to an application
-          */
-          const accountLevelGateways = matches.filter((m) => m.account_sid && m.application_sid);
-          if (accountLevelGateways.length > 1) {
-            logger.info({accounts: accountLevelGateways.map((m) => m.account_sid)},
-              'multiple accounts have added this carrier with default routing -- cannot determine which to use');
-            return {
-              fromCarrier: true,
-              error: 'Multiple accounts are attempting to default route this carrier'
-            };
-          }
-          else if (accountLevelGateways.length === 1) {
-            const [accounts] = await pp.query('SELECT * from accounts where account_sid = ?',
-              [accountLevelGateways[0].account_sid]);
-            return {
-              fromCarrier: true,
-              gateway: accountLevelGateways[0],
-              service_provider_sid: accountLevelGateways[0].service_provider_sid,
-              account_sid: accountLevelGateways[0].account_sid,
-              application_sid: accountLevelGateways[0].application_sid,
-              account: accounts[0]
-            };
-          }
-          else {
-            /* check if we only have a single account, otherwise we have no
-               way of knowing which account this is for
-            */
-            const [r] = await pp.query('SELECT count(*) as count from accounts where service_provider_sid = ?',
-              [matches[0].service_provider_sid]);
-            if (r[0].count === 0 || r[0].count > 1) return {fromCarrier: true};
-            else {
-              const [accounts] = await pp.query('SELECT * from accounts where service_provider_sid = ?',
-                [matches[0].service_provider_sid]);
-              return {
-                fromCarrier: true,
-                gateway: matches[0],
-                service_provider_sid: accounts[0].service_provider_sid,
-                account_sid: accounts[0].account_sid,
-                account: accounts[0]
-              };
-            }
-          }
+        const application = await getApplicationForDidAndCarriers(req, vc_sids);
+        if (application) {
+          logger.debug({application}, 'looking up DID: found application with Regex or wildcard');
+          const gateway = matches.find((m) => m.voip_carrier_sid === application.voip_carrier_sid);
+          // the gateway may belong to "all accounts", so we need to use the account_sid of the application
+          const [a] = await pp.query(sqlAccountBySid, [application.account_sid]);
+          return {
+            fromCarrier: true,
+            gateway: gateway,
+            service_provider_sid: gateway.service_provider_sid,
+            account_sid: application.account_sid,
+            application_sid: application.application_sid,
+            account: a[0],
+          };
        }
-        else if (r.length > 1) {
-          logger.info({r},
+
+        /* came from a provisioned carrier, but the dialed number is not provisioned.
+            check if we have an account with default routing of that carrier to an application
+        */
+        const accountLevelGateways = matches.filter((m) => m.account_sid && m.application_sid);
+        if (accountLevelGateways.length > 1) {
+          logger.info({accounts: accountLevelGateways.map((m) => m.account_sid)},
            'multiple accounts have added this carrier with default routing -- cannot determine which to use');
          return {
            fromCarrier: true,
-            error: 'Multiple accounts are attempting to route the same phone number from the same carrier'
+            error: 'Multiple accounts are attempting to default route this carrier'
          };
        }
-
-        /* we have a route for this phone number and carrier combination */
-        const gateway = matches.find((m) => m.voip_carrier_sid === r[0].voip_carrier_sid);
-        const [accounts] = await pp.query(sqlAccountBySid, [r[0].account_sid]);
-        assert(accounts.length);
+        else if (accountLevelGateways.length === 1) {
+          const [accounts] = await pp.query('SELECT * from accounts where account_sid = ?',
+            [accountLevelGateways[0].account_sid]);
+          return {
+            fromCarrier: true,
+            gateway: accountLevelGateways[0],
+            service_provider_sid: accountLevelGateways[0].service_provider_sid,
+            account_sid: accountLevelGateways[0].account_sid,
+            application_sid: accountLevelGateways[0].application_sid,
+            account: accounts[0]
+          };
+        }
+        else {
+          /* check if we only have a single account, otherwise we have no
+-               way of knowing which account this is for
+          */
+          const [r] = await pp.query('SELECT count(*) as count from accounts where service_provider_sid = ?',
+            [matches[0].service_provider_sid]);
+          if (r[0].count === 0 || r[0].count > 1) return {fromCarrier: true};
+          else {
+            const [accounts] = await pp.query('SELECT * from accounts where service_provider_sid = ?',
+              [matches[0].service_provider_sid]);
+            return {
+              fromCarrier: true,
+              gateway: matches[0],
+              service_provider_sid: accounts[0].service_provider_sid,
+              account_sid: accounts[0].account_sid,
+              account: accounts[0]
+            };
+          }
+        }
+      }
+      else if (r.length > 1) {
+        logger.info({r},
+          'multiple accounts have added this carrier with default routing -- cannot determine which to use');
        return {
          fromCarrier: true,
-          gateway,
-          service_provider_sid: accounts[0].service_provider_sid,
-          account_sid: r[0].account_sid,
-          application_sid: r[0].application_sid,
-          account: accounts[0]
+          error: 'Multiple accounts are attempting to route the same phone number from the same carrier'
        };
      }
+
+      /* we have a route for this phone number and carrier combination */
+      const gateway = matches.find((m) => m.voip_carrier_sid === r[0].voip_carrier_sid);
+      const [accounts] = await pp.query(sqlAccountBySid, [r[0].account_sid]);
+      assert(accounts.length);
+      return {
+        fromCarrier: true,
+        gateway,
+        service_provider_sid: accounts[0].service_provider_sid,
+        account_sid: r[0].account_sid,
+        application_sid: r[0].application_sid,
+        account: accounts[0]
+      };
    }
    return failure;
  };
@@ -323,6 +480,7 @@ module.exports = (srf, logger) => {
  return {
    wasOriginatedFromCarrier,
    getApplicationForDidAndCarrier,
+    getApplicationForDidAndCarriers,
    getOutboundGatewayForRefer,
    getSPForAccount,
    getApplicationBySid
@@ -1,7 +1,7 @@
 const debug = require('debug')('jambonz:sbc-inbound');
 const assert = require('assert');
 const parseUri = require('drachtio-srf').parseUri;
-const {nudgeCallCounts, roundTripTime} = require('./utils');
+const {nudgeCallCounts, roundTripTime, isMSTeamsCIDR} = require('./utils');
 const digestChallenge = require('@jambonz/digest-utils');
 const msProxyIps = process.env.MS_TEAMS_SIP_PROXY_IPS ?
  process.env.MS_TEAMS_SIP_PROXY_IPS.split(',').map((i) => i.trim()) :
@@ -35,6 +35,7 @@ module.exports = function(srf, logger) {
  const initLocals = (req, res, next) => {
    const callId = req.get('Call-ID');
    req.locals = req.locals || {callId};
+    req.locals.nudge = 0;

    /* check if forwarded by a proxy that applied an X-Forwarded-For Header */
    if (req.has('X-Forwarded-For') || req.has('X-Subspace-Forwarded-For')) {
@@ -129,7 +130,7 @@ module.exports = function(srf, logger) {
          logger.info('identifyAccount: rejecting call from carrier because DID has not been provisioned');
          return res.send(404, 'Number Not Provisioned');
        }
-        logger.debug({gateway}, 'identifyAccount: incoming call from gateway');
+        logger.info({gateway}, 'identifyAccount: incoming call from gateway');

        let sid;
        if (siprec) {
@@ -155,8 +156,8 @@ module.exports = function(srf, logger) {
          ...req.locals
        };
      }
-      else if (msProxyIps.includes(req.source_address)) {
-        logger.debug({source_address: req.source_address}, 'identifyAccount: incoming call from Microsoft Teams');
+      else if (msProxyIps.includes(req.source_address) || isMSTeamsCIDR(req.source_address)) {
+        logger.info({source_address: req.source_address}, 'identifyAccount: incoming call from Microsoft Teams');
        const uri = parseUri(req.uri);

        const app = await lookupAppByTeamsTenant(uri.host);
@@ -178,7 +179,7 @@ module.exports = function(srf, logger) {
      else {
        req.locals.originator = 'user';
        const uri = parseUri(req.uri);
-        logger.debug({source_address: req.source_address, realm: uri.host},
+        logger.info({source_address: req.source_address, realm: uri.host},
          'identifyAccount: incoming user call');
        const account = await lookupAccountBySipRealm(uri.host);
        if (!account) {
@@ -235,6 +236,8 @@ module.exports = function(srf, logger) {
        callId: req.get('Call-ID'),
        service_provider_sid: req.locals.service_provider_sid,
        account_sid: req.locals.account_sid
+      }, {
+        ...(req.locals.account.enable_debug_log && {level: 'debug'})
      });

      next();
@@ -257,13 +260,20 @@ module.exports = function(srf, logger) {
    assert(account_sid);
    assert(service_provider_sid);

+    /* if quick cancel then we are done */
+    if (req.canceled) {
+      logger.info('checkLimits: call was immediately canceled, no need to increment call count as we are done');
+      return;
+    }
+
    /* decrement count if INVITE is later rejected */
    res.once('end', async({status}) => {
      if (status > 200) {
-        nudgeCallCounts(logger, {
+        nudgeCallCounts(req, 'failure', {
          service_provider_sid,
          account_sid,
-          application_sid
+          application_sid,
+          callId: req.locals.callId
        }, decrKey, {writeCallCountSP, writeCallCount, writeCallCountApp})
          .catch((err) => logger.error(err, 'Error decrementing call counts'));
      }
@@ -271,10 +281,11 @@ module.exports = function(srf, logger) {

    try {
      /* increment the call count */
-      const  {callsSP, calls} = await nudgeCallCounts(logger, {
+      const  {callsSP, calls} = await nudgeCallCounts(req, 'init', {
        service_provider_sid,
        account_sid,
-        application_sid
+        application_sid,
+        callId: req.locals.callId
      }, incrKey, {writeCallCountSP, writeCallCount, writeCallCountApp});

      /* compare to account's limit, though avoid db hit when call count is low */
@@ -284,24 +295,22 @@ module.exports = function(srf, logger) {
      logger.debug(`checkLimits: call count is now ${calls}, limit is ${minLimit}`);
      if (calls <= minLimit) return next();

-      if (process.env.JAMBONES_HOSTING) {
-        const accountCapacities = await lookupAccountCapacitiesBySid(account_sid);
-        const accountLimit = accountCapacities.find((c) => c.category == 'voice_call_session');
-        if (accountLimit) {
-          /* check account limit */
-          const limit_sessions = accountLimit.quantity;
-          if (calls > limit_sessions) {
-            debug(`checkLimits: limits exceeded: call count ${calls}, limit ${limit_sessions}`);
-            logger.info({calls, limit_sessions}, 'checkLimits: limits exceeded');
-            writeAlerts({
-              alert_type: AlertType.ACCOUNT_CALL_LIMIT,
-              service_provider_sid: account.service_provider_sid,
-              account_sid,
-              count: limit_sessions
-            }).catch((err) => logger.info({err}, 'checkLimits: error writing alert'));
-            res.send(503, 'Maximum Calls In Progress');
-            return req.srf.endSession(req);
-          }
+      const accountCapacities = await lookupAccountCapacitiesBySid(account_sid);
+      const accountLimit = accountCapacities.find((c) => c.category == 'voice_call_session');
+      if (accountLimit) {
+        /* check account limit */
+        const limit_sessions = accountLimit.quantity;
+        if (calls > limit_sessions) {
+          debug(`checkLimits: limits exceeded: call count ${calls}, limit ${limit_sessions}`);
+          logger.info({calls, limit_sessions}, 'checkLimits: limits exceeded');
+          writeAlerts({
+            alert_type: AlertType.ACCOUNT_CALL_LIMIT,
+            service_provider_sid: account.service_provider_sid,
+            account_sid,
+            count: limit_sessions
+          }).catch((err) => logger.info({err}, 'checkLimits: error writing alert'));
+          res.send(503, 'Maximum Calls In Progress');
+          return req.srf.endSession(req);
        }
      }
      else if (trackingOn) {
@@ -312,7 +321,7 @@ module.exports = function(srf, logger) {
            alert_type: AlertType.ACCOUNT_CALL_LIMIT,
            service_provider_sid: service_provider_sid,
            account_sid,
-            count: calls
+            count: account_limit
          }).catch((err) => logger.info({err}, 'checkLimits: error writing alert'));
          res.send(503, 'Max Account Calls In Progress', {
            headers: {
@@ -322,12 +331,17 @@ module.exports = function(srf, logger) {
          });
          return req.srf.endSession(req);
        }
+        if (!account_limit && !sp_limit && process.env.JAMBONES_HOSTING) {
+          logger.info(`checkLimits: no active subscription found for account ${account_sid}, rejecting call`);
+          res.send(503, 'No Active Subscription');
+          return req.srf.endSession(req);
+        }
        if (process.env.JAMBONES_TRACK_SP_CALLS && sp_limit > 0 && callsSP > sp_limit) {
          logger.info({callsSP, sp_limit}, 'checkLimits: service provider limits exceeded');
          writeAlerts({
            alert_type: AlertType.SP_CALL_LIMIT,
            service_provider_sid: service_provider_sid,
-            count: callsSP
+            count: sp_limit
          }).catch((err) => logger.info({err}, 'checkLimits: error writing alert'));
          res.send(503, 'Max Service Provider Calls In Progress', {
            headers: {
@@ -1,5 +1,8 @@
+const CIDRMatcher = require('cidr-matcher');
+const express = require('express');
 const rtpCharacteristics = require('../data/rtp-transcoding');
 const srtpCharacteristics = require('../data/srtp-transcoding');
+
 let idx = 0;

 const isWSS = (req) => {
@@ -8,7 +11,7 @@ const isWSS = (req) => {

 const getAppserver = (srf) => {
  const len = srf.locals.featureServers.length;
-  return srf.locals.featureServers[ idx++ % len];
+  return srf.locals.featureServers[idx++ % len];
 };

 function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, teams = false) {
@@ -16,18 +19,31 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, teams = false) {
  const srtpCopy = JSON.parse(JSON.stringify(srtpCharacteristics));
  const from = req.getParsedHeader('from');
  const srtpOpts = teams ? srtpCopy['teams'] : srtpCopy['default'];
+  if ((req.locals.gateway?.pad_crypto || 0) > 0) {
+    srtpOpts.flags.push('pad crypto');
+  }
  const dstOpts = dstIsUsingSrtp ? srtpOpts : rtpCopy;
  const srcOpts = srcIsUsingSrtp ? srtpOpts : rtpCopy;

-  /* webrtc clients (e.g. sipjs) send DMTF via SIP INFO */
-  if ((srcIsUsingSrtp || dstIsUsingSrtp) && !teams) {
+  /* Allow Feature server to inject DTMF to both leg except call from Teams */
+  if (!teams) {
    dstOpts.flags.push('inject DTMF');
    srcOpts.flags.push('inject DTMF');
  }
+  /** By default use strict source to secure aganst RTPInject vuln,
+   * set env var to true to disable it and use media handover instead */
+  const disableStrictSource = !!process.env.RTPENGINE_DISABLE_STRICT_SOURCE;
+  dstOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
+  srcOpts.flags.push(disableStrictSource ?  'media handover' : 'strict source');
+
+  const acceptCodecs = process.env.JAMBONES_ACCEPT_AND_TRANSCODE ?
+    process.env.JAMBONES_ACCEPT_AND_TRANSCODE :
+    process.env.JAMBONES_ACCEPT_G729 ? 'g729' : '';
  const common = {
    'call-id': req.get('Call-ID'),
    'replace': ['origin', 'session-connection'],
-    'record call': process.env.JAMBONES_RECORD_ALL_CALLS ? 'yes' : 'no'
+    'record call': process.env.JAMBONES_RECORD_ALL_CALLS ? 'yes' : 'no',
+    ...(acceptCodecs && { codec: { mask: acceptCodecs, transcode: 'pcmu,pcma' } })
  };
  return {
    common,
@@ -70,7 +86,7 @@ const equalsIgnoreOrder = (a, b) => {
  return true;
 };

-const  systemHealth = async(redisClient, ping, getCount) => {
+const systemHealth = async(redisClient, ping, getCount) => {
  await Promise.all([redisClient.ping(), ping()]);
  return getCount();
 };
@@ -96,7 +112,6 @@ const handleErrors = (logger, app, resolve, reject, e) => {


 const createHealthCheckApp = (port, logger) => {
-  const express = require('express');
  const app = express();

  app.use(express.urlencoded({ extended: true }));
@@ -108,12 +123,97 @@ const createHealthCheckApp = (port, logger) => {
  });
 };

-const nudgeCallCounts = async(logger, sids, nudgeOperator, writers) => {
-  const {service_provider_sid, account_sid, application_sid} = sids;
+/**
+ * nudgeCallCounts - increment or decrement call counts in redis
+ *
+ *              current nudge value
+ * -----------------------------------------
+ *  why    |     -1     |    0    |    1    |
+ * -----------------------------------------
+ *  init   |    no-op   |    +1   |    N/A  |
+ * failure |    N/A     |    -1   |    -1   |
+ * complete|    N/A     |    N/A  |    -1   |
+ *
+ *
+ */
+
+const shouldNudge = (why, req) => {
+  const {nudge, logger} = req.locals;
+  let modifyCount = false;
+  const originalNudge = nudge;
+
+  switch (why) {
+    case 'init':
+      if (nudge === 0) {
+        // normal case: new call, increment call count
+        req.locals.nudge = 1;
+        modifyCount = true;
+      }
+      else if (nudge === -1) {
+        // extremely quick cancel, don't increment call count
+        req.locals.nudge = 0;
+      }
+      else {
+        logger.info(`shouldNudge: unexpected nudge value ${nudge} for ${why}`);
+      }
+      break;
+    case 'failure':
+      if (nudge === 1) {
+        // normal case of call failed for any reason, decrement call count
+        req.locals.nudge = 0;
+        modifyCount = true;
+      }
+      else if (nudge === 0) {
+        // very quick failure dont decrement call count
+        req.locals.nudge = -1;
+      }
+      else {
+        logger.info(`shouldNudge: unexpected nudge value ${nudge} for ${why}`);
+      }
+      break;
+    case 'complete':
+      if (nudge === 1) {
+        // normal case of call completed, decrement call count
+        req.locals.nudge = 0;
+        modifyCount = true;
+      }
+      else {
+        logger.info(`shouldNudge: unexpected nudge value ${nudge} for ${why}`);
+      }
+      break;
+    default:
+      logger.info(`shouldNudge: unexpected why value ${why}`);
+      break;
+  }
+
+  logger.info(`shouldNudge: '${why}': updating count: ${modifyCount}, nudge: ${originalNudge} -> ${req.locals.nudge}`);
+  return modifyCount;
+};
+
+const nudgeCallCounts = async(req, why, sids, nudgeOperator, writers) => {
+  const {logger} = req.locals;
+  const {service_provider_sid, account_sid, application_sid, callId} = sids;
  const {writeCallCount, writeCallCountSP, writeCallCountApp} = writers;
  const nudges = [];
  const writes = [];

+  if (!shouldNudge(why, req)) {
+    return {callsSP: null, calls: null, callsApp: null};
+  }
+
+  if (process.env.JAMBONES_DEBUG_CALL_COUNTS) {
+    const {srf} = require('..');
+    const {addKey, deleteKey} = srf.locals.realtimeDbHelpers;
+
+    if (why === 'init') {
+      // save for 3 days
+      await addKey(`debug:incalls:${account_sid}:${callId}`, new Date().toISOString(), 259200);
+    }
+    else {
+      await deleteKey(`debug:incalls:${account_sid}:${callId}`);
+    }
+  }
+
  if (process.env.JAMBONES_TRACK_SP_CALLS) {
    const key = makeSPCallCountKey(service_provider_sid);
    nudges.push(nudgeOperator(key));
@@ -178,6 +278,66 @@ const parseConnectionIp = (sdp) => {
  return arr ? arr[1] : null;
 };

+/**
+ * Checks if ip is one of MS Teams sip signalling ips
+ * https://learn.microsoft.com/en-us/azure/communication-services/concepts
+ * /telephony/direct-routing-infrastructure#sip-signaling-fqdns
+ * @param ip IP address, example 172.31.0.1
+ * */
+const isMSTeamsCIDR = (ip) => {
+  const cidrs = [
+    '52.112.0.0/14',
+    '52.120.0.0/14'
+  ];
+  const matcher = new CIDRMatcher(cidrs);
+  return matcher.contains(ip);
+};
+
+const isPrivateVoipNetwork = (ip) => {
+  const {srf, logger} = require('..');
+  const {privateNetworkCidr} = srf.locals;
+  if (privateNetworkCidr) {
+    try {
+      const matcher = new CIDRMatcher(privateNetworkCidr.split(','));
+      return matcher.contains(ip);
+    } catch (err) {
+      logger.info({err, privateNetworkCidr},
+        'Error checking private network CIDR, probably misconfigured must be a comma separated list of CIDRs');
+    }
+  }
+  return false;
+};
+
+/**
+ * @param hostports can be a string or an array of hostports
+ */
+const parseHostPorts = (logger, hostports, srf) => {
+  typeof hostports === 'string' && (hostports = hostports.split(','));
+  const obj = {};
+  for (const hp of hostports) {
+    const [, protocol, ipv4, port] = hp.match(/^(.*)\/(.*):(\d+)$/);
+    if (protocol && ipv4 && port) {
+      obj[protocol] = `${ipv4}:${port}`;
+    }
+  }
+  if (!obj.tls) {
+    obj.tls = `${srf.locals.sipAddress}:5061`;
+  }
+
+  if (!obj.tcp) {
+    obj.tcp = `${srf.locals.sipAddress}:5060`;
+  }
+
+  logger.info({ obj }, 'sip endpoints');
+  return obj;
+};
+
+const makeFullMediaReleaseKey = (callId) => {
+  return `a_sdp:${callId}`;
+};
+const makePartnerFullMediaReleaseKey = (callId) => {
+  return `b_sdp:${callId}`;
+};

 module.exports = {
  isWSS,
@@ -194,5 +354,11 @@ module.exports = {
  createHealthCheckApp,
  nudgeCallCounts,
  roundTripTime,
-  parseConnectionIp
+  parseConnectionIp,
+  isMSTeamsCIDR,
+  isPrivateVoipNetwork,
+  parseHostPorts,
+  makeFullMediaReleaseKey,
+  makePartnerFullMediaReleaseKey
 };
+
@@ -1,9 +1,9 @@
 {
  "name": "sbc-inbound",
-  "version": "0.8.4",
+  "version": "0.9.5",
  "main": "app.js",
  "engines": {
-    "node": ">= 12.0.0"
+    "node": ">= 18.0.0"
  },
  "keywords": [
    "sip",
@@ -22,33 +22,35 @@
    "start": "node app",
    "test": "NODE_ENV=test HTTP_PORT=3050 JAMBONES_NETWORK_CIDR='127.0.0.1/32' JAMBONES_HOSTING=1 JWT_SECRET=foobarbazzle SBC_ACCOUNT_SID=ed649e33-e771-403a-8c99-1780eabbc803 JAMBONES_TIME_SERIES_HOST=127.0.0.1 JAMBONES_MYSQL_HOST=127.0.0.1 JAMBONES_MYSQL_USER=jambones_test JAMBONES_MYSQL_PASSWORD=jambones_test JAMBONES_MYSQL_DATABASE=jambones_test JAMBONES_REDIS_HOST=localhost JAMBONES_REDIS_PORT=16379 JAMBONES_LOGLEVEL=error DRACHTIO_SECRET=cymru DRACHTIO_HOST=127.0.0.1 DRACHTIO_PORT=9060 JAMBONES_RTPENGINES=127.0.0.1:12222 JAMBONES_FEATURE_SERVERS=172.38.0.11 node test/ ",
    "coverage": "./node_modules/.bin/nyc --reporter html --report-dir ./coverage npm run test",
-    "jslint": "eslint app.js lib"
+    "jslint": "eslint app.js lib",
+    "jslint:fix": "npm run jslint --fix"
  },
  "dependencies": {
-    "@jambonz/db-helpers": "^0.9.1",
+    "@aws-sdk/client-auto-scaling": "^3.549.0",
+    "@aws-sdk/client-sns": "^3.549.0",
+    "@babel/helpers": "^7.26.10",
+    "@jambonz/db-helpers": "^0.9.12",
+    "@jambonz/digest-utils": "^0.0.6",
    "@jambonz/http-health-check": "^0.0.1",
-    "@jambonz/realtimedb-helpers": "^0.8.6",
-    "@jambonz/rtpengine-utils": "^0.4.3",
-    "@jambonz/siprec-client-utils": "^0.2.5",
-    "@jambonz/stats-collector": "^0.1.8",
-    "@jambonz/time-series": "^0.2.5",
-    "@jambonz/digest-utils": "^0.0.3",
-    "@aws-sdk/client-sns": "^3.360.0",
-    "@aws-sdk/client-auto-scaling": "^3.360.0",
+    "@jambonz/realtimedb-helpers": "^0.8.13",
+    "@jambonz/rtpengine-utils": "^0.4.4",
+    "@jambonz/siprec-client-utils": "^0.2.10",
+    "@jambonz/stats-collector": "^0.1.10",
+    "@jambonz/time-series": "^0.2.10",
    "bent": "^7.3.12",
    "cidr-matcher": "^2.1.1",
    "debug": "^4.3.4",
-    "drachtio-fn-b2b-sugar": "0.0.12",
-    "drachtio-srf": "^4.5.21",
-    "express": "^4.18.1",
-    "pino": "^7.11.0",
+    "drachtio-fn-b2b-sugar": "0.2.1",
+    "drachtio-srf": "^5.0.5",
+    "express": "^4.19.2",
+    "pino": "^8.20.0",
    "verify-aws-sns-signature": "^0.1.0",
-    "xml2js": "^0.4.23"
+    "xml2js": "^0.6.2"
  },
  "devDependencies": {
    "eslint": "^7.32.0",
-    "eslint-plugin-promise": "^4.3.1",
+    "eslint-plugin-promise": "^6.1.1",
    "nyc": "^15.1.0",
-    "tape": "^4.15.1"
+    "tape": "^5.7.5"
  }
 }
@@ -14,14 +14,22 @@ DROP TABLE IF EXISTS beta_invite_codes;

 DROP TABLE IF EXISTS call_routes;

+DROP TABLE IF EXISTS clients;
+
 DROP TABLE IF EXISTS dns_records;

+DROP TABLE IF EXISTS lcr;
+
 DROP TABLE IF EXISTS lcr_carrier_set_entry;

 DROP TABLE IF EXISTS lcr_routes;

 DROP TABLE IF EXISTS password_settings;

+DROP TABLE IF EXISTS user_permissions;
+
+DROP TABLE IF EXISTS permissions;
+
 DROP TABLE IF EXISTS predefined_sip_gateways;

 DROP TABLE IF EXISTS predefined_smpp_gateways;
@@ -46,8 +54,12 @@ DROP TABLE IF EXISTS signup_history;

 DROP TABLE IF EXISTS smpp_addresses;

+DROP TABLE IF EXISTS google_custom_voices;
+
 DROP TABLE IF EXISTS speech_credentials;

+DROP TABLE IF EXISTS system_information;
+
 DROP TABLE IF EXISTS users;

 DROP TABLE IF EXISTS smpp_gateways;
@@ -120,6 +132,19 @@ application_sid CHAR(36) NOT NULL,
 PRIMARY KEY (call_route_sid)
 ) COMMENT='a regex-based pattern match for call routing';

+CREATE TABLE clients
+(
+client_sid CHAR(36) NOT NULL UNIQUE ,
+account_sid CHAR(36) NOT NULL,
+is_active BOOLEAN NOT NULL DEFAULT 1,
+username VARCHAR(64),
+password VARCHAR(1024),
+allow_direct_app_calling BOOLEAN NOT NULL DEFAULT 1,
+allow_direct_queue_calling BOOLEAN NOT NULL DEFAULT 1,
+allow_direct_user_calling BOOLEAN NOT NULL DEFAULT 1,
+PRIMARY KEY (client_sid)
+);
+
 CREATE TABLE dns_records
 (
 dns_record_sid CHAR(36) NOT NULL UNIQUE ,
@@ -132,11 +157,23 @@ PRIMARY KEY (dns_record_sid)
 CREATE TABLE lcr_routes
 (
 lcr_route_sid CHAR(36),
+lcr_sid CHAR(36) NOT NULL,
 regex VARCHAR(32) NOT NULL COMMENT 'regex-based pattern match against dialed number, used for LCR routing of PSTN calls',
 description VARCHAR(1024),
-priority INTEGER NOT NULL UNIQUE  COMMENT 'lower priority routes are attempted first',
+priority INTEGER NOT NULL COMMENT 'lower priority routes are attempted first',
 PRIMARY KEY (lcr_route_sid)
-) COMMENT='Least cost routing table';
+) COMMENT='An ordered list of  digit patterns in an LCR table.  The patterns are tested in sequence until one matches';
+
+CREATE TABLE lcr
+(
+lcr_sid CHAR(36) NOT NULL UNIQUE ,
+name VARCHAR(64) COMMENT 'User-assigned name for this LCR table',
+is_active BOOLEAN NOT NULL DEFAULT 1,
+default_carrier_set_entry_sid CHAR(36) COMMENT 'default carrier/route to use when no digit match based results are found.',
+service_provider_sid CHAR(36),
+account_sid CHAR(36),
+PRIMARY KEY (lcr_sid)
+) COMMENT='An LCR (least cost routing) table that is used by a service provider or account to make decisions about routing outbound calls when multiple carriers are available.';

 CREATE TABLE password_settings
 (
@@ -145,6 +182,14 @@ require_digit BOOLEAN NOT NULL DEFAULT false,
 require_special_character BOOLEAN NOT NULL DEFAULT false
 );

+CREATE TABLE permissions
+(
+permission_sid CHAR(36) NOT NULL UNIQUE ,
+name VARCHAR(32) NOT NULL UNIQUE ,
+description VARCHAR(255),
+PRIMARY KEY (permission_sid)
+);
+
 CREATE TABLE predefined_carriers
 (
 predefined_carrier_sid CHAR(36) NOT NULL UNIQUE ,
@@ -236,7 +281,10 @@ CREATE TABLE sbc_addresses
 sbc_address_sid CHAR(36) NOT NULL UNIQUE ,
 ipv4 VARCHAR(255) NOT NULL,
 port INTEGER NOT NULL DEFAULT 5060,
+tls_port INTEGER,
+wss_port INTEGER,
 service_provider_sid CHAR(36),
+last_updated DATETIME,
 PRIMARY KEY (sbc_address_sid)
 );

@@ -292,9 +340,29 @@ last_tested DATETIME,
 tts_tested_ok BOOLEAN,
 stt_tested_ok BOOLEAN,
 created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+label VARCHAR(64),
 PRIMARY KEY (speech_credential_sid)
 );

+CREATE TABLE google_custom_voices
+(
+google_custom_voice_sid CHAR(36) NOT NULL UNIQUE ,
+speech_credential_sid CHAR(36) NOT NULL,
+model VARCHAR(512) NOT NULL,
+reported_usage ENUM('REPORTED_USAGE_UNSPECIFIED','REALTIME','OFFLINE') DEFAULT 'REALTIME',
+name VARCHAR(64) NOT NULL,
+PRIMARY KEY (google_custom_voice_sid)
+);
+
+CREATE TABLE system_information
+(
+domain_name VARCHAR(255),
+sip_domain_name VARCHAR(255),
+monitoring_domain_name VARCHAR(255),
+private_network_cidr VARCHAR(8192),
+log_level ENUM('info', 'debug') NOT NULL DEFAULT 'info'
+);
+
 CREATE TABLE users
 (
 user_sid CHAR(36) NOT NULL UNIQUE ,
@@ -345,9 +413,18 @@ smpp_inbound_password VARCHAR(64),
 register_from_user VARCHAR(128),
 register_from_domain VARCHAR(255),
 register_public_ip_in_contact BOOLEAN NOT NULL DEFAULT false,
+register_status VARCHAR(4096),
 PRIMARY KEY (voip_carrier_sid)
 ) COMMENT='A Carrier or customer PBX that can send or receive calls';

+CREATE TABLE user_permissions
+(
+user_permissions_sid CHAR(36) NOT NULL UNIQUE ,
+user_sid CHAR(36) NOT NULL,
+permission_sid CHAR(36) NOT NULL,
+PRIMARY KEY (user_permissions_sid)
+);
+
 CREATE TABLE smpp_gateways
 (
 smpp_gateway_sid CHAR(36) NOT NULL UNIQUE ,
@@ -365,7 +442,7 @@ PRIMARY KEY (smpp_gateway_sid)
 CREATE TABLE phone_numbers
 (
 phone_number_sid CHAR(36) UNIQUE ,
-number VARCHAR(32) NOT NULL UNIQUE ,
+number VARCHAR(132) NOT NULL,
 voip_carrier_sid CHAR(36),
 account_sid CHAR(36),
 application_sid CHAR(36),
@@ -378,11 +455,15 @@ CREATE TABLE sip_gateways
 sip_gateway_sid CHAR(36),
 ipv4 VARCHAR(128) NOT NULL COMMENT 'ip address or DNS name of the gateway.  For gateways providing inbound calling service, ip address is required.',
 netmask INTEGER NOT NULL DEFAULT 32,
-port INTEGER NOT NULL DEFAULT 5060 COMMENT 'sip signaling port',
+port INTEGER COMMENT 'sip signaling port',
 inbound BOOLEAN NOT NULL COMMENT 'if true, whitelist this IP to allow inbound calls from the gateway',
 outbound BOOLEAN NOT NULL COMMENT 'if true, include in least-cost routing when placing calls to the PSTN',
 voip_carrier_sid CHAR(36) NOT NULL,
 is_active BOOLEAN NOT NULL DEFAULT 1,
+send_options_ping BOOLEAN NOT NULL DEFAULT 0,
+use_sips_scheme BOOLEAN NOT NULL DEFAULT 0,
+pad_crypto BOOLEAN NOT NULL DEFAULT 0,
+protocol ENUM('udp','tcp','tls', 'tls/srtp') DEFAULT 'udp' COMMENT 'Outbound call protocol',
 PRIMARY KEY (sip_gateway_sid)
 ) COMMENT='A whitelisted sip gateway used for origination/termination';

@@ -415,12 +496,24 @@ account_sid CHAR(36) COMMENT 'account that this application belongs to (if null,
 call_hook_sid CHAR(36) COMMENT 'webhook to call for inbound calls ',
 call_status_hook_sid CHAR(36) COMMENT 'webhook to call for call status events',
 messaging_hook_sid CHAR(36) COMMENT 'webhook to call for inbound SMS/MMS ',
+app_json TEXT,
 speech_synthesis_vendor VARCHAR(64) NOT NULL DEFAULT 'google',
 speech_synthesis_language VARCHAR(12) NOT NULL DEFAULT 'en-US',
-speech_synthesis_voice VARCHAR(64),
+speech_synthesis_voice VARCHAR(256),
+speech_synthesis_label VARCHAR(64),
 speech_recognizer_vendor VARCHAR(64) NOT NULL DEFAULT 'google',
 speech_recognizer_language VARCHAR(64) NOT NULL DEFAULT 'en-US',
+speech_recognizer_label VARCHAR(64),
+use_for_fallback_speech BOOLEAN DEFAULT false,
+fallback_speech_synthesis_vendor VARCHAR(64),
+fallback_speech_synthesis_language VARCHAR(12),
+fallback_speech_synthesis_voice VARCHAR(256),
+fallback_speech_synthesis_label VARCHAR(64),
+fallback_speech_recognizer_vendor VARCHAR(64),
+fallback_speech_recognizer_language VARCHAR(64),
+fallback_speech_recognizer_label VARCHAR(64),
 created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+record_all_calls BOOLEAN NOT NULL DEFAULT false,
 PRIMARY KEY (application_sid)
 ) COMMENT='A defined set of behaviors to be applied to phone calls ';

@@ -458,6 +551,10 @@ subspace_client_secret VARCHAR(255),
 subspace_sip_teleport_id VARCHAR(255),
 subspace_sip_teleport_destinations VARCHAR(255),
 siprec_hook_sid CHAR(36),
+record_all_calls BOOLEAN NOT NULL DEFAULT false,
+record_format VARCHAR(16) NOT NULL DEFAULT 'mp3',
+bucket_credential VARCHAR(8192) COMMENT 'credential used to authenticate with storage service',
+enable_debug_log BOOLEAN NOT NULL DEFAULT false,
 PRIMARY KEY (account_sid)
 ) COMMENT='An enterprise that uses the platform for comm services';

@@ -478,9 +575,21 @@ ALTER TABLE call_routes ADD FOREIGN KEY account_sid_idxfk_3 (account_sid) REFERE

 ALTER TABLE call_routes ADD FOREIGN KEY application_sid_idxfk (application_sid) REFERENCES applications (application_sid);

+CREATE INDEX client_sid_idx ON clients (client_sid);
+ALTER TABLE clients ADD CONSTRAINT account_sid_idxfk_13 FOREIGN KEY account_sid_idxfk_13 (account_sid) REFERENCES accounts (account_sid);
+
 CREATE INDEX dns_record_sid_idx ON dns_records (dns_record_sid);
 ALTER TABLE dns_records ADD FOREIGN KEY account_sid_idxfk_4 (account_sid) REFERENCES accounts (account_sid);

+CREATE INDEX lcr_sid_idx ON lcr_routes (lcr_sid);
+ALTER TABLE lcr_routes ADD FOREIGN KEY lcr_sid_idxfk (lcr_sid) REFERENCES lcr (lcr_sid);
+
+CREATE INDEX lcr_sid_idx ON lcr (lcr_sid);
+ALTER TABLE lcr ADD FOREIGN KEY default_carrier_set_entry_sid_idxfk (default_carrier_set_entry_sid) REFERENCES lcr_carrier_set_entry (lcr_carrier_set_entry_sid);
+
+CREATE INDEX service_provider_sid_idx ON lcr (service_provider_sid);
+CREATE INDEX account_sid_idx ON lcr (account_sid);
+CREATE INDEX permission_sid_idx ON permissions (permission_sid);
 CREATE INDEX predefined_carrier_sid_idx ON predefined_carriers (predefined_carrier_sid);
 CREATE INDEX predefined_sip_gateway_sid_idx ON predefined_sip_gateways (predefined_sip_gateway_sid);
 CREATE INDEX predefined_carrier_sid_idx ON predefined_sip_gateways (predefined_carrier_sid);
@@ -533,8 +642,6 @@ CREATE INDEX smpp_address_sid_idx ON smpp_addresses (smpp_address_sid);
 CREATE INDEX service_provider_sid_idx ON smpp_addresses (service_provider_sid);
 ALTER TABLE smpp_addresses ADD FOREIGN KEY service_provider_sid_idxfk_4 (service_provider_sid) REFERENCES service_providers (service_provider_sid);

-CREATE UNIQUE INDEX speech_credentials_idx_1 ON speech_credentials (vendor,account_sid);
-
 CREATE INDEX speech_credential_sid_idx ON speech_credentials (speech_credential_sid);
 CREATE INDEX service_provider_sid_idx ON speech_credentials (service_provider_sid);
 ALTER TABLE speech_credentials ADD FOREIGN KEY service_provider_sid_idxfk_5 (service_provider_sid) REFERENCES service_providers (service_provider_sid);
@@ -542,6 +649,10 @@ ALTER TABLE speech_credentials ADD FOREIGN KEY service_provider_sid_idxfk_5 (ser
 CREATE INDEX account_sid_idx ON speech_credentials (account_sid);
 ALTER TABLE speech_credentials ADD FOREIGN KEY account_sid_idxfk_8 (account_sid) REFERENCES accounts (account_sid);

+CREATE INDEX google_custom_voice_sid_idx ON google_custom_voices (google_custom_voice_sid);
+CREATE INDEX speech_credential_sid_idx ON google_custom_voices (speech_credential_sid);
+ALTER TABLE google_custom_voices ADD FOREIGN KEY speech_credential_sid_idxfk (speech_credential_sid) REFERENCES speech_credentials (speech_credential_sid) ON DELETE CASCADE;
+
 CREATE INDEX user_sid_idx ON users (user_sid);
 CREATE INDEX email_idx ON users (email);
 CREATE INDEX phone_idx ON users (phone);
@@ -561,10 +672,18 @@ ALTER TABLE voip_carriers ADD FOREIGN KEY service_provider_sid_idxfk_7 (service_

 ALTER TABLE voip_carriers ADD FOREIGN KEY application_sid_idxfk_2 (application_sid) REFERENCES applications (application_sid);

+CREATE INDEX user_permissions_sid_idx ON user_permissions (user_permissions_sid);
+CREATE INDEX user_sid_idx ON user_permissions (user_sid);
+ALTER TABLE user_permissions ADD FOREIGN KEY user_sid_idxfk (user_sid) REFERENCES users (user_sid) ON DELETE CASCADE;
+
+ALTER TABLE user_permissions ADD FOREIGN KEY permission_sid_idxfk (permission_sid) REFERENCES permissions (permission_sid);
+
 CREATE INDEX smpp_gateway_sid_idx ON smpp_gateways (smpp_gateway_sid);
 CREATE INDEX voip_carrier_sid_idx ON smpp_gateways (voip_carrier_sid);
 ALTER TABLE smpp_gateways ADD FOREIGN KEY voip_carrier_sid_idxfk (voip_carrier_sid) REFERENCES voip_carriers (voip_carrier_sid);

+CREATE UNIQUE INDEX phone_numbers_unique_idx_voip_carrier_number ON phone_numbers (number,voip_carrier_sid);
+
 CREATE INDEX phone_number_sid_idx ON phone_numbers (phone_number_sid);
 CREATE INDEX number_idx ON phone_numbers (number);
 CREATE INDEX voip_carrier_sid_idx ON phone_numbers (voip_carrier_sid);
@@ -19,7 +19,8 @@ values ('f4e1848d-3ff8-40eb-b9c1-30e1ef053f94','ed649e33-e771-403a-8c99-1780eabb
 insert into account_products(account_product_sid, account_subscription_sid, product_sid,quantity)
 values ('f23ff996-6534-4aba-8666-4b347391eca2', 'f4e1848d-3ff8-40eb-b9c1-30e1ef053f94', 'c4403cdb-8e75-4b27-9726-7d8315e3216d', 10);

-insert into voip_carriers (voip_carrier_sid, name, account_sid) values ('287c1452-620d-4195-9f19-c9814ef90d78', 'westco', 'ed649e33-e771-403a-8c99-1780eabbc803');
+insert into voip_carriers (voip_carrier_sid, name, account_sid, service_provider_sid) 
+values ('287c1452-620d-4195-9f19-c9814ef90d78', 'westco', 'ed649e33-e771-403a-8c99-1780eabbc803', '3f35518f-5a0d-4c2e-90a5-2407bb3b36f0');
 insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, inbound, outbound) 
 values ('124a5339-c62c-4075-9e19-f4de70a96597', '287c1452-620d-4195-9f19-c9814ef90d78', '172.38.0.20', true, true);
 insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, port, inbound, outbound) 
@@ -42,7 +43,8 @@ insert into account_products(account_product_sid, account_subscription_sid, prod
 values ('92f137f7-4bc3-4157-b096-6817e54b1874', '73bbcc5d-512f-4cea-8535-9a6e3d2bd19d', 'c4403cdb-8e75-4b27-9726-7d8315e3216d', 0);
 insert into account_limits(account_limits_sid, account_sid, category, quantity) values('a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d', 'd7cc37cb-d152-49ef-a51b-485f6e917089', 'voice_call_session', 0);

-insert into voip_carriers (voip_carrier_sid, name, account_sid) values ('9b1abdc7-0220-4964-bc66-32b5c70cd9ab', 'westco', 'd7cc37cb-d152-49ef-a51b-485f6e917089');
+insert into voip_carriers (voip_carrier_sid, name, account_sid, service_provider_sid) 
+values ('9b1abdc7-0220-4964-bc66-32b5c70cd9ab', 'westco', 'd7cc37cb-d152-49ef-a51b-485f6e917089', '3f35518f-5a0d-4c2e-90a5-2407bb3b36f0');
 insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, inbound, outbound) 
 values ('12f401d9-cbb1-49e5-bd33-cefbca0badc3', '9b1abdc7-0220-4964-bc66-32b5c70cd9ab', '172.38.0.20', true, true);
 insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, port, inbound, outbound) 
@@ -52,7 +54,8 @@ values ('1401eb72-0daf-4471-aba6-038a0a2587b3', '9b1abdc7-0220-4964-bc66-32b5c70
 insert into applications (application_sid, name, account_sid, call_hook_sid, call_status_hook_sid)
 values ('3b43e39f-4346-4218-8434-a53130e8be49', 'test', 'ee9d7d49-b3e4-4fdb-9d66-661149f717e8', '90dda62e-0ea2-47d1-8164-5bd49003476c', '4d7ce0aa-5ead-4e61-9a6b-3daa732218b1');

-insert into voip_carriers (voip_carrier_sid, name, account_sid, application_sid) values ('999c1452-620d-4195-9f19-c9814ef90d78', 'customer PBX', 'ee9d7d49-b3e4-4fdb-9d66-661149f717e8', '3b43e39f-4346-4218-8434-a53130e8be49');
+insert into voip_carriers (voip_carrier_sid, name, account_sid, application_sid, service_provider_sid) 
+values ('999c1452-620d-4195-9f19-c9814ef90d78', 'customer PBX', 'ee9d7d49-b3e4-4fdb-9d66-661149f717e8', '3b43e39f-4346-4218-8434-a53130e8be49', '3f35518f-5a0d-4c2e-90a5-2407bb3b36f0');
 insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, inbound, outbound) 
 values ('888a5339-c62c-4075-9e19-f4de70a96597', '999c1452-620d-4195-9f19-c9814ef90d78', '172.38.0.21', true, false);
 
@@ -89,3 +92,32 @@ insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, inbound, outb
 values ('664a5339-c62c-4075-9e19-f4de70a96597', '731abdc7-0220-4964-bc66-32b5c70cd9ab', '172.38.0.40', true, false);
 insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, inbound, outbound) 
 values ('554a5339-c62c-4075-9e19-f4de70a96597', '987abdc7-0220-4964-bc66-32b5c70cd9ab', '172.38.0.40', true, false);
+
+-- voip carrier belonging to all accounts
+insert into voip_carriers (voip_carrier_sid, name, service_provider_sid) 
+values ('voip100', 'test-voip-carrier', '3f35518f-5a0d-4c2e-90a5-2407bb3b36f0');
+insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, inbound, outbound) 
+values ('sip100', 'voip100', '172.38.0.50', true, false);
+
+insert into voip_carriers (voip_carrier_sid, name, service_provider_sid) 
+values ('voip101', 'test-voip-carrier-101', '3f35518f-5a0d-4c2e-90a5-2407bb3b36f0');
+insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, inbound, outbound) 
+values ('sip101', 'voip101', '172.38.0.50', true, false);
+insert into sip_gateways (sip_gateway_sid, voip_carrier_sid, ipv4, inbound, outbound) 
+values ('sip102', 'voip101', '172.38.0.51', true, false);
+
+insert into applications (application_sid, name, account_sid, call_hook_sid, call_status_hook_sid)
+values ('app100', 'app100', 'ee9d7d49-b3e4-4fdb-9d66-661149f717e8', '90dda62e-0ea2-47d1-8164-5bd49003476c', '90dda62e-0ea2-47d1-8164-5bd49003476c');
+insert into applications (application_sid, name, account_sid, call_hook_sid, call_status_hook_sid)
+values ('app101', 'app101', 'ee9d7d49-b3e4-4fdb-9d66-661149f717e8', '90dda62e-0ea2-47d1-8164-5bd49003476c', '90dda62e-0ea2-47d1-8164-5bd49003476c');
+insert into phone_numbers (phone_number_sid, number, voip_carrier_sid, account_sid, application_sid)
+values ('phone100', '^100', 'voip101', 'ee9d7d49-b3e4-4fdb-9d66-661149f717e8', 'app100');
+insert into phone_numbers (phone_number_sid, number, voip_carrier_sid, account_sid, application_sid)
+values ('phone101', '^10012', 'voip100', 'ee9d7d49-b3e4-4fdb-9d66-661149f717e8', 'app101');
+-- insert an invalid regex pattern, the below pattern should be ignored during pattern
+insert into phone_numbers (phone_number_sid, number, voip_carrier_sid, account_sid, application_sid)
+values ('phone102', '\\dkjfhmdf\\', 'voip100', 'ee9d7d49-b3e4-4fdb-9d66-661149f717e8', 'app101');
+
+-- account with a sip realm that is not associated with any voip carriers
+insert into accounts (account_sid, name, service_provider_sid, webhook_secret, sip_realm)
+values ('acct-100', 'Account 100', '3f35518f-5a0d-4c2e-90a5-2407bb3b36f0', 'foobar', 'ram.sip.jambonz.org');
@@ -23,7 +23,7 @@ services:
      sbc-inbound:
        ipv4_address: 172.38.0.2
  sbc:
-    image: drachtio/drachtio-server:latest
+    image: drachtio/drachtio-server:0.8.26
    command: drachtio --contact "sip:*;transport=udp" --loglevel debug --sofia-loglevel 9
    ports:
      - "9060:9022/tcp"
@@ -2,3 +2,4 @@ require('./docker_start');
 require('./create-test-db');
 require('./sip-tests');
 require('./docker_stop');
+require('./utils');
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="ISO-8859-1" ?>
+<!DOCTYPE scenario SYSTEM "sipp.dtd">
+
+<!-- This program is free software; you can redistribute it and/or      -->
+<!-- modify it under the terms of the GNU General Public License as     -->
+<!-- published by the Free Software Foundation; either version 2 of the -->
+<!-- License, or (at your option) any later version.                    -->
+<!--                                                                    -->
+<!-- This program is distributed in the hope that it will be useful,    -->
+<!-- but WITHOUT ANY WARRANTY; without even the implied warranty of     -->
+<!-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      -->
+<!-- GNU General Public License for more details.                       -->
+<!--                                                                    -->
+<!-- You should have received a copy of the GNU General Public License  -->
+<!-- along with this program; if not, write to the                      -->
+<!-- Free Software Foundation, Inc.,                                    -->
+<!-- 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA             -->
+<!--                                                                    -->
+<!--                 Sipp 'uac' scenario with pcap (rtp) play           -->
+<!--                                                                    -->
+
+<scenario name="UAC with media">
+  <!-- In client mode (sipp placing calls), the Call-ID MUST be         -->
+  <!-- generated by sipp. To do so, use [call_id] keyword.                -->
+  <send retrans="500">
+    <![CDATA[
+
+      INVITE sip:100678@172.38.0.10:5060 SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:100678@172.38.0.10:5060>
+      Call-ID: [call_id]
+      CSeq: 1 INVITE
+      Contact: sip:sipp@[local_ip]:[local_port]
+      Max-Forwards: 70
+      Subject: uac-pcap-carrier-success
+      Content-Type: application/sdp
+      Content-Length: [len]
+
+      v=0
+      o=user1 53655765 2353687637 IN IP[local_ip_type] [local_ip]
+      s=-
+      c=IN IP[local_ip_type] [local_ip]
+      t=0 0
+      m=audio [auto_media_port] RTP/AVP 8 101
+      a=rtpmap:8 PCMA/8000
+      a=rtpmap:101 telephone-event/8000
+      a=fmtp:101 0-11,16
+
+    ]]>
+  </send>
+
+  <recv response="100" optional="true">
+  </recv>
+
+  <recv response="180" optional="true">
+  </recv>
+
+  <!-- By adding rrs="true" (Record Route Sets), the route sets         -->
+  <!-- are saved and used for following messages sent. Useful to test   -->
+  <!-- against stateful SIP proxies/B2BUAs.                             -->
+  <recv response="200" rtd="true" crlf="true">
+  </recv>
+
+  <!-- Packet lost can be simulated in any send/recv message by         -->
+  <!-- by adding the 'lost = "10"'. Value can be [1-100] percent.       -->
+  <send>
+    <![CDATA[
+
+      ACK sip:100678@172.38.0.10:5060 SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:100678@172.38.0.10:5060>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 1 ACK
+      Max-Forwards: 70
+      Subject: uac-pcap-carrier-success
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+  <!-- Play a pre-recorded PCAP file (RTP stream)                       -->
+  <nop>
+    <action>
+      <exec play_pcap_audio="pcap/g711a.pcap"/>
+    </action>
+  </nop>
+
+  <!-- Pause briefly      -->
+  <pause milliseconds="3000"/>
+
+  <!-- The 'crlf' option inserts a blank line in the statistics report. -->
+  <send retrans="500">
+    <![CDATA[
+
+      BYE sip:100678@172.38.0.10:5060 SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:100678@172.38.0.10:5060>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 2 BYE
+      Subject: uac-pcap-carrier-success
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+  <recv response="200" crlf="true">
+  </recv>
+
+  <!-- definition of the response time repartition table (unit is ms)   -->
+  <ResponseTimeRepartition value="10, 20, 30, 40, 50, 100, 150, 200"/>
+
+  <!-- definition of the call length repartition table (unit is ms)     -->
+  <CallLengthRepartition value="10, 50, 100, 500, 1000, 5000, 10000"/>
+
+</scenario>
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="ISO-8859-1" ?>
+<!DOCTYPE scenario SYSTEM "sipp.dtd">
+
+<!-- This program is free software; you can redistribute it and/or      -->
+<!-- modify it under the terms of the GNU General Public License as     -->
+<!-- published by the Free Software Foundation; either version 2 of the -->
+<!-- License, or (at your option) any later version.                    -->
+<!--                                                                    -->
+<!-- This program is distributed in the hope that it will be useful,    -->
+<!-- but WITHOUT ANY WARRANTY; without even the implied warranty of     -->
+<!-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      -->
+<!-- GNU General Public License for more details.                       -->
+<!--                                                                    -->
+<!-- You should have received a copy of the GNU General Public License  -->
+<!-- along with this program; if not, write to the                      -->
+<!-- Free Software Foundation, Inc.,                                    -->
+<!-- 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA             -->
+<!--                                                                    -->
+<!--                 Sipp 'uac' scenario with pcap (rtp) play           -->
+<!--                                                                    -->
+
+<scenario name="UAC with media">
+  <!-- In client mode (sipp placing calls), the Call-ID MUST be         -->
+  <!-- generated by sipp. To do so, use [call_id] keyword.                -->
+  <send retrans="500">
+    <![CDATA[
+
+      INVITE sip:+100678@ram.sip.jambonz.org SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:100678@ram.sip.jambonz.org>
+      Call-ID: [call_id]
+      CSeq: 1 INVITE
+      Contact: sip:sipp@[local_ip]:[local_port]
+      Max-Forwards: 70
+      Subject: uac-pcap-carrier-success
+      Content-Type: application/sdp
+      Content-Length: [len]
+
+      v=0
+      o=user1 53655765 2353687637 IN IP[local_ip_type] [local_ip]
+      s=-
+      c=IN IP[local_ip_type] [local_ip]
+      t=0 0
+      m=audio [auto_media_port] RTP/AVP 8 101
+      a=rtpmap:8 PCMA/8000
+      a=rtpmap:101 telephone-event/8000
+      a=fmtp:101 0-11,16
+
+    ]]>
+  </send>
+
+  <recv response="100" optional="true">
+  </recv>
+
+  <recv response="180" optional="true">
+  </recv>
+
+  <!-- By adding rrs="true" (Record Route Sets), the route sets         -->
+  <!-- are saved and used for following messages sent. Useful to test   -->
+  <!-- against stateful SIP proxies/B2BUAs.                             -->
+  <recv response="200" rtd="true" crlf="true">
+  </recv>
+
+  <!-- Packet lost can be simulated in any send/recv message by         -->
+  <!-- by adding the 'lost = "10"'. Value can be [1-100] percent.       -->
+  <send>
+    <![CDATA[
+
+      ACK sip:100678@ram.sip.jambonz.org SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:100678@ram.sip.jambonz.org>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 1 ACK
+      Max-Forwards: 70
+      Subject: uac-pcap-carrier-success
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+  <!-- Play a pre-recorded PCAP file (RTP stream)                       -->
+  <nop>
+    <action>
+      <exec play_pcap_audio="pcap/g711a.pcap"/>
+    </action>
+  </nop>
+
+  <!-- Pause briefly      -->
+  <pause milliseconds="3000"/>
+
+  <!-- The 'crlf' option inserts a blank line in the statistics report. -->
+  <send retrans="500">
+    <![CDATA[
+
+      BYE sip:100678@ram.sip.jambonz.org SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:100678@ram.sip.jambonz.org>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 2 BYE
+      Subject: uac-pcap-carrier-success
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+  <recv response="200" crlf="true">
+  </recv>
+
+  <!-- definition of the response time repartition table (unit is ms)   -->
+  <ResponseTimeRepartition value="10, 20, 30, 40, 50, 100, 150, 200"/>
+
+  <!-- definition of the call length repartition table (unit is ms)     -->
+  <CallLengthRepartition value="10, 50, 100, 500, 1000, 5000, 10000"/>
+
+</scenario>
@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="ISO-8859-1" ?>
+<!DOCTYPE scenario SYSTEM "sipp.dtd">
+
+<!-- This program is free software; you can redistribute it and/or      -->
+<!-- modify it under the terms of the GNU General Public License as     -->
+<!-- published by the Free Software Foundation; either version 2 of the -->
+<!-- License, or (at your option) any later version.                    -->
+<!--                                                                    -->
+<!-- This program is distributed in the hope that it will be useful,    -->
+<!-- but WITHOUT ANY WARRANTY; without even the implied warranty of     -->
+<!-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      -->
+<!-- GNU General Public License for more details.                       -->
+<!--                                                                    -->
+<!-- You should have received a copy of the GNU General Public License  -->
+<!-- along with this program; if not, write to the                      -->
+<!-- Free Software Foundation, Inc.,                                    -->
+<!-- 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA             -->
+<!--                                                                    -->
+<!--                 Sipp 'uac' scenario with pcap (rtp) play           -->
+<!--                                                                    -->
+
+<scenario name="UAC with media">
+  <!-- In client mode (sipp placing calls), the Call-ID MUST be         -->
+  <!-- generated by sipp. To do so, use [call_id] keyword.                -->
+  <send retrans="500">
+    <![CDATA[
+
+      INVITE sip:+16173333456@jambonz.org SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:16173333456@jambonz.org>
+      Call-ID: [call_id]
+      CSeq: 1 INVITE
+      Contact: sip:sipp@[local_ip]:[local_port]
+      Max-Forwards: 70
+      Subject: uac-late-media
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+  <recv response="100" optional="true">
+  </recv>
+
+  <recv response="180" optional="true">
+  </recv>
+
+  <!-- By adding rrs="true" (Record Route Sets), the route sets         -->
+  <!-- are saved and used for following messages sent. Useful to test   -->
+  <!-- against stateful SIP proxies/B2BUAs.                             -->
+  <recv response="200" rtd="true" crlf="true">
+  </recv>
+
+  <!-- Packet lost can be simulated in any send/recv message by         -->
+  <!-- by adding the 'lost = "10"'. Value can be [1-100] percent.       -->
+  <send>
+    <![CDATA[
+
+      ACK sip:16173333456@jambonz.org SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:16173333456@jambonz.org>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 1 ACK
+      Max-Forwards: 70
+      Subject: uac-late-media
+      Content-Type: application/sdp
+      Content-Length: [len]
+
+      v=0
+      o=user1 53655765 2353687637 IN IP[local_ip_type] [local_ip]
+      s=-
+      c=IN IP[local_ip_type] [local_ip]
+      t=0 0
+      m=audio [auto_media_port] RTP/AVP 8 101
+      a=rtpmap:8 PCMA/8000
+      a=rtpmap:101 telephone-event/8000
+      a=fmtp:101 0-11,16
+
+
+    ]]>
+  </send>
+
+  <!-- Play a pre-recorded PCAP file (RTP stream)                       -->
+  <nop>
+    <action>
+      <exec play_pcap_audio="pcap/g711a.pcap"/>
+    </action>
+  </nop>
+
+  <!-- Pause briefly      -->
+  <pause milliseconds="3000"/>
+
+  <!-- The 'crlf' option inserts a blank line in the statistics report. -->
+  <send retrans="500">
+    <![CDATA[
+
+      BYE sip:16173333456@jambonz.org SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag09[call_number]
+      To: <sip:16173333456@jambonz.org>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 2 BYE
+      Subject: uac-late-media
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+  <recv response="200" crlf="true">
+  </recv>
+
+  <!-- definition of the response time repartition table (unit is ms)   -->
+  <ResponseTimeRepartition value="10, 20, 30, 40, 50, 100, 150, 200"/>
+
+  <!-- definition of the call length repartition table (unit is ms)     -->
+  <CallLengthRepartition value="10, 50, 100, 500, 1000, 5000, 10000"/>
+
+</scenario>
+
@@ -36,6 +36,8 @@
      Subject: uac-pcap-carrier-success
      Content-Type: application/sdp
      Content-Length: [len]
+      X-Authenticated-User: xhoaluu@jambonz.org
+      X-Application-Sid: APP_ID_1

      v=0
      o=user1 53655765 2353687637 IN IP[local_ip_type] [local_ip]
@@ -33,6 +33,10 @@ test('incoming call tests', async(t) => {
    t.ok(obj.calls === 0, 'HTTP GET / works (current call count)')
    obj = await getJSON('http://127.0.0.1:3050/system-health');
    t.ok(obj.calls === 0, 'HTTP GET /system-health works (health check)')
+
+    await sippUac('uac-late-media.xml', '172.38.0.20');
+    t.pass('incoming call with no SDP packet is rejected with a 488');
+
    await sippUac('uac-pcap-carrier-success.xml', '172.38.0.20');
    t.pass('incoming call from carrier completed successfully');

@@ -60,6 +64,15 @@ test('incoming call tests', async(t) => {
    await sippUac('uac-pcap-carrier-max-call-limit.xml', '172.38.0.20');
    t.pass('rejects incoming call with 503 when max calls per account reached');

+    await sippUac('uac-did-regex-match-vc-all-accts.xml', '172.38.0.50');
+    t.pass('incoming call matched by trailing wildcard *, voice gateway belongs to all accounts, with sip realm');
+
+    await sippUac('uac-did-regex-match-vc-all-accts-nosiprealm.xml', '172.38.0.51');
+    t.pass('incoming call matched by trailing wildcard *, voice gateway belongs to all accounts, without sip realm');
+
+    await sippUac('uac-did-regex-match-vc-all-accts-nosiprealm.xml', '172.38.0.50');
+    t.pass('incoming call matched by trailing wildcard *, voice gateway belongs to all accounts, without sip realm');
+
    /* switch off this env for remaining tests (JAMBONES_HOSTING is for Saas sts) */
    delete process.env.JAMBONES_HOSTING;
    await sippUac('uac-pcap-carrier-fail-ambiguous.xml', '172.38.0.40');
@@ -67,8 +80,9 @@ test('incoming call tests', async(t) => {
  
    await waitFor(12);
    const res = await queryCdrs({account_sid: 'ed649e33-e771-403a-8c99-1780eabbc803'});
+    console.log(`cdrs res.total: ${res.total}`);
    //console.log(`cdrs: ${JSON.stringify(res)}`);
-    t.ok(7 === res.total, 'successfully wrote 7 cdrs for calls');
+    t.ok(7 === res.total, 'successfully wrote 8 cdrs for calls');

    srf.disconnect();
    t.end();
@@ -0,0 +1,89 @@
+const test = require('tape');
+const { parseHostPorts } = require('../lib/utils');
+const { parseUri } = require('drachtio-srf');
+
+process.on('unhandledRejection', (reason, p) => {
+  console.log('Unhandled Rejection at: Promise', p, 'reason:', reason);
+});
+
+const hostports = "tls/3.70.141.74:5061,wss/3.70.141.74:8443,tcp/3.70.141.74:5060,udp/3.70.141.74:5060";
+const hostportsNoTls = "wss/3.70.141.74:8443,tcp/3.70.141.74:5060,udp/3.70.141.74:5060";
+const logger = { info: (args) => console.log(args) };
+
+const srf = {
+  locals: {
+    sipAddress: '127.0.0.1'
+  }
+};
+
+test('utils tests - parseHostPorts', async (t) => {
+  try {
+    let obj = parseHostPorts(logger, hostports, srf);
+
+    const expected = {
+      tls: '3.70.141.74:5061',
+      wss: '3.70.141.74:8443',
+      tcp: '3.70.141.74:5060',
+      udp: '3.70.141.74:5060'
+    };
+
+    t.ok(obj.tls === expected.tls, 'sip endpoint tls');
+    t.ok(obj.wss === expected.wss, 'sip endpoint wss');
+    t.ok(obj.tcp === expected.tcp, 'sip endpoint tcp');
+    t.ok(obj.udp === expected.udp, 'sip endpoint udp');
+
+    obj = parseHostPorts(logger, hostportsNoTls.split(','), srf);
+
+    t.ok(obj.tls === '127.0.0.1:5061', 'sip endpoint tls');
+
+    t.end();
+  } catch (err) {
+    console.log(`error received: ${err}`);
+    t.error(err);
+  }
+});
+
+
+test('utils tests - parse URI user', async (t) => {
+  try {
+    let invalidUri = "sip:@202660.tenios.com";
+    const req = {
+      getParsedHeader: () => ({ uri: invalidUri })
+    };
+
+    const referTo = req.getParsedHeader('Refer-To');
+    let uri = parseUri(referTo.uri);
+    
+    const expected = {
+      family: "ipv4",
+      scheme: "sip",
+      user: "",
+      password: undefined,
+      host: "202660.tenios.com",
+      port: NaN,
+      params: {},
+      headers: {},
+    }
+
+    t.ok(uri.family === expected.family, 'family eq ipv4');
+    t.ok(uri.scheme === expected.scheme, 'scheme eq sip');
+    t.ok(uri.password === expected.password, 'pw eq undefined');
+    t.ok(uri.host === expected.host, 'host eq 202660.tenios.com');
+    t.ok(uri.user === "", 'user eq empty string');
+    t.ok(isNaN(uri.port), 'port eq NaN');
+    t.ok(typeof uri.params === 'object', 'params eq object');
+    t.ok(typeof uri.headers === 'object', 'headers eq object');
+
+    invalidUri = "<sip:@202660.tenios.com>";    
+    uri = parseUri(invalidUri);
+    /* TODO: uri can be undefined - check these conditions in call-session */
+    t.ok(uri === undefined, 'uri is undefined');
+
+    const validUri = "<sip:+49221578952870@202660.tenios.com>";
+
+    t.end();
+  } catch (err) {
+    console.log(`error received: ${err}`);
+    t.error(err);
+  }
+});
Author	SHA1	Message	Date
Sam Machin	83461f99e8	Set strict source on rtpengine (#210 ) * Set strict source on rtpengine RTPBleed * use env var for strict source * lint * Update utils.js * arghhhh * clarification * change	2025-08-03 19:44:47 -04:00
Dave Horton	45684aa337	bump version	2025-07-15 11:46:09 -04:00
Vinod Dharashive	9d0c829ae8	increase dtmf volume (#208 ) https://github.com/jambonz/jambonz-feature-server/issues/1272	2025-07-09 08:23:17 -04:00
sathish kumar pasham	7a6551c141	Fix security vulnerabilities by upgrading to @babel/helpers version 7.26.10. (#207 )	2025-06-27 08:14:26 -04:00
rammohan-y	5f267906b1	Fixed issue when wild cards or regex is used in phone number for multiple carriers (#202 ) * Fixed issue when wild cards or regex is used in phone number for multiple carriers https://github.com/jambonz/sbc-inbound/issues/201 * Implemanted the regex/pattern based logic when url is a sip_realm * Refactored getApplicationForDidAndCarrier as it is failing to parse other regex if first regex is invalid In gateway is defined at "all accounts" using the phone number's account_sid * Performance improvements * Exported getApplicationForDidAndCarriers method * Added additional unit test cases	2025-06-18 21:11:05 +02:00
Dave Horton	680d32e9a2	update version	2025-05-14 15:42:00 -04:00
Dave Horton	71c437ee07	update db-helpers	2025-05-13 10:35:46 -04:00
rammohan-y	35c38685a9	Updated drachtio-srf version (#199 ) https://github.com/drachtio/drachtio-server/issues/424	2025-04-22 11:05:30 -04:00
Hoan Luu Huu	8d15098b77	update drachtio srf 5.0.4 (#198 )	2025-04-18 07:45:18 -04:00
Hoan Luu Huu	656ad3b6cb	update digest-utils version (#197 )	2025-04-17 19:45:39 -04:00
rammohan-y	7eccb6816d	Updated db-helper to 0.9.11 (#196 ) https://github.com/jambonz/jambonz-feature-server/issues/1151	2025-04-14 08:22:17 -04:00
rammohan-y	f58cf8eecf	updated realtimedb-helper to 0.8.13 (#195 )	2025-03-10 09:54:03 -04:00
Dave Horton	638c003dfc	fix aws sns topic subscribe (#193 )	2025-02-24 12:57:23 -05:00
Dave Horton	23c748046d	REFER should have sips contact if far end is using sips (#192 )	2025-02-24 09:37:18 -05:00
Dave Horton	086adfbeef	update drachtio-srf	2025-02-20 10:15:25 -05:00
Dave Horton	d9b375738b	reject calls on hosted jambonz with no active subscriptions (#191 )	2025-02-19 13:05:56 -05:00
Hoan Luu Huu	ec3af43a41	support sip recording from a siprec call (#190 ) * support sip recording from a siprec call * update srsClient version	2025-02-12 09:24:12 -05:00
Dave Horton	0ba5cb53bb	refined the method for syncing call count updates and added debugging (#189 ) * refined the method for syncing call count updates and added debugging * include callId in debug key * fix debug key name	2025-02-05 13:00:13 -05:00
Dave Horton	25415c0be9	logging	2025-01-17 09:11:08 -05:00
Dave Horton	c0e42bcdaa	update deps	2025-01-14 10:49:31 -05:00
Dave Horton	8f3ea260ca	fix race condition with call counts when quick cancel is received (#188 ) * fix race condition with call counts when quick cancel is received * wip * update dractio-srf and mrf to main branch releases	2025-01-14 10:04:03 -05:00
Dave Horton	c807fdb93d	Feat/3pcc invite (#187 ) * wip * wip * wip * add test for late media / 3pcc invite, which should now work	2024-12-12 18:39:01 -05:00
Hoan Luu Huu	a7d6cf5a31	support referby with display name (#186 ) * support referby with display name * update siprec client utils	2024-12-11 10:34:54 -05:00
Dave Horton	1cd526c684	wip (#182 )	2024-11-19 09:38:19 -05:00
Dave Horton	50b249544e	fix #180 (#181 )	2024-11-14 17:52:34 -05:00
Hoan Luu Huu	4add329102	support force opus pcmu transcode (#175 ) * support force opus pcmu transcode * fix review comment * wip	2024-11-14 12:22:45 -05:00
André HeberandAndre Heber	06b3122571	reject late media call with 488 and X-Reason (#179 ) * reject late media call with 488 and X-Reason * test added * changed X-Reason, clarified test --------- Co-authored-by: Andre Heber <a.heber@cognigy.com>	2024-11-14 09:13:39 -05:00
Hoan Luu Huu	bcfbe9a0fc	fixed incase srtp, dont need to send reinvite when release media (#176 ) * fixed, srtp dont need to send reinvite when release media * fix review comment	2024-11-13 07:42:42 -05:00
Dave Horton	bb9e5e98f5	minor logging	2024-11-12 09:27:12 -05:00
Dave Horton	a714190aa4	fix race condition #177 (#178 )	2024-11-12 09:15:19 -05:00
Hoan Luu Huu	e6d41dec71	update time series version (#171 )	2024-10-17 08:07:10 -04:00
Hoan Luu Huu	a6b1e58b87	support change log level run time (#169 ) * support change log level run time * support change log level run time	2024-10-07 09:52:01 -04:00
Hoan Luu Huu	524a556a7c	fixed pad_crypto does not work if not a incoming call to a sip realm (#167 ) * fixed pad_crypto does not work if not a incoming call to a sip realm * fixed review comment	2024-09-19 10:26:22 -04:00
Markus FrindtandMarkus Frindt	b6d856c626	fix count of alert limits (#151 ) Co-authored-by: Markus Frindt <m.frindt@cognigy.com>	2024-09-19 07:12:55 -04:00
Dave Horton	3454232314	bump version	2024-09-18 20:46:49 -04:00
Hoan Luu Huu	a97cadc4b9	allow inbound call SRTP pad crypto (#161 )	2024-09-11 09:37:28 +01:00
Dave Horton	20755f456d	use system_information.private_network_cidr (#158 ) * use system_information.private_network_cidr * lint	2024-08-18 12:50:01 -04:00
Dave Horton	fec4c42008	fix/gh-actions	2024-08-07 10:03:22 -04:00
javibookline	34cfe8ca9d	Handle cases where gateway query at account level returns more than one (#135 ) * Handle cases where gateway query at account level returns more than one * Change constant variable as it needs to be reassigned * Fix mistake for handling case where sql query returned no match * grammar * Fix linting errors * Avoid checking for duplicates in case there is only one match to avoid stringifying+parsing for nothing	2024-08-07 10:02:24 -04:00
Dave Horton	55bcba05f6	update gh actions (#156 )	2024-08-01 08:48:40 -04:00
Markus FrindtandMarkus Frindt	c270c0df43	Feat/improve parse host ports (#149 ) * Move parseHostPorts to utils and cover with test suite * fix tabs * comment pre commit hook * add test * wip * remove only * fix 2 critical, 12 high vulnerabilities via npm audit fix --------- Co-authored-by: Markus Frindt <m.frindt@cognigy.com>	2024-08-01 08:41:49 -04:00
Dave Horton	b848ab99e1	fix for #153 (#154 )	2024-07-24 12:27:35 -04:00
Dave Horton	4153a141d7	sip scheme in contact header of re-invite 200 OK should be same as initial 200 OK (#150 )	2024-07-10 15:56:08 -06:00
Dave Horton	e999b4e5e8	Contact in 200 should set sip(s) appropriately and have port and prot… (#148 ) * Contact in 200 should set sip(s) appropriately and have port and protocol * fix for k8s * lint * wip	2024-07-03 10:56:23 -06:00
Vinod Dharashive	0e2285c4b8	Contact header to have private IP on Private cidr (#147 ) * Contact header to have private IP on Private cidr fix for #146 * Update call-session.js * Update call-session.js * Update call-session.js	2024-06-25 14:34:07 -04:00
Dave Horton	f9ae466709	#142 add option to transcode incoming g729 calls to pcmu (#144 )	2024-05-22 12:42:06 -04:00
Dave Horton	831005f7a1	discover local ip address based on authentication response from drachtio-server (#143 )	2024-05-16 10:50:07 -04:00
Hoan Luu Huu	a46ad934a8	support complex refer-to and refered-by uri (#140 ) * support complex refer-to and refered-by uri * wip	2024-05-07 08:27:32 -04:00
Hoan Luu Huu	d200799997	update stats version (#141 )	2024-05-06 20:07:05 -04:00
Dave Horton	2fef169e92	update deps (#138 )	2024-04-07 18:33:28 -04:00
Hoan Luu Huu	5829ecdf4c	fix cannot clear siprec sessions (#136 )	2024-03-27 07:25:07 -04:00
Hoan Luu Huu	03d3a9695d	forward reinvite error response to other destination (#133 ) * forward reinvite error response to other destination * update comment review	2024-03-07 07:48:33 -05:00
Hoan Luu Huu	f5be95006c	start/stop/pause/resume recording success when one of siprec server success. (#131 ) * start/stop/pause/resume recording success when one of siprec server success. * wip * wip * update customer header for pause and resume * allow timeout for siprec action * wip * wip * wip * update siprec client utils	2024-03-05 13:05:42 -05:00
Dave Horton	2747bc15d6	update deps, comment out questionable code	2024-01-17 13:37:07 -05:00
Dave Horton	cdfbf384fe	update db-helpers	2024-01-17 13:26:37 -05:00
Hoan Luu Huu	96a83619c7	fix sbc to forward BYE header (#129 ) * fix sbc to forward BYE header * fix sbc to forward BYE header	2023-12-28 20:45:38 -05:00
Hoan Luu Huu	b8a67019a1	support sending DTMF to caller (#125 ) * support sending DTMF to caller * wip	2023-12-13 09:14:27 -05:00
Hoan Luu Huu	0e1627ba82	phone number's application should override voice carrier default application (#128 ) * phone number's application should override voice carrier default application * fix review comments * fix review comments	2023-12-13 08:25:26 -05:00
Hoan Luu Huu	bb857a72ff	let realtimedb-utils build configuration from env vars (#122 )	2023-11-14 09:13:08 -05:00
Hoan Luu Huu	aea3033ae0	support PRIVATE_VOIP_NETWORK_CIDR for SDP negotiation (#124 ) * support PRIVATE_VOIP_NETWORK_CIDR for SDP negotiation * support multi PRIVATE_VOIP_NETWORK_CIDR	2023-11-13 15:24:41 -05:00
Dave Horton	9b9eaa37fb	0.8.5	2023-11-09 12:39:24 -05:00
Dave Horton	56e0e3c0f2	update drachtio-srf	2023-11-09 10:02:46 -05:00
Hoan Luu Huu	6a6b4dd26f	upgrade drachtio srf (#121 ) * upgrade drachtio srf * fix review comments	2023-10-24 08:42:53 -04:00
Hoan Luu Huu	a3799576a2	add sentinelPassword option (#119 )	2023-10-04 19:41:21 -04:00
Antony Jukesandajukes	63e72fbfce	feat/MS Teams IP check improvement (#117 ) * added ip in cidr utilities * middleware add ms teams cidr check * use cidr-matcher lib * removed redundant require * moved cidr-matcher require to top of file * moved express require to top of file --------- Co-authored-by: ajukes <ajukes@callable.io>	2023-09-18 10:35:04 -04:00
Dave Horton	e5dce35bab	more efficient checking of device calls (#118 ) * more efficient checking of device calls * when searching for matching gateways choose largest enclosing netmask	2023-09-15 10:53:22 -04:00
two56andMatt Preskett	b6675de2bd	Fix: Feature server REFER (#114 ) * Update _onFeatureServerTransfer to fix REFER case * Add INFO listener --------- Co-authored-by: Matt Preskett <matt.preskett@netcall.com>	2023-08-20 08:47:01 -04:00
Dave Horton	66e73d8353	logging	2023-08-14 14:36:07 -04:00
Hoan Luu Huu	a25aa08e17	update stats colector version (#111 )	2023-08-07 21:22:47 -04:00
Hoan Luu Huu	b1296c8e89	correct pare callRecording headers from sip info (#110 )	2023-07-20 09:02:04 -04:00
Hoan Luu Huu	17df3a4ca8	Feat/siprec custom headers (#109 ) * siprec custom headers * siprec custom headers * update siprec client util	2023-07-20 08:21:09 -04:00
Hoan Luu Huu	f2e820915d	Multi srs (#106 ) * multi srs * multi srs * multi srs * fix review comment	2023-07-04 16:41:46 +01:00