Redirect outbound user calls to private IP of other SBC (#197 )

* redirect client calls to private address of other SBC * remove unused util * use address not port
Fix/193 (#195 )
2026-10-04 02:04:19 +00:00 · 2025-10-04 20:08:57 -04:00 · 2025-09-12 09:21:13 -04:00 · 2025-09-04 07:57:38 -04:00 · 2025-09-03 23:35:56 -04:00 · 2025-09-03 13:53:51 -04:00
7 changed files with 33 additions and 20 deletions
@@ -3,6 +3,6 @@
  "DTLS": "off",
  "SDES": "off",
  "ICE": "remove",
-  "flags": ["media handover", "port latching"],
+  "flags": ["port latching"],
  "rtcp-mux": ["demux"]
 }
@@ -3,13 +3,13 @@
    "transport-protocol": "UDP/TLS/RTP/SAVPF",
    "ICE": "force",
    "SDES": "off",
-    "flags": ["generate mid", "SDES-no", "media handover", "port latching"],
+    "flags": ["generate mid", "SDES-no", "port latching"],
    "rtcp-mux": ["require"]  
  },
  "teams": {
    "transport-protocol": "RTP/SAVP",
    "ICE": "force",
-    "flags": ["generate mid", "media handover",
+    "flags": ["generate mid",
      "SDES-no-AES_CM_128_HMAC_SHA1_32",
      "SDES-no-F8_128_HMAC_SHA1_80",
      "SDES-no-F8_128_HMAC_SHA1_32",
@@ -322,7 +322,7 @@ class CallSession extends Emitter {
              const prefix = vc.tech_prefix || '';
              const transport =  o.protocol?.startsWith('tls') ? 'tls' : (o.protocol || 'udp');
              const hostport = !o.port || 5060 === o.port ? o.ipv4 : `${o.ipv4}:${o.port}`;
-              const prependPlus = vc.e164_leading_plus && !this.req.calledNumber.startsWith('0') ? '+' : '';
+              const prependPlus = vc.e164_leading_plus && /^[1-9]/.test(calledNumber) ? '+' : '';
              const scheme = transport === 'tls' && !process.env.JAMBONES_USE_BEST_EFFORT_TLS && o.use_sips_scheme ?
                'sips' : 'sip';
              let u = `${scheme}:${prefix}${prependPlus}${calledNumber}@${hostport};transport=${transport}`;
@@ -497,16 +497,19 @@ class CallSession extends Emitter {
          };
        }
        else {
+          const uri = parseUri(this.req.uri);
          hdrs = {
            ...hdrs,
            'From': createBLegFromHeader({
              logger: this.logger,
              req: this.req,
+              transport: uri.params.transport,
              ...(private_network && {host: this.privateSipAddress})
            }),
            'Contact': createBLegFromHeader({
              logger: this.logger,
              req: this.req,
+              transport: uri.params.transport,
              ...(private_network && {host: this.privateSipAddress})
            })
          };
@@ -639,7 +642,7 @@ class CallSession extends Emitter {
              }, this.decrKey, {writeCallCountSP, writeCallCount, writeCallCountApp})
                .catch((err) => this.logger.error(err, 'Error decrementing call counts'));
            }
-            debug(`got final outdial error: ${err}`);
+            this.logger.debug(`got final outdial error: ${err}`);
            if (!passFailure) this.res.send(status);
            this.emit('failed');
            this.rtpEngineResource.destroy()
@@ -1,7 +1,7 @@
 const debug = require('debug')('jambonz:sbc-outbound');
 const parseUri = require('drachtio-srf').parseUri;
 const Registrar = require('@jambonz/mw-registrar');
-const {selectHostPort, nudgeCallCounts} = require('./utils');
+const { nudgeCallCounts} = require('./utils');
 const FS_UUID_SET_NAME =  'fsUUIDs';

 module.exports = (srf, logger, redisClient) => {
@@ -234,8 +234,8 @@ module.exports = (srf, logger, redisClient) => {
        logger.info({details: reg}, `sending call to registered user ${aor}`);
        if (req.server.hostport !== reg.sbcAddress) {
          /* redirect to the correct SBC where this user is connected */
-          const proxyAddress = selectHostPort(reg.sbcAddress, 'tcp');
-          const redirectUri =  `<sip:${proxyAddress[1]}>`;
+          const proxyAddress = reg.privateSbcAddress.split(':');
+          const redirectUri =  `<sip:${proxyAddress[0]}>`;
          logger.info({
            myHostPort: req.server.hostport,
            registeredHostPort: reg.sbcAddress,
@@ -28,6 +28,14 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, padCrypto, teams
      srcOpts.flags.push('inject DTMF');
    }
  }
+
+  /** By default, and for backwards compatibility, use media handover
+   * set env var to true to use strict source instead (needed for rtpbleed vulnerability)
+   */
+  const enableStrictSource = !!process.env.RTPENGINE_ENABLE_STRICT_SOURCE;
+  dstOpts.flags.push(enableStrictSource ? 'strict source' : 'media handover');
+  srcOpts.flags.push(enableStrictSource ?  'strict source' : 'media handover');
+
  const common = {
    'call-id': req.get('Call-ID'),
    'replace': ['origin', 'session-connection'],
@@ -282,7 +290,7 @@ const isPrivateVoipNetwork = async(uri) => {
  if (privateNetworkCidr) {
    try {
      const matcher = new CIDRMatcher(privateNetworkCidr.split(','));
-      const arr = /sips?:.*@(.*?)(:\d+)?(;.*)$/.exec(uri);
+      const arr = /sips?:.*@(.*?)(:\d+)?(;.*)?$/.exec(uri);
      if (arr) {
        const input = arr[1];
        let addresses;
@@ -1,12 +1,12 @@
 {
  "name": "sbc-outbound",
-  "version": "0.9.4",
+  "version": "0.9.5",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sbc-outbound",
-      "version": "0.9.4",
+      "version": "0.9.5",
      "license": "MIT",
      "dependencies": {
        "@babel/helpers": "^7.26.10",
@@ -21,7 +21,7 @@
        "cidr-matcher": "^2.1.1",
        "debug": "^4.3.4",
        "drachtio-fn-b2b-sugar": "^0.2.1",
-        "drachtio-srf": "^5.0.5",
+        "drachtio-srf": "^5.0.12",
        "express": "^4.19.2",
        "pino": "^8.20.0",
        "sdp-transform": "^2.15.0"
@@ -1061,10 +1061,11 @@
      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
    },
    "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
      "dev": true,
+      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0",
        "concat-map": "0.0.1"
@@ -1586,9 +1587,10 @@
      "integrity": "sha512-bMtje8GWVTze+UG6WSGnlUfBaYCuFiApNXl/XxWc+X9uATZiZkV2jIqhf+Y4SY3nS8dZclJIVKd9qwoCa+i+Vw=="
    },
    "node_modules/drachtio-srf": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/drachtio-srf/-/drachtio-srf-5.0.5.tgz",
-      "integrity": "sha512-dKdOf+zonTvk1eVu0IVc4a/Hdah2KspXngAeLQ3NZHdAkjQCJjYQZubVP6ho2QT1pzu8wA3U4M/atL1O99Ujzw==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/drachtio-srf/-/drachtio-srf-5.0.12.tgz",
+      "integrity": "sha512-3L5nq3uxwb+DcHaeyRBR974no5mJkFilqqhbJ2VTjpJXC/nYAU/Q468z9hq3vtq7pGjc1kORxMHgH4Y0Oj8cIw==",
+      "license": "MIT",
      "dependencies": {
        "debug": "^3.2.7",
        "delegates": "^0.1.0",
@@ -1,6 +1,6 @@
 {
  "name": "sbc-outbound",
-  "version": "0.9.4",
+  "version": "0.9.5",
  "main": "app.js",
  "engines": {
    "node": ">= 18.0.0"
@@ -39,7 +39,7 @@
    "cidr-matcher": "^2.1.1",
    "debug": "^4.3.4",
    "drachtio-fn-b2b-sugar": "^0.2.1",
-    "drachtio-srf": "^5.0.5",
+    "drachtio-srf": "^5.0.12",
    "express": "^4.19.2",
    "pino": "^8.20.0",
    "sdp-transform": "^2.15.0"
Author	SHA1	Message	Date
Sam Machin	cd0d360561	Redirect outbound user calls to private IP of other SBC (#197 ) * redirect client calls to private address of other SBC * remove unused util * use address not port	2025-10-04 20:08:57 -04:00
Sam Machin	32d82ed67d	Fix/193 (#195 ) * pass sip failure reason back to FS * Update call-session.js * update drachtio-srf dep	2025-09-12 09:21:13 -04:00
Dave Horton	c17f27ab2c	fix prev commit (#192 )	2025-09-04 07:57:38 -04:00
Dave Horton	2fc570f731	when sending to retell with user starting with call_ dont prepend plus (#191 )	2025-09-03 23:35:56 -04:00
Sam Machin	c87f831868	Fix/transport in contact (#190 ) * use the req transport param in the From and Contact headers if set. * Update call-session.js	2025-09-03 13:53:51 -04:00
Sam Machin	616228bf09	update isPrivateVoipNetwork function (#189 )	2025-09-02 08:02:59 -04:00
Dave Horton	55fef10f0e	revert change (for now) that caused audio issues when reinviting to partial media (#187 )	2025-08-18 12:45:48 -04:00
Sam Machin	9357920f76	set strict source (#185 ) * set strict source RTPBleed * change to env var for strict source * Update srtp-transcoding.json * lint * lint * reverse the logic * and argghhh * clarification * change	2025-08-03 19:44:31 -04:00
Dave Horton	6771cbdefc	bump version	2025-07-15 11:46:40 -04:00