Redirect outbound user calls to private IP of other SBC (#197)

* redirect client calls to private address of other SBC

* remove unused util

* use address not port

lib/call-session.js

@@ -322,7 +322,7 @@ class CallSession extends Emitter {
               const prefix = vc.tech_prefix || '';
               const transport =  o.protocol?.startsWith('tls') ? 'tls' : (o.protocol || 'udp');
               const hostport = !o.port || 5060 === o.port ? o.ipv4 : `${o.ipv4}:${o.port}`;
-              const prependPlus = vc.e164_leading_plus && !this.req.calledNumber.startsWith('0') ? '+' : '';
+              const prependPlus = vc.e164_leading_plus && /^[1-9]/.test(calledNumber) ? '+' : '';
               const scheme = transport === 'tls' && !process.env.JAMBONES_USE_BEST_EFFORT_TLS && o.use_sips_scheme ?
                 'sips' : 'sip';
               let u = `${scheme}:${prefix}${prependPlus}${calledNumber}@${hostport};transport=${transport}`;
@@ -497,16 +497,19 @@ class CallSession extends Emitter {
           };
         }
         else {
+          const uri = parseUri(this.req.uri);
           hdrs = {
             ...hdrs,
             'From': createBLegFromHeader({
               logger: this.logger,
               req: this.req,
+              transport: uri.params.transport,
               ...(private_network && {host: this.privateSipAddress})
             }),
             'Contact': createBLegFromHeader({
               logger: this.logger,
               req: this.req,
+              transport: uri.params.transport,
               ...(private_network && {host: this.privateSipAddress})
             })
           };
@@ -639,7 +642,7 @@ class CallSession extends Emitter {
               }, this.decrKey, {writeCallCountSP, writeCallCount, writeCallCountApp})
                 .catch((err) => this.logger.error(err, 'Error decrementing call counts'));
             }
-            debug(`got final outdial error: ${err}`);
+            this.logger.debug(`got final outdial error: ${err}`);
             if (!passFailure) this.res.send(status);
             this.emit('failed');
             this.rtpEngineResource.destroy()

lib/middleware.js

@@ -1,7 +1,7 @@
 const debug = require('debug')('jambonz:sbc-outbound');
 const parseUri = require('drachtio-srf').parseUri;
 const Registrar = require('@jambonz/mw-registrar');
-const {selectHostPort, nudgeCallCounts} = require('./utils');
+const { nudgeCallCounts} = require('./utils');
 const FS_UUID_SET_NAME =  'fsUUIDs';
 
 module.exports = (srf, logger, redisClient) => {
@@ -234,8 +234,8 @@ module.exports = (srf, logger, redisClient) => {
         logger.info({details: reg}, `sending call to registered user ${aor}`);
         if (req.server.hostport !== reg.sbcAddress) {
           /* redirect to the correct SBC where this user is connected */
-          const proxyAddress = selectHostPort(reg.sbcAddress, 'tcp');
-          const redirectUri =  `<sip:${proxyAddress[1]}>`;
+          const proxyAddress = reg.privateSbcAddress.split(':');
+          const redirectUri =  `<sip:${proxyAddress[0]}>`;
           logger.info({
             myHostPort: req.server.hostport,
             registeredHostPort: reg.sbcAddress,

lib/utils.js

@@ -28,11 +28,13 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, padCrypto, teams
       srcOpts.flags.push('inject DTMF');
     }
   }
-  /** By default use strict source to secure aganst RTPInject vuln,
-   * set env var to true to disable it and use media handover instead */
-  const disableStrictSource = !!process.env.RTPENGINE_DISABLE_STRICT_SOURCE;
-  dstOpts.flags.push(disableStrictSource ? 'media handover' : 'strict source');
-  srcOpts.flags.push(disableStrictSource ?  'media handover' : 'strict source');
+
+  /** By default, and for backwards compatibility, use media handover
+   * set env var to true to use strict source instead (needed for rtpbleed vulnerability)
+   */
+  const enableStrictSource = !!process.env.RTPENGINE_ENABLE_STRICT_SOURCE;
+  dstOpts.flags.push(enableStrictSource ? 'strict source' : 'media handover');
+  srcOpts.flags.push(enableStrictSource ?  'strict source' : 'media handover');
 
   const common = {
     'call-id': req.get('Call-ID'),
@@ -288,7 +290,7 @@ const isPrivateVoipNetwork = async(uri) => {
   if (privateNetworkCidr) {
     try {
       const matcher = new CIDRMatcher(privateNetworkCidr.split(','));
-      const arr = /sips?:.*@(.*?)(:\d+)?(;.*)$/.exec(uri);
+      const arr = /sips?:.*@(.*?)(:\d+)?(;.*)?$/.exec(uri);
       if (arr) {
         const input = arr[1];
         let addresses;

package-lock.json

@@ -21,7 +21,7 @@
         "cidr-matcher": "^2.1.1",
         "debug": "^4.3.4",
         "drachtio-fn-b2b-sugar": "^0.2.1",
-        "drachtio-srf": "^5.0.5",
+        "drachtio-srf": "^5.0.12",
         "express": "^4.19.2",
         "pino": "^8.20.0",
         "sdp-transform": "^2.15.0"
@@ -1587,9 +1587,10 @@
       "integrity": "sha512-bMtje8GWVTze+UG6WSGnlUfBaYCuFiApNXl/XxWc+X9uATZiZkV2jIqhf+Y4SY3nS8dZclJIVKd9qwoCa+i+Vw=="
     },
     "node_modules/drachtio-srf": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/drachtio-srf/-/drachtio-srf-5.0.5.tgz",
-      "integrity": "sha512-dKdOf+zonTvk1eVu0IVc4a/Hdah2KspXngAeLQ3NZHdAkjQCJjYQZubVP6ho2QT1pzu8wA3U4M/atL1O99Ujzw==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/drachtio-srf/-/drachtio-srf-5.0.12.tgz",
+      "integrity": "sha512-3L5nq3uxwb+DcHaeyRBR974no5mJkFilqqhbJ2VTjpJXC/nYAU/Q468z9hq3vtq7pGjc1kORxMHgH4Y0Oj8cIw==",
+      "license": "MIT",
       "dependencies": {
         "debug": "^3.2.7",
         "delegates": "^0.1.0",

package.json

@@ -39,7 +39,7 @@
     "cidr-matcher": "^2.1.1",
     "debug": "^4.3.4",
     "drachtio-fn-b2b-sugar": "^0.2.1",
-    "drachtio-srf": "^5.0.5",
+    "drachtio-srf": "^5.0.12",
     "express": "^4.19.2",
     "pino": "^8.20.0",
     "sdp-transform": "^2.15.0"